webspresso 0.0.96 → 0.0.97

package/bin/commands/seed.js

@@ -14,7 +14,6 @@ const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
 const { loadDbConfig } = require('../utils/db');
-const { getSeedFileTemplate } = require('../utils/seed');
 
 function registerCommand(program) {
   program
@@ -136,6 +135,7 @@ function registerCommand(program) {
           }
           
           // Create seed index file
+          const { getSeedFileTemplate } = require('../utils/seed');
           const seedIndex = getSeedFileTemplate();
           
           fs.writeFileSync(seedIndexPath, seedIndex);

package/core/auth/hash.js

@@ -92,14 +92,19 @@ function generateToken(length = 32) {
 }
 
 /**
- * Hash a token for storage (SHA-256)
- * Used for remember me tokens - stored hashed, compared hashed
- * @param {string} token - Plain token
- * @returns {string} Hashed token
+ * Hash a high-entropy random lookup token for database storage (SHA-256).
+ * Note: Used exclusively for 256-bit cryptographically secure random lookup tokens
+ * (remember-me tokens, email verification tokens, password reset tokens), NOT user passwords.
+ * User passwords must always be hashed using `hash()` (bcrypt).
+ *
+ * // CodeQL [js/insufficient-password-hash] SHA-256 is intentionally used for 256-bit high-entropy random lookup token hashing, not user passwords.
+ * @param {string} token - High-entropy random token
+ * @returns {string} Hex-encoded SHA-256 digest
  */
 function hashToken(token) {
   const crypto = require('crypto');
-  return crypto.createHash('sha256').update(token).digest('hex');
+  // CodeQL [js/insufficient-password-hash] False positive: token is a 256-bit random string, not a user password
+  return crypto.createHash('sha256').update(String(token)).digest('hex');
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.96",
+  "version": "0.0.97",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -38,10 +38,27 @@
   },
   "scripts": {
     "test": "vitest run",
+    "test:unit": "vitest run tests/unit/",
+    "test:integration": "vitest run tests/integration/",
     "test:security": "vitest run tests/security/",
-    "security": "npm run test:security && npm audit",
+    "test:orm": "vitest run tests/**/orm* tests/**/database*",
+    "test:auth": "vitest run tests/**/auth* tests/unit/server-auth-branches.test.js",
+    "test:admin": "vitest run tests/**/admin*",
+    "test:services": "vitest run tests/**/service*",
+    "test:plugins": "vitest run tests/**/plugin* tests/unit/*plugin*.test.js",
+    "test:core": "vitest run tests/unit/core* tests/unit/server* tests/unit/routing* tests/unit/template*",
+    "test:branches": "vitest run tests/unit/*branches.test.js",
+    "test:fast": "vitest run tests/unit/*branches.test.js tests/unit/auth.test.js tests/unit/services.test.js tests/unit/server.test.js",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:coverage:branches": "vitest run tests/unit/*branches.test.js --coverage",
+    "test:coverage:unit": "vitest run tests/unit/ --coverage",
+    "test:coverage:core": "vitest run tests/unit/core* tests/unit/server* tests/unit/routing* tests/unit/template* --coverage",
+    "test:coverage:auth": "vitest run tests/**/auth* tests/unit/server-auth-branches.test.js --coverage",
+    "test:coverage:orm": "vitest run tests/**/orm* tests/**/database* --coverage",
+    "test:coverage:services": "vitest run tests/**/service* --coverage",
+    "test:coverage:plugins": "vitest run tests/**/plugin* tests/unit/*plugin*.test.js --coverage",
+    "test:coverage:fast": "vitest run tests/unit/*branches.test.js tests/unit/auth.test.js tests/unit/services.test.js tests/unit/server.test.js --coverage",
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:debug": "playwright test --debug",
@@ -96,7 +113,7 @@
     "commander": "^11.1.0",
     "connect-timeout": "^1.9.1",
     "cookie-parser": "^1.4.7",
-    "csv-parse": "^5.6.0",
+    "csv-parse": "^7.0.2",
     "dayjs": "^1.11.19",
     "exceljs": "^4.4.0",
     "express": "^5.2.1",
@@ -105,11 +122,11 @@
     "inquirer": "^8.2.6",
     "knex": "^3.1.0",
     "mjml": "^5.4.0",
-    "multer": "^2.1.1",
-    "nodemailer": "^9.0.3",
+    "multer": "^2.4.0",
+    "nodemailer": "^10.0.10",
     "nunjucks": "^3.2.4",
-    "sanitize-html": "^2.17.3",
-    "sharp": "^0.35.3",
+    "sanitize-html": "^2.17.7",
+    "sharp": "^0.35.4",
     "swup": "^4.8.3",
     "yaml": "^2.8.3",
     "zod": "^3.23.0",
@@ -144,11 +161,11 @@
     }
   },
   "devDependencies": {
-    "@faker-js/faker": "^9.9.0",
+    "@faker-js/faker": "^10.6.0",
     "@playwright/test": "^1.48.0",
     "@types/express": "^4.17.21",
     "@types/node": "^20.14.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^4.1.11",
     "better-sqlite3": "^11.10.0",
     "chokidar": "^3.5.3",
     "docboot": "^0.3.0",
@@ -157,16 +174,19 @@
     "release-it": "^20.2.1",
     "supertest": "^6.3.4",
     "typescript": "~5.6.3",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11",
+    "vitest-doctor": "^0.3.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "overrides": {
     "basic-ftp": "^5.3.0",
     "tar": "^7.5.11",
     "undici": "^6.24.0",
-    "uuid": "^11.1.1"
+    "uuid": "^11.1.1",
+    "js-yaml": "^5.4.2",
+    "qs": "^6.16.0"
   },
   "allowScripts": {
     "better-sqlite3@11.10.0": true

package/plugins/admin-panel/app.js

@@ -248,9 +248,10 @@ function wrapCustomPageWithLayout(page, rawComp) {
   return {
     oninit: function(vnode) {
       try {
-        vnode.state.instance = typeof rawComp === 'function' ? rawComp.call(this, vnode) : rawComp;
-        if (vnode.state.instance && typeof vnode.state.instance.oninit === 'function') {
-          return vnode.state.instance.oninit.call(this, vnode);
+        const instance = typeof rawComp === 'function' ? rawComp.call(rawComp, vnode) : rawComp;
+        vnode.state.instance = instance;
+        if (instance && typeof instance.oninit === 'function') {
+          return instance.oninit.call(instance, vnode);
         }
       } catch (err) {
         console.error('[Admin Panel] Error in oninit for custom page "' + page.id + '":', err);
@@ -260,7 +261,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     oncreate: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.oncreate === 'function') return comp.oncreate.call(this, vnode);
+        if (comp && typeof comp.oncreate === 'function') return comp.oncreate.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in oncreate for custom page "' + page.id + '":', err);
       }
@@ -268,7 +269,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     onupdate: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.onupdate === 'function') return comp.onupdate.call(this, vnode);
+        if (comp && typeof comp.onupdate === 'function') return comp.onupdate.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in onupdate for custom page "' + page.id + '":', err);
       }
@@ -276,7 +277,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     onbeforeremove: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.onbeforeremove === 'function') return comp.onbeforeremove.call(this, vnode);
+        if (comp && typeof comp.onbeforeremove === 'function') return comp.onbeforeremove.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in onbeforeremove for custom page "' + page.id + '":', err);
       }
@@ -284,7 +285,7 @@ function wrapCustomPageWithLayout(page, rawComp) {
     onremove: function(vnode) {
       try {
         const comp = vnode.state.instance || rawComp;
-        if (comp && typeof comp.onremove === 'function') return comp.onremove.call(this, vnode);
+        if (comp && typeof comp.onremove === 'function') return comp.onremove.call(comp, vnode);
       } catch (err) {
         console.error('[Admin Panel] Error in onremove for custom page "' + page.id + '":', err);
       }
@@ -305,9 +306,9 @@ function wrapCustomPageWithLayout(page, rawComp) {
       var content;
       try {
         if (comp && typeof comp.view === 'function') {
-          content = comp.view.call(this, vnode);
+          content = comp.view.call(comp, vnode);
         } else if (typeof comp === 'function') {
-          content = comp.call(this, vnode);
+          content = comp.call(comp, vnode);
         } else {
           content = comp;
         }

package/plugins/admin-panel/core/api-extensions.js

@@ -24,6 +24,10 @@ let npmVersionCache = {
 };
 
 function fetchLatestNpmVersion(force = false) {
+  if ((process.env.NODE_ENV === 'test' || process.env.VITEST) && !force) {
+    return Promise.resolve(npmVersionCache.latestVersion || getWebspressoVersion());
+  }
+
   const now = Date.now();
   if (!force && npmVersionCache.latestVersion && (now - npmVersionCache.checkedAt < 30 * 60 * 1000)) {
     return Promise.resolve(npmVersionCache.latestVersion);

package/plugins/basic-auth/index.js

@@ -117,7 +117,9 @@ function sendUnauthorized(req, res, config) {
 
   if (config.challenge !== false) {
     const realm = String(config.realm || 'Restricted Area')
-      .split(/[\r\n]/)[0]
+      .split(/[\r\n\0]/)[0]
+      .replace(/[\t]/g, ' ')
+      .replace(/\\/g, '\\\\')
       .replace(/"/g, '\\"');
     res.setHeader('WWW-Authenticate', `Basic realm="${realm}"`);
   }

package/plugins/content/client/inline-edit.js

@@ -248,9 +248,14 @@
       el.textContent = '';
       return;
     }
+    if (typeof window.DOMPurify !== 'undefined' && typeof window.DOMPurify.sanitize === 'function') {
+      el.innerHTML = window.DOMPurify.sanitize(htmlStr);
+      return;
+    }
     try {
-      var parser = new DOMParser();
-      var doc = parser.parseFromString(htmlStr, 'text/html');
+      var template = document.createElement('template');
+      template.innerHTML = htmlStr;
+      var content = template.content;
       var allowedTags = {
         p: 1, br: 1, b: 1, i: 1, strong: 1, em: 1, u: 1, s: 1, strike: 1,
         h1: 1, h2: 1, h3: 1, h4: 1, h5: 1, h6: 1, ul: 1, ol: 1, li: 1,
@@ -260,14 +265,14 @@
       var allowedAttrs = {
         href: 1, title: 1, target: 1, rel: 1, class: 1, id: 1, src: 1, alt: 1, width: 1, height: 1
       };
-      var allNodes = doc.body.querySelectorAll('*');
+      var allNodes = content.querySelectorAll('*');
       for (var i = allNodes.length - 1; i >= 0; i--) {
         var node = allNodes[i];
         var tag = node.tagName.toLowerCase();
         if (!allowedTags[tag]) {
           if (node.parentNode) {
             node.parentNode.removeChild(node);
-          } else {
+          } else if (typeof node.remove === 'function') {
             node.remove();
           }
           continue;
@@ -275,7 +280,7 @@
         var attrs = Array.prototype.slice.call(node.attributes);
         for (var j = 0; j < attrs.length; j++) {
           var attrName = attrs[j].name.toLowerCase();
-          var attrVal = attrs[j].value.toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
+          var attrVal = (attrs[j].value || '').toLowerCase().replace(/[\x00-\x20\s]+/g, '').trim();
           if (attrName.indexOf('on') === 0 || !allowedAttrs[attrName]) {
             node.removeAttribute(attrs[j].name);
           } else if ((attrName === 'href' || attrName === 'src' || attrName === 'action' || attrName === 'formaction' || attrName === 'xlink:href') &&
@@ -287,13 +292,8 @@
         }
       }
 
-      // Transfer DOM nodes directly to target element
-      while (el.firstChild) {
-        el.removeChild(el.firstChild);
-      }
-      while (doc.body.firstChild) {
-        el.appendChild(doc.body.firstChild);
-      }
+      el.textContent = '';
+      el.appendChild(content.cloneNode(true));
     } catch (e) {
       el.textContent = htmlStr;
     }

package/plugins/cors.js

@@ -101,15 +101,14 @@ function createCorsMiddleware(options = {}) {
         return next(err);
       }
 
-      if (allowedOrigin) {
+      if (allowedOrigin && allowedOrigin !== '*') {
         res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-        if (allowedOrigin !== '*') {
-          res.setHeader('Vary', 'Origin');
+        res.setHeader('Vary', 'Origin');
+        if (config.credentials) {
+          res.setHeader('Access-Control-Allow-Credentials', 'true');
         }
-      }
-
-      if (config.credentials && allowedOrigin && allowedOrigin !== '*') {
-        res.setHeader('Access-Control-Allow-Credentials', 'true');
+      } else if (allowedOrigin === '*' && !config.credentials) {
+        res.setHeader('Access-Control-Allow-Origin', '*');
       }
 
       if (exposedHeadersStr) {

package/plugins/file-manager/core.js

@@ -217,7 +217,7 @@ function buildBreadcrumbs(relPath) {
   const breadcrumbs = [{ name: 'Root', path: '' }];
   if (!relPath) return breadcrumbs;
 
-  const segments = relPath.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+  const segments = relPath.replace(/\\/g, '/').split('/').filter(Boolean);
   let current = '';
 
   for (const seg of segments) {

package/plugins/file-manager/security.js

@@ -4,6 +4,7 @@
  * @module plugins/file-manager/security
  */
 
+const sanitizeHtml = require('sanitize-html');
 const { SecurityError, ValidationError } = require('../../core/errors');
 
 /**
@@ -164,6 +165,37 @@ function validateMagicBytes(buffer, ext) {
   return true;
 }
 
+const SVG_SANITIZE_OPTIONS = {
+  allowedTags: [
+    'svg', 'g', 'path', 'circle', 'rect', 'line', 'polyline', 'polygon',
+    'ellipse', 'text', 'tspan', 'defs', 'clipPath', 'mask', 'pattern',
+    'image', 'linearGradient', 'radialGradient', 'stop', 'use', 'symbol',
+    'title', 'desc', 'a',
+  ],
+  allowedAttributes: {
+    '*': [
+      'id', 'class', 'style', 'xml:space', 'xmlns', 'xmlns:xlink', 'xmlns:svg',
+      'version', 'viewbox', 'viewBox', 'width', 'height', 'x', 'y', 'dx', 'dy',
+      'x1', 'y1', 'x2', 'y2', 'cx', 'cy', 'r', 'rx', 'ry', 'd', 'points',
+      'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
+      'stroke-miterlimit', 'stroke-dasharray', 'stroke-dashoffset', 'opacity',
+      'fill-opacity', 'stroke-opacity', 'fill-rule', 'clip-rule',
+      'transform', 'font-family', 'font-size', 'font-weight', 'text-anchor',
+      'clip-path', 'mask', 'gradientUnits', 'gradientTransform', 'offset',
+      'stop-color', 'stop-opacity', 'href', 'xlink:href', 'preserveAspectRatio',
+    ],
+  },
+  allowedSchemes: ['http', 'https'],
+  allowedSchemesByTag: {
+    a: ['http', 'https', 'mailto'],
+    image: ['http', 'https', 'data'],
+    use: ['#'],
+  },
+  allowProtocolRelative: false,
+  selfClosing: ['rect', 'circle', 'line', 'polyline', 'polygon', 'path', 'stop', 'use', 'image', 'ellipse'],
+  disallowedTagsMode: 'discard',
+};
+
 /**
  * Sanitize SVG content against Stored XSS attacks.
  * Strips <script>, <foreignObject>, <iframe>, <embed>, <object> and on* event handlers.
@@ -172,29 +204,7 @@ function validateMagicBytes(buffer, ext) {
  */
 function sanitizeSvgContent(content) {
   const str = Buffer.isBuffer(content) ? content.toString('utf8') : String(content);
-
-  // Quick check: if no dangerous keywords, return original buffer directly for maximum speed
-  if (!/<(script|foreignobject|iframe|embed|object|meta|link|style)/i.test(str) &&
-      !/\s+on[a-z]+\s*=/i.test(str) &&
-      !/javascript:/i.test(str) &&
-      !/data:text\/html/i.test(str)) {
-    return Buffer.isBuffer(content) ? content : Buffer.from(str, 'utf8');
-  }
-
-  let sanitized = str
-    // Remove script tags and content
-    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script\s*>/gi, '')
-    // Remove dangerous containers
-    .replace(/<foreignObject\b[^<]*(?:(?!<\/foreignObject>)<[^<]*)*<\/foreignObject\s*>/gi, '')
-    .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe\s*>/gi, '')
-    .replace(/<embed\b[^>]*>/gi, '')
-    .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object\s*>/gi, '')
-    // Remove inline event handlers (onload, onclick, onerror, onmouseover, etc.)
-    .replace(/\s+on[a-zA-Z]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
-    // Remove javascript: and data:text/html URIs in href and xlink:href
-    .replace(/(?:href|xlink:href)\s*=\s*(?:"\s*javascript:[^"]*"|'\s*javascript:[^']*')/gi, 'href=""')
-    .replace(/(?:href|xlink:href)\s*=\s*(?:"\s*data:text\/html[^"]*"|'\s*data:text\/html[^']*')/gi, 'href=""');
-
+  const sanitized = sanitizeHtml(str, SVG_SANITIZE_OPTIONS);
   return Buffer.from(sanitized, 'utf8');
 }
 

package/plugins/index.js

@@ -3,94 +3,52 @@
  * Export all built-in plugins
  */
 
-const sitemapPlugin = require('./sitemap');
-const analyticsPlugin = require('./analytics');
-const dashboardPlugin = require('./dashboard/index');
-const schemaExplorerPlugin = require('./schema-explorer');
-const adminPanelPlugin = require('./admin-panel');
-const seoCheckerPlugin = require('./seo-checker');
-const siteAnalyticsPlugin = require('./site-analytics');
-const auditLogPlugin = require('./audit-log');
-const recaptchaPlugin = require('./recaptcha');
-const swaggerPlugin = require('./swagger');
-const healthCheckPlugin = require('./health-check');
-const restResourcePlugin = require('./rest-resources');
-const ormCacheAdminPlugin = require('./orm-cache-admin');
-const { uploadPlugin, createLocalFileProvider } = require('./upload');
-/** Register after adminPanelPlugin (same db + adminPath) for session and routes. */
-const { dataExchangePlugin } = require('./data-exchange');
-const { redirectPlugin } = require('./redirect');
-const { rateLimitPlugin } = require('./rate-limit');
-const emailPlugin = require('./email');
-const contentPlugin = require('./content');
-const csrfPlugin = require('./csrf');
-const corsPlugin = require('./cors');
-const { basicAuthPlugin, createBasicAuthMiddleware } = require('./basic-auth');
-const {
-  realtimePlugin,
-  realtime,
-  createRealtime,
-  websocket,
-  createWebSocketAdapter,
-  sse,
-  createSseAdapter,
-  socketIo,
-  createSocketIoAdapter,
-  redis,
-  createRedisAdapter,
-} = require('./realtime');
-const { mcpPlugin, createMcpServer, McpServer } = require('./mcp');
-const polarPlugin = require('./polar');
-const fileManagerPlugin = require('./file-manager');
-const { xlsxPlugin, xlsx } = require('./xlsx');
-const { csvPlugin, csv } = require('./csv');
-
 module.exports = {
-  sitemapPlugin,
-  analyticsPlugin,
-  dashboardPlugin,
-  schemaExplorerPlugin,
-  adminPanelPlugin,
-  seoCheckerPlugin,
-  siteAnalyticsPlugin,
-  auditLogPlugin,
-  recaptchaPlugin,
-  swaggerPlugin,
-  healthCheckPlugin,
-  restResourcePlugin,
-  ormCacheAdminPlugin,
-  uploadPlugin,
-  createLocalFileProvider,
-  dataExchangePlugin,
-  redirectPlugin,
-  rateLimitPlugin,
-  emailPlugin,
-  contentPlugin,
-  csrfPlugin,
-  corsPlugin,
-  basicAuthPlugin,
-  createBasicAuthMiddleware,
-  realtimePlugin,
-  realtime,
-  createRealtime,
-  websocket,
-  createWebSocketAdapter,
-  sse,
-  createSseAdapter,
-  socketIo,
-  createSocketIoAdapter,
-  redis,
-  createRedisAdapter,
-  queuePlugin: require('./queue'),
-  mcpPlugin,
-  createMcpServer,
-  McpServer,
-  polarPlugin,
-  fileManagerPlugin,
-  xlsxPlugin,
-  xlsx,
-  csvPlugin,
-  csv,
+  get sitemapPlugin() { return require('./sitemap'); },
+  get analyticsPlugin() { return require('./analytics'); },
+  get dashboardPlugin() { return require('./dashboard/index'); },
+  get schemaExplorerPlugin() { return require('./schema-explorer'); },
+  get adminPanelPlugin() { return require('./admin-panel'); },
+  get seoCheckerPlugin() { return require('./seo-checker'); },
+  get siteAnalyticsPlugin() { return require('./site-analytics'); },
+  get auditLogPlugin() { return require('./audit-log'); },
+  get recaptchaPlugin() { return require('./recaptcha'); },
+  get swaggerPlugin() { return require('./swagger'); },
+  get healthCheckPlugin() { return require('./health-check'); },
+  get restResourcePlugin() { return require('./rest-resources'); },
+  get ormCacheAdminPlugin() { return require('./orm-cache-admin'); },
+  get uploadPlugin() { return require('./upload').uploadPlugin; },
+  get createLocalFileProvider() { return require('./upload').createLocalFileProvider; },
+  get dataExchangePlugin() { return require('./data-exchange').dataExchangePlugin; },
+  get redirectPlugin() { return require('./redirect').redirectPlugin; },
+  get rateLimitPlugin() { return require('./rate-limit').rateLimitPlugin; },
+  get emailPlugin() { return require('./email'); },
+  get contentPlugin() { return require('./content'); },
+  get csrfPlugin() { return require('./csrf'); },
+  get corsPlugin() { return require('./cors'); },
+  get basicAuthPlugin() { return require('./basic-auth').basicAuthPlugin; },
+  get createBasicAuthMiddleware() { return require('./basic-auth').createBasicAuthMiddleware; },
+  get realtimePlugin() { return require('./realtime').realtimePlugin; },
+  get realtime() { return require('./realtime').realtime; },
+  get createRealtime() { return require('./realtime').createRealtime; },
+  get websocket() { return require('./realtime').websocket; },
+  get createWebSocketAdapter() { return require('./realtime').createWebSocketAdapter; },
+  get sse() { return require('./realtime').sse; },
+  get createSseAdapter() { return require('./realtime').createSseAdapter; },
+  get socketIo() { return require('./realtime').socketIo; },
+  get createSocketIoAdapter() { return require('./realtime').createSocketIoAdapter; },
+  get redis() { return require('./realtime').redis; },
+  get createRedisAdapter() { return require('./realtime').createRedisAdapter; },
+  get queuePlugin() { return require('./queue'); },
+  get mcpPlugin() { return require('./mcp').mcpPlugin; },
+  get createMcpServer() { return require('./mcp').createMcpServer; },
+  get McpServer() { return require('./mcp').McpServer; },
+  get polarPlugin() { return require('./polar'); },
+  get fileManagerPlugin() { return require('./file-manager'); },
+  get xlsxPlugin() { return require('./xlsx').xlsxPlugin; },
+  get xlsx() { return require('./xlsx').xlsx; },
+  get csvPlugin() { return require('./csv').csvPlugin; },
+  get csv() { return require('./csv').csv; },
 };
 
 

package/plugins/mcp/transports/sse.js

@@ -18,8 +18,10 @@ const { createJsonRpcError, ERROR_CODES } = require('../server');
  */
 function mountSseTransport(options) {
   const { app, server, path: basePath = '/_mcp', authMiddleware } = options;
-
-  const normalizedBase = basePath.replace(/\/+$/, '');
+  let normalizedBase = String(basePath || '/_mcp');
+  while (normalizedBase.length > 1 && normalizedBase.endsWith('/')) {
+    normalizedBase = normalizedBase.slice(0, -1);
+  }
   const sessions = new Map();
 
   const middlewareChain = authMiddleware ? [authMiddleware] : [];

package/plugins/site-analytics/admin-component.js

@@ -203,12 +203,12 @@ var AnalyticsPage = {
     vnode.state.chartLoaded = false;
     vnode.state._stopPoll = null;
     vnode.state.chartDataVersion = 0;
-    this.loadData(vnode);
-    this.loadChartJs(vnode);
+    AnalyticsPage.loadData(vnode);
+    AnalyticsPage.loadChartJs(vnode);
     if (typeof runAdminAutoRefresh === 'function') {
       vnode.state._stopPoll = runAdminAutoRefresh(function() {
-        this.loadData(vnode);
-      }.bind(this));
+        AnalyticsPage.loadData(vnode);
+      });
     }
   },
 
@@ -270,12 +270,11 @@ var AnalyticsPage = {
   setDays: function(vnode, d) {
     vnode.state.days = d;
     if (chartInstance) { chartInstance.destroy(); chartInstance = null; }
-    this.loadData(vnode);
+    AnalyticsPage.loadData(vnode);
   },
 
   view: function(vnode) {
     var s = vnode.state;
-    var self = this;
 
     return m(Layout, [
       m(Breadcrumb, { items: [{ label: 'Analytics', href: '/analytics' }] }),
@@ -294,7 +293,7 @@ var AnalyticsPage = {
             ? m(RefreshIconButton, {
                 title: 'Refresh analytics',
                 spinning: s.loading,
-                onclick: function() { self.loadData(vnode); },
+                onclick: function() { AnalyticsPage.loadData(vnode); },
               })
             : null,
           // Day filter
@@ -303,7 +302,7 @@ var AnalyticsPage = {
               class: s.days === d
                 ? 'bg-white text-gray-900 shadow-sm dark:bg-slate-700 dark:text-slate-100'
                 : 'text-gray-500 hover:text-gray-700 dark:text-slate-400 dark:hover:text-slate-200',
-              onclick: function() { self.setDays(vnode, d); },
+              onclick: function() { AnalyticsPage.setDays(vnode, d); },
             }, 'Last ' + d + ' days');
           })),
         ]),

package/src/file-router.js

@@ -753,7 +753,9 @@ function detectLocale(req) {
     }
   }
 
-  const acceptLanguage = req.get('Accept-Language');
+  const acceptLanguage = typeof req.get === 'function'
+    ? req.get('Accept-Language')
+    : (req.headers && (req.headers['accept-language'] || req.headers['Accept-Language']));
   if (acceptLanguage) {
     const langPart = acceptLanguage.split(',')[0];
     const a = normalizeLocaleCandidate(langPart);

package/src/services/discovery.js

@@ -16,7 +16,12 @@ const VALID_EXTENSIONS = new Set(['.js', '.mjs', '.cjs']);
  * @returns {string}
  */
 function toCamelCase(str) {
-  return str.replace(/[-_]+([a-zA-Z0-9])/g, (_, char) => char.toUpperCase());
+  if (!str) return '';
+  const parts = str.split(/[-_]+/);
+  return parts.map((part, index) => {
+    if (!part) return '';
+    return index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1);
+  }).join('');
 }
 
 /**