Fix basic bugs and eliminate duplicate code across the framework

[Copilot]

Five distinct bugs and code quality issues identified across the framework's core modules.

Bug Fixes

• PathHelper.resolve — wrong replacement string (src/Helpers/Path.ts): The .ts.js → .ts normalisation branch was calling .replace('.js.js', '.ts') instead of .replace('.ts.js', '.ts'), so paths like AuthController.ts.js were never actually fixed.

• InXpresserError — two Date instances per error (src/Errors/InXpresserError.ts): Constructor called new Date() twice, meaning date and dateString could represent different moments under load. dateString now derives from this.date.

• RequestEngine.toApi — double res.status() call (src/RequestEngine.ts): toApi called this.res.status(status) explicitly, then passed status to this.json() which calls this.status() again. The explicit pre-call is removed.

// Before — status set twice
if (status !== undefined) this.res.status(status);
return this.json(d, status);  // also calls this.status(status) internally

// After
return this.json(d, status);

Code Quality

• helpers.randomStr — triplicated logic (src/Extensions/Helpers.ts): Identical character-loop existed in inbuilt.fn.ts, util.fn.ts, and helpers.ts. The helper now delegates to $.utils.randomStr().

• Unsafe .hasOwnProperty() calls (index.ts, RequestEngine, RouterEngine, PluginEngine): Direct method calls fail on null-prototype objects and are spoofable if the property is shadowed. All hot-path usages replaced with Object.prototype.hasOwnProperty.call(obj, key).

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.