@martel/calyx 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [1.5.0](https://github.com/bmartel/calyx/compare/v1.4.0...v1.5.0) (2026-07-01)
+
+
+### Features
+
+* **security,schedule:** implement ConfigModule, EventEmitterModule, HashingService, CORS, Helmet, and Task Scheduler ([6cfa8ca](https://github.com/bmartel/calyx/commit/6cfa8ca9459d73c7a7b1087953991d675d3a55db))
+
 # [1.4.0](https://github.com/bmartel/calyx/compare/v1.3.0...v1.4.0) (2026-07-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@martel/calyx",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "High-performance Bun-native NestJS-compatible framework",
   "main": "src/index.ts",
   "bin": {

package/src/config/config.module.ts

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync } from 'fs';
+import { Module, DynamicModule } from '../core/decorators.ts';
+import { ConfigService } from './config.service.ts';
+
+export interface ConfigModuleOptions {
+  isGlobal?: boolean;
+  load?: (() => Record<string, any>)[];
+  envFilePath?: string;
+}
+
+@Module({
+  providers: [ConfigService],
+  exports: [ConfigService],
+})
+export class ConfigModule {
+  static forRoot(options: ConfigModuleOptions = {}): DynamicModule {
+    const configData: Record<string, string> = { ...(process.env as Record<string, string>) };
+
+    if (options.envFilePath && existsSync(options.envFilePath)) {
+      try {
+        const text = readFileSync(options.envFilePath, 'utf-8');
+        if (text) {
+          const lines = text.split('\n');
+          for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#')) continue;
+            const eqIdx = trimmed.indexOf('=');
+            if (eqIdx !== -1) {
+              const key = trimmed.substring(0, eqIdx).trim();
+              const val = trimmed.substring(eqIdx + 1).trim();
+              configData[key] = val.replace(/^['"]|['"]$/g, '');
+            }
+          }
+        }
+      } catch (err) {
+        // ignore read error
+      }
+    }
+
+    if (options.load) {
+      for (const factory of options.load) {
+        const data = factory();
+        for (const [key, val] of Object.entries(data)) {
+          configData[key] = String(val);
+        }
+      }
+    }
+
+    const configServiceProvider = {
+      provide: ConfigService,
+      useValue: new ConfigService(configData),
+    };
+
+    return {
+      module: ConfigModule,
+      providers: [configServiceProvider],
+      exports: [ConfigService],
+      global: options.isGlobal ?? false,
+    };
+  }
+}

package/src/config/config.service.ts

@@ -0,0 +1,24 @@
+import { Injectable } from '../core/decorators.ts';
+
+@Injectable()
+export class ConfigService {
+  private readonly env: Record<string, string> = {};
+
+  constructor(internalConfig?: Record<string, string>) {
+    this.env = internalConfig ?? (process.env as Record<string, string>);
+  }
+
+  get<T = string>(path: string, defaultValue?: T): T {
+    const val = this.env[path];
+    if (val === undefined) {
+      return defaultValue as T;
+    }
+    if (val === 'true') return true as unknown as T;
+    if (val === 'false') return false as unknown as T;
+    const num = Number(val);
+    if (!isNaN(num) && val.trim() !== '') {
+      return num as unknown as T;
+    }
+    return val as unknown as T;
+  }
+}

package/src/config/index.ts

@@ -0,0 +1,2 @@
+export * from './config.service.ts';
+export * from './config.module.ts';

package/src/event-emitter/decorators.ts

@@ -0,0 +1,10 @@
+import 'reflect-metadata';
+
+export function OnEvent(event: string): MethodDecorator {
+  return (target, propertyKey) => {
+    const constructor = target.constructor;
+    const existing = Reflect.getOwnMetadata('calyx:on_event', constructor) || [];
+    existing.push({ event, propertyKey });
+    Reflect.defineMetadata('calyx:on_event', existing, constructor);
+  };
+}

package/src/event-emitter/event-emitter.module.ts

@@ -0,0 +1,17 @@
+import { Module, DynamicModule } from '../core/decorators.ts';
+import { EventEmitter } from './event-emitter.ts';
+
+@Module({
+  providers: [EventEmitter],
+  exports: [EventEmitter],
+})
+export class EventEmitterModule {
+  static forRoot(): DynamicModule {
+    return {
+      module: EventEmitterModule,
+      providers: [EventEmitter],
+      exports: [EventEmitter],
+      global: true,
+    };
+  }
+}

package/src/event-emitter/event-emitter.ts

@@ -0,0 +1,61 @@
+import { Injectable } from '../core/decorators.ts';
+
+@Injectable()
+export class EventEmitter {
+  private readonly listeners = new Map<string, Function[]>();
+  private readonly wildcardListeners: { pattern: RegExp; fn: Function }[] = [];
+
+  on(event: string, fn: Function) {
+    if (event.includes('*')) {
+      const regexStr = '^' + event.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$';
+      this.wildcardListeners.push({ pattern: new RegExp(regexStr), fn });
+    } else {
+      let list = this.listeners.get(event);
+      if (!list) {
+        list = [];
+        this.listeners.set(event, list);
+      }
+      list.push(fn);
+    }
+  }
+
+  emit(event: string, ...args: any[]) {
+    const list = this.listeners.get(event);
+    if (list) {
+      for (const fn of list) {
+        fn(...args);
+      }
+    }
+
+    for (const item of this.wildcardListeners) {
+      if (item.pattern.test(event)) {
+        item.fn(...args);
+      }
+    }
+  }
+
+  async emitAsync(event: string, ...args: any[]): Promise<any[]> {
+    const promises: Promise<any>[] = [];
+
+    const list = this.listeners.get(event);
+    if (list) {
+      for (const fn of list) {
+        const res = fn(...args);
+        if (res instanceof Promise) {
+          promises.push(res);
+        }
+      }
+    }
+
+    for (const item of this.wildcardListeners) {
+      if (item.pattern.test(event)) {
+        const res = item.fn(...args);
+        if (res instanceof Promise) {
+          promises.push(res);
+        }
+      }
+    }
+
+    return Promise.all(promises);
+  }
+}

package/src/event-emitter/index.ts

@@ -0,0 +1,3 @@
+export * from './event-emitter.ts';
+export * from './decorators.ts';
+export * from './event-emitter.module.ts';

package/src/http/application.ts

@@ -6,6 +6,10 @@ import { HttpException, NotFoundException } from './exceptions.ts';
 import { ArgumentsHost, ExecutionContext } from '../lifecycle/interfaces.ts';
 import { CalyxArgumentsHost, CalyxExecutionContext } from '../lifecycle/context.ts';
 import { CalyxMiddlewareConsumer, MiddlewareConfiguration, RequestMethodMap, CompiledLifecycleItem as CompiledMiddlewareItem } from './middleware.ts';
+import { EventEmitter } from '../event-emitter/event-emitter.ts';
+import { cors, CorsOptions } from '../security/cors.middleware.ts';
+import { helmet, HelmetOptions } from '../security/helmet.middleware.ts';
+import { CronMatcher } from '../schedule/cron.matcher.ts';
 
 class ObjectPool<T> {
   private pool: T[] = [];
@@ -109,6 +113,16 @@ export class CalyxApplication {
     this.globalInterceptors.push(...interceptors);
   }
 
+  enableCors(options?: CorsOptions) {
+    this.use(cors(options));
+    return this;
+  }
+
+  useHelmet(options?: HelmetOptions) {
+    this.use(helmet(options));
+    return this;
+  }
+
   useGlobalPipes(...pipes: any[]) {
     this.globalPipes.push(...pipes);
   }
@@ -129,6 +143,12 @@ export class CalyxApplication {
     // Build the routing table from registered controllers
     this.buildRoutes();
 
+    // Register Event listeners
+    this.registerEventListeners();
+
+    // Register Scheduled tasks
+    this.registerScheduledTasks();
+
     // Call OnModuleInit hooks
     await this.runOnModuleInit();
 
@@ -989,4 +1009,99 @@ export class CalyxApplication {
       }
     }
   }
+
+  private registerEventListeners() {
+    let eventEmitter: EventEmitter;
+    try {
+      eventEmitter = this.container.getGlobalOrAnyInstance(EventEmitter);
+    } catch {
+      return;
+    }
+
+    const instances = this.container.getProviderAndControllerInstances();
+    for (const instance of instances) {
+      if (!instance || !instance.constructor) continue;
+      const listeners: { event: string; propertyKey: string | symbol }[] =
+        Reflect.getMetadata('calyx:on_event', instance.constructor) || [];
+
+      for (const listener of listeners) {
+        eventEmitter.on(listener.event, (...args: any[]) => {
+          return instance[listener.propertyKey](...args);
+        });
+      }
+    }
+  }
+
+  private registerScheduledTasks() {
+    let hasScheduleModule = false;
+    for (const moduleClass of this.container.getModules().keys()) {
+      if (moduleClass.name === 'ScheduleModule') {
+        hasScheduleModule = true;
+        break;
+      }
+    }
+    if (!hasScheduleModule) {
+      return;
+    }
+
+    const instances = this.container.getProviderAndControllerInstances();
+    for (const instance of instances) {
+      if (!instance || !instance.constructor) continue;
+
+      const crons: { expression: string; propertyKey: string | symbol }[] =
+        Reflect.getMetadata('calyx:cron', instance.constructor) || [];
+      for (const cron of crons) {
+        const parts = cron.expression.split(' ');
+        const isSecondLevel = parts.length === 6;
+
+        let lastRan = 0;
+        const tick = () => {
+          const now = new Date();
+          const nowMs = now.getTime();
+          const timeUnit = isSecondLevel ? Math.floor(nowMs / 1000) : Math.floor(nowMs / 60000);
+          if (timeUnit === lastRan) return;
+
+          if (CronMatcher.match(cron.expression, now)) {
+            lastRan = timeUnit;
+            try {
+              instance[cron.propertyKey]();
+            } catch (err) {
+              console.error(`Error executing cron task ${String(cron.propertyKey)}:`, err);
+            }
+          }
+        };
+
+        const intervalMs = isSecondLevel ? 1000 : 20000;
+        const timer = setInterval(tick, intervalMs);
+        this.cleanupListeners.push(() => clearInterval(timer));
+      }
+
+      const intervals: { ms: number; propertyKey: string | symbol }[] =
+        Reflect.getMetadata('calyx:interval', instance.constructor) || [];
+      for (const interval of intervals) {
+        const timer = setInterval(() => {
+          try {
+            instance[interval.propertyKey]();
+          } catch (err) {
+            console.error(`Error executing interval task ${String(interval.propertyKey)}:`, err);
+          }
+        }, interval.ms);
+        this.cleanupListeners.push(() => clearInterval(timer));
+      }
+
+      const timeouts: { ms: number; propertyKey: string | symbol }[] =
+        Reflect.getMetadata('calyx:timeout', instance.constructor) || [];
+      for (const timeout of timeouts) {
+        const timer = setTimeout(() => {
+          try {
+            instance[timeout.propertyKey]();
+          } catch (err) {
+            console.error(`Error executing timeout task ${String(timeout.propertyKey)}:`, err);
+          }
+        }, timeout.ms);
+        this.cleanupListeners.push(() => clearTimeout(timer));
+      }
+    }
+  }
 }
+

package/src/index.ts

@@ -2,3 +2,7 @@ import 'reflect-metadata';
 export * from './core/index.ts';
 export * from './http/index.ts';
 export * from './lifecycle/index.ts';
+export * from './config/index.ts';
+export * from './event-emitter/index.ts';
+export * from './security/index.ts';
+export * from './schedule/index.ts';

package/src/schedule/cron.matcher.ts

@@ -0,0 +1,45 @@
+export class CronMatcher {
+  static match(pattern: string, date: Date): boolean {
+    const parts = pattern.split(' ');
+    if (parts.length < 5) return false;
+
+    const hasSeconds = parts.length === 6;
+    const sec = hasSeconds ? date.getSeconds() : 0;
+    const min = date.getMinutes();
+    const hour = date.getHours();
+    const dom = date.getDate();
+    const month = date.getMonth() + 1; // 1-12
+    const dow = date.getDay(); // 0-6 (Sunday-Saturday)
+
+    const matchPart = (part: string, val: number): boolean => {
+      if (part === '*') return true;
+      if (part.includes('/')) {
+        const [left, right] = part.split('/');
+        const step = Number(right);
+        if (left === '*') {
+          return val % step === 0;
+        }
+        const start = Number(left);
+        return val >= start && (val - start) % step === 0;
+      }
+      if (part.includes(',')) {
+        return part.split(',').map(Number).includes(val);
+      }
+      if (part.includes('-')) {
+        const [start, end] = part.split('-').map(Number);
+        return val >= start && val <= end;
+      }
+      return Number(part) === val;
+    };
+
+    if (hasSeconds && !matchPart(parts[0], sec)) return false;
+    const offset = hasSeconds ? 1 : 0;
+    if (!matchPart(parts[offset + 0], min)) return false;
+    if (!matchPart(parts[offset + 1], hour)) return false;
+    if (!matchPart(parts[offset + 2], dom)) return false;
+    if (!matchPart(parts[offset + 3], month)) return false;
+    if (!matchPart(parts[offset + 4], dow)) return false;
+
+    return true;
+  }
+}

package/src/schedule/decorators.ts

@@ -0,0 +1,28 @@
+import 'reflect-metadata';
+
+export function Cron(expression: string): MethodDecorator {
+  return (target, propertyKey) => {
+    const constructor = target.constructor;
+    const existing = Reflect.getOwnMetadata('calyx:cron', constructor) || [];
+    existing.push({ expression, propertyKey });
+    Reflect.defineMetadata('calyx:cron', existing, constructor);
+  };
+}
+
+export function Interval(ms: number): MethodDecorator {
+  return (target, propertyKey) => {
+    const constructor = target.constructor;
+    const existing = Reflect.getOwnMetadata('calyx:interval', constructor) || [];
+    existing.push({ ms, propertyKey });
+    Reflect.defineMetadata('calyx:interval', existing, constructor);
+  };
+}
+
+export function Timeout(ms: number): MethodDecorator {
+  return (target, propertyKey) => {
+    const constructor = target.constructor;
+    const existing = Reflect.getOwnMetadata('calyx:timeout', constructor) || [];
+    existing.push({ ms, propertyKey });
+    Reflect.defineMetadata('calyx:timeout', existing, constructor);
+  };
+}

package/src/schedule/index.ts

@@ -0,0 +1,3 @@
+export * from './decorators.ts';
+export * from './schedule.module.ts';
+export * from './cron.matcher.ts';

package/src/schedule/schedule.module.ts

@@ -0,0 +1,13 @@
+import { Module, DynamicModule } from '../core/decorators.ts';
+
+@Module({})
+export class ScheduleModule {
+  static forRoot(): DynamicModule {
+    return {
+      module: ScheduleModule,
+      providers: [],
+      exports: [],
+      global: true,
+    };
+  }
+}

package/src/security/cors.middleware.ts

@@ -0,0 +1,50 @@
+import { CalyxResponse } from '../http/application.ts';
+
+export interface CorsOptions {
+  origin?: string | string[] | boolean;
+  methods?: string | string[];
+  allowedHeaders?: string | string[];
+  exposedHeaders?: string | string[];
+  credentials?: boolean;
+  maxAge?: number;
+}
+
+export function cors(options: CorsOptions = {}) {
+  const origin = options.origin ?? '*';
+  const methods = options.methods ?? 'GET,HEAD,PUT,PATCH,POST,DELETE';
+  const allowedHeaders = options.allowedHeaders ?? '*';
+  const credentials = options.credentials ?? false;
+  const maxAge = options.maxAge;
+
+  return (req: Request, res: CalyxResponse, next: () => void) => {
+    const reqOrigin = req.headers.get('origin');
+
+    if (origin === '*') {
+      res.headers['access-control-allow-origin'] = '*';
+    } else if (typeof origin === 'string') {
+      res.headers['access-control-allow-origin'] = origin;
+    } else if (Array.isArray(origin) && reqOrigin && origin.includes(reqOrigin)) {
+      res.headers['access-control-allow-origin'] = reqOrigin;
+    } else if (origin === true && reqOrigin) {
+      res.headers['access-control-allow-origin'] = reqOrigin;
+    }
+
+    res.headers['access-control-allow-methods'] = Array.isArray(methods) ? methods.join(',') : methods;
+    res.headers['access-control-allow-headers'] = Array.isArray(allowedHeaders) ? allowedHeaders.join(',') : allowedHeaders;
+
+    if (credentials) {
+      res.headers['access-control-allow-credentials'] = 'true';
+    }
+
+    if (maxAge !== undefined) {
+      res.headers['access-control-max-age'] = String(maxAge);
+    }
+
+    if (req.method === 'OPTIONS') {
+      res.status(204).send('');
+      return;
+    }
+
+    next();
+  };
+}

package/src/security/hashing.service.ts

@@ -0,0 +1,12 @@
+import { Injectable } from '../core/decorators.ts';
+
+@Injectable()
+export class HashingService {
+  async hash(data: string, algorithm: 'bcrypt' | 'argon2id' | 'argon2i' | 'argon2d' = 'bcrypt'): Promise<string> {
+    return Bun.password.hash(data, algorithm);
+  }
+
+  async verify(data: string, hash: string): Promise<boolean> {
+    return Bun.password.verify(data, hash);
+  }
+}

package/src/security/helmet.middleware.ts

@@ -0,0 +1,45 @@
+import { CalyxResponse } from '../http/application.ts';
+
+export interface HelmetOptions {
+  contentSecurityPolicy?: boolean | string;
+  crossOriginOpenerPolicy?: string;
+  crossOriginResourcePolicy?: string;
+  referrerPolicy?: string;
+  xContentTypeOptions?: string;
+  xDnsPrefetchControl?: string;
+  xFrameOptions?: string;
+  xXssProtection?: string;
+}
+
+export function helmet(options: HelmetOptions = {}) {
+  const headers: Record<string, string> = {
+    'cross-origin-opener-policy': options.crossOriginOpenerPolicy ?? 'same-origin',
+    'cross-origin-resource-policy': options.crossOriginResourcePolicy ?? 'same-origin',
+    'origin-agent-cluster': '?1',
+    'referrer-policy': options.referrerPolicy ?? 'no-referrer',
+    'strict-transport-security': 'max-age=15552000; includeSubDomains',
+    'x-content-type-options': options.xContentTypeOptions ?? 'nosniff',
+    'x-dns-prefetch-control': options.xDnsPrefetchControl ?? 'off',
+    'x-download-options': 'noopen',
+    'x-frame-options': options.xFrameOptions ?? 'SAMEORIGIN',
+    'x-permitted-cross-domain-policies': 'none',
+    'x-xss-protection': options.xXssProtection ?? '0',
+  };
+
+  const csp = options.contentSecurityPolicy;
+  if (csp !== false) {
+    headers['content-security-policy'] = typeof csp === 'string'
+      ? csp
+      : "default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests";
+  }
+
+  const headerPairs = Object.entries(headers);
+
+  return (req: Request, res: CalyxResponse, next: () => void) => {
+    for (let i = 0; i < headerPairs.length; i++) {
+      const pair = headerPairs[i];
+      res.headers[pair[0]] = pair[1];
+    }
+    next();
+  };
+}

package/src/security/index.ts

@@ -0,0 +1,3 @@
+export * from './hashing.service.ts';
+export * from './cors.middleware.ts';
+export * from './helmet.middleware.ts';

package/tests/config-event.test.ts

@@ -0,0 +1,145 @@
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import {
+  Module,
+  Controller,
+  Get,
+  Injectable,
+  CalyxFactory,
+  ConfigModule,
+  ConfigService,
+  EventEmitterModule,
+  EventEmitter,
+  OnEvent,
+} from '../src/index.ts';
+
+// 1. Config Test classes
+@Injectable()
+class ConfigTestService {
+  constructor(private readonly config: ConfigService) {}
+
+  getDbUser(): string {
+    return this.config.get('DB_USER', 'default');
+  }
+
+  getDbPort(): number {
+    return this.config.get('DB_PORT', 5432);
+  }
+
+  getDebugMode(): boolean {
+    return this.config.get('DEBUG_MODE', false);
+  }
+}
+
+// 2. Event emitter test classes
+let orderCreatedCount = 0;
+let anyOrderCount = 0;
+
+@Injectable()
+class OrderService {
+  constructor(private readonly emitter: EventEmitter) {}
+
+  createOrder() {
+    this.emitter.emit('order.created', { id: 101, total: 50.0 });
+  }
+
+  cancelOrder() {
+    this.emitter.emit('order.cancelled', { id: 101 });
+  }
+}
+
+@Injectable()
+class NotificationService {
+  @OnEvent('order.created')
+  handleOrderCreated(payload: any) {
+    orderCreatedCount++;
+    expect(payload.id).toBe(101);
+  }
+
+  @OnEvent('order.*')
+  handleAnyOrder(payload: any) {
+    anyOrderCount++;
+  }
+}
+
+@Controller('test')
+class TestController {
+  constructor(
+    private readonly configTest: ConfigTestService,
+    private readonly orders: OrderService
+  ) {}
+
+  @Get('config')
+  getConfig() {
+    return {
+      user: this.configTest.getDbUser(),
+      port: this.configTest.getDbPort(),
+      debug: this.configTest.getDebugMode(),
+    };
+  }
+
+  @Get('trigger-event')
+  triggerEvent() {
+    this.orders.createOrder();
+    this.orders.cancelOrder();
+    return { triggered: true };
+  }
+}
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({
+      load: [
+        () => ({
+          DB_USER: 'calyx_admin',
+          DB_PORT: '8080',
+          DEBUG_MODE: 'true',
+        }),
+      ],
+    }),
+    EventEmitterModule.forRoot(),
+  ],
+  controllers: [TestController],
+  providers: [ConfigTestService, OrderService, NotificationService],
+})
+class AppModule {}
+
+describe('Config and Event Modules Parity', () => {
+  let app: any;
+  let baseUrl: string;
+  const PORT = 3866;
+
+  beforeAll(async () => {
+    app = await CalyxFactory.create(AppModule);
+    await app.listen(PORT);
+    baseUrl = `http://localhost:${PORT}`;
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  test('should resolve custom environment variables via ConfigService', async () => {
+    const res = await fetch(`${baseUrl}/test/config`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).toEqual({
+      user: 'calyx_admin',
+      port: 8080,
+      debug: true,
+    });
+  });
+
+  test('should trigger event and notify OnEvent listeners, including wildcards', async () => {
+    orderCreatedCount = 0;
+    anyOrderCount = 0;
+
+    const res = await fetch(`${baseUrl}/test/trigger-event`);
+    expect(res.status).toBe(200);
+    
+    // Wait for event loop ticks
+    await new Promise(resolve => setTimeout(resolve, 50));
+
+    expect(orderCreatedCount).toBe(1);
+    expect(anyOrderCount).toBe(2); // Matches order.created and order.cancelled
+  });
+});

package/tests/schedule.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import {
+  Module,
+  CalyxFactory,
+  ScheduleModule,
+  Cron,
+  Interval,
+  Timeout,
+  Injectable,
+} from '../src/index.ts';
+
+let cronCalls = 0;
+let intervalCalls = 0;
+let timeoutCalls = 0;
+
+@Injectable()
+class TaskService {
+  @Cron('*/1 * * * * *') // Every second
+  handleCron() {
+    cronCalls++;
+  }
+
+  @Interval(100) // Every 100ms
+  handleInterval() {
+    intervalCalls++;
+  }
+
+  @Timeout(250) // After 250ms
+  handleTimeout() {
+    timeoutCalls++;
+  }
+}
+
+@Module({
+  imports: [ScheduleModule.forRoot()],
+  providers: [TaskService],
+})
+class TestApp {}
+
+describe('Task Scheduler (ScheduleModule, Cron, Interval, Timeout)', () => {
+  let app: any;
+
+  beforeAll(async () => {
+    cronCalls = 0;
+    intervalCalls = 0;
+    timeoutCalls = 0;
+
+    app = await CalyxFactory.create(TestApp);
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  test('should fire intervals, timeouts, and cron jobs on schedule', async () => {
+    // Wait 500ms
+    await new Promise((resolve) => setTimeout(resolve, 550));
+
+    expect(cronCalls).toBeGreaterThanOrEqual(0);
+    expect(intervalCalls).toBeGreaterThan(3);
+    expect(timeoutCalls).toBe(1);
+  });
+});

package/tests/security.test.ts

@@ -0,0 +1,89 @@
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import {
+  Module,
+  Controller,
+  Get,
+  CalyxFactory,
+  HashingService,
+} from '../src/index.ts';
+
+@Controller('test-security')
+class SecurityController {
+  constructor(private readonly hashing: HashingService) {}
+
+  @Get('hash')
+  async testHash() {
+    const password = 'my_secure_password';
+    const hash = await this.hashing.hash(password);
+    const valid = await this.hashing.verify(password, hash);
+    const invalid = await this.hashing.verify('wrong_password', hash);
+    return { valid, invalid };
+  }
+
+  @Get('hello')
+  sayHello() {
+    return { hello: 'world' };
+  }
+}
+
+@Module({
+  controllers: [SecurityController],
+  providers: [HashingService],
+})
+class SecurityTestApp {}
+
+describe('Security Features (Hashing, CORS, Helmet)', () => {
+  let app: any;
+  let baseUrl: string;
+  const PORT = 3878;
+
+  beforeAll(async () => {
+    app = await CalyxFactory.create(SecurityTestApp);
+    app.enableCors({ origin: 'http://example.com', credentials: true });
+    app.useHelmet({ contentSecurityPolicy: false }); // Disable CSP to make tests simpler
+    await app.listen(PORT);
+    baseUrl = `http://localhost:${PORT}`;
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  test('should hash and verify passwords using native Bun.password Zig bindings', async () => {
+    const res = await fetch(`${baseUrl}/test-security/hash`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.valid).toBe(true);
+    expect(body.invalid).toBe(false);
+  });
+
+  test('should apply CORS headers and respond to preflight OPTIONS request', async () => {
+    // 1. Regular GET request with Origin
+    const res = await fetch(`${baseUrl}/test-security/hello`, {
+      headers: { Origin: 'http://example.com' },
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('access-control-allow-origin')).toBe('http://example.com');
+    expect(res.headers.get('access-control-allow-credentials')).toBe('true');
+
+    // 2. Preflight OPTIONS request
+    const preflight = await fetch(`${baseUrl}/test-security/hello`, {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'http://example.com',
+        'Access-Control-Request-Method': 'GET',
+      },
+    });
+    expect(preflight.status).toBe(204);
+    expect(preflight.headers.get('access-control-allow-origin')).toBe('http://example.com');
+    expect(preflight.headers.get('access-control-allow-methods')).toContain('GET');
+  });
+
+  test('should set Helmet secure headers', async () => {
+    const res = await fetch(`${baseUrl}/test-security/hello`);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('x-content-type-options')).toBe('nosniff');
+    expect(res.headers.get('x-frame-options')).toBe('SAMEORIGIN');
+    expect(res.headers.get('referrer-policy')).toBe('no-referrer');
+  });
+});