@zintrust/core 0.1.0 → 0.1.2

package/src/config/logging/KvLogger.d.ts

@@ -0,0 +1,22 @@
+/**
+ * KV Logger
+ * Writes batches of log events to a KV namespace (Cloudflare Workers compatible)
+ *
+ * Enabled via env:
+ *  - KV_LOG_ENABLED (default: false)
+ *  - KV_NAMESPACE (binding name; default: 'CACHE')
+ *  - KV_LOG_RETENTION_DAYS (default: 30)
+ */
+export type KvLogEvent = {
+    timestamp: string;
+    level: 'debug' | 'info' | 'warn' | 'error' | 'fatal';
+    message: string;
+    category?: string;
+    data?: unknown;
+    error?: string;
+};
+export declare const KvLogger: Readonly<{
+    enqueue(event: KvLogEvent): Promise<void>;
+}>;
+export default KvLogger;
+//# sourceMappingURL=KvLogger.d.ts.map

package/src/config/logging/KvLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KvLogger.d.ts","sourceRoot":"","sources":["../../../../src/config/logging/KvLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA2IF,eAAO,MAAM,QAAQ;mBACE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;EAkB/C,CAAC;AAEH,eAAe,QAAQ,CAAC"}

package/src/config/logging/KvLogger.js

@@ -0,0 +1,143 @@
+/**
+ * KV Logger
+ * Writes batches of log events to a KV namespace (Cloudflare Workers compatible)
+ *
+ * Enabled via env:
+ *  - KV_LOG_ENABLED (default: false)
+ *  - KV_NAMESPACE (binding name; default: 'CACHE')
+ *  - KV_LOG_RETENTION_DAYS (default: 30)
+ */
+import { Cloudflare } from '../cloudflare';
+import { Env } from '../env';
+const getRetentionTtlSeconds = () => {
+    const days = Env.getInt('KV_LOG_RETENTION_DAYS', 30);
+    const safeDays = Number.isFinite(days) && days > 0 ? days : 30;
+    return safeDays * 24 * 60 * 60;
+};
+const getKvBindingName = () => {
+    const name = Env.get('KV_NAMESPACE', 'CACHE').trim();
+    return name.length > 0 ? name : 'CACHE';
+};
+const isEnabled = () => Env.getBool('KV_LOG_ENABLED', false);
+const safeRandom = () => {
+    try {
+        // Prefer crypto if available
+        const cryptoObj = globalThis.crypto;
+        if (cryptoObj?.getRandomValues) {
+            const bytes = new Uint8Array(8);
+            cryptoObj.getRandomValues(bytes);
+            return Array.from(bytes)
+                .map((b) => b.toString(16).padStart(2, '0'))
+                .join('');
+        }
+    }
+    catch {
+        // fall through
+    }
+    const generate = Math.random().toString(16).slice(2); // NOSONAR
+    const fallback = generate + Math.random().toString(16).slice(2); // NOSONAR this is not used for security
+    return fallback;
+};
+const buildKey = (timestampIso) => {
+    const date = timestampIso.slice(0, 10);
+    const hour = timestampIso.slice(11, 13);
+    return `logs:${date}:${hour}:${safeRandom()}`;
+};
+let buffer = [];
+let flushTimer;
+let flushPromise;
+const scheduleFlush = async () => {
+    if (flushPromise !== undefined)
+        return flushPromise;
+    // Fixed small batching window to reduce KV write volume.
+    const windowMs = 1000;
+    const promise = new Promise((resolve) => {
+        const run = async () => {
+            try {
+                await flushNow();
+            }
+            finally {
+                resolve(undefined);
+            }
+        };
+        if (typeof globalThis.setTimeout !== 'function') {
+            // microtask-ish
+            void run();
+            return;
+        }
+        flushTimer = globalThis.setTimeout(() => {
+            flushTimer = undefined;
+            void run();
+        }, windowMs);
+    });
+    flushPromise = promise.finally(() => {
+        flushPromise = undefined;
+    });
+    return flushPromise;
+};
+const getKv = () => {
+    const bindingName = getKvBindingName();
+    return Cloudflare.getKVBinding(bindingName);
+};
+const putBatch = async (kv, events) => {
+    if (events.length === 0)
+        return;
+    const timestamp = events.at(-1)?.timestamp ?? new Date().toISOString();
+    const key = buildKey(timestamp);
+    const payload = JSON.stringify({
+        version: 1,
+        createdAt: new Date().toISOString(),
+        count: events.length,
+        events,
+    });
+    const opts = { expirationTtl: getRetentionTtlSeconds() };
+    await kv.put(key, payload, opts);
+};
+const flushNow = async () => {
+    if (!isEnabled()) {
+        buffer = [];
+        return;
+    }
+    const kv = getKv();
+    if (kv === null) {
+        buffer = [];
+        return;
+    }
+    const toSend = buffer;
+    buffer = [];
+    try {
+        await putBatch(kv, toSend);
+    }
+    catch {
+        // Best-effort: never throw from logging.
+    }
+};
+const flushSoon = async () => {
+    if (flushPromise !== undefined)
+        return flushPromise;
+    flushPromise = Promise.resolve()
+        .then(async () => flushNow())
+        .finally(() => {
+        flushPromise = undefined;
+    });
+    return flushPromise;
+};
+export const KvLogger = Object.freeze({
+    async enqueue(event) {
+        if (!isEnabled())
+            return Promise.resolve();
+        buffer.push(event);
+        // Basic size guard: flush if it gets too large
+        const maxBatch = 100;
+        if (buffer.length >= maxBatch) {
+            // Cancel scheduled flush and flush immediately
+            if (flushTimer !== undefined) {
+                globalThis.clearTimeout(flushTimer);
+                flushTimer = undefined;
+            }
+            return flushSoon();
+        }
+        return scheduleFlush();
+    },
+});
+export default KvLogger;

package/src/config/logging/SlackLogger.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Slack Notification Logger
+ * Sends warn/error/fatal log events to a Slack incoming webhook.
+ *
+ * Enabled via env:
+ *  - SLACK_LOG_ENABLED (default: false)
+ *  - SLACK_LOG_WEBHOOK_URL
+ *  - SLACK_LOG_LEVELS (comma-separated; default: "warn,error,fatal")
+ *  - SLACK_LOG_BATCH_WINDOW_MS (default: 5000)
+ */
+export type SlackLogEvent = {
+    timestamp: string;
+    level: 'debug' | 'info' | 'warn' | 'error' | 'fatal';
+    message: string;
+    category?: string;
+    data?: unknown;
+    error?: string;
+};
+export declare const SlackLogger: Readonly<{
+    enqueue(event: SlackLogEvent): Promise<void>;
+}>;
+export default SlackLogger;
+//# sourceMappingURL=SlackLogger.d.ts.map

package/src/config/logging/SlackLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackLogger.d.ts","sourceRoot":"","sources":["../../../../src/config/logging/SlackLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAoHF,eAAO,MAAM,WAAW;mBACD,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;EAclD,CAAC;AAEH,eAAe,WAAW,CAAC"}

package/src/config/logging/SlackLogger.js

@@ -0,0 +1,119 @@
+/**
+ * Slack Notification Logger
+ * Sends warn/error/fatal log events to a Slack incoming webhook.
+ *
+ * Enabled via env:
+ *  - SLACK_LOG_ENABLED (default: false)
+ *  - SLACK_LOG_WEBHOOK_URL
+ *  - SLACK_LOG_LEVELS (comma-separated; default: "warn,error,fatal")
+ *  - SLACK_LOG_BATCH_WINDOW_MS (default: 5000)
+ */
+import { Env } from '../env';
+import { ErrorFactory } from '../../exceptions/ZintrustError';
+import { HttpClient } from '../../tools/http/Http';
+const isEnabled = () => Env.getBool('SLACK_LOG_ENABLED', false);
+const getLevels = () => {
+    const raw = Env.get('SLACK_LOG_LEVELS', 'warn,error,fatal');
+    return new Set(raw
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter((s) => s.length > 0));
+};
+const levelToColor = (level) => {
+    if (level === 'fatal' || level === 'error')
+        return '#D50200';
+    if (level === 'warn')
+        return '#D39E00';
+    return '#439FE0';
+};
+const formatEventText = (ev) => {
+    const header = `*${ev.level.toUpperCase()}* ${ev.message}`;
+    const metaParts = [];
+    if (ev.category !== undefined)
+        metaParts.push(`category=${ev.category}`);
+    metaParts.push(`ts=${ev.timestamp}`);
+    const meta = metaParts.length > 0 ? `\n_${metaParts.join(' ')}_` : '';
+    const err = ev.error === undefined ? '' : `\n*error:* ${String(ev.error)}`;
+    const data = ev.data === undefined ? '' : `\n*data:* \`${JSON.stringify(ev.data)}\``;
+    return `${header}${meta}${err}${data}`;
+};
+let buffer = [];
+let flushPromise;
+let dedupeKeys = new Set();
+const dedupeKeyFor = (ev) => {
+    const base = `${ev.level}:${ev.message}:${ev.error ?? ''}`;
+    return base.length > 500 ? base.slice(0, 500) : base;
+};
+const sendBatch = async (events) => {
+    const webhookUrl = Env.get('SLACK_LOG_WEBHOOK_URL').trim();
+    if (webhookUrl.length === 0) {
+        throw ErrorFactory.createConfigError('SLACK_LOG_WEBHOOK_URL is required when Slack logging is enabled');
+    }
+    const lines = events.map((e) => formatEventText(e)).join('\n\n');
+    const payload = {
+        attachments: [
+            {
+                color: levelToColor(events[0]?.level ?? 'warn'),
+                text: lines,
+            },
+        ],
+    };
+    await HttpClient.post(webhookUrl, payload).send();
+};
+const flushNow = async () => {
+    const toSend = buffer;
+    buffer = [];
+    dedupeKeys = new Set();
+    if (!isEnabled())
+        return;
+    if (toSend.length === 0)
+        return;
+    try {
+        await sendBatch(toSend);
+    }
+    catch {
+        // Best-effort: never throw from logging.
+    }
+};
+const scheduleFlush = async () => {
+    if (flushPromise !== undefined)
+        return flushPromise;
+    const windowMs = Math.max(0, Env.getInt('SLACK_LOG_BATCH_WINDOW_MS', 5000));
+    const promise = new Promise((resolve) => {
+        const run = async () => {
+            try {
+                await flushNow();
+            }
+            finally {
+                resolve(undefined);
+            }
+        };
+        if (windowMs === 0 || typeof globalThis.setTimeout !== 'function') {
+            void run();
+            return;
+        }
+        globalThis.setTimeout(() => {
+            void run();
+        }, windowMs);
+    });
+    flushPromise = promise.finally(() => {
+        flushPromise = undefined;
+    });
+    return flushPromise;
+};
+export const SlackLogger = Object.freeze({
+    async enqueue(event) {
+        if (!isEnabled())
+            return Promise.resolve();
+        const levels = getLevels();
+        if (!levels.has(event.level))
+            return Promise.resolve();
+        const key = dedupeKeyFor(event);
+        if (dedupeKeys.has(key))
+            return scheduleFlush();
+        dedupeKeys.add(key);
+        buffer.push(event);
+        return scheduleFlush();
+    },
+});
+export default SlackLogger;

package/src/config/mail.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Mail Configuration
+ * Runtime mail drivers and settings
+ * Sealed namespace for immutability
+ */
+export type MailDriverName = 'disabled' | 'sendgrid' | 'smtp' | 'ses' | 'mailgun';
+export type DisabledMailDriverConfig = {
+    driver: 'disabled';
+};
+export type SendGridMailDriverConfig = {
+    driver: 'sendgrid';
+    apiKey: string;
+};
+export type MailgunMailDriverConfig = {
+    driver: 'mailgun';
+    apiKey: string;
+    domain: string;
+    baseUrl: string;
+};
+export type SmtpMailDriverConfig = {
+    driver: 'smtp';
+    host: string;
+    port: number;
+    username: string;
+    password: string;
+    secure: boolean | 'starttls';
+};
+export type SesMailDriverConfig = {
+    driver: 'ses';
+    region: string;
+};
+export type MailDriverConfig = DisabledMailDriverConfig | SendGridMailDriverConfig | MailgunMailDriverConfig | SmtpMailDriverConfig | SesMailDriverConfig;
+export declare const mailConfig: Readonly<{
+    /**
+     * Default mail driver
+     */
+    readonly default: MailDriverName;
+    /**
+     * Default "From" identity
+     */
+    readonly from: {
+        readonly address: string;
+        readonly name: string;
+    };
+    /**
+     * Driver configs
+     */
+    readonly drivers: {
+        readonly disabled: {
+            readonly driver: "disabled";
+        };
+        readonly sendgrid: {
+            readonly driver: "sendgrid";
+            readonly apiKey: string;
+        };
+        readonly mailgun: {
+            readonly driver: "mailgun";
+            readonly apiKey: string;
+            readonly domain: string;
+            readonly baseUrl: string;
+        };
+        readonly smtp: {
+            readonly driver: "smtp";
+            readonly host: string;
+            readonly port: number;
+            readonly username: string;
+            readonly password: string;
+            readonly secure: boolean | "starttls";
+        };
+        readonly ses: {
+            readonly driver: "ses";
+            readonly region: string;
+        };
+    };
+    /**
+     * Get selected driver config
+     */
+    readonly getDriver: () => MailDriverConfig;
+}>;
+export type MailConfig = typeof mailConfig;
+//# sourceMappingURL=mail.d.ts.map

package/src/config/mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.d.ts","sourceRoot":"","sources":["../../../src/config/mail.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;AAElF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAGF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,KAAK,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,wBAAwB,GACxB,wBAAwB,GACxB,uBAAuB,GACvB,oBAAoB,GACpB,mBAAmB,CAAC;AA6FxB,eAAO,MAAM,UAAU;IA9DrB;;OAEG;;IAGH;;OAEG;;;;;IAMH;;OAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCH;;OAEG;8BACU,gBAAgB;EAKuB,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC"}

package/src/config/mail.js

@@ -0,0 +1,73 @@
+/**
+ * Mail Configuration
+ * Runtime mail drivers and settings
+ * Sealed namespace for immutability
+ */
+import { Env } from './env';
+const getMailDriver = (config) => {
+    const defaultDriver = config.default;
+    if (Object.hasOwn(config.drivers, defaultDriver)) {
+        const driverName = defaultDriver;
+        return config.drivers[driverName];
+    }
+    return config.drivers.disabled;
+};
+const mailConfigObj = {
+    /**
+     * Default mail driver
+     */
+    default: Env.get('MAIL_DRIVER', 'disabled') ?? 'disabled',
+    /**
+     * Default "From" identity
+     */
+    from: {
+        address: Env.get('MAIL_FROM_ADDRESS', ''),
+        name: Env.get('MAIL_FROM_NAME', ''),
+    },
+    /**
+     * Driver configs
+     */
+    drivers: {
+        disabled: {
+            driver: 'disabled',
+        },
+        sendgrid: {
+            driver: 'sendgrid',
+            apiKey: Env.get('SENDGRID_API_KEY', ''),
+        },
+        mailgun: {
+            driver: 'mailgun',
+            apiKey: Env.get('MAILGUN_API_KEY', ''),
+            domain: Env.get('MAILGUN_DOMAIN', ''),
+            baseUrl: Env.get('MAILGUN_BASE_URL', 'https://api.mailgun.net').trim(),
+        },
+        smtp: {
+            driver: 'smtp',
+            host: Env.get('MAIL_HOST', ''),
+            port: Env.getInt('MAIL_PORT', 587),
+            username: Env.get('MAIL_USERNAME', ''),
+            password: Env.get('MAIL_PASSWORD', ''),
+            secure: (() => {
+                const raw = Env.get('MAIL_SECURE', '').trim().toLowerCase();
+                if (raw === 'starttls')
+                    return 'starttls';
+                if (raw === 'tls' || raw === 'ssl' || raw === 'smtps' || raw === 'implicit')
+                    return true;
+                if (raw === 'none' || raw === 'off' || raw === 'false' || raw === '0')
+                    return false;
+                return Env.getBool('MAIL_SECURE', false);
+            })(),
+        },
+        ses: {
+            driver: 'ses',
+            region: Env.get('AWS_REGION', 'us-east-1'),
+        },
+    },
+    /**
+     * Get selected driver config
+     */
+    getDriver() {
+        return getMailDriver(this);
+    },
+};
+export const mailConfig = Object.freeze(mailConfigObj);

package/src/config/middleware.d.ts

@@ -0,0 +1,8 @@
+import type { Middleware } from '../middleware/MiddlewareStack';
+export type MiddlewareConfig = {
+    global: Middleware[];
+    route: Record<string, Middleware>;
+};
+export declare const middlewareConfig: Readonly<MiddlewareConfig>;
+export default middlewareConfig;
+//# sourceMappingURL=middleware.d.ts.map

package/src/config/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/config/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAI9D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC,CAAC;AAeF,eAAO,MAAM,gBAAgB,4BAAqC,CAAC;AACnE,eAAe,gBAAgB,CAAC"}

package/src/config/middleware.js

@@ -0,0 +1,18 @@
+import { CsrfMiddleware } from '../middleware/CsrfMiddleware';
+import { ErrorHandlerMiddleware } from '../middleware/ErrorHandlerMiddleware';
+import { LoggingMiddleware } from '../middleware/LoggingMiddleware';
+import { RateLimiter } from '../middleware/RateLimiter';
+import { SecurityMiddleware } from '../middleware/SecurityMiddleware';
+const shared = Object.freeze({
+    log: LoggingMiddleware.create(),
+    error: ErrorHandlerMiddleware.create(),
+    security: SecurityMiddleware.create(),
+    rateLimit: RateLimiter.create(),
+    csrf: CsrfMiddleware.create(),
+});
+const middlewareConfigObj = {
+    global: [shared.log, shared.error, shared.security, shared.rateLimit, shared.csrf],
+    route: shared,
+};
+export const middlewareConfig = Object.freeze(middlewareConfigObj);
+export default middlewareConfig;

package/src/config/notification.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Notification Configuration
+ *
+ * Config-first mapping of notification providers.
+ * Keeps runtime driver selection in one place and uses Env for safe access.
+ */
+export type KnownNotificationDriverName = 'console' | 'termii' | 'twilio' | 'slack';
+export type ConsoleNotificationDriverConfig = {
+    driver: 'console';
+};
+export type TermiiNotificationDriverConfig = {
+    driver: 'termii';
+    apiKey: string;
+    sender: string;
+    endpoint: string;
+};
+export type TwilioNotificationDriverConfig = {
+    driver: 'twilio';
+    accountSid: string;
+    authToken: string;
+    fromNumber: string;
+};
+export type SlackNotificationDriverConfig = {
+    driver: 'slack';
+    webhookUrl: string;
+};
+export type KnownNotificationDriverConfig = ConsoleNotificationDriverConfig | TermiiNotificationDriverConfig | TwilioNotificationDriverConfig | SlackNotificationDriverConfig;
+declare const _default: Readonly<{
+    /**
+     * Normalized notification driver name.
+     *
+     * NOTE: This intentionally supports custom driver names (e.g. project-specific drivers),
+     * so it returns a string rather than a strict union.
+     */
+    readonly getDriverName: () => string;
+    /**
+     * Provider configs.
+     */
+    readonly providers: {
+        console: {
+            driver: "console";
+        };
+        termii: {
+            driver: "termii";
+            apiKey: string;
+            sender: string;
+            endpoint: string;
+        };
+        twilio: {
+            driver: "twilio";
+            accountSid: string;
+            authToken: string;
+            fromNumber: string;
+        };
+        slack: {
+            driver: "slack";
+            webhookUrl: string;
+        };
+    };
+}>;
+export default _default;
+//# sourceMappingURL=notification.d.ts.map

package/src/config/notification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.d.ts","sourceRoot":"","sources":["../../../src/config/notification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpF,MAAM,MAAM,+BAA+B,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACrC,+BAA+B,GAC/B,8BAA8B,GAC9B,8BAA8B,GAC9B,6BAA6B,CAAC;;IAUhC;;;;;OAKG;kCACc,MAAM;IAIvB;;OAEG;;;;;;;;;;;;;;;;;;;;;;;AA2BL,wBAAoD"}

package/src/config/notification.js

@@ -0,0 +1,43 @@
+/**
+ * Notification Configuration
+ *
+ * Config-first mapping of notification providers.
+ * Keeps runtime driver selection in one place and uses Env for safe access.
+ */
+import { Env } from './env';
+const notificationConfigObj = {
+    /**
+     * Normalized notification driver name.
+     *
+     * NOTE: This intentionally supports custom driver names (e.g. project-specific drivers),
+     * so it returns a string rather than a strict union.
+     */
+    getDriverName() {
+        return Env.get('NOTIFICATION_DRIVER', 'console').trim().toLowerCase();
+    },
+    /**
+     * Provider configs.
+     */
+    providers: {
+        console: {
+            driver: 'console',
+        },
+        termii: {
+            driver: 'termii',
+            apiKey: Env.get('TERMII_API_KEY', ''),
+            sender: Env.get('TERMII_SENDER', 'Zintrust'),
+            endpoint: Env.get('TERMII_ENDPOINT', 'https://api.termii.com/sms/send'),
+        },
+        twilio: {
+            driver: 'twilio',
+            accountSid: Env.get('TWILIO_ACCOUNT_SID', ''),
+            authToken: Env.get('TWILIO_AUTH_TOKEN', ''),
+            fromNumber: Env.get('TWILIO_FROM_NUMBER', ''),
+        },
+        slack: {
+            driver: 'slack',
+            webhookUrl: Env.get('SLACK_WEBHOOK_URL', ''),
+        },
+    },
+};
+export default Object.freeze(notificationConfigObj);

package/src/config/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/config/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgJH,eAAO,MAAM,cAAc;IAtHzB;;OAEG;;;yBAGa,MAAM;4BAQ4B,OAAO,GAAG,OAAO,GAAG,OAAO;;;;;;IAO7E;;OAEG;;;;;;;;iCAQ6D,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAGzF;;OAEG;;;;;IAMH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;IAQH;;OAEG;;;;;IAMH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;2BAOmD,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAG/E;;OAEG;;;;;;;;EAUyD,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/config/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA+IH,eAAO,MAAM,cAAc;IAtHzB;;OAEG;;;yBAGa,MAAM;4BAQ4B,OAAO,GAAG,OAAO,GAAG,OAAO;;;;;;IAO7E;;OAEG;;;;;;;;iCAQ6D,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAGzF;;OAEG;;;;;IAMH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;IAQH;;OAEG;;;;;IAMH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;2BAOmD,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAG/E;;OAEG;;;;;;;;EAUyD,CAAC"}

package/src/config/security.js

@@ -3,6 +3,7 @@
  * JWT, CSRF, encryption and other security settings
  * Sealed namespace for immutability
  */
+import { appConfig } from './app';
 import { Env } from './env';
 import { Logger } from './logger';
 import { ErrorFactory } from '../exceptions/ZintrustError';
@@ -12,8 +13,7 @@ import { ErrorFactory } from '../exceptions/ZintrustError';
 function warnMissingSecret(secretName) {
     Logger.error(`❌ CRITICAL: ${secretName} environment variable is not set!`);
     Logger.error('⚠️  Application may not function correctly. Set this in production immediately.');
-    const nodeEnv = Env.get('NODE_ENV', 'development');
-    if (nodeEnv === 'production') {
+    if (appConfig.isProduction()) {
         throw ErrorFactory.createConfigError(`Missing required secret: ${secretName}`, { secretName });
     }
     // In non-production environments, allow the app/CLI to start while still warning loudly.

package/src/config/startup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Startup Configuration
+ *
+ * Startup-only controls (evaluated during Application.boot()).
+ */
+export type StartupConfig = {
+    healthChecksEnabled: boolean;
+    validateSecrets: boolean;
+    checkDatabase: boolean;
+    checkCache: boolean;
+    timeoutMs: number;
+    continueOnFailure: boolean;
+};
+export declare const startupConfig: Readonly<{
+    healthChecksEnabled: boolean;
+    validateSecrets: boolean;
+    checkDatabase: boolean;
+    checkCache: boolean;
+    timeoutMs: number;
+    continueOnFailure: boolean;
+}>;
+export default startupConfig;
+//# sourceMappingURL=startup.d.ts.map

package/src/config/startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../../../src/config/startup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,aAAa,GAAG;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;EAOA,CAAC;AAE3B,eAAe,aAAa,CAAC"}