@zintrust/core 0.1.0

package/src/config/logger.js

@@ -0,0 +1,77 @@
+/**
+ * Logger utility - Central logging configuration
+ * Sealed namespace pattern - all exports through Logger namespace
+ * Replaces console.* calls throughout the codebase
+ */
+import { Env } from './env';
+const isDevelopment = Env.NODE_ENV === 'development' || Env.NODE_ENV === undefined;
+const isProduction = Env.NODE_ENV === 'production';
+/**
+ * Helper to extract error message from unknown error type
+ */
+const getErrorMessage = (error) => {
+    if (error === undefined) {
+        return '';
+    }
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+};
+// Private helper functions
+const logDebug = (message, data, category) => {
+    String(category);
+    if (isDevelopment) {
+        console.debug(`[DEBUG] ${message}`, data ?? ''); // eslint-disable-line no-console
+    }
+};
+const logInfo = (message, data, category) => {
+    String(category);
+    console.log(`[INFO] ${message}`, data ?? ''); // eslint-disable-line no-console
+};
+const logWarn = (message, data, category) => {
+    String(category);
+    console.warn(`[WARN] ${message}`, data ?? ''); // eslint-disable-line no-console
+};
+const logError = (message, error, category) => {
+    const errorMessage = getErrorMessage(error);
+    String(category);
+    console.error(`[ERROR] ${message}`, errorMessage); // eslint-disable-line no-console
+};
+const logFatal = (message, error, category) => {
+    const errorMessage = getErrorMessage(error);
+    String(category);
+    console.error(`[FATAL] ${message}`, errorMessage); // eslint-disable-line no-console
+    if (isProduction && typeof process !== 'undefined') {
+        process.exit(1);
+    }
+};
+const createLoggerScope = (scope) => {
+    return {
+        debug(message, data) {
+            logDebug(`[${scope}] ${message}`, data, scope);
+        },
+        info(message, data) {
+            logInfo(`[${scope}] ${message}`, data, scope);
+        },
+        warn(message, data) {
+            logWarn(`[${scope}] ${message}`, data, scope);
+        },
+        error(message, error) {
+            logError(`[${scope}] ${message}`, error, scope);
+        },
+        fatal(message, error) {
+            logFatal(`[${scope}] ${message}`, error, scope);
+        },
+    };
+};
+// Sealed namespace with all logger functionality
+export const Logger = Object.freeze({
+    debug: logDebug,
+    info: logInfo,
+    warn: logWarn,
+    error: logError,
+    fatal: logFatal,
+    scope: createLoggerScope,
+});
+export default Logger;

package/src/config/microservices.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Microservices Configuration
+ * Microservices architecture and service discovery settings
+ * Sealed namespace for immutability
+ */
+export declare const microservicesConfig: Readonly<{
+    /**
+     * Enable microservices mode
+     */
+    readonly enabled: boolean;
+    /**
+     * Enabled services (comma-separated)
+     */
+    readonly services: string[];
+    /**
+     * Service discovery
+     */
+    readonly discovery: {
+        readonly type: "filesystem" | "consul" | "etcd";
+        readonly servicesPath: string;
+        readonly refreshInterval: number;
+    };
+    /**
+     * Service Registry
+     */
+    readonly registry: {
+        readonly host: string;
+        readonly port: number;
+        readonly deregisterCriticalServiceAfter: string;
+    };
+    /**
+     * Service Authentication
+     */
+    readonly auth: {
+        readonly strategy: "api-key" | "jwt" | "none" | "custom";
+        readonly apiKey: string;
+        readonly jwtSecret: string;
+    };
+    /**
+     * Request Tracing
+     */
+    readonly tracing: {
+        readonly enabled: boolean;
+        readonly samplingRate: number;
+        readonly exportInterval: number;
+        readonly jaegerEndpoint: string;
+    };
+    /**
+     * Database Isolation
+     */
+    readonly database: {
+        readonly isolation: "shared" | "isolated";
+        readonly schema: string;
+    };
+    /**
+     * Service Health Check
+     */
+    readonly healthCheck: {
+        readonly enabled: boolean;
+        readonly interval: number;
+        readonly timeout: number;
+        readonly unhealthyThreshold: number;
+        readonly healthyThreshold: number;
+    };
+    /**
+     * Service Communication
+     */
+    readonly communication: {
+        readonly timeout: number;
+        readonly retries: number;
+        readonly retryDelay: number;
+        readonly circuitBreaker: {
+            readonly enabled: boolean;
+            readonly threshold: number;
+            readonly timeout: number;
+        };
+    };
+    /**
+     * Service Mesh (Istio/Linkerd support)
+     */
+    readonly mesh: {
+        readonly enabled: boolean;
+        readonly type: "istio" | "linkerd";
+        readonly namespace: string;
+    };
+}>;
+export type MicroservicesConfig = typeof microservicesConfig;
+//# sourceMappingURL=microservices.d.ts.map

package/src/config/microservices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microservices.d.ts","sourceRoot":"","sources":["../../../src/config/microservices.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiGH,eAAO,MAAM,mBAAmB;IA5F9B;;OAEG;;IAGH;;OAEG;;IAKH;;OAEG;;uBAEwD,YAAY,GAAG,QAAQ,GAAG,MAAM;;;;IAK3F;;OAEG;;;;;;IAOH;;OAEG;;2BAEqD,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ;;;;IAK7F;;OAEG;;;;;;;IAQH;;OAEG;;4BAEqD,QAAQ,GAAG,UAAU;;;IAI7E;;OAEG;;;;;;;;IASH;;OAEG;;;;;;;;;;;IAYH;;OAEG;;;uBAG8C,OAAO,GAAG,SAAS;;;EAKE,CAAC;AAEzE,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC"}

package/src/config/microservices.js

@@ -0,0 +1,90 @@
+/**
+ * Microservices Configuration
+ * Microservices architecture and service discovery settings
+ * Sealed namespace for immutability
+ */
+import { Env } from './env';
+const microservicesConfigObj = {
+    /**
+     * Enable microservices mode
+     */
+    enabled: Env.getBool('MICROSERVICES', false),
+    /**
+     * Enabled services (comma-separated)
+     */
+    services: Env.get('SERVICES', '')
+        .split(',')
+        .filter((s) => s.trim()),
+    /**
+     * Service discovery
+     */
+    discovery: {
+        type: Env.get('SERVICE_DISCOVERY_TYPE', 'filesystem'),
+        servicesPath: Env.get('SERVICES_PATH', 'services'),
+        refreshInterval: Env.getInt('SERVICE_DISCOVERY_REFRESH_INTERVAL', 30000),
+    },
+    /**
+     * Service Registry
+     */
+    registry: {
+        host: Env.get('SERVICE_REGISTRY_HOST', 'localhost'),
+        port: Env.getInt('SERVICE_REGISTRY_PORT', 8500),
+        deregisterCriticalServiceAfter: Env.get('SERVICE_DEREGISTER_CRITICAL_AFTER', '30s'),
+    },
+    /**
+     * Service Authentication
+     */
+    auth: {
+        strategy: Env.get('SERVICE_AUTH_STRATEGY', 'none'),
+        apiKey: Env.get('SERVICE_API_KEY'),
+        jwtSecret: Env.get('SERVICE_JWT_SECRET'),
+    },
+    /**
+     * Request Tracing
+     */
+    tracing: {
+        enabled: Env.getBool('MICROSERVICES_TRACING', false),
+        samplingRate: Env.getInt('MICROSERVICES_TRACING_RATE', 100) / 100,
+        exportInterval: Env.getInt('TRACING_EXPORT_INTERVAL', 10000),
+        jaegerEndpoint: Env.get('JAEGER_AGENT_HOST', 'localhost'),
+    },
+    /**
+     * Database Isolation
+     */
+    database: {
+        isolation: Env.get('DATABASE_ISOLATION', 'shared'),
+        schema: Env.get('DATABASE_SCHEMA_PREFIX', 'microservice'),
+    },
+    /**
+     * Service Health Check
+     */
+    healthCheck: {
+        enabled: Env.getBool('SERVICE_HEALTH_CHECK_ENABLED', true),
+        interval: Env.getInt('SERVICE_HEALTH_CHECK_INTERVAL', 30000),
+        timeout: Env.getInt('SERVICE_HEALTH_CHECK_TIMEOUT', 5000),
+        unhealthyThreshold: Env.getInt('SERVICE_UNHEALTHY_THRESHOLD', 3),
+        healthyThreshold: Env.getInt('SERVICE_HEALTHY_THRESHOLD', 2),
+    },
+    /**
+     * Service Communication
+     */
+    communication: {
+        timeout: Env.getInt('SERVICE_CALL_TIMEOUT', 30000),
+        retries: Env.getInt('SERVICE_CALL_RETRIES', 3),
+        retryDelay: Env.getInt('SERVICE_CALL_RETRY_DELAY', 1000),
+        circuitBreaker: {
+            enabled: Env.getBool('CIRCUIT_BREAKER_ENABLED', true),
+            threshold: Env.getInt('CIRCUIT_BREAKER_THRESHOLD', 5),
+            timeout: Env.getInt('CIRCUIT_BREAKER_TIMEOUT', 60000),
+        },
+    },
+    /**
+     * Service Mesh (Istio/Linkerd support)
+     */
+    mesh: {
+        enabled: Env.getBool('SERVICE_MESH_ENABLED', false),
+        type: Env.get('SERVICE_MESH_TYPE', 'istio'),
+        namespace: Env.get('SERVICE_MESH_NAMESPACE', 'default'),
+    },
+};
+export const microservicesConfig = Object.freeze(microservicesConfigObj);

package/src/config/queue.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Queue Configuration
+ * Background job and message queue settings
+ * Sealed namespace for immutability
+ */
+type QueueDriverName = 'sync' | 'database' | 'redis' | 'rabbitmq' | 'sqs';
+type SyncQueueDriverConfig = {
+    driver: 'sync';
+};
+type DatabaseQueueDriverConfig = {
+    driver: 'database';
+    table: string;
+    connection: string;
+};
+type RedisQueueDriverConfig = {
+    driver: 'redis';
+    host: string;
+    port: number;
+    password?: string;
+    database: number;
+};
+type RabbitMqQueueDriverConfig = {
+    driver: 'rabbitmq';
+    host: string;
+    port: number;
+    username: string;
+    password: string;
+    vhost: string;
+};
+type SqsQueueDriverConfig = {
+    driver: 'sqs';
+    key?: string;
+    secret?: string;
+    region: string;
+    queueUrl?: string;
+};
+type QueueDriversConfig = {
+    sync: SyncQueueDriverConfig;
+    database: DatabaseQueueDriverConfig;
+    redis: RedisQueueDriverConfig;
+    rabbitmq: RabbitMqQueueDriverConfig;
+    sqs: SqsQueueDriverConfig;
+};
+export declare const queueConfig: Readonly<{
+    /**
+     * Default queue driver
+     */
+    default: QueueDriverName;
+    /**
+     * Queue drivers
+     */
+    drivers: {
+        sync: {
+            driver: "sync";
+        };
+        database: {
+            driver: "database";
+            table: string;
+            connection: string;
+        };
+        redis: {
+            driver: "redis";
+            host: string;
+            port: number;
+            password: string;
+            database: number;
+        };
+        rabbitmq: {
+            driver: "rabbitmq";
+            host: string;
+            port: number;
+            username: string;
+            password: string;
+            vhost: string;
+        };
+        sqs: {
+            driver: "sqs";
+            key: string;
+            secret: string;
+            region: string;
+            queueUrl: string;
+        };
+    };
+    /**
+     * Get queue driver config
+     */
+    getDriver(): QueueDriversConfig[QueueDriverName];
+    /**
+     * Failed jobs table
+     */
+    failed: {
+        database: string;
+        table: string;
+    };
+    /**
+     * Job processing
+     */
+    processing: {
+        timeout: number;
+        retries: number;
+        backoff: number;
+        workers: number;
+    };
+}>;
+export type QueueConfig = typeof queueConfig;
+export {};
+//# sourceMappingURL=queue.d.ts.map

package/src/config/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../../src/config/queue.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,KAAK,eAAe,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1E,KAAK,qBAAqB,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,MAAM,EAAE,KAAK,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,yBAAyB,CAAC;IACpC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,QAAQ,EAAE,yBAAyB,CAAC;IACpC,GAAG,EAAE,oBAAoB,CAAC;CAC3B,CAAC;AAgFF,eAAO,MAAM,WAAW;IAnEtB;;OAEG;aACyC,eAAe;IAE3D;;OAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkCH;;OAEG;iBACU,kBAAkB,CAAC,eAAe,CAAC;IAIhD;;OAEG;;;;;IAMH;;OAEG;;;;;;;EASmD,CAAC;AAEzD,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC"}

package/src/config/queue.js

@@ -0,0 +1,74 @@
+/**
+ * Queue Configuration
+ * Background job and message queue settings
+ * Sealed namespace for immutability
+ */
+import { Env } from './env';
+const getQueueDriver = (config) => {
+    const driverName = config.default;
+    return config.drivers[driverName];
+};
+const queueConfigObj = {
+    /**
+     * Default queue driver
+     */
+    default: Env.get('QUEUE_DRIVER', 'sync'),
+    /**
+     * Queue drivers
+     */
+    drivers: {
+        sync: {
+            driver: 'sync',
+        },
+        database: {
+            driver: 'database',
+            table: Env.get('QUEUE_TABLE', 'jobs'),
+            connection: Env.get('QUEUE_DB_CONNECTION', 'default'),
+        },
+        redis: {
+            driver: 'redis',
+            host: Env.get('REDIS_HOST', 'localhost'),
+            port: Env.getInt('REDIS_PORT', 6379),
+            password: Env.get('REDIS_PASSWORD'),
+            database: Env.getInt('REDIS_QUEUE_DB', 1),
+        },
+        rabbitmq: {
+            driver: 'rabbitmq',
+            host: Env.get('RABBITMQ_HOST', 'localhost'),
+            port: Env.getInt('RABBITMQ_PORT', 5672),
+            username: Env.get('RABBITMQ_USER', 'guest'),
+            password: Env.get('RABBITMQ_PASSWORD', 'guest'),
+            vhost: Env.get('RABBITMQ_VHOST', '/'),
+        },
+        sqs: {
+            driver: 'sqs',
+            key: Env.get('AWS_ACCESS_KEY_ID'),
+            secret: Env.get('AWS_SECRET_ACCESS_KEY'),
+            region: Env.AWS_REGION,
+            queueUrl: Env.get('AWS_SQS_QUEUE_URL'),
+        },
+    },
+    /**
+     * Get queue driver config
+     */
+    getDriver() {
+        return getQueueDriver(this);
+    },
+    /**
+     * Failed jobs table
+     */
+    failed: {
+        database: Env.get('FAILED_JOBS_DB_CONNECTION', 'default'),
+        table: Env.get('FAILED_JOBS_TABLE', 'failed_jobs'),
+    },
+    /**
+     * Job processing
+     */
+    processing: {
+        timeout: Env.getInt('QUEUE_JOB_TIMEOUT', 60),
+        retries: Env.getInt('QUEUE_JOB_RETRIES', 3),
+        backoff: Env.getInt('QUEUE_JOB_BACKOFF', 0),
+        workers: Env.getInt('QUEUE_WORKERS', 1),
+    },
+};
+export const queueConfig = Object.freeze(queueConfigObj);

package/src/config/security.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Security Configuration
+ * JWT, CSRF, encryption and other security settings
+ * Sealed namespace for immutability
+ */
+export declare const securityConfig: Readonly<{
+    /**
+     * JWT Configuration
+     */
+    readonly jwt: {
+        readonly enabled: boolean;
+        readonly secret: string;
+        readonly algorithm: "HS256" | "HS512" | "RS256";
+        readonly expiresIn: string;
+        readonly refreshExpiresIn: string;
+        readonly issuer: string;
+        readonly audience: string;
+    };
+    /**
+     * CSRF Protection
+     */
+    readonly csrf: {
+        readonly enabled: boolean;
+        readonly headerName: string;
+        readonly tokenName: string;
+        readonly cookieName: string;
+        readonly cookieHttpOnly: boolean;
+        readonly cookieSecure: boolean;
+        readonly cookieSameSite: "strict" | "lax" | "none";
+    };
+    /**
+     * Encryption
+     */
+    readonly encryption: {
+        readonly algorithm: string;
+        readonly key: string;
+    };
+    /**
+     * API Key Authentication
+     */
+    readonly apiKey: {
+        readonly enabled: boolean;
+        readonly headerName: string;
+        readonly secret: string;
+    };
+    /**
+     * CORS Configuration
+     */
+    readonly cors: {
+        readonly enabled: boolean;
+        readonly origins: string[];
+        readonly methods: string[];
+        readonly allowedHeaders: string[];
+        readonly exposedHeaders: string[];
+        readonly credentials: boolean;
+        readonly maxAge: number;
+    };
+    /**
+     * Rate Limiting
+     */
+    readonly rateLimit: {
+        readonly enabled: boolean;
+        readonly windowMs: number;
+        readonly maxRequests: number;
+        readonly message: string;
+    };
+    /**
+     * XSS Protection
+     */
+    readonly xss: {
+        readonly enabled: boolean;
+        readonly reportUri: string;
+    };
+    /**
+     * Helmet Security Headers
+     */
+    readonly helmet: {
+        readonly enabled: boolean;
+        readonly contentSecurityPolicy: boolean;
+        readonly hsts: {
+            readonly enabled: boolean;
+            readonly maxAge: number;
+            readonly includeSubDomains: boolean;
+        };
+    };
+    /**
+     * Session Configuration
+     */
+    readonly session: {
+        readonly name: string;
+        readonly secret: string;
+        readonly expiresIn: number;
+        readonly secure: boolean;
+        readonly httpOnly: boolean;
+        readonly sameSite: "strict" | "lax" | "none";
+    };
+    /**
+     * Password settings
+     */
+    readonly password: {
+        readonly minLength: number;
+        readonly requireUppercase: boolean;
+        readonly requireNumbers: boolean;
+        readonly requireSpecialChars: boolean;
+        readonly bcryptRounds: number;
+    };
+}>;
+//# sourceMappingURL=security.d.ts.map

package/src/config/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/config/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgJH,eAAO,MAAM,cAAc;IAtHzB;;OAEG;;;yBAGa,MAAM;4BAQ4B,OAAO,GAAG,OAAO,GAAG,OAAO;;;;;;IAO7E;;OAEG;;;;;;;;iCAQ6D,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAGzF;;OAEG;;;;;IAMH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;IAQH;;OAEG;;;;;IAMH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;2BAOmD,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAG/E;;OAEG;;;;;;;;EAUyD,CAAC"}

package/src/config/security.js

@@ -0,0 +1,134 @@
+/**
+ * Security Configuration
+ * JWT, CSRF, encryption and other security settings
+ * Sealed namespace for immutability
+ */
+import { Env } from './env';
+import { Logger } from './logger';
+import { ErrorFactory } from '../exceptions/ZintrustError';
+/**
+ * Helper to warn about missing secrets
+ */
+function warnMissingSecret(secretName) {
+    Logger.error(`❌ CRITICAL: ${secretName} environment variable is not set!`);
+    Logger.error('⚠️  Application may not function correctly. Set this in production immediately.');
+    const nodeEnv = Env.get('NODE_ENV', 'development');
+    if (nodeEnv === 'production') {
+        throw ErrorFactory.createConfigError(`Missing required secret: ${secretName}`, { secretName });
+    }
+    // In non-production environments, allow the app/CLI to start while still warning loudly.
+    // This is intentionally predictable for local development and test tooling.
+    return 'dev-unsafe-jwt-secret';
+}
+let cachedJwtSecret;
+const securityConfigObj = {
+    /**
+     * JWT Configuration
+     */
+    jwt: {
+        enabled: Env.getBool('JWT_ENABLED', true),
+        get secret() {
+            if (cachedJwtSecret !== undefined)
+                return cachedJwtSecret;
+            const isEnabled = Env.getBool('JWT_ENABLED', true);
+            cachedJwtSecret = isEnabled
+                ? Env.get('JWT_SECRET') || warnMissingSecret('JWT_SECRET')
+                : Env.get('JWT_SECRET') || '';
+            return cachedJwtSecret;
+        },
+        algorithm: Env.get('JWT_ALGORITHM', 'HS256'),
+        expiresIn: Env.get('JWT_EXPIRES_IN', '1h'),
+        refreshExpiresIn: Env.get('JWT_REFRESH_EXPIRES_IN', '7d'),
+        issuer: Env.get('JWT_ISSUER', 'zintrust'),
+        audience: Env.get('JWT_AUDIENCE', 'zintrust-api'),
+    },
+    /**
+     * CSRF Protection
+     */
+    csrf: {
+        enabled: Env.getBool('CSRF_ENABLED', true),
+        headerName: Env.get('CSRF_HEADER_NAME', 'x-csrf-token'),
+        tokenName: Env.get('CSRF_TOKEN_NAME', '_csrf'),
+        cookieName: Env.get('CSRF_COOKIE_NAME', 'XSRF-TOKEN'),
+        cookieHttpOnly: Env.getBool('CSRF_COOKIE_HTTP_ONLY', true),
+        cookieSecure: Env.getBool('CSRF_COOKIE_SECURE', true),
+        cookieSameSite: Env.get('CSRF_COOKIE_SAME_SITE', 'strict'),
+    },
+    /**
+     * Encryption
+     */
+    encryption: {
+        algorithm: Env.get('ENCRYPTION_ALGORITHM', 'aes-256-cbc'),
+        key: Env.get('ENCRYPTION_KEY', 'your-encryption-key'),
+    },
+    /**
+     * API Key Authentication
+     */
+    apiKey: {
+        enabled: Env.getBool('API_KEY_ENABLED', true),
+        headerName: Env.get('API_KEY_HEADER', 'x-api-key'),
+        secret: Env.get('API_KEY_SECRET'),
+    },
+    /**
+     * CORS Configuration
+     */
+    cors: {
+        enabled: Env.getBool('CORS_ENABLED', true),
+        origins: Env.get('CORS_ORIGINS', '*').split(','),
+        methods: Env.get('CORS_METHODS', 'GET,POST,PUT,PATCH,DELETE').split(','),
+        allowedHeaders: Env.get('CORS_ALLOWED_HEADERS', 'Content-Type,Authorization').split(','),
+        exposedHeaders: Env.get('CORS_EXPOSED_HEADERS', '').split(','),
+        credentials: Env.getBool('CORS_CREDENTIALS', false),
+        maxAge: Env.getInt('CORS_MAX_AGE', 86400),
+    },
+    /**
+     * Rate Limiting
+     */
+    rateLimit: {
+        enabled: Env.getBool('RATE_LIMIT_ENABLED', true),
+        windowMs: Env.getInt('RATE_LIMIT_WINDOW_MS', 900000), // 15 minutes
+        maxRequests: Env.getInt('RATE_LIMIT_MAX_REQUESTS', 100),
+        message: Env.get('RATE_LIMIT_MESSAGE', 'Too many requests, please try again later'),
+    },
+    /**
+     * XSS Protection
+     */
+    xss: {
+        enabled: Env.getBool('XSS_ENABLED', true),
+        reportUri: Env.get('XSS_REPORT_URI'),
+    },
+    /**
+     * Helmet Security Headers
+     */
+    helmet: {
+        enabled: Env.getBool('HELMET_ENABLED', true),
+        contentSecurityPolicy: Env.getBool('CSP_ENABLED', true),
+        hsts: {
+            enabled: Env.getBool('HSTS_ENABLED', true),
+            maxAge: Env.getInt('HSTS_MAX_AGE', 31536000),
+            includeSubDomains: Env.getBool('HSTS_INCLUDE_SUBDOMAINS', true),
+        },
+    },
+    /**
+     * Session Configuration
+     */
+    session: {
+        name: Env.get('SESSION_NAME', 'zintrust_session'),
+        secret: Env.get('SESSION_SECRET', 'your-session-secret'),
+        expiresIn: Env.getInt('SESSION_EXPIRES_IN', 1800000), // 30 minutes
+        secure: Env.getBool('SESSION_SECURE', true),
+        httpOnly: Env.getBool('SESSION_HTTP_ONLY', true),
+        sameSite: Env.get('SESSION_SAME_SITE', 'strict'),
+    },
+    /**
+     * Password settings
+     */
+    password: {
+        minLength: Env.getInt('PASSWORD_MIN_LENGTH', 8),
+        requireUppercase: Env.getBool('PASSWORD_REQUIRE_UPPERCASE', true),
+        requireNumbers: Env.getBool('PASSWORD_REQUIRE_NUMBERS', true),
+        requireSpecialChars: Env.getBool('PASSWORD_REQUIRE_SPECIAL_CHARS', true),
+        bcryptRounds: Env.getInt('BCRYPT_ROUNDS', 10),
+    },
+};
+export const securityConfig = Object.freeze(securityConfigObj);