@zintrust/core 0.1.0

package/src/middleware/RateLimiter.js

@@ -0,0 +1,72 @@
+/**
+ * Rate Limiter Middleware
+ * Token bucket implementation for request rate limiting
+ * Zero-dependency implementation
+ */
+import { Logger } from '../config/logger';
+const DEFAULT_OPTIONS = {
+    windowMs: 60 * 1000, // 1 minute
+    max: 100, // 100 requests per minute
+    message: 'Too many requests, please try again later.',
+    statusCode: 429,
+    headers: true,
+    keyGenerator: (req) => {
+        return (req.getHeader('x-forwarded-for') ?? req.getRaw().socket.remoteAddress ?? 'unknown');
+    },
+};
+export const RateLimiter = Object.freeze({
+    /**
+     * Create rate limiter middleware
+     */
+    create(options = DEFAULT_OPTIONS) {
+        const config = { ...DEFAULT_OPTIONS, ...options };
+        const clients = new Map();
+        // Cleanup to prevent unbounded growth.
+        // Done lazily (on requests) to avoid background timers in serverless/test environments.
+        let nextCleanupAt = Date.now() + config.windowMs;
+        const cleanupExpiredClients = (now) => {
+            if (now < nextCleanupAt)
+                return;
+            for (const [key, state] of clients.entries()) {
+                if (now > state.resetTime) {
+                    clients.delete(key);
+                }
+            }
+            nextCleanupAt = now + config.windowMs;
+        };
+        return async (req, res, next) => {
+            const key = config.keyGenerator ? config.keyGenerator(req) : 'unknown';
+            const now = Date.now();
+            cleanupExpiredClients(now);
+            let client = clients.get(key);
+            // Initialize or reset if window expired
+            if (!client || now > client.resetTime) {
+                client = {
+                    count: 0,
+                    resetTime: now + config.windowMs,
+                };
+                clients.set(key, client);
+            }
+            client.count++;
+            const remaining = Math.max(0, config.max - client.count);
+            const resetTime = Math.ceil((client.resetTime - now) / 1000);
+            // Set headers
+            if (config.headers ?? false) {
+                res.setHeader('X-RateLimit-Limit', config.max.toString());
+                res.setHeader('X-RateLimit-Remaining', remaining.toString());
+                res.setHeader('X-RateLimit-Reset', resetTime.toString());
+            }
+            // Check limit
+            if (client.count > config.max) {
+                Logger.warn(`Rate limit exceeded for IP: ${key}`);
+                res.setStatus(config.statusCode ?? 429);
+                res.json({
+                    error: 'Too Many Requests',
+                    message: config.message,
+                });
+                return;
+            }
+            await next();
+        };
+    },
+});

package/src/middleware/SecurityMiddleware.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Security Middleware
+ * Implements standard security headers and CORS protection
+ * Zero-dependency implementation replacing helmet/cors
+ */
+import { Middleware } from './MiddlewareStack';
+export interface SecurityOptions {
+    hsts?: {
+        maxAge?: number;
+        includeSubDomains?: boolean;
+        preload?: boolean;
+    };
+    frameguard?: {
+        action?: 'DENY' | 'SAMEORIGIN';
+    };
+    cors?: {
+        origin?: string;
+        methods?: string[];
+        allowedHeaders?: string[];
+        credentials?: boolean;
+        maxAge?: number;
+    };
+    csp?: {
+        directives?: Record<string, string[]>;
+    };
+}
+export declare const SecurityMiddleware: Readonly<{
+    /**
+     * Create security middleware with options
+     */
+    create(options?: SecurityOptions): Middleware;
+}>;
+//# sourceMappingURL=SecurityMiddleware.d.ts.map

package/src/middleware/SecurityMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SecurityMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACvC,CAAC;CACH;AA+FD,eAAO,MAAM,kBAAkB;IAC7B;;OAEG;qBACa,eAAe,GAAQ,UAAU;EAgBjD,CAAC"}

package/src/middleware/SecurityMiddleware.js

@@ -0,0 +1,106 @@
+/**
+ * Security Middleware
+ * Implements standard security headers and CORS protection
+ * Zero-dependency implementation replacing helmet/cors
+ */
+const DEFAULT_OPTIONS = {
+    hsts: {
+        maxAge: 15552000, // 180 days
+        includeSubDomains: true,
+        preload: false,
+    },
+    frameguard: {
+        action: 'SAMEORIGIN',
+    },
+    cors: {
+        origin: '*',
+        methods: ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE'],
+        allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
+        credentials: true,
+        maxAge: 86400,
+    },
+};
+function applyHsts(res, hsts) {
+    if (!hsts)
+        return;
+    let headerValue = `max-age=${hsts.maxAge}`;
+    if (hsts.includeSubDomains ?? false)
+        headerValue += '; includeSubDomains';
+    if (hsts.preload ?? false)
+        headerValue += '; preload';
+    res.setHeader('Strict-Transport-Security', headerValue);
+}
+function applyFrameguard(res, frameguard) {
+    if (!frameguard)
+        return;
+    res.setHeader('X-Frame-Options', frameguard.action ?? 'SAMEORIGIN');
+}
+function applyNoSniff(res) {
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+}
+function applyReferrerPolicy(res) {
+    res.setHeader('Referrer-Policy', 'no-referrer');
+}
+function applyCsp(res, csp) {
+    if (!csp?.directives)
+        return;
+    const headerValue = Object.entries(csp.directives)
+        .map(([key, values]) => `${key} ${values.join(' ')}`)
+        .join('; ');
+    res.setHeader('Content-Security-Policy', headerValue);
+}
+function applyCors(req, res, cors) {
+    if (!cors)
+        return false;
+    const originHeader = req.getHeader('origin');
+    const origin = typeof originHeader === 'string' ? originHeader : undefined;
+    let allowedOrigin = cors.origin;
+    if (Array.isArray(cors.origin)) {
+        if (origin === undefined || !cors.origin.includes(origin)) {
+            allowedOrigin = undefined;
+        }
+        else {
+            allowedOrigin = origin;
+        }
+    }
+    if (allowedOrigin !== null && allowedOrigin !== undefined) {
+        res.setHeader('Access-Control-Allow-Origin', allowedOrigin ?? '*');
+    }
+    if (cors.methods) {
+        res.setHeader('Access-Control-Allow-Methods', cors.methods.join(', '));
+    }
+    if (cors.allowedHeaders) {
+        res.setHeader('Access-Control-Allow-Headers', cors.allowedHeaders.join(', '));
+    }
+    if (cors.credentials !== undefined) {
+        res.setHeader('Access-Control-Allow-Credentials', 'true');
+    }
+    if (cors.maxAge !== undefined) {
+        res.setHeader('Access-Control-Max-Age', cors.maxAge.toString());
+    }
+    // Handle Preflight
+    if (req.getMethod() === 'OPTIONS') {
+        res.setStatus(204);
+        return true;
+    }
+    return false;
+}
+export const SecurityMiddleware = Object.freeze({
+    /**
+     * Create security middleware with options
+     */
+    create(options = {}) {
+        const config = { ...DEFAULT_OPTIONS, ...options };
+        return async (req, res, next) => {
+            applyHsts(res, config.hsts);
+            applyFrameguard(res, config.frameguard);
+            applyNoSniff(res);
+            applyReferrerPolicy(res);
+            applyCsp(res, config.csp);
+            const preflightHandled = applyCors(req, res, config.cors);
+            if (preflightHandled)
+                return;
+            await next();
+        };
+    },
+});

package/src/middleware/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Middleware Exports
+ * Central export point for all framework middleware
+ */
+export * from './CsrfMiddleware';
+export * from './MiddlewareStack';
+export * from './RateLimiter';
+export * from './SecurityMiddleware';
+//# sourceMappingURL=index.d.ts.map

package/src/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC"}

package/src/middleware/index.js

@@ -0,0 +1,8 @@
+/**
+ * Middleware Exports
+ * Central export point for all framework middleware
+ */
+export * from './CsrfMiddleware';
+export * from './MiddlewareStack';
+export * from './RateLimiter';
+export * from './SecurityMiddleware';

package/src/node-singletons/child-process.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js Child Process Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:child_process built-in
+ */
+export { execFileSync, execSync, spawn } from 'node:child_process';
+//# sourceMappingURL=child-process.d.ts.map

package/src/node-singletons/child-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/child-process.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC"}

package/src/node-singletons/child-process.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js Child Process Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:child_process built-in
+ */
+export { execFileSync, execSync, spawn } from 'node:child_process';

package/src/node-singletons/crypto.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js Crypto Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:crypto built-in
+ */
+export { createHash, createHmac, createSign, createVerify, generateKeyPairSync, pbkdf2Sync, randomBytes, randomInt, } from 'node:crypto';
+//# sourceMappingURL=crypto.d.ts.map

package/src/node-singletons/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC"}

package/src/node-singletons/crypto.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js Crypto Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:crypto built-in
+ */
+export { createHash, createHmac, createSign, createVerify, generateKeyPairSync, pbkdf2Sync, randomBytes, randomInt, } from 'node:crypto';

package/src/node-singletons/events.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js Events Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:events built-in
+ */
+export { EventEmitter } from 'node:events';
+//# sourceMappingURL=events.d.ts.map

package/src/node-singletons/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/events.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/src/node-singletons/events.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js Events Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:events built-in
+ */
+export { EventEmitter } from 'node:events';

package/src/node-singletons/fs.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Node.js File System Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:fs and node:fs/promises built-ins
+ */
+import * as fs from 'node:fs';
+export * as fsPromises from 'node:fs/promises';
+export { appendFileSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+export type { Stats } from 'node:fs';
+export { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+export default fs;
+//# sourceMappingURL=fs.d.ts.map

package/src/node-singletons/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAK9B,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlE,eAAe,EAAE,CAAC"}

package/src/node-singletons/fs.js

@@ -0,0 +1,14 @@
+/**
+ * Node.js File System Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:fs and node:fs/promises built-ins
+ */
+import * as fs from 'node:fs';
+// Many parts of the CLI codebase use the "fsPromises" naming convention.
+// Exporting it here keeps imports consistent and makes Vitest mocking of
+// `node:fs/promises` flow through this singleton layer.
+export * as fsPromises from 'node:fs/promises';
+export { appendFileSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+export { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+// Default export for compatibility
+export default fs;

package/src/node-singletons/http.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Node.js HTTP Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:http built-in
+ */
+export { IncomingMessage, ServerResponse, createServer } from 'node:http';
+export type { IncomingHttpHeaders, Server } from 'node:http';
+//# sourceMappingURL=http.d.ts.map

package/src/node-singletons/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC"}

package/src/node-singletons/http.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js HTTP Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:http built-in
+ */
+export { IncomingMessage, ServerResponse, createServer } from 'node:http';

package/src/node-singletons/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Node.js Singleton Modules
+ * Centralized exports for all node:* imports
+ * This allows conditional loading and runtime-aware imports
+ *
+ * Safe for all runtimes (API, CLI, Serverless):
+ * - http
+ * - crypto
+ * - events
+ * - perf-hooks
+ *
+ * CLI-only (Node.js):
+ * - fs
+ * - path
+ * - child-process
+ * - url
+ * - os
+ * - readline
+ */
+export * from './crypto';
+export * from './events';
+export * from './http';
+export * from './perf-hooks';
+export * as childProcess from './child-process';
+export * as fs from './fs';
+export * as os from './os';
+export * as path from './path';
+export * as readline from './readline';
+export * as url from './url';
+//# sourceMappingURL=index.d.ts.map

package/src/node-singletons/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAG5C,OAAO,KAAK,YAAY,MAAM,gCAAgC,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,uBAAuB,CAAC;AAC9C,OAAO,KAAK,QAAQ,MAAM,2BAA2B,CAAC;AACtD,OAAO,KAAK,GAAG,MAAM,sBAAsB,CAAC"}

package/src/node-singletons/index.js

@@ -0,0 +1,31 @@
+/**
+ * Node.js Singleton Modules
+ * Centralized exports for all node:* imports
+ * This allows conditional loading and runtime-aware imports
+ *
+ * Safe for all runtimes (API, CLI, Serverless):
+ * - http
+ * - crypto
+ * - events
+ * - perf-hooks
+ *
+ * CLI-only (Node.js):
+ * - fs
+ * - path
+ * - child-process
+ * - url
+ * - os
+ * - readline
+ */
+// Safe for all runtimes
+export * from './crypto';
+export * from './events';
+export * from './http';
+export * from './perf-hooks';
+// CLI-only (should not be imported in API code)
+export * as childProcess from './child-process';
+export * as fs from './fs';
+export * as os from './os';
+export * as path from './path';
+export * as readline from './readline';
+export * as url from './url';

package/src/node-singletons/os.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Node.js OS Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:os built-in
+ */
+export { arch, cpus, freemem, loadavg, platform, tmpdir, totalmem, type } from 'node:os';
+import * as osModule from 'node:os';
+export default osModule;
+//# sourceMappingURL=os.d.ts.map

package/src/node-singletons/os.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"os.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/os.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAGzF,OAAO,KAAK,QAAQ,MAAM,SAAS,CAAC;AACpC,eAAe,QAAQ,CAAC"}

package/src/node-singletons/os.js

@@ -0,0 +1,9 @@
+/**
+ * Node.js OS Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:os built-in
+ */
+export { arch, cpus, freemem, loadavg, platform, tmpdir, totalmem, type } from 'node:os';
+// Also export the full module for compatibility
+import * as osModule from 'node:os';
+export default osModule;

package/src/node-singletons/path.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js Path Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:path built-in
+ */
+export { basename, delimiter, dirname, extname, join, relative, resolve, sep } from 'node:path';
+//# sourceMappingURL=path.d.ts.map

package/src/node-singletons/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC"}

package/src/node-singletons/path.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js Path Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:path built-in
+ */
+export { basename, delimiter, dirname, extname, join, relative, resolve, sep } from 'node:path';

package/src/node-singletons/perf-hooks.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js Performance Hooks Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:perf_hooks built-in
+ */
+export { performance } from 'node:perf_hooks';
+//# sourceMappingURL=perf-hooks.d.ts.map

package/src/node-singletons/perf-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"perf-hooks.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/perf-hooks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/src/node-singletons/perf-hooks.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js Performance Hooks Module Singleton
+ * Safe to import in both API and CLI code
+ * Exported from node:perf_hooks built-in
+ */
+export { performance } from 'node:perf_hooks';

package/src/node-singletons/readline.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Node.js Readline Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:readline built-in
+ */
+import * as readlineModule from 'node:readline';
+export { createInterface, cursorTo } from 'node:readline';
+export type { Interface } from 'node:readline';
+export default readlineModule;
+//# sourceMappingURL=readline.d.ts.map

package/src/node-singletons/readline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readline.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/readline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,cAAc,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG/C,eAAe,cAAc,CAAC"}

package/src/node-singletons/readline.js

@@ -0,0 +1,9 @@
+/**
+ * Node.js Readline Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:readline built-in
+ */
+import * as readlineModule from 'node:readline';
+export { createInterface, cursorTo } from 'node:readline';
+// Also export the full module for compatibility
+export default readlineModule;

package/src/node-singletons/url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js URL Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:url built-in
+ */
+export { fileURLToPath, pathToFileURL } from 'node:url';
+//# sourceMappingURL=url.d.ts.map

package/src/node-singletons/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../../src/node-singletons/url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/src/node-singletons/url.js

@@ -0,0 +1,6 @@
+/**
+ * Node.js URL Module Singleton
+ * CLI-only: Should not be imported in API/serverless code
+ * Exported from node:url built-in
+ */
+export { fileURLToPath, pathToFileURL } from 'node:url';

package/src/orm/ConnectionManager.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Persistent Connection Manager for Zintrust Framework
+ * Handles database connections across different runtime environments
+ * Supports: PostgreSQL, MySQL, SQL Server with connection pooling for Lambda
+ */
+export interface ConnectionConfig {
+    adapter: 'postgresql' | 'mysql' | 'sqlserver' | 'd1' | 'aurora-data-api';
+    host?: string;
+    port?: number;
+    database: string;
+    username?: string;
+    password?: string;
+    maxConnections?: number;
+    idleTimeout?: number;
+    connectionTimeout?: number;
+    enableRdsProxy?: boolean;
+    rdsProxyEndpoint?: string;
+}
+export interface PooledConnection {
+    id: string;
+    adapter: string;
+    createdAt: number;
+    lastUsedAt: number;
+    isActive: boolean;
+    queryCount: number;
+}
+export interface ConnectionPool {
+    total: number;
+    active: number;
+    idle: number;
+    queued: number;
+}
+interface ConnectionManagerInstance {
+    getConnection(id?: string): Promise<unknown>;
+    releaseConnection(connectionId?: string): Promise<void>;
+    closeAll(): Promise<void>;
+    getPoolStats(): ConnectionPool;
+    enableRdsProxy(endpoint: string): Promise<void>;
+    getAuroraDataApiConnection(): Promise<AuroraDataApiConnection>;
+}
+/**
+ * Manages database connections across Lambda warm invocations
+ * Reuses connections to reduce cold start impact and connection overhead
+ * Sealed namespace object following Pattern 2
+ *
+ * @see FRAMEWORK_REFACTOR_FUNCTION_PATTERN.md for Pattern 2 details
+ */
+export declare const ConnectionManager: Readonly<{
+    /**
+     * Get or create singleton instance
+     */
+    getInstance(config?: ConnectionConfig): ConnectionManagerInstance;
+    /**
+     * Get or create database connection
+     */
+    getConnection(id?: string): Promise<unknown>;
+    /**
+     * Release connection back to pool (but keep persistent)
+     */
+    releaseConnection(connectionId?: string): Promise<void>;
+    /**
+     * Close all connections (graceful shutdown)
+     */
+    closeAll(): Promise<void>;
+    /**
+     * Get connection pool statistics
+     */
+    getPoolStats(): ConnectionPool;
+    /**
+     * Enable RDS Proxy for connection pooling
+     */
+    enableRdsProxy(endpoint: string): Promise<void>;
+    /**
+     * Use Aurora Data API for serverless queries (no persistent connection)
+     */
+    getAuroraDataApiConnection(): Promise<AuroraDataApiConnection>;
+}>;
+/**
+ * Aurora Data API connection interface for serverless
+ */
+export interface AuroraDataApiConnection {
+    execute(sql: string, params?: unknown[]): Promise<AuroraQueryResult>;
+    batch(statements: Array<{
+        sql: string;
+        params?: unknown[];
+    }>): Promise<AuroraQueryResult[]>;
+}
+export interface AuroraQueryResult {
+    numberOfRecordsUpdated: number;
+    records: Array<Record<string, unknown>>;
+}
+/**
+ * Get database credentials from AWS Secrets Manager
+ */
+export declare function getDatabaseSecret(_secretName: string): Promise<DatabaseSecret>;
+/**
+ * Get database credentials from environment variables
+ */
+export declare function getDatabaseCredentialsFromEnv(): DatabaseSecret;
+/**
+ * Secrets Manager for retrieving database credentials securely
+ * Sealed namespace object following Pattern 2
+ *
+ * @see FRAMEWORK_REFACTOR_FUNCTION_PATTERN.md for Pattern 2 details
+ */
+export declare const SecretsHelper: Readonly<{
+    getDatabaseSecret: typeof getDatabaseSecret;
+    getDatabaseCredentialsFromEnv: typeof getDatabaseCredentialsFromEnv;
+}>;
+export interface DatabaseSecret {
+    username: string;
+    password: string;
+    host: string;
+    port: number;
+    database: string;
+}
+export {};
+//# sourceMappingURL=ConnectionManager.d.ts.map