@zintrust/core 0.1.1 → 0.1.3

package/src/toolkit/Secrets/index.js

@@ -0,0 +1,119 @@
+/**
+ * Secrets Toolkit (Core)
+ *
+ * Internal framework module intended for CLI usage.
+ * It may use Node APIs (via node-singletons) and should not be used by runtime apps.
+ */
+import { ErrorFactory } from '../../exceptions/ZintrustError';
+import { EnvFile } from '../Secrets/EnvFile';
+import { Manifest } from '../Secrets/Manifest';
+import { AwsSecretsManager } from '../Secrets/providers/AwsSecretsManager';
+import { CloudflareKv } from '../Secrets/providers/CloudflareKv';
+const resolveProvider = (provider) => {
+    if (provider === 'aws' || provider === 'cloudflare')
+        return provider;
+    throw ErrorFactory.createCliError('Missing/invalid provider. Use --provider aws|cloudflare or set ZINTRUST_SECRETS_PROVIDER.');
+};
+const resolveOutFile = (outFile) => outFile ?? process.env['ZINTRUST_ENV_FILE'] ?? '.env.pull';
+const resolveManifestPath = (manifestPath) => manifestPath ?? process.env['ZINTRUST_SECRETS_MANIFEST'] ?? 'secrets.manifest.json';
+const resolveInFile = (inFile) => inFile ?? process.env['ZINTRUST_ENV_IN_FILE'] ?? '.env';
+const pullAws = async (manifest) => {
+    const client = AwsSecretsManager.createFromEnv();
+    const entries = Object.entries(manifest.keys).filter(([, spec]) => spec.aws !== undefined);
+    const pairs = await Promise.all(entries.map(async ([envKey, spec]) => {
+        const aws = spec.aws;
+        if (aws === undefined)
+            return null;
+        const value = await client.getValue(aws.secretId, aws.jsonKey);
+        return value === null ? null : [envKey, value];
+    }));
+    const resolved = {};
+    for (const pair of pairs) {
+        if (pair)
+            resolved[pair[0]] = pair[1];
+    }
+    return resolved;
+};
+const pullCloudflare = async (manifest) => {
+    const client = CloudflareKv.createFromEnv();
+    const entries = Object.entries(manifest.keys).filter(([, spec]) => spec.cloudflare !== undefined);
+    const pairs = await Promise.all(entries.map(async ([envKey, spec]) => {
+        const cf = spec.cloudflare;
+        if (cf === undefined)
+            return null;
+        const value = await client.getValue(cf.key, cf.namespaceId);
+        return value === null ? null : [envKey, value];
+    }));
+    const resolved = {};
+    for (const pair of pairs) {
+        if (pair)
+            resolved[pair[0]] = pair[1];
+    }
+    return resolved;
+};
+const pushAws = async (manifest, env, dryRun) => {
+    const client = AwsSecretsManager.createFromEnv();
+    const entries = Object.entries(manifest.keys).filter(([, spec]) => spec.aws !== undefined);
+    const pushed = await Promise.all(entries.map(async ([envKey, spec]) => {
+        const aws = spec.aws;
+        if (aws === undefined)
+            return null;
+        const value = env[envKey];
+        if (typeof value !== 'string')
+            return null;
+        if (!dryRun)
+            await client.putValue(aws.secretId, value);
+        return envKey;
+    }));
+    return pushed.filter((k) => typeof k === 'string');
+};
+const pushCloudflare = async (manifest, env, dryRun) => {
+    const client = CloudflareKv.createFromEnv();
+    const entries = Object.entries(manifest.keys).filter(([, spec]) => spec.cloudflare !== undefined);
+    const pushed = await Promise.all(entries.map(async ([envKey, spec]) => {
+        const cf = spec.cloudflare;
+        if (cf === undefined)
+            return null;
+        const value = env[envKey];
+        if (typeof value !== 'string')
+            return null;
+        if (!dryRun)
+            await client.putValue(cf.key, value, cf.namespaceId);
+        return envKey;
+    }));
+    return pushed.filter((k) => typeof k === 'string');
+};
+export const SecretsToolkit = Object.freeze({
+    async pull(options) {
+        const provider = resolveProvider(options.provider ??
+            process.env['ZINTRUST_SECRETS_PROVIDER']);
+        const outFile = resolveOutFile(options.outFile);
+        const manifestPath = resolveManifestPath(options.manifestPath);
+        const manifest = await Manifest.load({ cwd: options.cwd, path: manifestPath, provider });
+        const resolved = provider === 'aws' ? await pullAws(manifest) : await pullCloudflare(manifest);
+        if (options.dryRun === true)
+            return { outFile, keys: Object.keys(resolved) };
+        await EnvFile.write({ cwd: options.cwd, path: outFile, values: resolved, mode: 'overwrite' });
+        return { outFile, keys: Object.keys(resolved) };
+    },
+    async push(options) {
+        const provider = resolveProvider(options.provider ??
+            process.env['ZINTRUST_SECRETS_PROVIDER']);
+        const inFile = resolveInFile(options.inFile);
+        const manifestPath = resolveManifestPath(options.manifestPath);
+        const manifest = await Manifest.load({ cwd: options.cwd, path: manifestPath, provider });
+        const env = await EnvFile.read({ cwd: options.cwd, path: inFile });
+        const dryRun = options.dryRun === true;
+        const keys = provider === 'aws'
+            ? await pushAws(manifest, env, dryRun)
+            : await pushCloudflare(manifest, env, dryRun);
+        return { inFile, keys };
+    },
+    doctor(options) {
+        const provider = resolveProvider(options.provider ??
+            process.env['ZINTRUST_SECRETS_PROVIDER']);
+        const missing = provider === 'aws' ? AwsSecretsManager.doctorEnv() : CloudflareKv.doctorEnv();
+        return { provider, ok: missing.length === 0, missing };
+    },
+});
+export default SecretsToolkit;

package/src/toolkit/Secrets/providers/AwsSecretsManager.d.ts

@@ -0,0 +1,14 @@
+export type AwsCredentials = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+};
+export declare const AwsSecretsManager: Readonly<{
+    createFromEnv(): {
+        getValue: (secretId: string, jsonKey?: string) => Promise<string | null>;
+        putValue: (secretId: string, value: string) => Promise<void>;
+    };
+    doctorEnv(): string[];
+}>;
+export default AwsSecretsManager;
+//# sourceMappingURL=AwsSecretsManager.d.ts.map

package/src/toolkit/Secrets/providers/AwsSecretsManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsSecretsManager.d.ts","sourceRoot":"","sources":["../../../../../src/toolkit/Secrets/providers/AwsSecretsManager.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA0GF,eAAO,MAAM,iBAAiB;qBACX;QACf,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACzE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D;iBAsDY,MAAM,EAAE;EAcrB,CAAC;AAEH,eAAe,iBAAiB,CAAC"}

package/src/toolkit/Secrets/providers/AwsSecretsManager.js

@@ -0,0 +1,131 @@
+import { AwsSigV4 } from '../../../common/index';
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+const sha256Hex = (data) => AwsSigV4.sha256Hex(data);
+const buildAuthorization = (params) => {
+    const canonicalUri = '/';
+    const canonicalQueryString = '';
+    const headers = {
+        'content-type': 'application/x-amz-json-1.1',
+        host: params.host,
+        'x-amz-date': params.amzDate,
+        'x-amz-target': params.target,
+    };
+    const sessionToken = params.credentials.sessionToken;
+    if (typeof sessionToken === 'string' && sessionToken.trim() !== '') {
+        headers['x-amz-security-token'] = sessionToken;
+    }
+    const payloadHash = sha256Hex(params.body);
+    return AwsSigV4.buildAuthorization({
+        method: params.method,
+        canonicalUri,
+        canonicalQueryString,
+        headers,
+        payloadHash,
+        region: params.region,
+        service: 'secretsmanager',
+        amzDate: params.amzDate,
+        dateStamp: params.dateStamp,
+        credentials: params.credentials,
+    });
+};
+const parseMaybeJson = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+};
+const requestAwsSecretsManager = async (region, credentials, target, body) => {
+    const host = `secretsmanager.${region}.amazonaws.com`;
+    const url = `https://${host}/`;
+    const now = new Date();
+    const { amzDate, dateStamp } = AwsSigV4.toAmzDate(now);
+    const bodyJson = JSON.stringify(body);
+    const { authorization } = buildAuthorization({
+        method: 'POST',
+        host,
+        region,
+        amzDate,
+        dateStamp,
+        credentials,
+        target,
+        body: bodyJson,
+    });
+    const headers = {
+        'content-type': 'application/x-amz-json-1.1',
+        'x-amz-date': amzDate,
+        'x-amz-target': target,
+        Authorization: authorization,
+    };
+    const sessionToken = credentials.sessionToken;
+    if (typeof sessionToken === 'string' && sessionToken.trim() !== '') {
+        headers['x-amz-security-token'] = sessionToken;
+    }
+    const res = await fetch(url, {
+        method: 'POST',
+        headers,
+        body: bodyJson,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw ErrorFactory.createCliError(`AWS SecretsManager request failed (${res.status})`, {
+            status: res.status,
+            body: text,
+        });
+    }
+    return JSON.parse(text);
+};
+export const AwsSecretsManager = Object.freeze({
+    createFromEnv() {
+        const region = process.env['AWS_REGION'] ?? process.env['AWS_DEFAULT_REGION'] ?? '';
+        const accessKeyId = process.env['AWS_ACCESS_KEY_ID'] ?? '';
+        const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'] ?? '';
+        const sessionToken = process.env['AWS_SESSION_TOKEN'] ?? undefined;
+        if (region.trim() === '' || accessKeyId.trim() === '' || secretAccessKey.trim() === '') {
+            throw ErrorFactory.createCliError('AWS credentials missing: set AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY');
+        }
+        const credentials = { accessKeyId, secretAccessKey, sessionToken };
+        const getValue = async (secretId, jsonKey) => {
+            const data = await requestAwsSecretsManager(region, credentials, 'secretsmanager.GetSecretValue', {
+                SecretId: secretId,
+            });
+            if (typeof data.SecretString !== 'string')
+                return null;
+            if (jsonKey === undefined)
+                return data.SecretString;
+            const parsed = parseMaybeJson(data.SecretString);
+            if (typeof parsed === 'object' && parsed !== null) {
+                const obj = parsed;
+                if (!(jsonKey in obj))
+                    return null;
+                const v = obj[jsonKey];
+                if (typeof v === 'string')
+                    return v;
+                return JSON.stringify(v);
+            }
+            return null;
+        };
+        const putValue = async (secretId, value) => {
+            await requestAwsSecretsManager(region, credentials, 'secretsmanager.PutSecretValue', {
+                SecretId: secretId,
+                SecretString: value,
+            });
+        };
+        return { getValue, putValue };
+    },
+    doctorEnv() {
+        const missing = [];
+        const region = (process.env['AWS_REGION'] ?? process.env['AWS_DEFAULT_REGION'] ?? '').trim();
+        if (region === '')
+            missing.push('AWS_REGION');
+        const accessKeyId = (process.env['AWS_ACCESS_KEY_ID'] ?? '').trim();
+        if (accessKeyId === '')
+            missing.push('AWS_ACCESS_KEY_ID');
+        const secretAccessKey = (process.env['AWS_SECRET_ACCESS_KEY'] ?? '').trim();
+        if (secretAccessKey === '')
+            missing.push('AWS_SECRET_ACCESS_KEY');
+        return missing;
+    },
+});
+export default AwsSecretsManager;

package/src/toolkit/Secrets/providers/CloudflareKv.d.ts

@@ -0,0 +1,9 @@
+export declare const CloudflareKv: Readonly<{
+    createFromEnv(): {
+        getValue: (key: string, namespaceId?: string) => Promise<string | null>;
+        putValue: (key: string, value: string, namespaceId?: string) => Promise<void>;
+    };
+    doctorEnv(): string[];
+}>;
+export default CloudflareKv;
+//# sourceMappingURL=CloudflareKv.d.ts.map

package/src/toolkit/Secrets/providers/CloudflareKv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareKv.d.ts","sourceRoot":"","sources":["../../../../../src/toolkit/Secrets/providers/CloudflareKv.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY;qBACN;QACf,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACxE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/E;iBAsEY,MAAM,EAAE;EAcrB,CAAC;AAEH,eAAe,YAAY,CAAC"}

package/src/toolkit/Secrets/providers/CloudflareKv.js

@@ -0,0 +1,73 @@
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+export const CloudflareKv = Object.freeze({
+    createFromEnv() {
+        const accountId = process.env['CLOUDFLARE_ACCOUNT_ID'] ?? '';
+        const apiToken = process.env['CLOUDFLARE_API_TOKEN'] ?? '';
+        const defaultNamespaceId = process.env['CLOUDFLARE_KV_NAMESPACE_ID'] ?? '';
+        if (accountId.trim() === '' || apiToken.trim() === '') {
+            throw ErrorFactory.createCliError('Cloudflare credentials missing: set CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN');
+        }
+        const getNs = (namespaceId) => {
+            const resolved = namespaceId ?? defaultNamespaceId;
+            if (resolved.trim() === '') {
+                throw ErrorFactory.createCliError('Cloudflare KV namespace missing: set CLOUDFLARE_KV_NAMESPACE_ID or set namespaceId in manifest');
+            }
+            return resolved;
+        };
+        const base = `https://api.cloudflare.com/client/v4/accounts/${accountId}/storage/kv/namespaces`;
+        const getValue = async (key, namespaceId) => {
+            const ns = getNs(namespaceId);
+            const url = `${base}/${encodeURIComponent(ns)}/values/${encodeURIComponent(key)}`;
+            const res = await fetch(url, {
+                method: 'GET',
+                headers: {
+                    Authorization: `Bearer ${apiToken}`,
+                },
+            });
+            if (res.status === 404)
+                return null;
+            const text = await res.text();
+            if (!res.ok) {
+                throw ErrorFactory.createCliError(`Cloudflare KV GET failed (${res.status})`, {
+                    status: res.status,
+                    body: text,
+                });
+            }
+            return text;
+        };
+        const putValue = async (key, value, namespaceId) => {
+            const ns = getNs(namespaceId);
+            const url = `${base}/${encodeURIComponent(ns)}/values/${encodeURIComponent(key)}`;
+            const res = await fetch(url, {
+                method: 'PUT',
+                headers: {
+                    Authorization: `Bearer ${apiToken}`,
+                    'content-type': 'text/plain',
+                },
+                body: value,
+            });
+            const text = await res.text();
+            if (!res.ok) {
+                throw ErrorFactory.createCliError(`Cloudflare KV PUT failed (${res.status})`, {
+                    status: res.status,
+                    body: text,
+                });
+            }
+        };
+        return { getValue, putValue };
+    },
+    doctorEnv() {
+        const missing = [];
+        const accountId = (process.env['CLOUDFLARE_ACCOUNT_ID'] ?? '').trim();
+        if (accountId === '')
+            missing.push('CLOUDFLARE_ACCOUNT_ID');
+        const apiToken = (process.env['CLOUDFLARE_API_TOKEN'] ?? '').trim();
+        if (apiToken === '')
+            missing.push('CLOUDFLARE_API_TOKEN');
+        const namespaceId = (process.env['CLOUDFLARE_KV_NAMESPACE_ID'] ?? '').trim();
+        if (namespaceId === '')
+            missing.push('CLOUDFLARE_KV_NAMESPACE_ID');
+        return missing;
+    },
+});
+export default CloudflareKv;

package/src/tools/broadcast/Broadcast.d.ts

@@ -0,0 +1,7 @@
+export declare const Broadcast: Readonly<{
+    send(channel: string, event: string, data: unknown): Promise<{
+        ok: boolean;
+    }>;
+}>;
+export default Broadcast;
+//# sourceMappingURL=Broadcast.d.ts.map

package/src/tools/broadcast/Broadcast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Broadcast.d.ts","sourceRoot":"","sources":["../../../../src/tools/broadcast/Broadcast.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,SAAS;kBACA,MAAM,SAAS,MAAM,QAAQ,OAAO;;;EAmCxD,CAAC;AAEH,eAAe,SAAS,CAAC"}

package/src/tools/broadcast/Broadcast.js

@@ -0,0 +1,37 @@
+import { InMemoryDriver } from './drivers/InMemory';
+import { PusherDriver } from './drivers/Pusher';
+import { RedisDriver } from './drivers/Redis';
+import { RedisHttpsDriver } from './drivers/RedisHttps';
+import broadcastConfig from '../../config/broadcast';
+import { ErrorFactory } from '../../exceptions/ZintrustError';
+export const Broadcast = Object.freeze({
+    async send(channel, event, data) {
+        const driver = broadcastConfig.getDriverName();
+        const config = broadcastConfig.getDriverConfig();
+        if (driver === 'inmemory') {
+            const result = await InMemoryDriver.send(undefined, channel, event, data);
+            return result;
+        }
+        if (driver === 'pusher') {
+            if (config.driver !== 'pusher') {
+                throw ErrorFactory.createConfigError('Broadcast driver config mismatch: expected pusher');
+            }
+            return PusherDriver.send(config, channel, event, data);
+        }
+        if (driver === 'redis') {
+            if (config.driver !== 'redis') {
+                throw ErrorFactory.createConfigError('Broadcast driver config mismatch: expected redis');
+            }
+            return RedisDriver.send(config, channel, event, data);
+        }
+        if (driver === 'redishttps') {
+            if (config.driver !== 'redishttps') {
+                throw ErrorFactory.createConfigError('Broadcast driver config mismatch: expected redishttps');
+            }
+            return RedisHttpsDriver.send(config, channel, event, data);
+        }
+        const err = ErrorFactory.createConfigError(`Broadcast driver not implemented: ${driver}`);
+        throw err;
+    },
+});
+export default Broadcast;

package/src/tools/broadcast/drivers/BaseDriver.d.ts

@@ -0,0 +1,5 @@
+export declare const BaseDriver: Readonly<{
+    send(): Promise<unknown>;
+}>;
+export default BaseDriver;
+//# sourceMappingURL=BaseDriver.d.ts.map

package/src/tools/broadcast/drivers/BaseDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseDriver.d.ts","sourceRoot":"","sources":["../../../../../src/tools/broadcast/drivers/BaseDriver.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU;YACP,OAAO,CAAC,OAAO,CAAC;EAI9B,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/tools/broadcast/drivers/BaseDriver.js

@@ -0,0 +1,8 @@
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+export const BaseDriver = Object.freeze({
+    async send() {
+        await Promise.resolve();
+        throw ErrorFactory.createConfigError('Broadcast driver must implement send()');
+    },
+});
+export default BaseDriver;

package/src/tools/broadcast/drivers/InMemory.d.ts

@@ -0,0 +1,18 @@
+export declare const InMemoryDriver: Readonly<{
+    _events: Array<{
+        channel: string;
+        event: string;
+        data: unknown;
+    }>;
+    send(_config: unknown, channel: string, event: string, data: unknown): Promise<{
+        ok: boolean;
+    }>;
+    getEvents(): {
+        channel: string;
+        event: string;
+        data: unknown;
+    }[];
+    reset(): void;
+}>;
+export default InMemoryDriver;
+//# sourceMappingURL=InMemory.d.ts.map

package/src/tools/broadcast/drivers/InMemory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemory.d.ts","sourceRoot":"","sources":["../../../../../src/tools/broadcast/drivers/InMemory.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc;aACV,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;kBAEnD,OAAO,WAAW,MAAM,SAAS,MAAM,QAAQ,OAAO;;;;iBAF1C,MAAM;eAAS,MAAM;cAAQ,OAAO;;;EAgBpE,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/src/tools/broadcast/drivers/InMemory.js

@@ -0,0 +1,16 @@
+export const InMemoryDriver = Object.freeze({
+    _events: [],
+    async send(_config, channel, event, data) {
+        // ensure function is async and returns a resolved promise
+        await Promise.resolve();
+        this._events.push({ channel, event, data });
+        return { ok: true };
+    },
+    getEvents() {
+        return this._events.slice();
+    },
+    reset() {
+        this._events.length = 0;
+    },
+});
+export default InMemoryDriver;

package/src/tools/broadcast/drivers/Pusher.d.ts

@@ -0,0 +1,8 @@
+import type { PusherBroadcastDriverConfig } from '../../../config/broadcast';
+export declare const PusherDriver: Readonly<{
+    send(config: PusherBroadcastDriverConfig, channel: string, event: string, data: unknown): Promise<{
+        ok: boolean;
+    }>;
+}>;
+export default PusherDriver;
+//# sourceMappingURL=Pusher.d.ts.map

package/src/tools/broadcast/drivers/Pusher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pusher.d.ts","sourceRoot":"","sources":["../../../../../src/tools/broadcast/drivers/Pusher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAqDrE,eAAO,MAAM,YAAY;iBACJ,2BAA2B,WAAW,MAAM,SAAS,MAAM,QAAQ,OAAO;;;EAkD7F,CAAC;AAEH,eAAe,YAAY,CAAC"}

package/src/tools/broadcast/drivers/Pusher.js

@@ -0,0 +1,75 @@
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+import { createHash, createHmac } from '../../../node-singletons/crypto';
+const md5Hex = (data) => createHash('md5').update(data).digest('hex');
+const buildQueryString = (params) => {
+    const keys = Object.keys(params).sort((a, b) => a.localeCompare(b));
+    return keys
+        .map((key) => `${encodeURIComponent(key)}=${encodeURIComponent(params[key] ?? '')}`)
+        .join('&');
+};
+const buildBaseUrl = (cluster) => {
+    const normalized = cluster.trim();
+    if (normalized === '')
+        return 'https://api.pusherapp.com';
+    return `https://api-${normalized}.pusher.com`;
+};
+const ensureConfig = (config) => {
+    if (config.appId.trim() === '') {
+        throw ErrorFactory.createConfigError('Pusher broadcast misconfigured: PUSHER_APP_ID is required');
+    }
+    if (config.key.trim() === '') {
+        throw ErrorFactory.createConfigError('Pusher broadcast misconfigured: PUSHER_APP_KEY is required');
+    }
+    if (config.secret.trim() === '') {
+        throw ErrorFactory.createConfigError('Pusher broadcast misconfigured: PUSHER_APP_SECRET is required');
+    }
+};
+const signRequest = (params) => {
+    const stringToSign = `${params.method}\n${params.path}\n${params.queryString}`;
+    return createHmac('sha256', params.secret).update(stringToSign).digest('hex');
+};
+export const PusherDriver = Object.freeze({
+    async send(config, channel, event, data) {
+        ensureConfig(config);
+        const payload = {
+            name: event,
+            channels: [channel],
+            data: JSON.stringify(data ?? null),
+        };
+        const body = JSON.stringify(payload);
+        const path = `/apps/${config.appId}/events`;
+        const authTimestamp = String(Math.floor(Date.now() / 1000));
+        const queryParams = {
+            auth_key: config.key,
+            auth_timestamp: authTimestamp,
+            auth_version: '1.0',
+            body_md5: md5Hex(body),
+        };
+        const queryString = buildQueryString(queryParams);
+        const authSignature = signRequest({ method: 'POST', path, secret: config.secret, queryString });
+        const baseUrl = buildBaseUrl(config.cluster);
+        const url = `${baseUrl}${path}?${queryString}&auth_signature=${authSignature}`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+            },
+            body,
+        });
+        if (!res.ok) {
+            let responseBody;
+            try {
+                responseBody = await res.text();
+            }
+            catch {
+                responseBody = undefined;
+            }
+            throw ErrorFactory.createTryCatchError(`Pusher broadcast request failed (${res.status})`, {
+                status: res.status,
+                body: responseBody,
+            });
+        }
+        return { ok: true };
+    },
+});
+export default PusherDriver;

package/src/tools/broadcast/drivers/Redis.d.ts

@@ -0,0 +1,19 @@
+export type IRedisPublishClient = {
+    connect?: () => Promise<void>;
+    publish(channel: string, message: string): Promise<number>;
+};
+export type RedisBroadcastDriverConfig = {
+    driver: 'redis';
+    host: string;
+    port: number;
+    password: string;
+    channelPrefix: string;
+};
+export declare const RedisDriver: {
+    readonly send: (config: RedisBroadcastDriverConfig, channel: string, event: string, data: unknown) => Promise<{
+        ok: boolean;
+        published: number;
+    }>;
+};
+export default RedisDriver;
+//# sourceMappingURL=Redis.d.ts.map

package/src/tools/broadcast/drivers/Redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Redis.d.ts","sourceRoot":"","sources":["../../../../../src/tools/broadcast/drivers/Redis.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAiBF,eAAO,MAAM,WAAW;4BAsDD,0BAA0B,WAAW,MAAM,SAAS,MAAM,QAAQ,OAAO;;;;CAmB5F,CAAC;AAEL,eAAe,WAAW,CAAC"}

package/src/tools/broadcast/drivers/Redis.js

@@ -0,0 +1,73 @@
+import { ErrorFactory } from '../../../exceptions/ZintrustError';
+const buildRedisUrl = (config) => {
+    const host = (config.host ?? '').trim();
+    const port = Number(config.port);
+    if (!host)
+        throw ErrorFactory.createConfigError('Redis broadcast driver requires host');
+    if (!Number.isFinite(port) || port <= 0) {
+        throw ErrorFactory.createConfigError('Redis broadcast driver requires a valid port');
+    }
+    const password = (config.password ?? '').trim();
+    const authPart = password ? `:${encodeURIComponent(password)}@` : '';
+    return `redis://${authPart}${host}:${port}`;
+};
+export const RedisDriver = (() => {
+    let client = null;
+    let connected = false;
+    const ensureClient = async (config) => {
+        // Always validate config even if a client is already cached
+        const url = buildRedisUrl(config);
+        if (connected && client !== null)
+            return client;
+        // Import lazily so package is optional for environments that don't use Redis
+        try {
+            const mod = (await import('redis'));
+            client = mod.createClient({ url });
+            if (typeof client.connect === 'function') {
+                try {
+                    await client.connect();
+                    connected = true;
+                }
+                catch (err) {
+                    connected = false;
+                    throw ErrorFactory.createTryCatchError('Redis broadcast driver failed to connect', err);
+                }
+            }
+            else {
+                connected = true;
+            }
+        }
+        catch {
+            const globalFake = globalThis
+                .__fakeRedisClient;
+            if (globalFake === undefined) {
+                throw ErrorFactory.createConfigError("Redis broadcast driver requires the 'redis' package or a test fake client set in globalThis.__fakeRedisClient");
+            }
+            client = globalFake;
+            connected = true;
+        }
+        if (client === null)
+            throw ErrorFactory.createConfigError('Redis client could not be initialized');
+        return client;
+    };
+    const normalizePrefix = (value) => {
+        const prefix = (value ?? '').trim();
+        return prefix || 'broadcast:';
+    };
+    return {
+        async send(config, channel, event, data) {
+            const cli = await ensureClient(config);
+            const fullChannel = `${normalizePrefix(config.channelPrefix)}${channel}`;
+            let message;
+            try {
+                message = JSON.stringify({ event, data });
+            }
+            catch (err) {
+                throw ErrorFactory.createTryCatchError('Failed to serialize broadcast payload', err);
+            }
+            const published = await cli.publish(fullChannel, message);
+            return { ok: true, published };
+        },
+    };
+})();
+export default RedisDriver;