@zintrust/core 0.1.1 → 0.1.3

package/src/config/FileLogWriter.js

@@ -0,0 +1,192 @@
+/**
+ * FileLogWriter (Node.js only)
+ *
+ * Provides best-effort file logging with daily + size-based rotation.
+ * This module imports Node built-ins and should be loaded only in Node environments.
+ */
+import { ensureDirSafe } from '../common/index';
+import { Env } from './env';
+import * as fs from '../node-singletons/fs';
+import * as path from '../node-singletons/path';
+const getCwdSafe = () => {
+    try {
+        if (typeof process === 'undefined' || typeof process.cwd !== 'function')
+            return '';
+        return process.cwd();
+    }
+    catch {
+        return '';
+    }
+};
+const getDateStr = (d) => d.toISOString().slice(0, 10);
+const isAppLogFile = (fileName) => fileName.startsWith('app-') && fileName.endsWith('.log');
+const parseDateFromLogFilename = (fileName) => {
+    const match = /^app-(\d{4}-\d{2}-\d{2})(?:-\d+)?\.log$/.exec(fileName);
+    if (match?.[1] === undefined)
+        return null;
+    const parsed = Date.parse(`${match[1]}T00:00:00.000Z`);
+    return Number.isNaN(parsed) ? null : parsed;
+};
+const isOlderThanCutoffByMtime = (fullPath, cutoff) => {
+    try {
+        const stat = fs.statSync(fullPath);
+        return stat.mtime.getTime() < cutoff;
+    }
+    catch {
+        return false;
+    }
+};
+const safeUnlink = (fullPath) => {
+    try {
+        fs.unlinkSync(fullPath);
+    }
+    catch {
+        // best-effort
+    }
+};
+const readDirSafe = (dirPath) => {
+    try {
+        return fs.readdirSync(dirPath);
+    }
+    catch {
+        return [];
+    }
+};
+const shouldDeleteLogFile = (fileName, fullPath, cutoff) => {
+    const parsed = parseDateFromLogFilename(fileName);
+    if (parsed !== null)
+        return parsed < cutoff;
+    return isOlderThanCutoffByMtime(fullPath, cutoff);
+};
+const cleanupOldLogs = (logsDir, keepDays) => {
+    if (keepDays <= 0)
+        return;
+    const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1000;
+    const files = readDirSafe(logsDir);
+    if (files.length === 0)
+        return;
+    for (const fileName of files) {
+        if (!isAppLogFile(fileName))
+            continue;
+        const fullPath = path.join(logsDir, fileName);
+        if (!shouldDeleteLogFile(fileName, fullPath, cutoff))
+            continue;
+        safeUnlink(fullPath);
+    }
+};
+const listAppLogFiles = (logsDir, order) => {
+    const files = readDirSafe(logsDir)
+        .filter((f) => isAppLogFile(f))
+        .map((f) => ({ name: f, path: path.join(logsDir, f) }));
+    return files.sort((a, b) => {
+        if (a.name === b.name)
+            return 0;
+        const newerFirst = a.name < b.name ? 1 : -1;
+        return order === 'newest-first' ? newerFirst : -newerFirst;
+    });
+};
+const enforceKeepFilesPolicy = (filesNewestFirst, keepFiles, deleted) => {
+    if (typeof keepFiles !== 'number' || keepFiles < 0)
+        return;
+    if (filesNewestFirst.length <= keepFiles)
+        return;
+    const toDelete = filesNewestFirst.slice(keepFiles);
+    for (const f of toDelete) {
+        safeUnlink(f.path);
+        deleted.push(f.path);
+    }
+};
+const getFileSizesTotal = (filesOldestFirst) => {
+    let total = 0;
+    const sizes = [];
+    for (const file of filesOldestFirst) {
+        try {
+            const stat = fs.statSync(file.path);
+            sizes.push({ path: file.path, size: stat.size });
+            total += stat.size;
+        }
+        catch {
+            // ignore
+        }
+    }
+    return { total, sizes };
+};
+const deleteOldestUntilWithinLimit = (sizesOldestFirst, maxTotalSize, deleted, initialTotal) => {
+    let total = initialTotal;
+    let idx = 0;
+    while (total > maxTotalSize && idx < sizesOldestFirst.length) {
+        const del = sizesOldestFirst[idx];
+        safeUnlink(del.path);
+        deleted.push(del.path);
+        total -= del.size;
+        idx++;
+    }
+};
+const enforceMaxTotalSizePolicy = (logsDir, maxTotalSize, deleted) => {
+    if (typeof maxTotalSize !== 'number' || maxTotalSize <= 0)
+        return;
+    const remainingOldestFirst = listAppLogFiles(logsDir, 'oldest-first');
+    const { total, sizes } = getFileSizesTotal(remainingOldestFirst);
+    deleteOldestUntilWithinLimit(sizes, maxTotalSize, deleted, total);
+};
+/**
+ * Clean log files with additional retention policies.
+ * Returns an array of deleted file paths for auditing/tests.
+ */
+export const cleanOnce = (options) => {
+    const cwd = getCwdSafe();
+    if (cwd === '')
+        return [];
+    const logsDir = options?.logsDir ?? path.join(cwd, 'logs');
+    const keepDays = options?.keepDays ?? Env.LOG_ROTATION_DAYS;
+    const maxTotalSize = options?.maxTotalSize ?? Env.getInt('LOG_MAX_TOTAL_SIZE', 0);
+    const keepFiles = options?.keepFiles ?? Env.getInt('LOG_KEEP_FILES', 0);
+    // Step 1: delete by age
+    cleanupOldLogs(logsDir, keepDays);
+    const deleted = [];
+    // Step 2: enforce keepFiles (keep newest N files)
+    const filesNewestFirst = listAppLogFiles(logsDir, 'newest-first');
+    enforceKeepFilesPolicy(filesNewestFirst, keepFiles, deleted);
+    // Step 3: enforce max total size
+    enforceMaxTotalSizePolicy(logsDir, maxTotalSize, deleted);
+    return deleted;
+};
+const rotateIfNeeded = (logFile, maxSizeBytes) => {
+    if (maxSizeBytes <= 0)
+        return;
+    try {
+        if (!fs.existsSync(logFile))
+            return;
+        const stat = fs.statSync(logFile);
+        if (stat.size <= maxSizeBytes)
+            return;
+        const ext = '.log';
+        const base = logFile.endsWith(ext) ? logFile.slice(0, -ext.length) : logFile;
+        const rotated = `${base}-${Date.now()}${ext}`;
+        fs.renameSync(logFile, rotated);
+    }
+    catch {
+        // best-effort
+    }
+};
+export const FileLogWriter = Object.freeze({
+    write(line) {
+        const cwd = getCwdSafe();
+        if (cwd === '')
+            return;
+        const logsDir = path.join(cwd, 'logs');
+        ensureDirSafe(logsDir);
+        const dateStr = getDateStr(new Date());
+        const logFile = path.join(logsDir, `app-${dateStr}.log`);
+        rotateIfNeeded(logFile, Env.LOG_ROTATION_SIZE);
+        try {
+            fs.appendFileSync(logFile, `${line}\n`);
+        }
+        catch {
+            // best-effort
+            return;
+        }
+        cleanupOldLogs(logsDir, Env.LOG_ROTATION_DAYS);
+    },
+});
+export default FileLogWriter;

package/src/config/SecretsManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.d.ts","sourceRoot":"","sources":["../../../src/config/SecretsManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAID,UAAU,sBAAsB;IAC9B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAuRD;;;GAGG;AACH,eAAO,MAAM,cAAc;IACzB;;OAEG;yBACkB,YAAY,GAAG,sBAAsB;IAY1D;;OAEG;mBACkB,MAAM,YAAY,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAIzE;;OAEG;mBACkB,MAAM,SAAS,MAAM,YAAY,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF;;OAEG;sBACqB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;OAEG;sBACqB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;OAEG;0BACyB,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAItD;;OAEG;qBACc,MAAM,GAAG,IAAI;EAG9B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;EA0BT,CAAC;AAEZ,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAU3E;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAOzD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"SecretsManager.d.ts","sourceRoot":"","sources":["../../../src/config/SecretsManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAID,UAAU,sBAAsB;IAC9B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AA8SD;;;GAGG;AACH,eAAO,MAAM,cAAc;IACzB;;OAEG;yBACkB,YAAY,GAAG,sBAAsB;IAY1D;;OAEG;mBACkB,MAAM,YAAY,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAIzE;;OAEG;mBACkB,MAAM,SAAS,MAAM,YAAY,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF;;OAEG;sBACqB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;OAEG;sBACqB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;OAEG;0BACyB,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAItD;;OAEG;qBACc,MAAM,GAAG,IAAI;EAG9B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;EA0BT,CAAC;AAEZ,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAU3E;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAOzD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/src/config/SecretsManager.js

@@ -6,6 +6,22 @@
 import { Logger } from './logger';
 import { ErrorFactory } from '../exceptions/ZintrustError';
 let instance;
+function pruneCache(cache, maxEntries) {
+    if (cache.size <= maxEntries)
+        return;
+    const now = Date.now();
+    for (const [key, entry] of cache.entries()) {
+        if (entry.expiresAt <= now)
+            cache.delete(key);
+    }
+    // If still large, drop oldest entries (Map preserves insertion order)
+    while (cache.size > maxEntries) {
+        const next = cache.keys().next();
+        if (next.done === true)
+            break;
+        cache.delete(next.value);
+    }
+}
 /**
  * Get secret value from appropriate backend
  */
@@ -15,6 +31,8 @@ async function runGetSecret(config, cache, key, options) {
     if (cached !== undefined && cached.expiresAt > Date.now()) {
         return cached.value;
     }
+    // Opportunistic cleanup if cache has grown
+    pruneCache(cache, 500);
     let value;
     switch (config.platform) {
         case 'aws':
@@ -36,6 +54,7 @@ async function runGetSecret(config, cache, key, options) {
         value,
         expiresAt: Date.now() + ttl,
     });
+    pruneCache(cache, 500);
     return value;
 }
 /**
@@ -109,12 +128,13 @@ const SecretsManagerImpl = {
             /**
              * Rotate secret (trigger new secret generation)
              */
+            // eslint-disable-next-line @typescript-eslint/require-await
             async rotateSecret(_key) {
                 if (config.platform === 'aws') {
                     // AWS Secrets Manager supports automatic rotation
-                    return Promise.reject(ErrorFactory.createConfigError('Secret rotation not implemented'));
+                    throw ErrorFactory.createConfigError('Secret rotation not implemented');
                 }
-                return Promise.reject(ErrorFactory.createConfigError('Secret rotation not supported on this platform'));
+                throw ErrorFactory.createConfigError('Secret rotation not supported on this platform');
             },
             /**
              * Get all secrets matching pattern
@@ -128,7 +148,7 @@ const SecretsManagerImpl = {
                     case 'deno':
                     case 'local':
                     default:
-                        return Promise.resolve([]);
+                        return [];
                 }
             },
             /**
@@ -148,26 +168,30 @@ const SecretsManagerImpl = {
 /**
  * AWS Secrets Manager integration
  */
+// eslint-disable-next-line @typescript-eslint/require-await
 async function getFromAWSSecretsManager(key) {
     try {
         Logger.debug(`[AWS] Getting secret: ${key}`);
         throw ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module');
     }
     catch (error) {
-        return Promise.reject(ErrorFactory.createTryCatchError(`Failed to retrieve secret from AWS: ${error.message}`, error));
+        throw ErrorFactory.createTryCatchError(`Failed to retrieve secret from AWS: ${error.message}`, error);
     }
 }
+// eslint-disable-next-line @typescript-eslint/require-await
 async function setInAWSSecretsManager(key, _value, _options) {
     Logger.info(`[AWS] Setting secret: ${key}`);
-    return Promise.reject(ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module'));
+    throw ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module');
 }
+// eslint-disable-next-line @typescript-eslint/require-await
 async function deleteFromAWSSecretsManager(key) {
     Logger.info(`[AWS] Deleting secret: ${key}`);
-    return Promise.reject(ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module'));
+    throw ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module');
 }
+// eslint-disable-next-line @typescript-eslint/require-await
 async function listFromAWSSecretsManager(pattern) {
     Logger.info(`[AWS] Listing secrets with pattern: ${pattern ?? '*'}`);
-    return Promise.resolve([]);
+    return [];
 }
 /**
  * Cloudflare KV integration
@@ -205,22 +229,24 @@ async function listFromCloudflareKV(config, pattern) {
 /**
  * Deno environment integration
  */
+// eslint-disable-next-line @typescript-eslint/require-await
 async function getFromDenoEnv(key) {
     const value = globalThis['Deno']?.env?.get?.(key);
     if (value === undefined || value === null || value === '') {
-        return Promise.reject(ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key }));
+        throw ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key });
     }
-    return Promise.resolve(value);
+    return value;
 }
 /**
  * Local environment variables (Node.js)
  */
+// eslint-disable-next-line @typescript-eslint/require-await
 async function getFromEnv(key) {
     const value = process.env[key];
     if (value === undefined || value === null || value === '') {
-        return Promise.reject(ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key }));
+        throw ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key });
     }
-    return Promise.resolve(value);
+    return value;
 }
 /**
  * SecretsManager - Unified interface for retrieving secrets

package/src/config/StartupConfigValidator.d.ts

@@ -0,0 +1,15 @@
+export type StartupConfigValidationError = {
+    key: string;
+    value: unknown;
+    message: string;
+};
+export type StartupConfigValidationResult = {
+    valid: boolean;
+    errors: StartupConfigValidationError[];
+};
+export declare const StartupConfigValidator: Readonly<{
+    validate(): StartupConfigValidationResult;
+    assertValid(): void;
+}>;
+export default StartupConfigValidator;
+//# sourceMappingURL=StartupConfigValidator.d.ts.map

package/src/config/StartupConfigValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StartupConfigValidator.d.ts","sourceRoot":"","sources":["../../../src/config/StartupConfigValidator.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC,CAAC;AAwFF,eAAO,MAAM,sBAAsB;gBACrB,6BAA6B;mBAuC1B,IAAI;EAQnB,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/src/config/StartupConfigValidator.js

@@ -0,0 +1,86 @@
+import { appConfig } from './app';
+import { ErrorFactory } from '../exceptions/ZintrustError';
+const isSensitiveKey = (key) => {
+    const normalized = key.toLowerCase();
+    return (normalized.includes('password') ||
+        normalized.includes('secret') ||
+        normalized.includes('token') ||
+        normalized.includes('key') ||
+        normalized.includes('authorization'));
+};
+const redactValue = (key, value) => {
+    return isSensitiveKey(key) ? '<redacted>' : value;
+};
+const pushError = (errors, key, value, message) => {
+    errors.push({ key, value: redactValue(key, value), message });
+};
+const validateEnum = (errors, key, value, allowed) => {
+    if (!allowed.includes(value)) {
+        pushError(errors, key, value, `${key} must be one of: ${allowed.join(', ')}`);
+    }
+};
+const validateIntRange = (errors, key, value, min, max) => {
+    if (Number.isNaN(value)) {
+        pushError(errors, key, value, `${key} must be a valid integer`);
+        return;
+    }
+    if (value < min || value > max) {
+        pushError(errors, key, value, `${key} must be between ${min} and ${max}`);
+    }
+};
+const validatePositiveInt = (errors, key, value) => {
+    if (Number.isNaN(value)) {
+        pushError(errors, key, value, `${key} must be a valid integer`);
+        return;
+    }
+    if (value <= 0) {
+        pushError(errors, key, value, `${key} must be greater than 0`);
+    }
+};
+const getProcessLike = () => {
+    return typeof process === 'undefined' ? undefined : process;
+};
+const getEnvString = (key, defaultValue) => {
+    const proc = getProcessLike();
+    const env = proc?.env ?? {};
+    return env[key] ?? defaultValue;
+};
+const getEnvInt = (key, defaultValue) => {
+    const raw = getEnvString(key, String(defaultValue));
+    return Number.parseInt(raw, 10);
+};
+export const StartupConfigValidator = Object.freeze({
+    validate() {
+        const errors = [];
+        const nodeEnv = getEnvString('NODE_ENV', 'development');
+        validateEnum(errors, 'NODE_ENV', nodeEnv, ['development', 'production', 'testing', 'test']);
+        const appPort = getEnvInt('APP_PORT', 3000);
+        validateIntRange(errors, 'APP_PORT', appPort, 1, 65535);
+        const logFormat = getEnvString('LOG_FORMAT', 'text');
+        validateEnum(errors, 'LOG_FORMAT', logFormat, ['text', 'json']);
+        const logLevel = getEnvString('LOG_LEVEL', 'debug');
+        validateEnum(errors, 'LOG_LEVEL', logLevel, ['debug', 'info', 'warn', 'error']);
+        const logRotationSize = getEnvInt('LOG_ROTATION_SIZE', 10485760);
+        validatePositiveInt(errors, 'LOG_ROTATION_SIZE', logRotationSize);
+        const logRotationDays = getEnvInt('LOG_ROTATION_DAYS', 7);
+        validatePositiveInt(errors, 'LOG_ROTATION_DAYS', logRotationDays);
+        const startupHealthTimeoutMs = getEnvInt('STARTUP_HEALTH_TIMEOUT_MS', 2500);
+        validatePositiveInt(errors, 'STARTUP_HEALTH_TIMEOUT_MS', startupHealthTimeoutMs);
+        if (appConfig.isProduction()) {
+            const appKey = getEnvString('APP_KEY', '');
+            if (appKey.trim().length < 16) {
+                pushError(errors, 'APP_KEY', appKey, 'APP_KEY must be set and at least 16 characters in production');
+            }
+        }
+        return { valid: errors.length === 0, errors };
+    },
+    assertValid() {
+        const result = StartupConfigValidator.validate();
+        if (result.valid)
+            return;
+        throw ErrorFactory.createConfigError('Invalid startup configuration', {
+            errors: result.errors,
+        });
+    },
+});
+export default StartupConfigValidator;

package/src/config/app.d.ts

@@ -3,6 +3,7 @@
  * Core application settings
  * Sealed namespace for immutability
  */
+type StartMode = 'development' | 'production' | 'testing';
 declare const getSafeEnv: () => NodeJS.ProcessEnv;
 export declare const appConfig: Readonly<{
     /**
@@ -12,7 +13,7 @@ export declare const appConfig: Readonly<{
     /**
      * Application environment
      */
-    readonly environment: "development" | "production" | "testing";
+    readonly environment: StartMode;
     /**
      * Application port
      */

package/src/config/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/config/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,QAAA,MAAM,UAAU,QAAO,MAAM,CAAC,UAkB7B,CAAC;AAmEF,eAAO,MAAM,SAAS;IAhEpB;;OAEG;;IAGH;;OAEG;0BAC0B,aAAa,GAAG,YAAY,GAAG,SAAS;IAErE;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;kCACc,OAAO;IAIxB;;OAEG;iCACa,OAAO;IAIvB;;OAEG;8BACU,OAAO;IAIpB;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;+BA/EkB,MAAM,CAAC,UAAU;EAqFY,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/config/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,KAAK,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,CAAC;AAsC1D,QAAA,MAAM,UAAU,QAAO,MAAM,CAAC,UAuB7B,CAAC;AA0FF,eAAO,MAAM,SAAS;IA5EpB;;OAEG;;IAMH;;OAEG;;IAGH;;OAEG;;IAMH;;OAEG;;IAMH;;OAEG;kCACc,OAAO;IAIxB;;OAEG;iCACa,OAAO;IAIvB;;OAEG;8BACU,OAAO;IAIpB;;OAEG;;IAMH;;OAEG;;IAGH;;OAEG;;IAGH;;OAEG;;+BA3GkB,MAAM,CAAC,UAAU;EAiHY,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}

package/src/config/app.js

@@ -4,39 +4,87 @@
  * Sealed namespace for immutability
  */
 import { Env } from './env';
+const getProcessLike = () => {
+    return typeof process === 'undefined' ? undefined : process;
+};
+const readEnvString = (key, defaultValue = '') => {
+    const anyEnv = Env;
+    if (typeof anyEnv.get === 'function') {
+        return anyEnv.get(key, defaultValue);
+    }
+    const proc = getProcessLike();
+    const raw = proc?.env?.[key];
+    return raw ?? defaultValue;
+};
+const readEnvInt = (key, defaultValue) => {
+    const anyEnv = Env;
+    if (typeof anyEnv.getInt === 'function') {
+        return anyEnv.getInt(key, defaultValue);
+    }
+    const raw = readEnvString(key, String(defaultValue));
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isNaN(parsed) ? defaultValue : parsed;
+};
+const readEnvBool = (key, defaultValue) => {
+    const anyEnv = Env;
+    if (typeof anyEnv.getBool === 'function') {
+        return anyEnv.getBool(key, defaultValue);
+    }
+    const raw = readEnvString(key, defaultValue ? 'true' : 'false');
+    return raw.toLowerCase() === 'true' || raw === '1';
+};
 const getSafeEnv = () => {
     const baseEnv = typeof process === 'undefined' ? {} : process.env;
     return {
         ...baseEnv,
         // Ensure required keys exist (env.d.ts augments ProcessEnv with required fields)
-        NODE_ENV: baseEnv.NODE_ENV ?? Env.NODE_ENV,
-        USE_RAW_QRY: baseEnv.USE_RAW_QRY ?? (Env.get('USE_RAW_QRY') || undefined),
-        SERVICE_API_KEY: baseEnv.SERVICE_API_KEY ?? Env.get('SERVICE_API_KEY', ''),
-        SERVICE_JWT_SECRET: baseEnv.SERVICE_JWT_SECRET ?? Env.get('SERVICE_JWT_SECRET', ''),
-        BASE_URL: baseEnv.BASE_URL ?? Env.get('BASE_URL', ''),
-        MODE: baseEnv.MODE ?? Env.get('MODE', ''),
+        NODE_ENV: baseEnv.NODE_ENV ??
+            readEnvString('NODE_ENV', 'development'),
+        USE_RAW_QRY: baseEnv.USE_RAW_QRY ?? (readEnvString('USE_RAW_QRY', '') || undefined),
+        SERVICE_API_KEY: baseEnv.SERVICE_API_KEY ?? readEnvString('SERVICE_API_KEY', ''),
+        SERVICE_JWT_SECRET: baseEnv.SERVICE_JWT_SECRET ?? readEnvString('SERVICE_JWT_SECRET', ''),
+        BASE_URL: baseEnv['BASE_URL'] ?? readEnvString('BASE_URL', ''),
+        MODE: baseEnv['MODE'] ?? readEnvString('MODE', ''),
         // Hardening for child-process usage
-        PATH: Env.SAFE_PATH,
+        PATH: typeof Env.SAFE_PATH === 'string'
+            ? Env.SAFE_PATH
+            : (baseEnv['PATH'] ?? ''),
         npm_config_scripts_prepend_node_path: 'true',
     };
 };
+const normalizeMode = () => {
+    const value = (typeof Env.NODE_ENV === 'string'
+        ? Env.NODE_ENV
+        : readEnvString('NODE_ENV', 'development'));
+    if (value === 'production' || value === 'pro' || value === 'prod')
+        return 'production';
+    if (value === 'testing' || value === 'test')
+        return 'testing';
+    return 'development';
+};
 const appConfigObj = {
     /**
      * Application name
      */
-    name: Env.APP_NAME,
+    name: typeof Env.APP_NAME === 'string'
+        ? Env.APP_NAME
+        : readEnvString('APP_NAME', 'ZinTrust'),
     /**
      * Application environment
      */
-    environment: Env.NODE_ENV,
+    environment: normalizeMode(),
     /**
      * Application port
      */
-    port: Env.PORT,
+    port: typeof Env.PORT === 'number'
+        ? Env.PORT
+        : readEnvInt('APP_PORT', 3000),
     /**
      * Application host
      */
-    host: Env.HOST,
+    host: typeof Env.HOST === 'string'
+        ? Env.HOST
+        : readEnvString('HOST', 'localhost'),
     /**
      * Is development environment
      */
@@ -58,19 +106,21 @@ const appConfigObj = {
     /**
      * Application debug mode
      */
-    debug: Env.DEBUG,
+    debug: typeof Env.DEBUG === 'boolean'
+        ? Env.DEBUG
+        : readEnvBool('DEBUG', false),
     /**
      * Application timezone
      */
-    timezone: Env.get('APP_TIMEZONE', 'UTC'),
+    timezone: readEnvString('APP_TIMEZONE', 'UTC'),
     /**
      * Request timeout (milliseconds)
      */
-    requestTimeout: Env.getInt('REQUEST_TIMEOUT', 30000),
+    requestTimeout: readEnvInt('REQUEST_TIMEOUT', 30000),
     /**
      * Max request body size
      */
-    maxBodySize: Env.get('MAX_BODY_SIZE', '10mb'),
+    maxBodySize: readEnvString('MAX_BODY_SIZE', '10mb'),
     getSafeEnv,
 };
 export const appConfig = Object.freeze(appConfigObj);

package/src/config/broadcast.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Broadcast Configuration
+ *
+ * Centralizes broadcast driver selection and provider env mappings.
+ * Driver selection must be dynamic (tests may mutate process.env).
+ */
+export type KnownBroadcastDriverName = 'inmemory' | 'pusher' | 'redis' | 'redishttps';
+export type InMemoryBroadcastDriverConfig = {
+    driver: 'inmemory';
+};
+export type PusherBroadcastDriverConfig = {
+    driver: 'pusher';
+    appId: string;
+    key: string;
+    secret: string;
+    cluster: string;
+    useTLS: boolean;
+};
+export type RedisBroadcastDriverConfig = {
+    driver: 'redis';
+    host: string;
+    port: number;
+    password: string;
+    channelPrefix: string;
+};
+export type RedisHttpsBroadcastDriverConfig = {
+    driver: 'redishttps';
+    endpoint: string;
+    token: string;
+    channelPrefix: string;
+};
+export type KnownBroadcastDriverConfig = InMemoryBroadcastDriverConfig | PusherBroadcastDriverConfig | RedisBroadcastDriverConfig | RedisHttpsBroadcastDriverConfig;
+declare const _default: Readonly<{
+    /**
+     * Normalized broadcast driver name.
+     *
+     * NOTE: Allows custom driver names (project-specific drivers), so returns string.
+     */
+    readonly getDriverName: () => string;
+    /**
+     * Get a config object for the currently selected driver.
+     * Defaults to inmemory for unknown/unsupported names.
+     */
+    readonly getDriverConfig: () => KnownBroadcastDriverConfig;
+}>;
+export default _default;
+//# sourceMappingURL=broadcast.d.ts.map

package/src/config/broadcast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broadcast.d.ts","sourceRoot":"","sources":["../../../src/config/broadcast.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,YAAY,CAAC;AAEtF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAClC,6BAA6B,GAC7B,2BAA2B,GAC3B,0BAA0B,GAC1B,+BAA+B,CAAC;;IA6BlC;;;;OAIG;kCACc,MAAM;IAIvB;;;OAGG;oCACgB,0BAA0B;;AAW/C,wBAAiD"}