@zintrust/core 0.1.18 → 0.1.20

package/src/scripts/TemplateImportsCheck.js

@@ -1,8 +1,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import ts from 'typescript';
 const TEMPLATES_ROOT = path.resolve(process.cwd(), 'src/templates');
 const bannedPrefixes = [
-    '@config/',
     '@exceptions/',
     '@orm/',
     '@routing/',
@@ -19,10 +19,10 @@ const bannedPrefixes = [
     '@mail/',
     '@storage/',
     '@node-singletons/',
-    '@app/',
-    '@routes/',
     '@common/',
     '@/',
+    './',
+    '../',
 ];
 function listFilesRecursive(root) {
     const out = [];
@@ -47,12 +47,13 @@ function checkFile(filePath) {
     const offenses = [];
     const addIfBanned = (lineNo, spec, lineText) => {
         const trimmed = spec.trim();
-        if (trimmed === '@zintrust/core' || trimmed === '@zintrust/core/node')
+        if (trimmed === '@zintrust/core' ||
+            trimmed === '@zintrust/core/node' ||
+            trimmed === '@zintrust/core/start') {
             return;
+        }
         if (trimmed.startsWith('node:'))
             return;
-        if (trimmed.startsWith('./') || trimmed.startsWith('../'))
-            return;
         for (const prefix of bannedPrefixes) {
             if (trimmed.startsWith(prefix)) {
                 offenses.push({ line: lineNo, spec: trimmed, text: lineText });
@@ -79,6 +80,29 @@ function checkFile(filePath) {
     }
     return offenses;
 }
+function looksLikeTypeScriptTemplate(text) {
+    // Only attempt TS parsing when the template appears to contain TS module syntax.
+    // Many templates are not TS (markdown/env/etc.) and should not be validated this way.
+    return /\b(import|export)\b/.test(text);
+}
+function getTypeScriptSyntaxErrors(filePath) {
+    const text = fs.readFileSync(filePath, 'utf8');
+    if (!looksLikeTypeScriptTemplate(text))
+        return [];
+    const sourceFile = ts.createSourceFile(filePath, text, ts.ScriptTarget.ESNext, true, ts.ScriptKind.TS);
+    const diagnostics = sourceFile
+        .parseDiagnostics;
+    if (!diagnostics || diagnostics.length === 0)
+        return [];
+    const out = [];
+    for (const d of diagnostics) {
+        const message = ts.flattenDiagnosticMessageText(d.messageText, '\n');
+        const pos = typeof d.start === 'number' ? d.start : 0;
+        const { line } = sourceFile.getLineAndCharacterOfPosition(pos);
+        out.push({ line: line + 1, message });
+    }
+    return out;
+}
 function main() {
     if (!fs.existsSync(TEMPLATES_ROOT)) {
         process.stderr.write(`Templates root not found: ${TEMPLATES_ROOT}\n`);
@@ -86,6 +110,7 @@ function main() {
     }
     const files = listFilesRecursive(TEMPLATES_ROOT).filter(isTemplateFile);
     const allOffenses = [];
+    const allSyntaxErrors = [];
     for (const file of files) {
         const offenses = checkFile(file);
         for (const o of offenses) {
@@ -96,6 +121,21 @@ function main() {
                 text: o.text,
             });
         }
+        const syntaxErrors = getTypeScriptSyntaxErrors(file);
+        for (const e of syntaxErrors) {
+            allSyntaxErrors.push({
+                file: path.relative(process.cwd(), file),
+                line: e.line,
+                message: e.message,
+            });
+        }
+    }
+    if (allSyntaxErrors.length > 0) {
+        process.stderr.write('Template syntax check failed. TypeScript parse errors found:\n');
+        for (const e of allSyntaxErrors) {
+            process.stderr.write(`- ${e.file}:${e.line} -> ${e.message}\n`);
+        }
+        process.exit(1);
     }
     if (allOffenses.length > 0) {
         process.stderr.write('Template import check failed. Disallowed import specifiers found:\n');
@@ -103,7 +143,7 @@ function main() {
             process.stderr.write(`- ${o.file}:${o.line} -> ${o.spec}\n`);
             process.stderr.write(`  ${o.text.trim()}\n`);
         }
-        process.stderr.write("\nAllowed: '@zintrust/core', '@zintrust/core/node', 'node:*', and relative imports (./, ../).\n");
+        process.stderr.write("\nAllowed: '@zintrust/core', '@zintrust/core/node', '@zintrust/core/start', 'node:*'\n");
         process.exit(1);
     }
     process.stdout.write(`✓ Template import check passed (${files.length} templates)\n`);

package/src/scripts/TemplateSync.js

@@ -126,11 +126,31 @@ const rewriteStarterTemplateImports = (relPath, content) => {
     // Starter templates should import framework APIs from the public package surface,
     // not from internal path-alias modules that only exist in the framework repo.
     return (content
+        // Some templates are extracted from internal sources that use repo-relative imports.
+        // Normalize those to the public package surface.
+        .replaceAll("'../../../features'", "'@zintrust/core'")
+        .replaceAll('"../../../features"', '"@zintrust/core"')
+        .replaceAll("'../../../logger'", "'@zintrust/core'")
+        .replaceAll('"../../../logger"', '"@zintrust/core"')
+        .replaceAll("'../../logger'", "'@zintrust/core'")
+        .replaceAll('"../../logger"', '"@zintrust/core"')
+        .replaceAll("'../logger'", "'@zintrust/core'")
+        .replaceAll('"../logger"', '"@zintrust/core"')
+        .replaceAll("'@common/uuid'", "'@zintrust/core'")
+        .replaceAll('"@common/uuid"', '"@zintrust/core"')
+        // Starter templates should not rely on local config/env wrappers.
+        // Normalize Env imports to come from the public package surface.
+        .replaceAll("from '../env';", "from '@zintrust/core';")
+        .replaceAll('from "../env";', 'from "@zintrust/core";')
+        .replaceAll("from './env';", "from '@zintrust/core';")
+        .replaceAll('from "./env";', 'from "@zintrust/core";')
         // Node-singletons are internal to this repo; starter templates should use Node built-ins.
         .replaceAll("'@node-singletons/fs'", "'node:fs'")
         .replaceAll('"@node-singletons/fs"', '"node:fs"')
         .replaceAll("'@node-singletons/path'", "'node:path'")
         .replaceAll('"@node-singletons/path"', '"node:path"')
+        .replaceAll("'@node-singletons/perf-hooks'", "'node:perf_hooks'")
+        .replaceAll('"@node-singletons/perf-hooks"', '"node:perf_hooks"')
         // Starter project config/* should reference sibling config modules via relative imports.
         .replaceAll(/(['"])@config\/([^'"]+)\1/g, (_m, quote, suffix) => {
         const rewritten = rewriteConfigAlias(suffix);
@@ -156,9 +176,51 @@ const rewriteStarterTemplateImports = (relPath, content) => {
         .replaceAll('"@common/index"', '"@zintrust/core"')
         .replaceAll('"@httpClient/Http"', '"@zintrust/core"'));
 };
+const rewriteRegistryTemplateImports = (relPath, content) => {
+    if (!relPath.endsWith('.ts') && !relPath.endsWith('.tsx') && !relPath.endsWith('.mts')) {
+        return content;
+    }
+    // Registry templates (adapters/features) must only import from the public package surface.
+    // Unlike starter project templates, they should NEVER rewrite `@config/*` into relative imports.
+    return (content
+        // Normalize internal aliases to public API
+        .replaceAll("'@config/logger'", "'@zintrust/core'")
+        .replaceAll('"@config/logger"', '"@zintrust/core"')
+        .replaceAll("'@config/features'", "'@zintrust/core'")
+        .replaceAll('"@config/features"', '"@zintrust/core"')
+        .replaceAll("'@exceptions/ZintrustError'", "'@zintrust/core'")
+        .replaceAll('"@exceptions/ZintrustError"', '"@zintrust/core"')
+        .replaceAll("'@orm/DatabaseAdapter'", "'@zintrust/core'")
+        .replaceAll('"@orm/DatabaseAdapter"', '"@zintrust/core"')
+        .replaceAll("'@orm/QueryBuilder'", "'@zintrust/core'")
+        .replaceAll('"@orm/QueryBuilder"', '"@zintrust/core"')
+        .replaceAll("'@orm/Database'", "'@zintrust/core'")
+        .replaceAll('"@orm/Database"', '"@zintrust/core"')
+        .replaceAll("'@common/uuid'", "'@zintrust/core'")
+        .replaceAll('"@common/uuid"', '"@zintrust/core"')
+        .replaceAll("'@common/index'", "'@zintrust/core'")
+        .replaceAll('"@common/index"', '"@zintrust/core"')
+        // Node-singletons are internal to this repo; templates should use Node built-ins.
+        .replaceAll("'@node-singletons/fs'", "'node:fs'")
+        .replaceAll('"@node-singletons/fs"', '"node:fs"')
+        .replaceAll("'@node-singletons/path'", "'node:path'")
+        .replaceAll('"@node-singletons/path"', '"node:path"')
+        .replaceAll("'@node-singletons/perf-hooks'", "'node:perf_hooks'")
+        .replaceAll('"@node-singletons/perf-hooks"', '"node:perf_hooks"')
+        // Defensive: if old templates already contain repo-relative imports, normalize them.
+        .replaceAll("'../../../features'", "'@zintrust/core'")
+        .replaceAll('"../../../features"', '"@zintrust/core"')
+        .replaceAll("'../../../logger'", "'@zintrust/core'")
+        .replaceAll('"../../../logger"', '"@zintrust/core"')
+        .replaceAll("'../../logger'", "'@zintrust/core'")
+        .replaceAll('"../../logger"', '"@zintrust/core"')
+        .replaceAll("'../logger'", "'@zintrust/core'")
+        .replaceAll('"../logger"', '"@zintrust/core"'));
+};
 const syncRegistryMappings = (params) => {
     let updated = 0;
     let skipped = 0;
+    const checksumSalt = 'registry-imports-v3';
     for (const mapping of params.mappings) {
         const basePath = path.join(ROOT_DIR, mapping.basePath);
         const templatePath = path.join(ROOT_DIR, mapping.templatePath);
@@ -167,17 +229,19 @@ const syncRegistryMappings = (params) => {
             continue;
         }
         const currentHash = hashFile(basePath);
-        const storedHash = params.checksums[mapping.basePath];
+        const checksumKey = `${mapping.basePath}|${checksumSalt}`;
+        const storedHash = params.checksums[checksumKey];
         if (currentHash === storedHash && fs.existsSync(templatePath)) {
             Logger.info(`✓ ${mapping.description} (in sync)`);
             skipped++;
             continue;
         }
         try {
-            const templateContent = extractTemplateContent(basePath);
+            const rawTemplateContent = extractTemplateContent(basePath);
+            const templateContent = rewriteRegistryTemplateImports(mapping.basePath, rawTemplateContent);
             ensureDir(path.dirname(templatePath));
             fs.writeFileSync(templatePath, templateContent, 'utf8');
-            params.checksums[mapping.basePath] = currentHash;
+            params.checksums[checksumKey] = currentHash;
             Logger.info(`✓ Updated: ${mapping.description}`);
             updated++;
         }
@@ -233,14 +297,10 @@ const syncStarterProjectTemplates = (params) => {
         templateDirRel: `${params.projectRoot}/app`,
         description: 'Starter project app/*',
     });
-    const s2 = syncProjectTemplateDir({
-        checksums: params.checksums,
-        baseDirRel: 'src/config',
-        templateDirRel: `${params.projectRoot}/config`,
-        description: 'Starter project config/* (from src/config/*)',
-        transformContent: rewriteStarterTemplateImports,
-        checksumSalt: 'starter-imports-v4',
-    });
+    // NOTE:
+    // `src/templates/project/basic/config/*` is intentionally hand-authored.
+    // It must stay declarative (core owns runtime/env logic), and should never be
+    // auto-generated from `src/config/*` (which would overwrite project-level overrides).
     const s3 = syncProjectTemplateDir({
         checksums: params.checksums,
         baseDirRel: 'src/database',
@@ -262,9 +322,9 @@ const syncStarterProjectTemplates = (params) => {
         projectRoot: params.projectRoot,
     });
     return {
-        updated: s1.updated + s2.updated + s3.updated + s4.updated + s5.updated,
-        skipped: s1.skipped + s2.skipped + s3.skipped + s4.skipped + s5.skipped,
-        total: s1.total + s2.total + s3.total + s4.total + s5.total,
+        updated: s1.updated + s3.updated + s4.updated + s5.updated,
+        skipped: s1.skipped + s3.skipped + s4.skipped + s5.skipped,
+        total: s1.total + s3.total + s4.total + s5.total,
     };
 };
 /**
@@ -297,16 +357,28 @@ function saveChecksums(checksums) {
 // eslint-disable-next-line @typescript-eslint/require-await
 async function syncTemplates() {
     Logger.info('🔄 Syncing templates...\n');
+    const args = new Set(process.argv.slice(2));
+    const shouldSyncStarterTemplates = args.has('--dangerously-sync-starter-templates');
     const checksums = loadChecksums();
     const mappings = TemplateRegistry.getMappings();
     const registry = syncRegistryMappings({ checksums, mappings });
+    let starter = {
+        updated: 0,
+        skipped: 0,
+        total: 0,
+    };
     // Sync starter project templates (basic) from base framework folders.
-    // Spec: app/* -> app/*, src/config/* -> config/*, src/database/* -> database/*, routes/* -> routes/*
-    // plus .env (generated from .env.example with sensitive values blanked).
-    Logger.info('');
-    Logger.info('🔄 Syncing starter project templates (basic)...');
-    const projectRoot = 'src/templates/project/basic';
-    const starter = syncStarterProjectTemplates({ checksums, projectRoot });
+    // This is intentionally opt-in to avoid overwriting hand-authored starter templates.
+    if (shouldSyncStarterTemplates) {
+        Logger.info('');
+        Logger.info('🔄 Syncing starter project templates (basic)...');
+        const projectRoot = 'src/templates/project/basic';
+        starter = syncStarterProjectTemplates({ checksums, projectRoot });
+    }
+    else {
+        Logger.info('');
+        Logger.info('⏭️  Skipping starter project template sync (pass --dangerously-sync-starter-templates to enable)');
+    }
     // Save updated checksums
     saveChecksums(checksums);
     // Summary

package/src/security/Encryptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Encryptor.d.ts","sourceRoot":"","sources":["../../../src/security/Encryptor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AA2HhD,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,YAAY,IAAI,aAAa,CAAC;CAC/B;AAuCD,eAAO,MAAM,SAAS,EAAE,UAItB,CAAC"}
+{"version":3,"file":"Encryptor.d.ts","sourceRoot":"","sources":["../../../src/security/Encryptor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAsMhD,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,YAAY,IAAI,aAAa,CAAC;CAC/B;AAuCD,eAAO,MAAM,SAAS,EAAE,UAItB,CAAC"}

package/src/security/Encryptor.js

@@ -4,7 +4,8 @@
  */
 import { Logger } from '../config/logger.js';
 import { ErrorFactory } from '../exceptions/ZintrustError.js';
-import { pbkdf2Sync, randomBytes } from '../node-singletons/crypto.js';
+import * as crypto from '../node-singletons/crypto.js';
+import { promisify } from '../node-singletons/util.js';
 function isBcryptModule(value) {
     if (typeof value !== 'object' || value === null)
         return false;
@@ -56,19 +57,47 @@ function timingSafeEquals(a, b) {
 /**
  * Hash with PBKDF2 (default)
  */
-function hashPbkdf2(password) {
+async function hashPbkdf2(password) {
     const iterations = 600000; // OWASP recommended for SHA-256
-    const salt = randomBytes(32).toString('hex');
+    const salt = crypto.randomBytes(32).toString('hex');
     const keyLength = 64;
     const digest = 'sha256';
-    const hash = pbkdf2Sync(password, salt, iterations, keyLength, digest).toString('hex');
+    const pbkdf2Fn = (() => {
+        try {
+            const maybe = crypto.pbkdf2;
+            return typeof maybe === 'function' ? maybe : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const pbkdf2SyncFn = (() => {
+        try {
+            const maybe = crypto.pbkdf2Sync;
+            return typeof maybe === 'function' ? maybe : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    let hashHex = '';
+    if (pbkdf2Fn) {
+        const pbkdf2Async = promisify(pbkdf2Fn);
+        hashHex = (await pbkdf2Async(password, salt, iterations, keyLength, digest)).toString('hex');
+    }
+    else if (pbkdf2SyncFn) {
+        hashHex = pbkdf2SyncFn(password, salt, iterations, keyLength, digest).toString('hex');
+    }
+    else {
+        throw ErrorFactory.createSecurityError('PBKDF2 is not available in this runtime');
+    }
     // Format: algorithm$iterations$salt$hash
-    return `pbkdf2$${iterations}$${salt}$${hash}`;
+    return `pbkdf2$${iterations}$${salt}$${hashHex}`;
 }
 /**
  * Verify PBKDF2 hash
  */
-function verifyPbkdf2(password, passwordHash) {
+async function verifyPbkdf2(password, passwordHash) {
     const parts = passwordHash.split('$');
     const iterationsStr = parts[1];
     const salt = parts[2];
@@ -80,7 +109,35 @@ function verifyPbkdf2(password, passwordHash) {
         const iterations = Number.parseInt(iterationsStr, 10);
         const keyLength = 64;
         const digest = 'sha256';
-        const computed = pbkdf2Sync(password, salt, iterations, keyLength, digest).toString('hex');
+        const pbkdf2Fn = (() => {
+            try {
+                const maybe = crypto.pbkdf2;
+                return typeof maybe === 'function' ? maybe : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        const pbkdf2SyncFn = (() => {
+            try {
+                const maybe = crypto.pbkdf2Sync;
+                return typeof maybe === 'function' ? maybe : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        let computed = '';
+        if (pbkdf2Fn) {
+            const pbkdf2Async = promisify(pbkdf2Fn);
+            computed = (await pbkdf2Async(password, salt, iterations, keyLength, digest)).toString('hex');
+        }
+        else if (pbkdf2SyncFn) {
+            computed = pbkdf2SyncFn(password, salt, iterations, keyLength, digest).toString('hex');
+        }
+        else {
+            throw ErrorFactory.createSecurityError('PBKDF2 is not available in this runtime');
+        }
         return timingSafeEquals(computed, storedHash);
     }
     catch (error) {

package/src/security/JwtManager.d.ts

@@ -33,6 +33,7 @@ export interface IJwtManager {
 }
 export interface JwtManagerType {
     create(): IJwtManager;
+    signAccessToken: (payload: JwtPayload, expiresIn?: number) => string;
 }
 /**
  * JwtManager namespace - sealed for immutability

package/src/security/JwtManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JwtManager.d.ts","sourceRoot":"","sources":["../../../src/security/JwtManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,aAAa,IAAI,MAAM,CAAC;CACzB;AAQD,MAAM,WAAW,cAAc;IAC7B,MAAM,IAAI,WAAW,CAAC;CACvB;AAsCD;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,cAEvB,CAAC"}
+{"version":3,"file":"JwtManager.d.ts","sourceRoot":"","sources":["../../../src/security/JwtManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,aAAa,IAAI,MAAM,CAAC;CACzB;AAQD,MAAM,WAAW,cAAc;IAC7B,MAAM,IAAI,WAAW,CAAC;IACtB,eAAe,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CACtE;AA6ED;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,cAGvB,CAAC"}

package/src/security/JwtManager.js

@@ -3,8 +3,40 @@
  * JSON Web Token generation, verification, and claims management
  * Uses native Node.js crypto module (zero external dependencies)
  */
+import { securityConfig } from '../config/index.js';
 import { ErrorFactory } from '../exceptions/ZintrustError.js';
 import { createHmac, createSign, createVerify, randomBytes } from '../node-singletons/crypto.js';
+const createJwt = () => {
+    const algorithm = securityConfig.jwt.algorithm;
+    const secret = securityConfig.jwt.secret;
+    const jwt = JwtManager.create();
+    if (algorithm === 'HS256' || algorithm === 'HS512') {
+        jwt.setHmacSecret(secret);
+    }
+    return jwt;
+};
+const signAccessToken = (payload, expiresIn) => {
+    const algorithm = securityConfig.jwt.algorithm;
+    const jwt = createJwt();
+    // JwtManager currently supports HMAC secrets directly for HS algorithms.
+    // For other algorithms, verify will still reject mismatched tokens.
+    if (algorithm !== 'HS256' && algorithm !== 'HS512') {
+        return jwt.sign(payload, {
+            algorithm,
+            issuer: securityConfig.jwt.issuer,
+            audience: securityConfig.jwt.audience,
+            jwtId: jwt.generateJwtId(),
+        });
+    }
+    return jwt.sign(payload, {
+        algorithm,
+        expiresIn: expiresIn ?? securityConfig.jwt.expiresIn,
+        issuer: securityConfig.jwt.issuer,
+        audience: securityConfig.jwt.audience,
+        subject: typeof payload.sub === 'string' ? payload.sub : undefined,
+        jwtId: jwt.generateJwtId(),
+    });
+};
 /**
  * Create a new JWT manager instance
  */
@@ -44,6 +76,7 @@ const create = () => {
  */
 export const JwtManager = Object.freeze({
     create,
+    signAccessToken,
 });
 /**
  * Sign JWT token

package/src/security/Sanitizer.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Input Sanitizer (Character Whitelisting)
+ *
+ * Provides small utilities to remove unwanted characters from user input.
+ *
+ * Important:
+ * - This is NOT a complete SQL injection defense.
+ * - Always use parameterized queries / the ORM / QueryBuilder.
+ *
+ * Use this for:
+ * - Normalizing identifiers (username, slug-ish strings)
+ * - Cleaning phone numbers / numeric strings
+ * - Reducing unexpected characters before storage/logging
+ *
+ * Bulletproof Mode:
+ * - Enabled by default (`bulletproof=true`) for security-critical methods
+ * - Throws SanitizerError instead of returning empty/invalid values
+ * - Validates numeric ranges, leading zeros, type coercion attacks
+ * - ~5-15% performance overhead; disable for performance-critical paths
+ */
+export type SanitizerType = Readonly<{
+    parseAmount: (value: unknown, bulletproof?: boolean) => number;
+    alphanumeric: (value: unknown) => string;
+    alphanumericDotDash: (value: unknown) => string;
+    /** Returns `null` when value isn't numeric; returns `0` for empty / negative numbers. */
+    nonNegativeNumericStringOrNull: (value: unknown, bulletproof?: boolean) => number | null | string;
+    addressText: (value: unknown) => string;
+    emailLike: (value: unknown) => string;
+    email: (value: unknown, bulletproof?: boolean) => string;
+    messageText: (value: unknown) => string;
+    numericDotOnly: (value: unknown) => string;
+    ipAddressText: (value: unknown) => string;
+    nameText: (value: unknown, bulletproof?: boolean) => string;
+    alphaNumericColonDash: (value: unknown) => string;
+    digitsOnly: (value: unknown, bulletproof?: boolean) => string;
+    decimalString: (value: unknown, bulletproof?: boolean) => string;
+    dateSlash: (value: unknown) => string;
+    safePasswordChars: (value: unknown, bulletproof?: boolean) => string;
+    wordCharsAndSpaces: (value: unknown) => string;
+    lowercaseAlphanumeric: (value: unknown) => string;
+    uppercaseAlphanumeric: (value: unknown) => string;
+    alphanumericNoSpaces: (value: unknown) => string;
+    dateSlashNoSpaces: (value: unknown) => string;
+    uuidTokenSafe: (value: unknown) => string;
+    tokenSafe: (value: unknown) => string;
+    keyLike: (value: unknown) => string;
+}>;
+export declare const createSanitizer: () => SanitizerType;
+export declare const Sanitizer: Readonly<{
+    parseAmount: (value: unknown, bulletproof?: boolean) => number;
+    alphanumeric: (value: unknown) => string;
+    alphanumericDotDash: (value: unknown) => string;
+    /** Returns `null` when value isn't numeric; returns `0` for empty / negative numbers. */
+    nonNegativeNumericStringOrNull: (value: unknown, bulletproof?: boolean) => number | null | string;
+    addressText: (value: unknown) => string;
+    emailLike: (value: unknown) => string;
+    email: (value: unknown, bulletproof?: boolean) => string;
+    messageText: (value: unknown) => string;
+    numericDotOnly: (value: unknown) => string;
+    ipAddressText: (value: unknown) => string;
+    nameText: (value: unknown, bulletproof?: boolean) => string;
+    alphaNumericColonDash: (value: unknown) => string;
+    digitsOnly: (value: unknown, bulletproof?: boolean) => string;
+    decimalString: (value: unknown, bulletproof?: boolean) => string;
+    dateSlash: (value: unknown) => string;
+    safePasswordChars: (value: unknown, bulletproof?: boolean) => string;
+    wordCharsAndSpaces: (value: unknown) => string;
+    lowercaseAlphanumeric: (value: unknown) => string;
+    uppercaseAlphanumeric: (value: unknown) => string;
+    alphanumericNoSpaces: (value: unknown) => string;
+    dateSlashNoSpaces: (value: unknown) => string;
+    uuidTokenSafe: (value: unknown) => string;
+    tokenSafe: (value: unknown) => string;
+    keyLike: (value: unknown) => string;
+}>;
+//# sourceMappingURL=Sanitizer.d.ts.map

package/src/security/Sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sanitizer.d.ts","sourceRoot":"","sources":["../../../src/security/Sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA8CH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC/D,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACzC,mBAAmB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAEhD,yFAAyF;IACzF,8BAA8B,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;IAElG,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAExC,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAE1C,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5D,qBAAqB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAElD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAEjE,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAEtC,iBAAiB,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACrE,kBAAkB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAE/C,qBAAqB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAElD,oBAAoB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAE9C,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAEtC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CACrC,CAAC,CAAC;AAufH,eAAO,MAAM,eAAe,QAAO,aAMlC,CAAC;AAEF,eAAO,MAAM,SAAS;iBAniBP,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM;kBAChD,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;yBACnB,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;IAE/C,yFAAyF;oCACzD,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM;iBAEpF,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;eAC5B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;WAC9B,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM;iBAC3C,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;oBAEvB,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;mBAC3B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;cAE/B,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM;2BACpC,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;gBAErC,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM;mBAC9C,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM;eAErD,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;uBAElB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,KAAK,MAAM;wBAChD,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;2BAEvB,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;2BAC1B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;0BAE3B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;uBAC7B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;mBAE9B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;eAC9B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;aAE5B,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM;EAggBK,CAAC"}