@zintrust/core 0.1.18 → 0.1.20

package/src/cli/commands/CreateCommand.js

@@ -0,0 +1,143 @@
+/**
+ * Create Command
+ * Shortcuts for common scaffolding tasks.
+ */
+import { BaseCommand } from '../BaseCommand.js';
+import { FileGenerator } from '../scaffolding/FileGenerator.js';
+import { MigrationGenerator } from '../scaffolding/MigrationGenerator.js';
+import { CommonUtils } from '../../common/index.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import * as path from '../../node-singletons/path.js';
+const pluralize = (snake) => (snake.endsWith('s') ? snake : `${snake}s`);
+const buildCreateTableMigrationName = (model) => {
+    const modelSnake = CommonUtils.toSnakeCase(model).replaceAll(/[^a-z0-9_]+/g, '_');
+    const tablePlural = pluralize(modelSnake);
+    return `create_${tablePlural}_table`;
+};
+const buildAddColumnMigrationName = (column, model) => {
+    const colSnake = CommonUtils.toSnakeCase(column).replaceAll(/[^a-z0-9_]+/g, '_');
+    const modelSnake = CommonUtils.toSnakeCase(model).replaceAll(/[^a-z0-9_]+/g, '_');
+    const tablePlural = pluralize(modelSnake);
+    return `add_${colSnake}_${tablePlural}_table`;
+};
+const findMigrationBySuffix = (migrationsPath, suffix) => {
+    const files = FileGenerator.listFiles(migrationsPath, false);
+    for (const file of files) {
+        if (path.basename(file).endsWith(suffix))
+            return file;
+    }
+    return undefined;
+};
+const addOptions = (command) => {
+    command
+        .argument('<type>', 'What to create (currently: migration)')
+        .argument('<name>', 'Name (for migration: model name like "user")');
+    // Accepted for consistency with other CLI commands.
+    command.option('--no-interactive', 'Skip interactive prompts');
+};
+const executeCreate = async (cmd, options) => {
+    const args = Array.isArray(options.args) ? options.args : [];
+    const type = args[0];
+    const name = args[1];
+    if (type !== 'migration') {
+        throw ErrorFactory.createCliError('Usage: zin create migration <model>');
+    }
+    if (typeof name !== 'string' || name.trim() === '') {
+        throw ErrorFactory.createValidationError('Model name is required');
+    }
+    const projectRoot = process.cwd();
+    const migrationsPath = path.join(projectRoot, 'database', 'migrations');
+    const migrationName = buildCreateTableMigrationName(name);
+    const tableName = pluralize(CommonUtils.toSnakeCase(name).replaceAll(/[^a-z0-9_]+/g, '_'));
+    cmd.info(`Creating migration: ${migrationName}...`);
+    const result = await MigrationGenerator.generateMigration({
+        name: migrationName,
+        migrationsPath,
+        type: 'create',
+        table: tableName,
+    });
+    if (result.success === false)
+        throw ErrorFactory.createCliError(result.message);
+    cmd.success('Migration created successfully!');
+    cmd.info(`File: ${path.basename(result.filePath)}`);
+};
+const executeCm = async (cmd, options) => {
+    const args = Array.isArray(options.args) ? options.args : [];
+    const model = args[0];
+    if (typeof model !== 'string' || model.trim() === '') {
+        throw ErrorFactory.createCliError('Usage: zin cm <model>');
+    }
+    await executeCreate(cmd, { ...options, args: ['migration', model] });
+};
+const executeAm = async (cmd, options) => {
+    const args = Array.isArray(options.args) ? options.args : [];
+    const column = args[0];
+    const model = args[1];
+    if (typeof column !== 'string' ||
+        column.trim() === '' ||
+        typeof model !== 'string' ||
+        model.trim() === '') {
+        throw ErrorFactory.createCliError('Usage: zin am <column> <model>');
+    }
+    const projectRoot = process.cwd();
+    const migrationsPath = path.join(projectRoot, 'database', 'migrations');
+    const tableName = pluralize(CommonUtils.toSnakeCase(model).replaceAll(/[^a-z0-9_]+/g, '_'));
+    const createName = buildCreateTableMigrationName(model);
+    const existingCreate = findMigrationBySuffix(migrationsPath, `_${createName}.ts`);
+    if (existingCreate === undefined) {
+        throw ErrorFactory.createCliError(`Missing required create migration for model '${model}'. Create it first: zin cm ${model}`);
+    }
+    const migrationName = buildAddColumnMigrationName(column, model);
+    cmd.info(`Creating migration: ${migrationName}...`);
+    const result = await MigrationGenerator.generateMigration({
+        name: migrationName,
+        migrationsPath,
+        // Let generator infer type from name (add_* => alter)
+        table: tableName,
+        column: CommonUtils.toSnakeCase(column).replaceAll(/[^a-z0-9_]+/g, '_'),
+    });
+    if (result.success === false)
+        throw ErrorFactory.createCliError(result.message);
+    cmd.success('Migration created successfully!');
+    cmd.info(`File: ${path.basename(result.filePath)}`);
+};
+export const CreateCommand = Object.freeze({
+    create() {
+        const cmd = BaseCommand.create({
+            name: 'create',
+            description: 'Create resources (e.g. migrations) with opinionated naming',
+            addOptions,
+            execute: async (options) => executeCreate(cmd, options),
+        });
+        return cmd;
+    },
+});
+export const CreateMigrationCommand = Object.freeze({
+    create() {
+        const cmd = BaseCommand.create({
+            name: 'cm',
+            description: 'Shortcut: create migration for a model (create_<models>_table)',
+            addOptions: (command) => {
+                command.argument('<model>', 'Model name (e.g. user)');
+                command.option('--no-interactive', 'Skip interactive prompts');
+            },
+            execute: async (options) => executeCm(cmd, options),
+        });
+        return cmd;
+    },
+});
+export const AddMigrationCommand = Object.freeze({
+    create() {
+        const cmd = BaseCommand.create({
+            name: 'am',
+            description: 'Shortcut: add column migration for a model (add_<col>_<models>_table)',
+            addOptions: (command) => {
+                command.argument('<column>', 'Column name (e.g. bio)');
+                command.argument('<model>', 'Model name (e.g. user)');
+                command.option('--no-interactive', 'Skip interactive prompts');
+            },
+            execute: async (options) => executeAm(cmd, options),
+        });
+        return cmd;
+    },
+});

package/src/cli/commands/D1MigrateCommand.d.ts

@@ -2,7 +2,7 @@
  * D1 Migrate Command
  * Run Cloudflare D1 migrations using Wrangler
  */
-import { IBaseCommand } from '../BaseCommand';
+import type { IBaseCommand } from '../BaseCommand';
 /**
  * D1 Migrate Command
  * Run Cloudflare D1 migrations using Wrangler

package/src/cli/commands/D1MigrateCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1MigrateCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/D1MigrateCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA+B,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsD7E;;;GAGG;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;cACO,YAAY;EAqBtB,CAAC"}
+{"version":3,"file":"D1MigrateCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/D1MigrateCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAyDrE;;;GAGG;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;cACO,YAAY;EAwBtB,CAAC"}

package/src/cli/commands/D1MigrateCommand.js

@@ -1,31 +1,27 @@
-/**
- * D1 Migrate Command
- * Run Cloudflare D1 migrations using Wrangler
- */
 import { BaseCommand } from '../BaseCommand.js';
+import { WranglerD1 } from '../d1/WranglerD1.js';
 import { resolveNpmPath } from '../../common/index.js';
 import { appConfig } from '../../config/app.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
-import { execFileSync } from '../../node-singletons/child-process.js';
-// eslint-disable-next-line @typescript-eslint/require-await
+const RESOLVED_VOID = Promise.resolve();
 const runWrangler = async (cmd, args) => {
-    const npmPath = resolveNpmPath();
-    cmd.debug(`Executing: npm exec --yes -- wrangler ${args.join(' ')}`);
-    const result = execFileSync(npmPath, ['exec', '--yes', '--', 'wrangler', ...args], {
-        stdio: 'pipe',
-        encoding: 'utf8',
-        env: appConfig.getSafeEnv(),
-    });
-    return result;
+    // Back-compat entrypoint for tests; we only use this for D1 migrations apply.
+    const dbName = args[3];
+    const mode = args[4];
+    const isLocal = mode === '--local';
+    await RESOLVED_VOID;
+    return WranglerD1.applyMigrations({ cmd, dbName, isLocal });
 };
 const executeD1Migrate = async (cmd, options) => {
     const isLocal = options['local'] === true || options['remote'] !== true;
-    const dbName = typeof options['database'] === 'string' ? options['database'] : 'zintrust_db';
-    const target = isLocal ? '--local' : '--remote';
+    const dbName = typeof options['database'] === 'string' && options['database'].trim() !== ''
+        ? options['database']
+        : 'zintrust_db';
     cmd.info(`Running D1 migrations for ${dbName} (${isLocal ? 'local' : 'remote'})...`);
+    await RESOLVED_VOID;
     try {
-        const output = await runWrangler(cmd, ['d1', 'migrations', 'apply', dbName, target]);
+        const output = WranglerD1.applyMigrations({ cmd, dbName, isLocal });
         if (output !== '')
             cmd.info(output);
         cmd.info('✓ D1 migrations completed successfully');
@@ -57,9 +53,9 @@ export const D1MigrateCommand = Object.freeze({
     create() {
         const addOptions = (command) => {
             command
-                .option('--local', 'Run migrations against local D1 database')
-                .option('--remote', 'Run migrations against remote D1 database')
-                .option('--database <name>', 'D1 database name', 'zintrust_db');
+                .option('--local', 'Run against local D1 database (via wrangler dev)')
+                .option('--remote', 'Run against remote D1 database (production)')
+                .option('--database <name>', 'Wrangler D1 database binding name (from wrangler.toml). Defaults to "zintrust_db"');
         };
         const cmd = BaseCommand.create({
             name: 'd1:migrate',

package/src/cli/commands/DbSeedCommand.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Db Seed Command
+ * Run database seeders from database/seeders
+ */
+import type { IBaseCommand } from '../BaseCommand';
+export declare const DbSeedCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=DbSeedCommand.d.ts.map

package/src/cli/commands/DbSeedCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbSeedCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DbSeedCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6MrE,eAAO,MAAM,aAAa;cACd,YAAY;EAUtB,CAAC"}

package/src/cli/commands/DbSeedCommand.js

@@ -0,0 +1,171 @@
+/**
+ * Db Seed Command
+ * Run database seeders from database/seeders
+ */
+import { SeederDiscovery } from '../../seeders/SeederDiscovery.js';
+import { SeederLoader } from '../../seeders/SeederLoader.js';
+import { BaseCommand } from '../BaseCommand.js';
+import { PromptHelper } from '../PromptHelper.js';
+import { databaseConfig } from '../../config/database.js';
+import { Env } from '../../config/env.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { resetDatabase, useDatabase } from '../../orm/Database.js';
+const addSeedOptions = (command) => {
+    command
+        .option('--dir <path>', 'Seeders directory (relative to project root)', databaseConfig.seeders.directory)
+        .option('--service <domain/name>', 'Run global + service-local seeders')
+        .option('--only-service <domain/name>', 'Run only service-local seeders')
+        .option('--no-interactive', 'Skip interactive prompts');
+};
+const getInteractive = (options) => options['interactive'] !== false && process.env['CI'] !== 'true';
+const ensureNonD1Driver = (driver) => {
+    if (driver === 'd1' || driver === 'd1-remote') {
+        throw ErrorFactory.createCliError('This project is configured for D1. Seeding via `zin db:seed` is not supported yet.');
+    }
+};
+const mapConnectionToOrmConfig = (conn) => {
+    switch (conn.driver) {
+        case 'sqlite':
+            return { driver: 'sqlite', database: conn.database };
+        case 'postgresql':
+            return {
+                driver: 'postgresql',
+                host: conn.host,
+                port: conn.port,
+                database: conn.database,
+                username: conn.username,
+                password: conn.password,
+            };
+        case 'mysql':
+            return {
+                driver: 'mysql',
+                host: conn.host,
+                port: conn.port,
+                database: conn.database,
+                username: conn.username,
+                password: conn.password,
+            };
+        default:
+            return { driver: 'sqlite', database: ':memory:' };
+    }
+};
+const confirmProductionRun = async (cmd, interactive) => {
+    if (Env.NODE_ENV !== 'production')
+        return true;
+    const confirmed = await PromptHelper.confirm('NODE_ENV=production. Continue running seeders?', false, interactive);
+    if (!confirmed) {
+        cmd.warn('Cancelled.');
+        return false;
+    }
+    return true;
+};
+const getServiceArgs = (options) => {
+    let serviceArg;
+    if (typeof options['onlyService'] === 'string') {
+        serviceArg = String(options['onlyService']);
+    }
+    else if (typeof options['service'] === 'string') {
+        serviceArg = String(options['service']);
+    }
+    const includeGlobal = typeof options['onlyService'] !== 'string';
+    return { service: serviceArg, includeGlobal };
+};
+const parseServiceRef = (raw) => {
+    const trimmed = raw.trim();
+    const parts = trimmed.split('/').filter((p) => p.trim().length > 0);
+    if (parts.length !== 2) {
+        throw ErrorFactory.createCliError(`Invalid service reference: '${raw}'. Expected format: <domain>/<name>`);
+    }
+    return { domain: parts[0], name: parts[1] };
+};
+const normalizeSeederNameArg = (raw) => {
+    const trimmed = raw.trim();
+    if (trimmed.endsWith('.ts'))
+        return trimmed.slice(0, -3);
+    if (trimmed.endsWith('.js'))
+        return trimmed.slice(0, -3);
+    return trimmed;
+};
+const selectSeederFiles = (files, seederName) => {
+    if (seederName !== undefined) {
+        return files.filter((filePath) => {
+            const base = filePath.split('/').pop() ?? '';
+            const withoutExt = base.replace(/\.(ts|js)$/u, '');
+            return withoutExt === seederName;
+        });
+    }
+    const databaseSeeder = files.find((filePath) => {
+        const base = filePath.split('/').pop() ?? '';
+        const withoutExt = base.replace(/\.(ts|js)$/u, '');
+        return withoutExt === 'DatabaseSeeder';
+    });
+    if (databaseSeeder !== undefined)
+        return [databaseSeeder];
+    return files;
+};
+const executeSeed = async (options, cmd) => {
+    const interactive = getInteractive(options);
+    const okToProceed = await confirmProductionRun(cmd, interactive);
+    if (!okToProceed)
+        return;
+    const conn = databaseConfig.getConnection();
+    ensureNonD1Driver(conn.driver);
+    const ormConfig = mapConnectionToOrmConfig(conn);
+    const db = useDatabase(ormConfig, 'default');
+    const dirOpt = typeof options['dir'] === 'string' ? options['dir'] : databaseConfig.seeders.directory;
+    const { service, includeGlobal } = getServiceArgs(options);
+    const projectRoot = process.cwd();
+    const globalDir = SeederDiscovery.resolveDir(projectRoot, dirOpt);
+    const globalFiles = includeGlobal ? SeederDiscovery.listSeederFiles(globalDir) : [];
+    let serviceFiles = [];
+    if (service !== undefined) {
+        const { domain, name } = parseServiceRef(service);
+        const serviceRoot = `${projectRoot}/services/${domain}/${name}`;
+        const serviceDir = SeederDiscovery.resolveDir(serviceRoot, dirOpt);
+        serviceFiles = SeederDiscovery.listSeederFiles(serviceDir);
+    }
+    const seederArgRaw = Array.isArray(options.args) ? options.args[0] : undefined;
+    const seederName = typeof seederArgRaw === 'string' && seederArgRaw.trim() !== ''
+        ? normalizeSeederNameArg(seederArgRaw)
+        : undefined;
+    const selectedGlobal = selectSeederFiles(globalFiles, seederName);
+    const selectedService = selectSeederFiles(serviceFiles, seederName);
+    const selected = [...selectedGlobal, ...selectedService];
+    if (seederName !== undefined) {
+        if (selected.length === 0) {
+            throw ErrorFactory.createCliError(`Seeder not found: ${seederName} (dir=${dirOpt}, global=${globalFiles.length}, service=${serviceFiles.length})`);
+        }
+        if (selected.length > 1) {
+            throw ErrorFactory.createCliError(`Seeder name is ambiguous: ${seederName} (matches=${selected.length}). Use --only-service or adjust name.`);
+        }
+    }
+    if (selected.length === 0) {
+        cmd.info('No seeders found.');
+        return;
+    }
+    cmd.info(`Running ${selected.length} seeder(s)...`);
+    await db.connect();
+    try {
+        await selected.reduce(async (previous, filePath) => {
+            await previous;
+            const loaded = await SeederLoader.load(filePath);
+            cmd.info(`→ ${loaded.name}`);
+            await loaded.run(db);
+            cmd.success(`✓ Seeded: ${loaded.name}`);
+        }, Promise.resolve());
+    }
+    finally {
+        await resetDatabase();
+    }
+};
+export const DbSeedCommand = Object.freeze({
+    create() {
+        const cmd = BaseCommand.create({
+            name: 'db:seed',
+            description: 'Run database seeders',
+            addOptions: addSeedOptions,
+            execute: async (options) => executeSeed(options, cmd),
+        });
+        return cmd;
+    },
+});

package/src/cli/commands/DebugCommand.d.ts

@@ -2,7 +2,7 @@
  * Debug Command
  * Launch debug mode with profiling and monitoring
  */
-import { IBaseCommand } from '../BaseCommand';
+import type { IBaseCommand } from '../BaseCommand';
 /**
  * Debug Command Factory
  */

package/src/cli/commands/DebugCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DebugCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DebugCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAwD7E;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB;;OAEG;kBApBc,YAAY;EAsB7B,CAAC"}
+{"version":3,"file":"DebugCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DebugCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAyDrE;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB;;OAEG;kBApBc,YAAY;EAsB7B,CAAC"}

package/src/cli/commands/FixCommand.d.ts

@@ -2,7 +2,7 @@
  * Fix Command - Automated Code Cleanup
  * Runs ESLint fix and other automated tools
  */
-import { IBaseCommand } from '../BaseCommand';
+import type { IBaseCommand } from '../BaseCommand';
 /**
  * Fix Command Factory
  */

package/src/cli/commands/FixCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FixCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/FixCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAA+B,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmD7E;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;cACO,YAAY;EAkBtB,CAAC"}
+{"version":3,"file":"FixCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/FixCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAoDrE;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;cACO,YAAY;EAkBtB,CAAC"}

package/src/cli/commands/JwtDevCommand.d.ts

@@ -0,0 +1,8 @@
+/**
+ * JWT Dev Command
+ * Mint a local development JWT for quick manual API testing.
+ */
+import { type IBaseCommand } from '../BaseCommand';
+export declare const JwtDevCommand: IBaseCommand;
+export default JwtDevCommand;
+//# sourceMappingURL=JwtDevCommand.d.ts.map

package/src/cli/commands/JwtDevCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtDevCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/JwtDevCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6FvF,eAAO,MAAM,aAAa,EAAE,YAqD3B,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/src/cli/commands/JwtDevCommand.js

@@ -0,0 +1,114 @@
+/**
+ * JWT Dev Command
+ * Mint a local development JWT for quick manual API testing.
+ */
+import { BaseCommand } from '../BaseCommand.js';
+import { appConfig } from '../../config/app.js';
+import { securityConfig } from '../../config/security.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { JwtManager } from '../../security/JwtManager.js';
+const parseExpiresToSeconds = (value) => {
+    const raw = typeof value === 'string' ? value.trim() : '';
+    if (raw === '')
+        return 60 * 60;
+    // Allow raw seconds
+    if (/^\d+$/.test(raw)) {
+        const seconds = Number.parseInt(raw, 10);
+        if (!Number.isFinite(seconds) || seconds <= 0) {
+            throw ErrorFactory.createCliError(`Invalid --expires '${raw}'. Must be > 0 seconds.`);
+        }
+        return seconds;
+    }
+    const match = /^(\d+)([smhd])$/i.exec(raw);
+    if (!match) {
+        throw ErrorFactory.createCliError(`Invalid --expires '${raw}'. Use seconds (e.g. 3600) or a duration like 30m, 1h, 7d.`);
+    }
+    const amount = Number.parseInt(match[1] ?? '', 10);
+    const unit = (match[2] ?? '').toLowerCase();
+    if (!Number.isFinite(amount) || amount <= 0) {
+        throw ErrorFactory.createCliError(`Invalid --expires '${raw}'. Must be > 0.`);
+    }
+    const multipliers = {
+        s: 1,
+        m: 60,
+        h: 60 * 60,
+        d: 24 * 60 * 60,
+    };
+    const multiplier = multipliers[unit];
+    if (multiplier === undefined) {
+        throw ErrorFactory.createCliError(`Invalid --expires '${raw}'. Supported units: s, m, h, d (e.g. 30m, 1h).`);
+    }
+    return amount * multiplier;
+};
+const assertNotProduction = (allowProduction) => {
+    if (!appConfig.isProduction())
+        return;
+    if (allowProduction === true)
+        return;
+    throw ErrorFactory.createCliError("Refusing to mint a dev JWT in production. Use --allow-production only if you know what you're doing.");
+};
+const createJwt = (payload, expiresInSeconds) => {
+    const algorithm = securityConfig.jwt.algorithm;
+    const secret = securityConfig.jwt.secret;
+    const jwt = JwtManager.create();
+    if (algorithm === 'HS256' || algorithm === 'HS512') {
+        jwt.setHmacSecret(secret);
+    }
+    else {
+        throw ErrorFactory.createCliError(`JWT algorithm '${algorithm}' is not supported by zin jwt:dev (HS256/HS512 only).`);
+    }
+    return jwt.sign(payload, {
+        algorithm,
+        expiresIn: expiresInSeconds,
+        issuer: securityConfig.jwt.issuer,
+        audience: securityConfig.jwt.audience,
+        subject: typeof payload.sub === 'string' ? payload.sub : undefined,
+        jwtId: jwt.generateJwtId(),
+    });
+};
+export const JwtDevCommand = Object.freeze(BaseCommand.create({
+    name: 'jwt:dev',
+    description: 'Mint a local development JWT (for manual API testing)',
+    aliases: ['jwt:token', 'jwt:mint'],
+    addOptions: (command) => {
+        command
+            .option('--sub <sub>', 'JWT subject claim (default: 1)', '1')
+            .option('--email <email>', 'Email claim')
+            .option('--role <role>', 'Role claim')
+            .option('--expires <duration>', "Expiry: seconds or 30m/1h/7d (default: '1h')", '1h')
+            .option('--json', 'Output machine-readable JSON')
+            .option('--allow-production', 'Allow running in production (dangerous)');
+    },
+    execute: (options) => {
+        assertNotProduction(options.allowProduction);
+        const expiresInSeconds = parseExpiresToSeconds(options.expires);
+        const payload = {
+            ...(typeof options.sub === 'string' && options.sub.trim() !== ''
+                ? { sub: options.sub.trim() }
+                : {}),
+            ...(typeof options.email === 'string' && options.email.trim() !== ''
+                ? { email: options.email.trim() }
+                : {}),
+            ...(typeof options.role === 'string' && options.role.trim() !== ''
+                ? { role: options.role.trim() }
+                : {}),
+        };
+        const token = createJwt(payload, expiresInSeconds);
+        /* eslint-disable no-console */
+        if (options.json === true) {
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            console.log(JSON.stringify({
+                token,
+                algorithm: securityConfig.jwt.algorithm,
+                expiresIn: expiresInSeconds,
+                issuedAt: nowSeconds,
+                expiresAt: nowSeconds + expiresInSeconds,
+                payload,
+            }));
+            return;
+        }
+        console.log(token);
+        /* eslint-enable no-console */
+    },
+}));
+export default JwtDevCommand;

package/src/cli/commands/KeyGenerateCommand.d.ts

@@ -2,7 +2,7 @@
  * Key Generate Command
  * Generates and sets the application key
  */
-import { IBaseCommand } from '../BaseCommand';
+import type { IBaseCommand } from '../BaseCommand';
 export declare const KeyGenerateCommand: Readonly<{
     create(): IBaseCommand;
 }>;

package/src/cli/commands/KeyGenerateCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KeyGenerateCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/KeyGenerateCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO7E,eAAO,MAAM,kBAAkB;cACnB,YAAY;EAmEtB,CAAC"}
+{"version":3,"file":"KeyGenerateCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/KeyGenerateCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAQrE,eAAO,MAAM,kBAAkB;cACnB,YAAY;EAmEtB,CAAC"}

package/src/cli/commands/LogsCommand.d.ts

@@ -2,8 +2,8 @@
  * LogsCommand - CLI command for viewing and managing logs
  * Commands: zin logs, zin logs --follow, zin logs --level error, zin logs --clear
  */
-import { IBaseCommand } from '../BaseCommand';
-import { Command } from 'commander';
+import type { IBaseCommand } from '../BaseCommand';
+import type { Command } from 'commander';
 export declare const LogsCommand: Readonly<{
     /**
      * Create a new logs command instance

package/src/cli/commands/LogsCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LogsCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/LogsCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2KpC,eAAO,MAAM,WAAW;IACtB;;OAEG;cACO,YAAY;IAwBtB;;;OAGG;sBACe,OAAO,GAAG,IAAI;EAchC,CAAC;AAEH,eAAe,WAAW,CAAC"}
+{"version":3,"file":"LogsCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/LogsCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AASrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+MzC,eAAO,MAAM,WAAW;IACtB;;OAEG;cACO,YAAY;IAwBtB;;;OAGG;sBACe,OAAO,GAAG,IAAI;EAchC,CAAC;AAEH,eAAe,WAAW,CAAC"}

package/src/cli/commands/LogsCommand.js

@@ -95,23 +95,57 @@ const followLogs = (category) => {
     Logger.info(chalk.blue(`👀 Following logs: ${logFile}\n`));
     Logger.info(chalk.gray('Press Ctrl+C to stop...\n'));
     let lastSize = 0;
+    let currentStream = null;
+    const safeDestroy = (stream) => {
+        try {
+            const anyStream = stream;
+            if (typeof anyStream.destroy === 'function')
+                anyStream.destroy();
+        }
+        catch {
+            // best-effort
+        }
+    };
     const interval = setInterval(() => {
         if (!fs.existsSync(logFile))
             return;
         const stats = fs.statSync(logFile);
         if (stats.size <= lastSize)
             return;
-        const stream = fs.createReadStream(logFile, {
+        // Close previous stream if it exists
+        if (currentStream !== null) {
+            safeDestroy(currentStream);
+        }
+        currentStream = fs.createReadStream(logFile, {
             start: lastSize,
             encoding: 'utf-8',
         });
-        stream.on('data', (chunk) => {
+        currentStream.on('data', (chunk) => {
             processLogChunk(chunk, loggerInstance);
         });
+        currentStream.on('end', () => {
+            // Clean up stream reference when done
+            if (currentStream !== null) {
+                safeDestroy(currentStream);
+                currentStream = null;
+            }
+        });
+        currentStream.on('error', (error) => {
+            Logger.error('Stream error', { error });
+            if (currentStream !== null) {
+                safeDestroy(currentStream);
+                currentStream = null;
+            }
+        });
         lastSize = stats.size;
     }, 1000);
     process.on('SIGINT', () => {
         clearInterval(interval);
+        // Clean up stream on exit
+        if (currentStream !== null) {
+            safeDestroy(currentStream);
+            currentStream = null;
+        }
         Logger.info(chalk.yellow('\n\nLog following stopped'));
         process.exit(0);
     });