@zintrust/core 0.1.27 → 0.1.28

package/src/config/database.js

@@ -1,286 +0,0 @@
-/**
- * Database Configuration
- * Database connections and pooling settings
- * Sealed namespace for immutability
- */
-import { Env } from './env.js';
-import { ErrorFactory } from '../exceptions/ZintrustError.js';
-import { StartupConfigFile, StartupConfigFileRegistry } from '../runtime/StartupConfigFileRegistry.js';
-const isNodeProcess = () => {
-    return typeof process !== 'undefined' && typeof process.cwd === 'function';
-};
-const readEnvString = (key, fallback = '') => {
-    const anyEnv = Env;
-    const fromEnv = typeof anyEnv.get === 'function' ? anyEnv.get(key, fallback) : fallback;
-    if (typeof fromEnv === 'string' && fromEnv.trim() !== '')
-        return fromEnv;
-    if (typeof process !== 'undefined') {
-        const raw = process.env?.[key];
-        if (typeof raw === 'string' && raw.trim() !== '')
-            return raw;
-    }
-    return fromEnv ?? '';
-};
-const isExplicitEnvValue = (key) => {
-    if (!isNodeProcess())
-        return false;
-    const direct = Env[key];
-    if (typeof direct === 'string' && direct.trim() !== '')
-        return true;
-    const raw = process.env[key] ?? Env.get(key, '');
-    return typeof raw === 'string' && raw.trim() !== '';
-};
-const looksLikeSqliteFilePath = (value) => {
-    const v = String(value ?? '').trim();
-    if (v === '')
-        return false;
-    if (v === ':memory:')
-        return true;
-    // Heuristic: if it's a path, has an extension, or is explicitly relative.
-    if (v.includes('/') || v.includes('\\'))
-        return true;
-    if (v.startsWith('.'))
-        return true;
-    if (v.startsWith('~'))
-        return true;
-    if (v.endsWith('.sqlite') || v.endsWith('.db'))
-        return true;
-    // Otherwise it's likely a placeholder name (e.g. "zintrust"), not a file path.
-    return false;
-};
-const toSafeDbBasename = (raw) => {
-    const trimmed = raw.trim();
-    if (trimmed === '')
-        return 'zintrust';
-    // Conservative filename allowlist: letters/numbers/_/-, collapse everything else.
-    // Avoid regexes that can exhibit catastrophic backtracking; do deterministic collapsing/trimming.
-    const collapsed = trimmed.toLowerCase().replaceAll(/[^a-z0-9_-]+/g, '-');
-    // Collapse consecutive hyphens deterministically without regex backtracking.
-    let normalized = '';
-    let prevHyphen = false;
-    for (const element of collapsed) {
-        const ch = element;
-        if (ch === '-') {
-            if (!prevHyphen) {
-                normalized += ch;
-                prevHyphen = true;
-            }
-        }
-        else {
-            normalized += ch;
-            prevHyphen = false;
-        }
-    }
-    // Trim leading/trailing hyphens deterministically without regex.
-    let start = 0;
-    let end = normalized.length;
-    while (start < end && normalized.charAt(start) === '-')
-        start++;
-    while (end > start && normalized.charAt(end - 1) === '-')
-        end--;
-    const result = normalized.slice(start, end);
-    return result === '' ? 'zintrust' : result;
-};
-const resolveSqliteDefaultBasename = () => {
-    const service = typeof Env.SERVICE_NAME === 'string' && Env.SERVICE_NAME.trim() !== ''
-        ? Env.SERVICE_NAME
-        : readEnvString('SERVICE_NAME', '');
-    if (service.trim() !== '')
-        return toSafeDbBasename(service);
-    const app = typeof Env.APP_NAME === 'string' && Env.APP_NAME.trim() !== ''
-        ? Env.APP_NAME
-        : readEnvString('APP_NAME', '');
-    if (app.trim() !== '')
-        return toSafeDbBasename(app);
-    return 'zintrust';
-};
-const resolveDefaultSqliteDatabasePath = () => {
-    // Respect explicit sqlite *file path* configuration.
-    // Note: we intentionally treat plain names like "zintrust" as placeholders, not file paths,
-    // to avoid creating stray DB files in the project root.
-    if (isExplicitEnvValue('DB_DATABASE') || isExplicitEnvValue('DB_PATH')) {
-        const configured = Env.DB_DATABASE;
-        if (looksLikeSqliteFilePath(configured))
-            return configured;
-    }
-    // Only change the default behavior for dev/testing; production should be explicit.
-    if (!isNodeProcess() || Env.NODE_ENV === 'production')
-        return Env.DB_DATABASE;
-    // Store dev sqlite files in project-local metadata folder.
-    // Note: the SQLite adapter ensures the parent directory exists.
-    const base = resolveSqliteDefaultBasename();
-    return `.zintrust/dbs/${base}.sqlite`;
-};
-const hasOwn = (obj, key) => {
-    return Object.hasOwn(obj, key);
-};
-const parseReadHosts = (raw) => {
-    const list = String(raw ?? '')
-        .split(',')
-        .map((v) => v.trim())
-        .filter((v) => v.length > 0);
-    return list.length > 0 ? list : undefined;
-};
-const getDefaultConnection = (connections) => {
-    const envSelectedRaw = Env.get('DB_CONNECTION', '');
-    const value = String(envSelectedRaw ?? '').trim();
-    if (value.length > 0 && hasOwn(connections, value))
-        return value;
-    if (envSelectedRaw.trim().length > 0) {
-        throw ErrorFactory.createConfigError(`Database connection not configured: ${value}`);
-    }
-    return hasOwn(connections, 'sqlite') ? 'sqlite' : (Object.keys(connections)[0] ?? 'sqlite');
-};
-const getDatabaseConnection = (config) => {
-    const connName = config.default;
-    const resolved = config.connections[connName];
-    if (resolved !== undefined)
-        return resolved;
-    // Backwards-compatible fallback.
-    const sqliteFallback = config.connections['sqlite'];
-    if (sqliteFallback !== undefined)
-        return sqliteFallback;
-    const first = Object.values(config.connections)[0];
-    if (first !== undefined)
-        return first;
-    throw ErrorFactory.createConfigError(`No database connections are configured (default='${connName}').`);
-};
-const connections = {
-    sqlite: {
-        driver: 'sqlite',
-        database: resolveDefaultSqliteDatabasePath(),
-        migrations: 'database/migrations',
-    },
-    d1: {
-        driver: 'd1',
-    },
-    'd1-remote': {
-        driver: 'd1-remote',
-    },
-    postgresql: {
-        driver: 'postgresql',
-        host: Env.DB_HOST,
-        port: Env.DB_PORT_POSTGRESQL,
-        database: Env.DB_DATABASE_POSTGRESQL,
-        username: Env.DB_USERNAME_POSTGRESQL,
-        password: Env.DB_PASSWORD_POSTGRESQL,
-        ssl: Env.getBool('DB_SSL', false),
-        readHosts: parseReadHosts(Env.DB_READ_HOSTS_POSTGRESQL),
-        pooling: {
-            enabled: Env.getBool('DB_POOLING', true),
-            min: Env.getInt('DB_POOL_MIN', 5),
-            max: Env.getInt('DB_POOL_MAX', 20),
-            idleTimeout: Env.getInt('DB_IDLE_TIMEOUT', 30000),
-            connectionTimeout: Env.getInt('DB_CONNECTION_TIMEOUT', 10000),
-        },
-    },
-    mysql: {
-        driver: 'mysql',
-        host: Env.DB_HOST,
-        port: Env.DB_PORT,
-        database: Env.DB_DATABASE,
-        username: Env.DB_USERNAME,
-        password: Env.DB_PASSWORD,
-        readHosts: parseReadHosts(Env.DB_READ_HOSTS),
-        pooling: {
-            enabled: Env.getBool('DB_POOLING', true),
-            min: Env.getInt('DB_POOL_MIN', 5),
-            max: Env.getInt('DB_POOL_MAX', 20),
-        },
-    },
-    sqlserver: {
-        driver: 'sqlserver',
-        host: Env.DB_HOST_MSSQL,
-        port: Env.DB_PORT_MSSQL,
-        database: Env.DB_DATABASE_MSSQL,
-        username: Env.DB_USERNAME_MSSQL,
-        password: Env.DB_PASSWORD_MSSQL,
-        readHosts: parseReadHosts(Env.DB_READ_HOSTS_MSSQL),
-    },
-};
-const createDatabaseConfig = () => {
-    const overrides = StartupConfigFileRegistry.get(StartupConfigFile.Database) ?? {};
-    const mergedConnections = {
-        ...connections,
-        ...overrides.connections,
-    };
-    const baseLogging = {
-        enabled: Env.getBool('DB_LOG_QUERIES', Env.DEBUG),
-        level: Env.get('DB_LOG_LEVEL', 'debug'),
-    };
-    const baseMigrations = {
-        directory: 'database/migrations',
-        extension: Env.get('DB_MIGRATION_EXT', '.ts'),
-    };
-    const baseSeeders = {
-        directory: 'database/seeders',
-    };
-    const mergedDefault = typeof overrides.default === 'string' && overrides.default.trim() !== ''
-        ? overrides.default.trim()
-        : getDefaultConnection(mergedConnections);
-    const databaseConfigObj = {
-        /**
-         * Default database connection
-         */
-        default: mergedDefault,
-        /**
-         * Database connections
-         */
-        connections: mergedConnections,
-        /**
-         * Get current connection config
-         */
-        getConnection() {
-            return getDatabaseConnection(this);
-        },
-        /**
-         * Enable query logging
-         */
-        logging: {
-            ...baseLogging,
-            ...overrides.logging,
-        },
-        /**
-         * Migration settings
-         */
-        migrations: {
-            ...baseMigrations,
-            ...overrides.migrations,
-        },
-        /**
-         * Seeding settings
-         */
-        seeders: {
-            ...baseSeeders,
-            ...overrides.seeders,
-        },
-    };
-    return Object.freeze(databaseConfigObj);
-};
-let cached = null;
-const proxyTarget = {};
-const ensureDatabaseConfig = () => {
-    if (cached)
-        return cached;
-    cached = createDatabaseConfig();
-    try {
-        Object.defineProperties(proxyTarget, Object.getOwnPropertyDescriptors(cached));
-    }
-    catch {
-        // best-effort
-    }
-    return cached;
-};
-export const databaseConfig = new Proxy(proxyTarget, {
-    get(_target, prop) {
-        return ensureDatabaseConfig()[prop];
-    },
-    ownKeys() {
-        ensureDatabaseConfig();
-        return Reflect.ownKeys(proxyTarget);
-    },
-    getOwnPropertyDescriptor(_target, prop) {
-        ensureDatabaseConfig();
-        return Object.getOwnPropertyDescriptor(proxyTarget, prop);
-    },
-});

package/src/config/env.d.ts

@@ -1,128 +0,0 @@
-/**
- * Environment Configuration
- * Type-safe access to environment variables
- *
- * Sealed namespace pattern - all exports through Env namespace
- * Safe for both Node.js and serverless runtimes (Cloudflare Workers, Deno, Lambda)
- */
-import type { ProcessLike } from './type';
-export declare const getProcessLike: () => ProcessLike | undefined;
-export declare const dirnameFromExecPath: (execPath: string, platform?: string) => string;
-export declare const get: (key: string, defaultValue?: string) => string;
-export declare const getInt: (key: string, defaultValue?: number) => number;
-export declare const getFloat: (key: string, defaultValue?: number) => number;
-export declare const getBool: (key: string, defaultValue?: boolean) => boolean;
-export declare const getDefaultLogLevel: () => "debug" | "info" | "warn" | "error";
-export declare const Env: Readonly<{
-    get: (key: string, defaultValue?: string) => string;
-    getInt: (key: string, defaultValue?: number) => number;
-    getBool: (key: string, defaultValue?: boolean) => boolean;
-    getFloat: (key: string, defaultValue?: number) => number;
-    NODE_ENV: NodeJS.ProcessEnv["NODE_ENV"];
-    PORT: number;
-    HOST: string;
-    BASE_URL: string;
-    APP_NAME: string;
-    APP_KEY: string;
-    APP_PREVIOUS_KEYS: string;
-    DB_CONNECTION: string;
-    DB_HOST: string;
-    DB_PORT: number;
-    DB_DATABASE: string;
-    DB_USERNAME: string;
-    DB_PASSWORD: string;
-    DB_READ_HOSTS: string;
-    DB_PORT_POSTGRESQL: number;
-    DB_DATABASE_POSTGRESQL: string;
-    DB_USERNAME_POSTGRESQL: string;
-    DB_PASSWORD_POSTGRESQL: string;
-    DB_READ_HOSTS_POSTGRESQL: string;
-    DB_HOST_MSSQL: string;
-    DB_PORT_MSSQL: number;
-    DB_DATABASE_MSSQL: string;
-    DB_USERNAME_MSSQL: string;
-    DB_PASSWORD_MSSQL: string;
-    DB_READ_HOSTS_MSSQL: string;
-    D1_DATABASE_ID: string;
-    KV_NAMESPACE_ID: string;
-    D1_REMOTE_URL: string;
-    D1_REMOTE_KEY_ID: string;
-    D1_REMOTE_SECRET: string;
-    D1_REMOTE_MODE: string;
-    KV_REMOTE_URL: string;
-    KV_REMOTE_KEY_ID: string;
-    KV_REMOTE_SECRET: string;
-    KV_REMOTE_NAMESPACE: string;
-    ZT_PROXY_SIGNING_WINDOW_MS: number;
-    ZT_PROXY_TIMEOUT_MS: number;
-    CACHE_DRIVER: string;
-    REDIS_HOST: string;
-    REDIS_PORT: number;
-    REDIS_PASSWORD: string;
-    REDIS_URL: string;
-    MONGO_URI: string;
-    MONGO_DB: string;
-    QUEUE_CONNECTION: string;
-    QUEUE_DRIVER: string;
-    RATE_LIMIT_STORE: string;
-    RATE_LIMIT_DRIVER: string;
-    RATE_LIMIT_KEY_PREFIX: string;
-    NOTIFICATION_DRIVER: string;
-    TERMII_API_KEY: string;
-    TERMII_SENDER: string;
-    AWS_REGION: string;
-    AWS_LAMBDA_FUNCTION_NAME: string;
-    AWS_LAMBDA_FUNCTION_VERSION: string;
-    AWS_EXECUTION_ENV: string;
-    LAMBDA_TASK_ROOT: string;
-    MICROSERVICES: string;
-    SERVICES: string;
-    MICROSERVICES_TRACING: boolean;
-    MICROSERVICES_TRACING_RATE: number;
-    DATABASE_ISOLATION: string;
-    SERVICE_API_KEY: string;
-    SERVICE_JWT_SECRET: string;
-    DEBUG: boolean;
-    ENABLE_MICROSERVICES: boolean;
-    TOKEN_TTL: number;
-    TOKEN_LENGTH: number;
-    ENCRYPTION_CIPHER: string;
-    ENVIRONMENT: string;
-    REQUEST_TIMEOUT: number;
-    APP_TIMEZONE: string;
-    MAX_BODY_SIZE: number;
-    SHUTDOWN_TIMEOUT: number;
-    LOG_LEVEL: "debug" | "info" | "warn" | "error";
-    LOG_FORMAT: string;
-    LOG_CHANNEL: string;
-    DISABLE_LOGGING: boolean;
-    LOG_HTTP_REQUEST: boolean;
-    LOG_TO_FILE: boolean;
-    LOG_ROTATION_SIZE: number;
-    LOG_ROTATION_DAYS: number;
-    ZINTRUST_PROJECT_ROOT: string;
-    ZINTRUST_ALLOW_POSTINSTALL: string;
-    ZINTRUST_ENV_FILE: string;
-    ZINTRUST_SECRETS_MANIFEST: string;
-    ZINTRUST_ENV_IN_FILE: string;
-    ZINTRUST_SECRETS_PROVIDER: string;
-    ZINTRUST_ALLOW_AUTO_INSTALL: string;
-    CLOUDFLARE_ACCOUNT_ID: string;
-    CLOUDFLARE_API_TOKEN: string;
-    CLOUDFLARE_KV_NAMESPACE_ID: string;
-    AWS_DEFAULT_REGION: string;
-    AWS_ACCESS_KEY_ID: string;
-    AWS_SECRET_ACCESS_KEY: string;
-    AWS_SESSION_TOKEN: string;
-    CI: string;
-    HOME: string;
-    USERPROFILE: string;
-    TEMPLATE_COPYRIGHT: string;
-    SERVICE_NAME: string;
-    APP_MODE: string;
-    APP_PORT: number;
-    RUNTIME: string;
-    NODE_BIN_DIR: string;
-    SAFE_PATH: string;
-}>;
-//# sourceMappingURL=env.d.ts.map

package/src/config/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMhD,eAAO,MAAM,cAAc,QAAO,WAAW,GAAG,SAAwB,CAAC;AAEzE,eAAO,MAAM,mBAAmB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,MAKzE,CAAC;AAGF,eAAO,MAAM,GAAG,GAAI,KAAK,MAAM,EAAE,eAAe,MAAM,KAAG,MAGxD,CAAC;AAEF,eAAO,MAAM,MAAM,GAAI,KAAK,MAAM,EAAE,eAAe,MAAM,KAAG,MAM3D,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,KAAK,MAAM,EAAE,eAAe,MAAM,KAAG,MAM7D,CAAC;AAEF,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,EAAE,eAAe,OAAO,KAAG,OAK7D,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAKjE,CAAC;AAGF,eAAO,MAAM,GAAG;eApCS,MAAM,iBAAiB,MAAM,KAAG,MAAM;kBAKnC,MAAM,iBAAiB,MAAM,KAAG,MAAM;mBAgBrC,MAAM,iBAAiB,OAAO,KAAG,OAAO;oBARvC,MAAM,iBAAiB,MAAM,KAAG,MAAM;cA+BtB,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6GpB,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmExF,CAAC"}

package/src/config/env.js

@@ -1,220 +0,0 @@
-/**
- * Environment Configuration
- * Type-safe access to environment variables
- *
- * Sealed namespace pattern - all exports through Env namespace
- * Safe for both Node.js and serverless runtimes (Cloudflare Workers, Deno, Lambda)
- */
-// Cache process check once at module load time
-const processLike = typeof process === 'undefined' ? undefined : process;
-export const getProcessLike = () => processLike;
-export const dirnameFromExecPath = (execPath, platform) => {
-    const separator = platform === 'win32' ? '\\' : '/';
-    const lastSep = execPath.lastIndexOf(separator);
-    if (lastSep <= 0)
-        return '';
-    return execPath.slice(0, lastSep);
-};
-// Private helper functions
-export const get = (key, defaultValue) => {
-    const env = processLike?.env ?? {};
-    return env[key] ?? defaultValue ?? '';
-};
-export const getInt = (key, defaultValue) => {
-    const env = processLike?.env ?? {};
-    const value = env[key];
-    if (value === undefined || value === null)
-        return defaultValue ?? 0;
-    if (typeof value === 'string' && value.trim() === '')
-        return defaultValue ?? 0;
-    return Number.parseInt(value, 10);
-};
-export const getFloat = (key, defaultValue) => {
-    const env = processLike?.env ?? {};
-    const value = env[key];
-    if (value === undefined || value === null)
-        return defaultValue ?? 0;
-    if (typeof value === 'string' && value.trim() === '')
-        return defaultValue ?? 0;
-    return Number.parseFloat(value);
-};
-export const getBool = (key, defaultValue) => {
-    const env = processLike?.env ?? {};
-    const value = env[key];
-    if (value === undefined || value === null)
-        return defaultValue ?? false;
-    return value.toLowerCase() === 'true' || value === '1';
-};
-export const getDefaultLogLevel = () => {
-    const NODE_ENV_VALUE = get('NODE_ENV', 'development');
-    if (NODE_ENV_VALUE === 'production')
-        return 'info';
-    if (NODE_ENV_VALUE === 'testing')
-        return 'error';
-    return 'debug';
-};
-// Sealed namespace with all environment configuration
-export const Env = Object.freeze({
-    // Helper functions
-    get,
-    getInt,
-    getBool,
-    getFloat,
-    // Core
-    NODE_ENV: get('NODE_ENV', 'development'),
-    // Prefer PORT, fallback to APP_PORT for compatibility
-    PORT: getInt('PORT', getInt('APP_PORT', 3000)),
-    HOST: get('HOST', 'localhost'),
-    BASE_URL: get('BASE_URL', ''),
-    APP_NAME: get('APP_NAME', 'ZinTrust'),
-    APP_KEY: get('APP_KEY', ''),
-    // Optional key rotation support (comma-separated or JSON array of keys)
-    APP_PREVIOUS_KEYS: get('APP_PREVIOUS_KEYS', ''),
-    // Database
-    DB_CONNECTION: get('DB_CONNECTION', 'sqlite'),
-    DB_HOST: get('DB_HOST', 'localhost'),
-    DB_PORT: getInt('DB_PORT', 5432),
-    // Accept DB_PATH as an alias for sqlite file path (many env templates use it).
-    DB_DATABASE: get('DB_DATABASE', get('DB_PATH', 'zintrust')),
-    DB_USERNAME: get('DB_USERNAME', 'postgres'),
-    DB_PASSWORD: get('DB_PASSWORD', ''),
-    DB_READ_HOSTS: get('DB_READ_HOSTS', ''),
-    // PostgreSQL-specific configuration (with _POSTGRESQL suffix to avoid conflicts with MySQL)
-    DB_PORT_POSTGRESQL: getInt('DB_PORT_POSTGRESQL', 5432),
-    DB_DATABASE_POSTGRESQL: get('DB_DATABASE_POSTGRESQL', 'postgres'),
-    DB_USERNAME_POSTGRESQL: get('DB_USERNAME_POSTGRESQL', 'postgres'),
-    DB_PASSWORD_POSTGRESQL: get('DB_PASSWORD_POSTGRESQL', ''),
-    DB_READ_HOSTS_POSTGRESQL: get('DB_READ_HOSTS_POSTGRESQL', ''),
-    // SQL Server (MSSQL) specific configuration
-    DB_HOST_MSSQL: get('DB_HOST_MSSQL', get('DB_HOST', 'localhost')),
-    DB_PORT_MSSQL: getInt('DB_PORT_MSSQL', 1433),
-    DB_DATABASE_MSSQL: get('DB_DATABASE_MSSQL', 'zintrust'),
-    DB_USERNAME_MSSQL: get('DB_USERNAME_MSSQL', 'sa'),
-    DB_PASSWORD_MSSQL: get('DB_PASSWORD_MSSQL', ''),
-    DB_READ_HOSTS_MSSQL: get('DB_READ_HOSTS_MSSQL', ''),
-    // Cloudflare
-    D1_DATABASE_ID: get('D1_DATABASE_ID'),
-    KV_NAMESPACE_ID: get('KV_NAMESPACE_ID'),
-    // Cloudflare proxy services (D1/KV outside Cloudflare)
-    D1_REMOTE_URL: get('D1_REMOTE_URL', ''),
-    D1_REMOTE_KEY_ID: get('D1_REMOTE_KEY_ID', ''),
-    D1_REMOTE_SECRET: get('D1_REMOTE_SECRET', ''),
-    D1_REMOTE_MODE: get('D1_REMOTE_MODE', 'registry'),
-    KV_REMOTE_URL: get('KV_REMOTE_URL', ''),
-    KV_REMOTE_KEY_ID: get('KV_REMOTE_KEY_ID', ''),
-    KV_REMOTE_SECRET: get('KV_REMOTE_SECRET', ''),
-    KV_REMOTE_NAMESPACE: get('KV_REMOTE_NAMESPACE', ''),
-    // Proxy client tuning
-    ZT_PROXY_SIGNING_WINDOW_MS: getInt('ZT_PROXY_SIGNING_WINDOW_MS', 60000),
-    ZT_PROXY_TIMEOUT_MS: getInt('ZT_PROXY_TIMEOUT_MS', 30000),
-    // Cache
-    CACHE_DRIVER: get('CACHE_DRIVER', 'memory'),
-    REDIS_HOST: get('REDIS_HOST', 'localhost'),
-    REDIS_PORT: getInt('REDIS_PORT', 6379),
-    REDIS_PASSWORD: get('REDIS_PASSWORD', ''),
-    REDIS_URL: get('REDIS_URL', ''),
-    MONGO_URI: get('MONGO_URI'),
-    MONGO_DB: get('MONGO_DB', 'zintrust_cache'),
-    // Queue
-    QUEUE_CONNECTION: get('QUEUE_CONNECTION', ''),
-    QUEUE_DRIVER: get('QUEUE_DRIVER', ''),
-    // Rate Limiting
-    RATE_LIMIT_STORE: get('RATE_LIMIT_STORE', ''),
-    RATE_LIMIT_DRIVER: get('RATE_LIMIT_DRIVER', ''),
-    RATE_LIMIT_KEY_PREFIX: get('RATE_LIMIT_KEY_PREFIX', 'zintrust:ratelimit:'),
-    // Notifications
-    NOTIFICATION_DRIVER: get('NOTIFICATION_DRIVER', ''),
-    TERMII_API_KEY: get('TERMII_API_KEY', ''),
-    TERMII_SENDER: get('TERMII_SENDER', 'ZinTrust'),
-    // AWS
-    AWS_REGION: get('AWS_REGION', 'us-east-1'),
-    AWS_LAMBDA_FUNCTION_NAME: get('AWS_LAMBDA_FUNCTION_NAME'),
-    AWS_LAMBDA_FUNCTION_VERSION: get('AWS_LAMBDA_FUNCTION_VERSION'),
-    AWS_EXECUTION_ENV: get('AWS_EXECUTION_ENV'),
-    LAMBDA_TASK_ROOT: get('LAMBDA_TASK_ROOT'),
-    // Microservices
-    MICROSERVICES: get('MICROSERVICES'),
-    SERVICES: get('SERVICES'),
-    MICROSERVICES_TRACING: getBool('MICROSERVICES_TRACING'),
-    MICROSERVICES_TRACING_RATE: Number.parseFloat(get('MICROSERVICES_TRACING_RATE', '1.0')),
-    DATABASE_ISOLATION: get('DATABASE_ISOLATION', 'shared'),
-    SERVICE_API_KEY: get('SERVICE_API_KEY'),
-    SERVICE_JWT_SECRET: get('SERVICE_JWT_SECRET'),
-    // Security
-    DEBUG: getBool('DEBUG', false),
-    ENABLE_MICROSERVICES: getBool('ENABLE_MICROSERVICES', false),
-    TOKEN_TTL: getInt('TOKEN_TTL', 3600000),
-    TOKEN_LENGTH: getInt('TOKEN_LENGTH', 32),
-    // Encryption interop
-    ENCRYPTION_CIPHER: get('ENCRYPTION_CIPHER', ''),
-    // Deployment
-    ENVIRONMENT: get('ENVIRONMENT', 'development'),
-    REQUEST_TIMEOUT: getInt('REQUEST_TIMEOUT', 30000),
-    APP_TIMEZONE: get('APP_TIMEZONE', 'UTC'),
-    MAX_BODY_SIZE: getInt('MAX_BODY_SIZE', 10485760),
-    SHUTDOWN_TIMEOUT: getInt('SHUTDOWN_TIMEOUT', 10000),
-    // Logging
-    LOG_LEVEL: get('LOG_LEVEL', getDefaultLogLevel()),
-    LOG_FORMAT: get('LOG_FORMAT', 'text'),
-    LOG_CHANNEL: get('LOG_CHANNEL', ''),
-    DISABLE_LOGGING: getBool('DISABLE_LOGGING', false),
-    LOG_HTTP_REQUEST: getBool('LOG_HTTP_REQUEST', false),
-    LOG_TO_FILE: getBool('LOG_TO_FILE', false),
-    LOG_ROTATION_SIZE: getInt('LOG_ROTATION_SIZE', 10485760),
-    LOG_ROTATION_DAYS: getInt('LOG_ROTATION_DAYS', 7),
-    // zintrust-specific
-    ZINTRUST_PROJECT_ROOT: get('ZINTRUST_PROJECT_ROOT', ''),
-    ZINTRUST_ALLOW_POSTINSTALL: get('ZINTRUST_ALLOW_POSTINSTALL', ''),
-    ZINTRUST_ENV_FILE: get('ZINTRUST_ENV_FILE', '.env.pull'),
-    ZINTRUST_SECRETS_MANIFEST: get('ZINTRUST_SECRETS_MANIFEST', 'secrets.manifest.json'),
-    ZINTRUST_ENV_IN_FILE: get('ZINTRUST_ENV_IN_FILE', '.env'),
-    ZINTRUST_SECRETS_PROVIDER: get('ZINTRUST_SECRETS_PROVIDER', ''),
-    ZINTRUST_ALLOW_AUTO_INSTALL: get('ZINTRUST_ALLOW_AUTO_INSTALL', ''),
-    // Cloudflare Credentials
-    CLOUDFLARE_ACCOUNT_ID: get('CLOUDFLARE_ACCOUNT_ID', ''),
-    CLOUDFLARE_API_TOKEN: get('CLOUDFLARE_API_TOKEN', ''),
-    CLOUDFLARE_KV_NAMESPACE_ID: get('CLOUDFLARE_KV_NAMESPACE_ID', ''),
-    // AWS Credentials (additional)
-    AWS_DEFAULT_REGION: get('AWS_DEFAULT_REGION', ''),
-    AWS_ACCESS_KEY_ID: get('AWS_ACCESS_KEY_ID', ''),
-    AWS_SECRET_ACCESS_KEY: get('AWS_SECRET_ACCESS_KEY', ''),
-    AWS_SESSION_TOKEN: get('AWS_SESSION_TOKEN', ''),
-    // CI/CD
-    CI: get('CI', ''),
-    // System paths
-    HOME: get('HOME', ''),
-    USERPROFILE: get('USERPROFILE', ''),
-    // Template/Misc
-    TEMPLATE_COPYRIGHT: get('TEMPLATE_COPYRIGHT', '© 2025 ZinTrust Framework. All rights reserved.'),
-    SERVICE_NAME: get('SERVICE_NAME', ''),
-    APP_MODE: get('APP_MODE', ''),
-    APP_PORT: getInt('APP_PORT', 3000),
-    RUNTIME: get('RUNTIME', ''),
-    // Paths (safely constructed for Node.js environments)
-    NODE_BIN_DIR: (() => {
-        try {
-            if (processLike?.execPath === null || processLike?.execPath === undefined)
-                return '';
-            return dirnameFromExecPath(processLike.execPath, processLike.platform);
-        }
-        catch {
-            // Fallback for non-Node environments
-            return '';
-        }
-    })(),
-    SAFE_PATH: (() => {
-        try {
-            if (processLike?.execPath === null || processLike?.execPath === undefined)
-                return '';
-            const binDir = dirnameFromExecPath(processLike.execPath, processLike.platform);
-            if (processLike.platform === 'win32') {
-                return [String.raw `C:\Windows\System32`, String.raw `C:\Windows`, binDir].join(';');
-            }
-            return ['/usr/bin', '/bin', '/usr/sbin', '/sbin', binDir].join(':');
-        }
-        catch {
-            // Fallback for non-Node environments
-            return '';
-        }
-    })(),
-});

package/src/config/features.d.ts

@@ -1,27 +0,0 @@
-/**
- * Feature Flags - Controls access to advanced/experimental features
- * Sealed namespace for immutability
- */
-export declare const FeatureFlags: Readonly<{
-    /**
-     * Initialize all feature flags from environment
-     * Called once during application bootstrap
-     */
-    initialize(): void;
-    /**
-     * Check if raw queries are enabled
-     * Returns cached flag value (no environment lookup)
-     */
-    isRawQueryEnabled(): boolean;
-    /**
-     * Reset flags (primarily for testing)
-     */
-    reset(): void;
-    /**
-     * Set raw query enabled state
-     * Primarily for testing to avoid 'as any' type casting
-     */
-    setRawQueryEnabled(enabled: boolean): void;
-}>;
-export default FeatureFlags;
-//# sourceMappingURL=features.d.ts.map

package/src/config/features.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../../src/config/features.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB;;;OAGG;kBACW,IAAI;IAclB;;;OAGG;yBACkB,OAAO;IAI5B;;OAEG;aACM,IAAI;IAIb;;;OAGG;gCACyB,OAAO,GAAG,IAAI;EAG1C,CAAC;AAEH,eAAe,YAAY,CAAC"}