@zintrust/core 0.1.27 → 0.1.28

package/dist/src/index.js

@@ -0,0 +1,212 @@
+/**
+ * @zintrust/core v0.1.28
+ *
+ * ZinTrust Framework - Production-Grade TypeScript Backend
+ * Built for performance, type safety, and exceptional developer experience
+ *
+ * Build Information:
+ *   Built: 2026-01-28T22:41:09.126Z
+ *   Node: >=20.0.0
+ *   License: MIT
+ *
+ * Copyright (c) 2026 ZinTrust
+ * https://zintrust.com
+ */
+/**
+ * ZinTrust Framework - Production-Grade TypeScript Backend
+ * Built for performance, type safety, and exceptional developer experience
+ */
+/**
+ * Framework version and build metadata
+ * Available at runtime for debugging and health checks
+ */
+export const ZINTRUST_VERSION = '0.1.23';
+export const ZINTRUST_BUILD_DATE = '2026-01-28T22:41:09.085Z'; // Replaced during build
+import { Application } from './boot/Application.js';
+import { AwsSigV4 } from './common/index.js';
+import { SignedRequest } from './security/SignedRequest.js';
+const ZintrustApplication = Application;
+const ZintrustAwsSigV4 = AwsSigV4;
+const ZintrustSignedRequest = SignedRequest;
+export { Server } from './boot/Server.js';
+export { ServiceContainer } from './container/ServiceContainer.js';
+export { createPaginator, getNextPageUrl, getPrevPageUrl, Paginator } from './database/Paginator.js';
+export { Controller } from './http/Controller.js';
+export { FileUpload } from './http/FileUpload.js';
+export { Kernel } from './http/Kernel.js';
+export { bodyParsingMiddleware } from './http/middleware/BodyParsingMiddleware.js';
+export { fileUploadMiddleware } from './http/middleware/FileUploadMiddleware.js';
+export { BodyParsers } from './http/parsers/BodyParsers.js';
+export { MultipartParser } from './http/parsers/MultipartParser.js';
+export { MultipartParserRegistry } from './http/parsers/MultipartParserRegistry.js';
+export { Request } from './http/Request.js';
+export { RequestContext } from './http/RequestContext.js';
+export { Response } from './http/Response.js';
+export { getValidatedBody, getValidatedHeaders, getValidatedParams, getValidatedQuery, hasValidatedBody, requireValidatedBody, ValidationHelper, } from './http/ValidationHelper.js';
+export { CsrfMiddleware } from './middleware/CsrfMiddleware.js';
+export { ErrorHandlerMiddleware } from './middleware/ErrorHandlerMiddleware.js';
+export { LoggingMiddleware } from './middleware/LoggingMiddleware.js';
+export { MiddlewareStack } from './middleware/MiddlewareStack.js';
+export { RateLimiter } from './middleware/RateLimiter.js';
+export { SecurityMiddleware } from './middleware/SecurityMiddleware.js';
+export { SessionMiddleware } from './middleware/SessionMiddleware.js';
+export { ValidationMiddleware } from './middleware/ValidationMiddleware.js';
+export { MySQLAdapter } from './orm/adapters/MySQLAdapter.js';
+export { PostgreSQLAdapter } from './orm/adapters/PostgreSQLAdapter.js';
+export { SQLiteAdapter } from './orm/adapters/SQLiteAdapter.js';
+export { SQLServerAdapter } from './orm/adapters/SQLServerAdapter.js';
+export { Database, resetDatabase, useDatabase, useEnsureDbConnected } from './orm/Database.js';
+export { Model } from './orm/Model.js';
+export { QueryBuilder } from './orm/QueryBuilder.js';
+export { ZintrustApplication as Application };
+// Time Utilities
+export { DateTime } from './time/DateTime.js';
+// Migrations
+// Note: `Schema` is already exported by Validation. We expose the migration schema runtime
+// as `MigrationSchema` to avoid name collisions.
+export { Schema as MigrationSchema } from './migrations/schema/index.js';
+// Adapter registry (for external adapter packages)
+export { OpenApiGenerator } from './openapi/OpenApiGenerator.js';
+export { Router } from './routes/Router.js';
+export { normalizeRouteMeta, RouteRegistry } from './routes/RouteRegistry.js';
+export { DatabaseAdapterRegistry } from './orm/DatabaseAdapterRegistry.js';
+// Common
+export { generateSecureJobId, generateUuid, getString, Utilities, } from './common/utility.js';
+export { delay, ensureDirSafe } from './common/index.js';
+export { ZintrustAwsSigV4 as AwsSigV4 };
+// Collections
+export { collect, Collection } from './collections/index.js';
+// HTTP Client
+export { HttpClient } from './tools/http/Http.js';
+// Profiling
+export { MemoryProfiler } from './profiling/MemoryProfiler.js';
+export { N1Detector } from './profiling/N1Detector.js';
+export { QueryLogger } from './profiling/QueryLogger.js';
+export { RequestProfiler } from './profiling/RequestProfiler.js';
+// Performance
+export { GenerationCache, LazyLoader, Memoize, ParallelGenerator, PerformanceOptimizer, runAll, runBatch, } from './performance/Optimizer.js';
+// Observability
+export { OpenTelemetry } from './observability/OpenTelemetry.js';
+export { PrometheusMetrics } from './observability/PrometheusMetrics.js';
+// Validation
+export { ValidationError } from './validation/ValidationError.js';
+export { Schema, Validator } from './validation/Validator.js';
+// Security
+export { CsrfTokenManager } from './security/CsrfTokenManager.js';
+export { EncryptedEnvelope } from './security/EncryptedEnvelope.js';
+export { Encryptor } from './security/Encryptor.js';
+export { Hash } from './security/Hash.js';
+export { JwtManager } from './security/JwtManager.js';
+export { PasswordResetTokenBroker } from './security/PasswordResetTokenBroker.js';
+export { createSanitizer, Sanitizer } from './security/Sanitizer.js';
+export { TokenRevocation } from './security/TokenRevocation.js';
+export { Xss } from './security/Xss.js';
+export { XssProtection } from './security/XssProtection.js';
+export { ZintrustSignedRequest as SignedRequest };
+// Exceptions
+export { ErrorFactory } from './exceptions/ZintrustError.js';
+// Events
+export { EventDispatcher } from './events/EventDispatcher.js';
+// Sessions
+export { SessionManager } from './session/SessionManager.js';
+// Config (core-owned)
+export { Env } from './config/env.js';
+export { Logger } from './config/logger.js';
+export { appConfig } from './config/app.js';
+export { cacheConfig } from './config/cache.js';
+// Cache helpers
+export { Cache, cache } from './cache/Cache.js';
+export { registerCachesFromRuntimeConfig } from './cache/CacheRuntimeRegistration.js';
+// Cache driver registry (for external driver packages)
+export { CacheDriverRegistry } from './cache/CacheDriverRegistry.js';
+export { databaseConfig } from './config/database.js';
+export { registerDatabasesFromRuntimeConfig } from './orm/DatabaseRuntimeRegistration.js';
+export { microservicesConfig } from './config/microservices.js';
+// Microservices
+export { MicroserviceBootstrap } from './microservices/MicroserviceBootstrap.js';
+export { MicroserviceManager } from './microservices/MicroserviceManager.js';
+export { RequestTracingMiddleware } from './microservices/RequestTracingMiddleware.js';
+export { ServiceAuthMiddleware } from './microservices/ServiceAuthMiddleware.js';
+export { HealthCheckHandler, ServiceHealthMonitor } from './microservices/ServiceHealthMonitor.js';
+export { middlewareConfig, MiddlewareKeys } from './config/middleware.js';
+export { createBaseDrivers, queueConfig } from './config/queue.js';
+export { default as broadcastConfig } from './config/broadcast.js';
+export { default as notificationConfig } from './config/notification.js';
+export { securityConfig } from './config/security.js';
+export { mailConfig } from './config/mail.js';
+export { storageConfig } from './config/storage.js';
+export { startupConfig } from './config/startup.js';
+export { Constants, DEFAULTS, ENV_KEYS, HTTP_HEADERS, MIME_TYPES } from './config/constants.js';
+export { FeatureFlags } from './config/features.js';
+export { Cloudflare } from './config/cloudflare.js';
+export { getDatabaseCredentials, getJwtSecrets, SECRETS, SecretsManager, } from './config/SecretsManager.js';
+// Config (validation)
+export { StartupConfigValidator } from './config/StartupConfigValidator.js';
+// Mail
+export { Mail } from './tools/mail/index.js';
+export { MailTemplateRenderer, MailTemplates } from './tools/mail/templates/index.js';
+// Mail driver registry (for external driver packages)
+export { MailDriverRegistry } from './tools/mail/MailDriverRegistry.js';
+export { registerQueuesFromRuntimeConfig } from './tools/queue/QueueRuntimeRegistration.js';
+export { SmtpDriver } from './tools/mail/drivers/Smtp.js';
+export { SendGridDriver } from './tools/mail/drivers/SendGrid.js';
+export { MailgunDriver } from './tools/mail/drivers/Mailgun.js';
+// Notifications
+export { sendSlackWebhook } from './tools/notification/drivers/Slack.js';
+export { TermiiDriver } from './tools/notification/drivers/Termii.js';
+export { sendSms } from './tools/notification/drivers/Twilio.js';
+export { Notification } from './tools/notification/Notification.js';
+export { NotificationRegistry } from './tools/notification/Registry.js';
+// Templates
+export { MarkdownRenderer } from './tools/templates/index.js';
+// Health & Runtime (for scaffolded routes and health checks)
+export { RuntimeHealthProbes } from './health/RuntimeHealthProbes.js';
+// Broadcast (for real-time features)
+export { Broadcast } from './tools/broadcast/Broadcast.js';
+export { BroadcastRegistry } from './tools/broadcast/BroadcastRegistry.js';
+export { registerBroadcastersFromRuntimeConfig } from './tools/broadcast/BroadcastRuntimeRegistration.js';
+export { BroadcastWorker } from '../packages/workers/src/index.js';
+// Notification Workers
+export { NotificationWorker } from '../packages/workers/src/index.js';
+// Storage (for file management and signed URLs)
+export { Storage } from './tools/storage/index.js';
+export { LocalSignedUrl } from './tools/storage/LocalSignedUrl.js';
+export { StorageDriverRegistry } from './tools/storage/StorageDriverRegistry.js';
+export { S3Driver } from './tools/storage/drivers/S3.js';
+export { R2Driver } from './tools/storage/drivers/R2.js';
+export { GcsDriver } from './tools/storage/drivers/Gcs.js';
+// Queue drivers (for external registration packages)
+export { RedisQueue } from './tools/queue/drivers/Redis.js';
+export { createLockProvider, getLockProvider, registerLockProvider } from './tools/queue/LockProvider.js';
+export { Queue, resolveLockPrefix } from './tools/queue/Queue.js';
+// Seeders (for database seeding)
+export { SeederLoader } from './seeders/SeederLoader.js';
+// Schedules
+export { default as logCleanup } from './schedules/log-cleanup.js';
+// Node Singletons (cross-runtime wrappers for Node.js APIs)
+export * as NodeSingletons from './node-singletons/index.js';
+// Auth features
+export { Auth } from './auth/Auth.js';
+// Microservice utilities
+export { MicroserviceGenerator } from './microservices/MicroserviceGenerator.js';
+// CLI utilities (for build tools and scripting)
+export { BaseCommand } from './cli/BaseCommand.js';
+export { CLI } from './cli/CLI.js';
+export { ErrorHandler, EXIT_CODES } from './cli/ErrorHandler.js';
+// Runtime detection and kernel
+export { getKernel } from './runtime/getKernel.js';
+export { useFileLoader } from './runtime/useFileLoader.js';
+// Plugin system
+export { PluginManager } from './runtime/PluginManager.js';
+export { PluginRegistry } from './runtime/PluginRegistry.js';
+export { nowIso } from './common/utility.js';
+export { randomBytes } from './node-singletons/crypto.js';
+// Redis config
+export * from './config/redis.js';
+export { ZintrustLang } from './lang/lang.js';
+// Workers config
+export { createRedisConnection, workersConfig } from './config/workers.js';
+// Redis config key
+export { createBullMQKey, createCacheKey, createKeyByType, createQueueKey, createRedisKey, createSessionKey, createWorkerKey, extractOriginalKey, getBullMQSafeQueueName, getPrefix, isAppKey, } from './tools/redis/RedisKeyManager.js';
+// NOTE: Node-only exports (like FileLogWriter, process) are intentionally not
+// exported from this root entrypoint. Use the '@zintrust/core/node' subpath.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {
@@ -11,55 +11,110 @@
     "url": "https://github.com/ZinTrust/ZinTrust/issues"
   },
   "type": "module",
-  "main": "src/index.js",
-  "types": "src/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.d.ts",
-      "import": "./src/index.js"
-    },
-    "./start": {
-      "types": "./src/start.d.ts",
-      "import": "./src/start.js"
-    },
-    "./node": {
-      "types": "./src/node.d.ts",
-      "import": "./src/node.js"
-    },
-    "./routes/*": {
-      "types": "./routes/*.d.ts",
-      "import": "./routes/*.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "dependencies": {
-    "bcrypt": "^6.0.0",
-    "chalk": "^5.6.2",
-    "commander": "^14.0.2",
-    "inquirer": "^13.2.1",
-    "jsonwebtoken": "^9.0.3"
-  },
-  "overrides": {
-    "node-forge": "1.3.3",
-    "cross-spawn": "^7.0.5",
-    "glob": "^11.1.0",
-    "undici": "^6.23.0"
-  },
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
   "bin": {
-    "zintrust": "bin/zintrust.js",
-    "zin": "bin/zin.js",
-    "z": "bin/z.js",
-    "zt": "bin/zt.js"
+    "zintrust": "./bin/zintrust.ts",
+    "zin": "./bin/zin.ts",
+    "z": "./bin/z.ts",
+    "zt": "./bin/zt.ts"
   },
   "files": [
     "bin",
     "src",
-    "public"
+    "public",
+    "index.js",
+    "index.d.ts"
   ],
   "engines": {
     "node": ">=20.0.0",
     "npm": ">=9.0.0"
   },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "core:link-dist": "mkdir -p node_modules/@zintrust && rm -rf node_modules/@zintrust/core && ln -s ../../dist node_modules/@zintrust/core && ls -la node_modules/@zintrust/core && cat node_modules/@zintrust/core/package.json | head -n 8",
+    "prebuild": "node scripts/toggle-dev-routes.mjs comment",
+    "build": "npm run clean && npm run -s coverage:patch && npm run templates:check && tsc && tsc-alias && node scripts/rewrite-dist-tsconfig-aliases.mjs && node scripts/fix-dist-esm-imports.mjs && node scripts/copy-cli-templates-to-dist.mjs && node scripts/copy-getting-started-to-dist-readme.mjs && node scripts/copy-docs-public-to-dist.mjs && node scripts/generate-dist-package.mjs && node scripts/replace-build-placeholders.mjs && node scripts/add-version-banner.mjs && node scripts/generate-build-manifest.mjs && npm run packages:build:all",
+    "core:build:dist": "npm run clean && npm run templates:check && tsc && tsc-alias && node scripts/rewrite-dist-tsconfig-aliases.mjs && node scripts/fix-dist-esm-imports.mjs && node scripts/copy-cli-templates-to-dist.mjs && node scripts/copy-getting-started-to-dist-readme.mjs && node scripts/copy-docs-public-to-dist.mjs && node scripts/generate-dist-package.mjs && node scripts/replace-build-placeholders.mjs && node scripts/add-version-banner.mjs && node scripts/generate-build-manifest.mjs",
+    "postbuild": "node scripts/toggle-dev-routes.mjs uncomment",
+    "build:ci": "export CI=true && npm run clean && npm run templates:check && tsc && tsc-alias && node scripts/rewrite-dist-tsconfig-aliases.mjs && node scripts/copy-docs-public-to-dist.mjs && node scripts/fix-dist-esm-imports.mjs && node scripts/generate-dist-package.mjs && node scripts/replace-build-placeholders.mjs && node scripts/add-version-banner.mjs && node scripts/generate-build-manifest.mjs && npm run packages:build:all",
+    "prebuild:ci": "node scripts/toggle-dev-routes.mjs comment",
+    "prepro:build": "node scripts/toggle-dev-routes.mjs comment",
+    "pro:build": "npm run clean && npm test && npm run templates:check && tsc && tsc-alias && node scripts/rewrite-dist-tsconfig-aliases.mjs && node scripts/fix-dist-esm-imports.mjs && node scripts/copy-docs-public-to-dist.mjs && node scripts/copy-cli-templates-to-dist.mjs && node scripts/copy-getting-started-to-dist-readme.mjs && node scripts/generate-dist-package.mjs && node scripts/replace-build-placeholders.mjs && node scripts/add-version-banner.mjs && node scripts/generate-build-manifest.mjs && npm run packages:build:all",
+    "watch": "tsc --watch --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "coverage:diff": "tsx dev/coverage-diff.ts",
+    "coverage:patch": "sh scripts/coverage-patch.sh",
+    "lint": "eslint .",
+    "format": "prettier --write 'src/**/*.ts'",
+    "packages:build": "node scripts/build-all-packages.mjs",
+    "packages:build:all": "node scripts/build-all-packages.mjs --all",
+    "dev": "./bin/z.ts s",
+    "deploy": "cd docs-website && wrangler types && wrangler deploy --env ${WRANGLER_ENV:-production}",
+    "templates:sync": "npm run templates:check && node -e \"console.log('templates:sync is disabled for now (no auto-updates). Update src/templates manually.');\"",
+    "templates:check": "tsx src/scripts/TemplateImportsCheck.ts",
+    "env:generate": "tsx src/scripts/GenerateEnvArtifacts.ts",
+    "git-reload": "git rm -r --cached .  && git add .",
+    "start": "node dist/src/bootstrap.js",
+    "type-check": "tsc --noEmit",
+    "test:sonar": "vitest run --coverage && tsx dev/sonar-scan.ts",
+    "sonarqube": "tsx dev/sonar-scan.ts",
+    "sonarqube:setup": "node dev/sonarqube-setup.js",
+    "sonarcloud:issues": "tsx dev/sonarcloud-issues.ts",
+    "sonarcloud:issues:low": "tsx dev/sonarcloud-issues.ts --low --open",
+    "sonarcloud:issues:measures": "tsx dev/sonarcloud-issues.ts --measures",
+    "sonarcloud:check": "bash dev/sonarcloud-check.sh",
+    "docker:build": "docker build -t zintrust:latest .",
+    "docker:build:prod": "docker build -t zintrust:latest --target runtime .",
+    "docker:up": "docker-compose up -d",
+    "docker:down": "docker-compose down",
+    "docker:stop": "docker-compose stop",
+    "docker:logs": "docker-compose logs -f app",
+    "docker:shell": "docker-compose run --rm app sh",
+    "docker:test": "docker-compose exec app npm test",
+    "docker:migrate": "docker-compose exec app node dist/bootstrap.js migrate",
+    "microservices:generate": "tsx bin/zintrust-microservices.ts generate",
+    "microservices:bundle": "tsx bin/zintrust-microservices.ts bundle",
+    "microservices:docker": "tsx bin/zintrust-microservices.ts docker",
+    "microservices:discover": "tsx bin/zintrust-microservices.ts discover",
+    "microservices:status": "tsx bin/zintrust-microservices.ts status",
+    "microservices:health": "tsx bin/zintrust-microservices.ts health",
+    "docs:dev:vue": "cd docs-website/vue && npm run dev",
+    "docs:dev": "node scripts/docs-website-dev.mjs --port 7030",
+    "docs:build:vue": "mkdir -p docs-website/vue/public && cp docs-website/zintrust.svg docs-website/vue/public/ && cp docs/*.md docs-website/vue/ && cd docs-website/vue && npm run build && cp -R .vitepress/dist/* ../public/",
+    "docs:build:portal": "node scripts/docs-build-portal.mjs",
+    "docs:build:all": "rm -rf docs-website/public && npm run docs:build:portal && npm run docs:build:vue",
+    "docs:brand:png": "node scripts/convert-brand-svgs-to-png.mjs --input docs-website/brand --max 2048",
+    "dbl": "npm run docs:build:all",
+    "zintrust:prepare": "tsx bin/zintrust.ts prepare",
+    "ecommerce:up": "cd services/ecommerce && docker-compose up -d",
+    "ecommerce:down": "cd services/ecommerce && docker-compose down",
+    "ecommerce:logs": "cd services/ecommerce && docker-compose logs -f",
+    "cleanup:github-actions": "bash ./dev/cleanup-github-actions.sh",
+    "commemtout": "bash ./scripts/disable-plugins-import.sh",
+    "duplication:check": "node scripts/ci/duplication-check.mjs",
+    "prepare": "node -e \"const omit=(process.env.npm_config_omit||'').split(',').map(s=>s.trim()).filter(Boolean); const skip=process.env.NODE_ENV==='production'||process.env.CI==='true'||process.env.CI==='1'||omit.includes('dev'); process.exit(skip?0:1)\" || husky",
+    "postinstall": "node -e \"process.exit(0)\"",
+    "check-up": "npx npm-check-updates",
+    "pub": "npm run pro:build && cd dist && npm publish",
+    "pub:ci": "cd dist && npm publish --access public",
+    "rebuild:bcrypt": "npm rebuild bcrypt",
+    "rebuild:native": "npm rebuild bcrypt better-sqlite3",
+    "b:push": "npm run lint --max-warnings=0",
+    "bg": "npm install -g /opt/homebrew/var/www/Sites/zintrust/dist",
+    "release:sync-versions": "node scripts/release/sync-package-versions.mjs",
+    "release:publish-packages": "node scripts/release/publish-packages.mjs",
+    "release:publish-all": "npm run release:sync-versions && npm run release:publish-packages",
+    "cag": "npm run cleanup:github-actions",
+    "core": "npm run core:build:dist"
+  },
+  "lint-staged": {
+    "src/**/*.ts": [
+      "eslint --fix"
+    ]
+  },
   "keywords": [
     "framework",
     "typescript",
@@ -76,7 +131,50 @@
   ],
   "author": "ZinTrust Team",
   "license": "MIT",
-  "publishConfig": {
-    "access": "public"
+  "overrides": {
+    "node-forge": "1.3.3",
+    "cross-spawn": "^7.0.5",
+    "glob": "^11.1.0",
+    "undici": "^6.23.0"
+  },
+  "dependencies": {
+    "bcrypt": "^6.0.0",
+    "chalk": "^5.6.2",
+    "commander": "^14.0.2",
+    "inquirer": "^13.2.1",
+    "jsonwebtoken": "^9.0.3"
+  },
+  "devDependencies": {
+    "@codecov/vite-plugin": "^1.9.1",
+    "@faker-js/faker": "^10.2.0",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/resources": "^2.5.0",
+    "@opentelemetry/sdk-node": "^0.211.0",
+    "@opentelemetry/semantic-conventions": "^1.39.0",
+    "@resvg/resvg-js": "^2.6.2",
+    "@types/bcrypt": "^6.0.0",
+    "@types/better-sqlite3": "7.6.13",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^25.0.10",
+    "@types/pg": "^8.16.0",
+    "@typescript-eslint/eslint-plugin": "^8.54.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "better-sqlite3": "^12.6.2",
+    "bullmq": "^5.67.1",
+    "eslint": "^9.39.2",
+    "globals": "^17.1.0",
+    "hot-shots": "^13.1.0",
+    "husky": "^9.1.7",
+    "ioredis": "^5.9.2",
+    "jscpd": "^4.0.7",
+    "lint-staged": "^16.2.7",
+    "prettier": "^3.8.1",
+    "prom-client": "^15.1.3",
+    "sonarqube-scanner": "^4.3.4",
+    "tsc-alias": "^1.8.16",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.54.0",
+    "vitest": "^4.0.18"
   }
 }

package/src/auth/Auth.ts

@@ -0,0 +1,42 @@
+// TEMPLATE_START
+import * as bcrypt from 'bcrypt';
+import jwt, { type Secret, type SignOptions } from 'jsonwebtoken';
+
+const { sign, verify } = jwt;
+
+export const Auth = Object.freeze({
+  /**
+   * Hash a password
+   */
+  async hash(password: string): Promise<string> {
+    const salt = await bcrypt.genSalt(10);
+    return bcrypt.hash(password, salt);
+  },
+
+  /**
+   * Compare a password with a hash
+   */
+  async compare(password: string, hash: string): Promise<boolean> {
+    return bcrypt.compare(password, hash);
+  },
+
+  /**
+   * Generate a JWT token
+   */
+  generateToken(
+    payload: Record<string, unknown>,
+    secret: Secret,
+    expiresIn: NonNullable<SignOptions['expiresIn']> = '1h'
+  ): string {
+    const options: SignOptions = { expiresIn };
+    return sign(payload, secret, options);
+  },
+
+  /**
+   * Verify a JWT token
+   */
+  verifyToken<T>(token: string, secret: Secret): T {
+    return verify(token, secret) as T;
+  },
+});
+// TEMPLATE_END