@zintrust/core 0.1.28 → 0.1.29

package/src/config/queue.js

@@ -0,0 +1,144 @@
+/**
+ * Queue Configuration
+ * Background job and message queue settings
+ * Sealed namespace for immutability
+ */
+import { Env } from './env.js';
+import { StartupConfigFile, StartupConfigFileRegistry } from '../runtime/StartupConfigFileRegistry.js';
+const getQueueDriver = (config) => {
+    const driverName = config.default;
+    return config.drivers[driverName];
+};
+/**
+ * Helper: Create base driver configurations from environment
+ */
+export const createBaseDrivers = () => ({
+    sync: {
+        driver: 'sync',
+    },
+    database: {
+        driver: 'database',
+        table: Env.get('QUEUE_TABLE', 'jobs'),
+        connection: Env.get('QUEUE_DB_CONNECTION', 'default'),
+    },
+    redis: {
+        driver: 'redis',
+        host: Env.get('REDIS_HOST', 'localhost'),
+        port: Env.getInt('REDIS_PORT', 6379),
+        password: Env.get('REDIS_PASSWORD'),
+        database: Env.getInt('REDIS_QUEUE_DB', 1),
+    },
+    rabbitmq: {
+        driver: 'rabbitmq',
+        host: Env.get('RABBITMQ_HOST', 'localhost'),
+        port: Env.getInt('RABBITMQ_PORT', 5672),
+        username: Env.get('RABBITMQ_USER', 'guest'),
+        password: Env.get('RABBITMQ_PASSWORD', 'guest'),
+        vhost: Env.get('RABBITMQ_VHOST', '/'),
+    },
+    sqs: {
+        driver: 'sqs',
+        key: Env.get('AWS_ACCESS_KEY_ID'),
+        secret: Env.get('AWS_SECRET_ACCESS_KEY'),
+        region: Env.AWS_REGION,
+        queueUrl: Env.get('AWS_SQS_QUEUE_URL'),
+    },
+});
+/**
+ * Helper: Create monitor configuration from environment
+ */
+const createBaseMonitor = () => ({
+    enabled: Env.getBool('QUEUE_MONITOR_ENABLED', true),
+    basePath: Env.get('QUEUE_MONITOR_BASE_PATH', '/queue-monitor'),
+    middleware: Env.get('QUEUE_MONITOR_MIDDLEWARE', '')
+        .split(',')
+        .map((m) => m.trim())
+        .filter((m) => m.length > 0),
+    autoRefresh: Env.getBool('QUEUE_MONITOR_AUTO_REFRESH', true),
+    refreshIntervalMs: Env.getInt('QUEUE_MONITOR_REFRESH_MS', 5000),
+});
+const createQueueConfig = () => {
+    const overrides = StartupConfigFileRegistry.get(StartupConfigFile.Queue) ?? {};
+    const baseDefault = Env.get('QUEUE_DRIVER', 'sync');
+    const baseDrivers = createBaseDrivers();
+    const baseFailed = {
+        database: Env.get('FAILED_JOBS_DB_CONNECTION', 'default'),
+        table: Env.get('FAILED_JOBS_TABLE', 'failed_jobs'),
+    };
+    const baseProcessing = {
+        timeout: Env.getInt('QUEUE_JOB_TIMEOUT', 60),
+        retries: Env.getInt('QUEUE_JOB_RETRIES', 3),
+        backoff: Env.getInt('QUEUE_JOB_BACKOFF', 0),
+        workers: Env.getInt('QUEUE_WORKERS', 1),
+    };
+    const baseMonitor = createBaseMonitor();
+    const mergedDrivers = {
+        ...baseDrivers,
+        ...overrides.drivers,
+    };
+    const queueConfigObj = {
+        /**
+         * Default queue driver
+         */
+        default: overrides.default ?? baseDefault,
+        /**
+         * Queue drivers
+         */
+        drivers: mergedDrivers,
+        /**
+         * Get queue driver config
+         */
+        getDriver() {
+            return getQueueDriver(this);
+        },
+        /**
+         * Failed jobs table
+         */
+        failed: {
+            ...baseFailed,
+            ...overrides.failed,
+        },
+        /**
+         * Job processing
+         */
+        processing: {
+            ...baseProcessing,
+            ...overrides.processing,
+        },
+        /**
+         * Queue Monitor settings
+         */
+        monitor: {
+            ...baseMonitor,
+            ...overrides.monitor,
+        },
+    };
+    return Object.freeze(queueConfigObj);
+};
+let cached = null;
+const proxyTarget = {};
+const ensureQueueConfig = () => {
+    if (cached)
+        return cached;
+    cached = createQueueConfig();
+    try {
+        Object.defineProperties(proxyTarget, Object.getOwnPropertyDescriptors(cached));
+    }
+    catch {
+        // best-effort
+    }
+    return cached;
+};
+export const queueConfig = new Proxy(proxyTarget, {
+    get(_target, prop) {
+        return ensureQueueConfig()[prop];
+    },
+    ownKeys() {
+        ensureQueueConfig();
+        return Reflect.ownKeys(proxyTarget);
+    },
+    getOwnPropertyDescriptor(_target, prop) {
+        ensureQueueConfig();
+        return Object.getOwnPropertyDescriptor(proxyTarget, prop);
+    },
+});

package/src/config/redis.d.ts

@@ -0,0 +1,17 @@
+import type { RedisBroadcastDriverConfig } from './type';
+import type { QueueMessage } from '../tools/queue/Queue';
+export type QueueDriver = {
+    enqueue<T = unknown>(queue: string, payload: T): Promise<string>;
+    dequeue<T = unknown>(queue: string): Promise<QueueMessage<T> | undefined>;
+    ack(queue: string, id: string): Promise<void>;
+    length(queue: string): Promise<number>;
+    drain(queue: string): Promise<void>;
+};
+export type RedisPublishClient = {
+    connect?: () => Promise<void>;
+    publish(channel: string, message: string): Promise<number>;
+};
+export declare const buildRedisUrl: (config?: RedisBroadcastDriverConfig) => string;
+export declare const getRedisUrl: (config?: RedisBroadcastDriverConfig) => string | null;
+export declare const ensureDriver: <T = QueueDriver>(type?: "queue" | "publish") => Promise<T>;
+//# sourceMappingURL=redis.d.ts.map

package/src/config/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/config/redis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1E,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,0BAA0B,KAAG,MAYnE,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,SAAS,0BAA0B,KAAG,MAAM,GAAG,IAW1E,CAAC;AAEF,eAAO,MAAM,YAAY,GAAU,CAAC,GAAG,WAAW,EAAE,OAAO,OAAO,GAAG,SAAS,KAAG,OAAO,CAAC,CAAC,CAqCzF,CAAC"}

package/src/config/redis.js

@@ -0,0 +1,54 @@
+import { Env } from './env.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { Queue } from '../tools/queue/Queue.js';
+export const buildRedisUrl = (config) => {
+    // Otherwise build URL from individual settings (like cache driver)
+    const host = config?.host ?? Env.get('REDIS_HOST', 'localhost');
+    const port = config?.port ?? Env.getInt('REDIS_PORT', 6379);
+    const password = config?.password ?? Env.get('REDIS_PASSWORD');
+    const database = config?.database ?? Env.getInt('REDIS_QUEUE_DB', 1);
+    let redisUrl = `redis://`;
+    if (password)
+        redisUrl += `:${password}@`;
+    redisUrl += `${host}:${port}`;
+    if (database > 0)
+        redisUrl += `/${database}`;
+    return redisUrl;
+};
+export const getRedisUrl = (config) => {
+    const fromEnv = Env.get('REDIS_URL', '');
+    const hasProcess = typeof process === 'object' && process !== null;
+    const fallback = hasProcess ? (process.env?.['REDIS_URL'] ?? '') : '';
+    const trimmed = fromEnv.trim();
+    const url = (trimmed.length > 0 ? fromEnv : String(fallback)).trim();
+    // If REDIS_URL exists, use it
+    if (url.length > 0)
+        return url;
+    return buildRedisUrl(config);
+};
+export const ensureDriver = async (type) => {
+    if (type === 'publish') {
+        // Return Redis publish client with publish() method from package
+        const mod = (await import('../../packages/queue-redis/src/index.js'));
+        if (mod.createRedisPublishClient) {
+            return mod.createRedisPublishClient();
+        }
+        throw ErrorFactory.createConfigError('Redis publish client is not available in queue-redis package');
+    }
+    // Return queue driver (current behavior)
+    try {
+        return Queue.get('redis');
+    }
+    catch {
+        try {
+            const mod = (await import('../../packages/queue-redis/src/index.js'));
+            if (mod.RedisQueue !== undefined) {
+                Queue.register('redis', mod.RedisQueue);
+            }
+            return Queue.get('redis');
+        }
+        catch (error) {
+            throw ErrorFactory.createConfigError('Redis queue driver is not registered. Install queue:redis via zin plugin install.', error);
+        }
+    }
+};

package/src/config/security.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Security Configuration
+ * JWT, CSRF, encryption and other security settings
+ * Sealed namespace for immutability
+ *
+ * APP_KEY: Primary encryption key for storage signing and app-level encryption.
+ *          Set automatically during project scaffolding.
+ *
+ * Security keys can be configured per domain:
+ * - APP_KEY: Default encryption key for all operations (auto-generated)
+ * - API_KEY_SECRET: Optional API key authentication (if API_KEY_ENABLED=true)
+ * - ENCRYPTION_CIPHER: Cipher for encrypted envelope interoperability
+ * - JWT_SECRET: JWT token signing key
+ *
+ * Developers can use a single APP_KEY or configure separate keys for different
+ * security domains (e.g., different keys for different microservices).
+ */
+export declare const securityConfig: Readonly<{
+    /**
+     * JWT Configuration
+     */
+    readonly jwt: {
+        readonly enabled: boolean;
+        readonly secret: string;
+        readonly algorithm: "HS256" | "HS512" | "RS256";
+        readonly expiresIn: number;
+        readonly refreshExpiresIn: string;
+        readonly issuer: string;
+        readonly audience: string;
+    };
+    /**
+     * CSRF Protection
+     */
+    readonly csrf: {
+        readonly enabled: boolean;
+        readonly headerName: string;
+        readonly tokenName: string;
+        readonly cookieName: string;
+        readonly cookieHttpOnly: boolean;
+        readonly cookieSecure: boolean;
+        readonly cookieSameSite: "strict" | "lax" | "none";
+    };
+    /**
+     * Encryption
+     */
+    readonly encryption: {
+        readonly cipher: string;
+        readonly appKey: string;
+        readonly appPreviousKeys: string;
+        readonly algorithm: string;
+        readonly key: string;
+    };
+    /**
+     * API Key Authentication
+     */
+    readonly apiKey: {
+        readonly enabled: boolean;
+        readonly headerName: string;
+        readonly secret: string;
+    };
+    /**
+     * CORS Configuration
+     */
+    readonly cors: {
+        readonly enabled: boolean;
+        readonly origins: string[];
+        readonly methods: string[];
+        readonly allowedHeaders: string[];
+        readonly exposedHeaders: string[];
+        readonly credentials: boolean;
+        readonly maxAge: number;
+    };
+    /**
+     * Rate Limiting
+     */
+    readonly rateLimit: {
+        readonly enabled: boolean;
+        readonly windowMs: number;
+        readonly maxRequests: number;
+        readonly message: string;
+    };
+    /**
+     * XSS Protection
+     */
+    readonly xss: {
+        readonly enabled: boolean;
+        readonly reportUri: string;
+    };
+    /**
+     * Helmet Security Headers
+     */
+    readonly helmet: {
+        readonly enabled: boolean;
+        readonly contentSecurityPolicy: boolean;
+        readonly hsts: {
+            readonly enabled: boolean;
+            readonly maxAge: number;
+            readonly includeSubDomains: boolean;
+        };
+    };
+    /**
+     * Session Configuration
+     */
+    readonly session: {
+        readonly name: string;
+        readonly secret: string;
+        readonly expiresIn: number;
+        readonly secure: boolean;
+        readonly httpOnly: boolean;
+        readonly sameSite: "strict" | "lax" | "none";
+    };
+    /**
+     * Password settings
+     */
+    readonly password: {
+        readonly minLength: number;
+        readonly requireUppercase: boolean;
+        readonly requireNumbers: boolean;
+        readonly requireSpecialChars: boolean;
+        readonly bcryptRounds: number;
+    };
+}>;
+//# sourceMappingURL=security.d.ts.map

package/src/config/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/config/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyJH,eAAO,MAAM,cAAc;IAhIzB;;OAEG;;;yBAGa,MAAM;4BAQ4B,OAAO,GAAG,OAAO,GAAG,OAAO;;;;;;IAO7E;;OAEG;;;;;;;;iCAQ6D,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAGzF;;OAEG;;;;;;;;IAgBH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;IAQH;;OAEG;;;;;IAMH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;2BAOmD,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAG/E;;OAEG;;;;;;;;EAUyD,CAAC"}

package/src/config/security.js

@@ -0,0 +1,154 @@
+/**
+ * Security Configuration
+ * JWT, CSRF, encryption and other security settings
+ * Sealed namespace for immutability
+ *
+ * APP_KEY: Primary encryption key for storage signing and app-level encryption.
+ *          Set automatically during project scaffolding.
+ *
+ * Security keys can be configured per domain:
+ * - APP_KEY: Default encryption key for all operations (auto-generated)
+ * - API_KEY_SECRET: Optional API key authentication (if API_KEY_ENABLED=true)
+ * - ENCRYPTION_CIPHER: Cipher for encrypted envelope interoperability
+ * - JWT_SECRET: JWT token signing key
+ *
+ * Developers can use a single APP_KEY or configure separate keys for different
+ * security domains (e.g., different keys for different microservices).
+ */
+import { appConfig } from './app.js';
+import { Env } from './env.js';
+import { Logger } from './logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+/**
+ * Helper to warn about missing secrets
+ */
+function warnMissingSecret(secretName) {
+    Logger.error(`❌ CRITICAL: ${secretName} environment variable is not set!`);
+    Logger.error('⚠️  Application may not function correctly. Set this in production immediately.');
+    if (appConfig.isProduction()) {
+        throw ErrorFactory.createConfigError(`Missing required secret: ${secretName}`, { secretName });
+    }
+    // In non-production environments, allow the app/CLI to start while still warning loudly.
+    // This is intentionally predictable for local development and test tooling.
+    return 'dev-unsafe-jwt-secret';
+}
+let cachedJwtSecret;
+const securityConfigObj = {
+    /**
+     * JWT Configuration
+     */
+    jwt: {
+        enabled: Env.getBool('JWT_ENABLED', true),
+        get secret() {
+            if (cachedJwtSecret !== undefined)
+                return cachedJwtSecret;
+            const isEnabled = Env.getBool('JWT_ENABLED', true);
+            cachedJwtSecret = isEnabled
+                ? Env.get('JWT_SECRET') || Env.get('APP_KEY') || warnMissingSecret('JWT_SECRET')
+                : Env.get('JWT_SECRET') || Env.get('APP_KEY') || '';
+            return cachedJwtSecret;
+        },
+        algorithm: Env.get('JWT_ALGORITHM', 'HS256'),
+        expiresIn: Env.getInt('JWT_EXPIRES_IN', 60 * 60),
+        refreshExpiresIn: Env.get('JWT_REFRESH_EXPIRES_IN', '7d'),
+        issuer: Env.get('JWT_ISSUER', 'zintrust'),
+        audience: Env.get('JWT_AUDIENCE', 'zintrust-api'),
+    },
+    /**
+     * CSRF Protection
+     */
+    csrf: {
+        enabled: Env.getBool('CSRF_ENABLED', true),
+        headerName: Env.get('CSRF_HEADER_NAME', 'x-csrf-token'),
+        tokenName: Env.get('CSRF_TOKEN_NAME', '_csrf'),
+        cookieName: Env.get('CSRF_COOKIE_NAME', 'XSRF-TOKEN'),
+        cookieHttpOnly: Env.getBool('CSRF_COOKIE_HTTP_ONLY', true),
+        cookieSecure: Env.getBool('CSRF_COOKIE_SECURE', true),
+        cookieSameSite: Env.get('CSRF_COOKIE_SAME_SITE', 'strict'),
+    },
+    /**
+     * Encryption
+     */
+    encryption: {
+        // Required for framework-compatible encrypted payloads.
+        // Supported values: aes-256-cbc | aes-256-gcm (case-insensitive)
+        cipher: Env.get('ENCRYPTION_CIPHER', ''),
+        // Primary key used for encryption interoperability (framework-compatible envelopes).
+        // APP_KEY supports both `base64:...` and raw base64.
+        appKey: Env.get('APP_KEY', ''),
+        appPreviousKeys: Env.get('APP_PREVIOUS_KEYS', ''),
+        // Back-compat fields (not used by EncryptedEnvelope)
+        algorithm: Env.get('ENCRYPTION_ALGORITHM', 'aes-256-cbc'),
+        key: Env.get('ENCRYPTION_KEY', 'your-encryption-key'),
+    },
+    /**
+     * API Key Authentication
+     */
+    apiKey: {
+        enabled: Env.getBool('API_KEY_ENABLED', false),
+        headerName: Env.get('API_KEY_HEADER', 'x-api-key'),
+        secret: Env.get('API_KEY_SECRET'),
+    },
+    /**
+     * CORS Configuration
+     */
+    cors: {
+        enabled: Env.getBool('CORS_ENABLED', true),
+        origins: Env.get('CORS_ORIGINS', '*').split(','),
+        methods: Env.get('CORS_METHODS', 'GET,POST,PUT,PATCH,DELETE').split(','),
+        allowedHeaders: Env.get('CORS_ALLOWED_HEADERS', 'Content-Type,Authorization').split(','),
+        exposedHeaders: Env.get('CORS_EXPOSED_HEADERS', '').split(','),
+        credentials: Env.getBool('CORS_CREDENTIALS', false),
+        maxAge: Env.getInt('CORS_MAX_AGE', 86400),
+    },
+    /**
+     * Rate Limiting
+     */
+    rateLimit: {
+        enabled: Env.getBool('RATE_LIMIT_ENABLED', true),
+        windowMs: Env.getInt('RATE_LIMIT_WINDOW_MS', 900000), // 15 minutes
+        maxRequests: Env.getInt('RATE_LIMIT_MAX_REQUESTS', 100),
+        message: Env.get('RATE_LIMIT_MESSAGE', 'Too many requests, please try again later'),
+    },
+    /**
+     * XSS Protection
+     */
+    xss: {
+        enabled: Env.getBool('XSS_ENABLED', true),
+        reportUri: Env.get('XSS_REPORT_URI'),
+    },
+    /**
+     * Helmet Security Headers
+     */
+    helmet: {
+        enabled: Env.getBool('HELMET_ENABLED', true),
+        contentSecurityPolicy: Env.getBool('CSP_ENABLED', true),
+        hsts: {
+            enabled: Env.getBool('HSTS_ENABLED', true),
+            maxAge: Env.getInt('HSTS_MAX_AGE', 31536000),
+            includeSubDomains: Env.getBool('HSTS_INCLUDE_SUBDOMAINS', true),
+        },
+    },
+    /**
+     * Session Configuration
+     */
+    session: {
+        name: Env.get('SESSION_NAME', 'zintrust_session'),
+        secret: Env.get('SESSION_SECRET', 'your-session-secret'),
+        expiresIn: Env.getInt('SESSION_EXPIRES_IN', 1800000), // 30 minutes
+        secure: Env.getBool('SESSION_SECURE', true),
+        httpOnly: Env.getBool('SESSION_HTTP_ONLY', true),
+        sameSite: Env.get('SESSION_SAME_SITE', 'strict'),
+    },
+    /**
+     * Password settings
+     */
+    password: {
+        minLength: Env.getInt('PASSWORD_MIN_LENGTH', 8),
+        requireUppercase: Env.getBool('PASSWORD_REQUIRE_UPPERCASE', true),
+        requireNumbers: Env.getBool('PASSWORD_REQUIRE_NUMBERS', true),
+        requireSpecialChars: Env.getBool('PASSWORD_REQUIRE_SPECIAL_CHARS', true),
+        bcryptRounds: Env.getInt('BCRYPT_ROUNDS', 10),
+    },
+};
+export const securityConfig = Object.freeze(securityConfigObj);

package/src/config/startup.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Startup Configuration
+ *
+ * Startup-only controls (evaluated during Application.boot()).
+ */
+export type StartupConfig = {
+    healthChecksEnabled: boolean;
+    validateSecrets: boolean;
+    requireEnv: boolean;
+    checkDatabase: boolean;
+    checkCache: boolean;
+    timeoutMs: number;
+    continueOnFailure: boolean;
+};
+export declare const startupConfig: Readonly<{
+    healthChecksEnabled: boolean;
+    validateSecrets: boolean;
+    requireEnv: boolean;
+    checkDatabase: boolean;
+    checkCache: boolean;
+    timeoutMs: number;
+    continueOnFailure: boolean;
+}>;
+export default startupConfig;
+//# sourceMappingURL=startup.d.ts.map

package/src/config/startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../../../src/config/startup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,aAAa,GAAG;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;EAQA,CAAC;AAE3B,eAAe,aAAa,CAAC"}

package/src/config/startup.js

@@ -0,0 +1,16 @@
+/**
+ * Startup Configuration
+ *
+ * Startup-only controls (evaluated during Application.boot()).
+ */
+import { Env } from './env.js';
+export const startupConfig = Object.freeze({
+    healthChecksEnabled: Env.getBool('STARTUP_HEALTH_CHECKS', true),
+    validateSecrets: Env.getBool('STARTUP_VALIDATE_SECRETS', true),
+    requireEnv: Env.getBool('STARTUP_REQUIRE_ENV', false),
+    checkDatabase: Env.getBool('STARTUP_CHECK_DB', false),
+    checkCache: Env.getBool('STARTUP_CHECK_CACHE', false),
+    timeoutMs: Env.getInt('STARTUP_HEALTH_TIMEOUT_MS', 2500),
+    continueOnFailure: Env.getBool('STARTUP_CONTINUE_ON_FAILURE', false),
+});
+export default startupConfig;

package/src/config/storage.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Storage Configuration
+ * File storage and cloud storage settings
+ * Sealed namespace for immutability
+ */
+import type { StorageConfigRuntime, StorageDriverConfig, StorageDrivers } from './type';
+export type StorageConfigOverrides = Partial<{
+    default: string;
+    drivers: Partial<StorageDrivers> & Record<string, StorageDriverConfig>;
+    temp: {
+        path: string;
+        maxAge: number;
+    };
+    uploads: {
+        maxSize: string;
+        allowedMimes: string;
+        path: string;
+    };
+    backups: {
+        path: string;
+        driver: string;
+    };
+}>;
+type StorageRuntimeConfig = StorageConfigRuntime & {
+    getDriver: (this: StorageConfigRuntime) => StorageDriverConfig;
+    getDriverConfig: (this: StorageConfigRuntime, name?: string) => StorageDriverConfig;
+    temp: {
+        path: string;
+        maxAge: number;
+    };
+    uploads: {
+        maxSize: string;
+        allowedMimes: string;
+        path: string;
+    };
+    backups: {
+        path: string;
+        driver: string;
+    };
+};
+declare const createStorageConfig: () => StorageRuntimeConfig;
+export type StorageConfig = ReturnType<typeof createStorageConfig>;
+export declare const storageConfig: StorageConfig;
+export {};
+//# sourceMappingURL=storage.d.ts.map

package/src/config/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/config/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9F,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACvE,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,oBAAoB,GAAG,oBAAoB,GAAG;IACjD,SAAS,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,mBAAmB,CAAC;IAC/D,eAAe,EAAE,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,mBAAmB,CAAC;IACpF,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C,CAAC;AAgEF,QAAA,MAAM,mBAAmB,QAAO,oBAgF/B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAqBnE,eAAO,MAAM,aAAa,EAAE,aAY1B,CAAC"}