@zintrust/core 0.1.40 → 0.1.42

package/src/cli/commands/D1MigrateCommand.js

@@ -1,9 +1,13 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { D1SqlMigrations } from '../d1/D1SqlMigrations.js';
+import { WranglerConfig } from '../d1/WranglerConfig.js';
 import { WranglerD1 } from '../d1/WranglerD1.js';
 import { resolveNpmPath } from '../../common/index.js';
 import { appConfig } from '../../config/app.js';
+import { databaseConfig } from '../../config/database.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import * as path from '../../node-singletons/path.js';
 const RESOLVED_VOID = Promise.resolve();
 const runWrangler = async (cmd, args) => {
     // Back-compat entrypoint for tests; we only use this for D1 migrations apply.
@@ -13,30 +17,64 @@ const runWrangler = async (cmd, args) => {
     await RESOLVED_VOID;
     return WranglerD1.applyMigrations({ cmd, dbName, isLocal });
 };
-const executeD1Migrate = async (cmd, options) => {
+const getDbName = (options) => {
+    const value = options['database'];
+    return typeof value === 'string' && value.trim() !== '' ? value : 'zintrust_db';
+};
+const buildExecutionContext = (options) => {
+    const isWorkerCommand = process.argv.includes('d1:migrate:worker');
     const isLocal = options['local'] === true || options['remote'] !== true;
-    const dbName = typeof options['database'] === 'string' && options['database'].trim() !== ''
-        ? options['database']
-        : 'zintrust_db';
-    cmd.info(`Running D1 migrations for ${dbName} (${isLocal ? 'local' : 'remote'})...`);
+    const dbName = getDbName(options);
+    const projectRoot = process.cwd();
+    const migrationsRelDir = isWorkerCommand
+        ? path.join('database', 'migrations', 'd1')
+        : WranglerConfig.getD1MigrationsDir(projectRoot, dbName);
+    const sourceMigrationsDir = isWorkerCommand
+        ? path.join('packages', 'workers', 'migrations')
+        : databaseConfig.migrations.directory;
+    return {
+        isLocal,
+        dbName,
+        projectRoot,
+        migrationsRelDir,
+        sourceMigrationsDir,
+        outputDir: path.join(projectRoot, migrationsRelDir),
+    };
+};
+const handleMigrationError = (cmd, error) => {
+    Logger.error('D1 Migration failed', error);
+    ErrorFactory.createCliError('D1 Migration failed', error);
+    const err = error;
+    if (err.stdout !== undefined && err.stdout.length > 0)
+        cmd.info(err.stdout.toString());
+    if (err.stderr !== undefined && err.stderr.length > 0) {
+        const stderr = err.stderr.toString();
+        Logger.error('Wrangler stderr', stderr);
+        ErrorFactory.createCliError('Wrangler stderr', stderr);
+    }
+    throw error;
+};
+const executeD1Migrate = async (cmd, options) => {
+    const ctx = buildExecutionContext(options);
+    cmd.info(`Running D1 migrations for ${ctx.dbName} (${ctx.isLocal ? 'local' : 'remote'})...`);
+    cmd.info(`Generating D1 SQL migrations into ${ctx.migrationsRelDir}...`);
     await RESOLVED_VOID;
     try {
-        const output = WranglerD1.applyMigrations({ cmd, dbName, isLocal });
+        const generated = await D1SqlMigrations.compileAndWrite({
+            projectRoot: ctx.projectRoot,
+            globalDir: ctx.sourceMigrationsDir,
+            extension: databaseConfig.migrations.extension,
+            includeGlobal: true,
+            outputDir: ctx.outputDir,
+        });
+        cmd.info(`Generated ${generated.length} SQL migration file(s).`);
+        const output = WranglerD1.applyMigrations({ cmd, dbName: ctx.dbName, isLocal: ctx.isLocal });
         if (output !== '')
             cmd.info(output);
         cmd.info('✓ D1 migrations completed successfully');
     }
     catch (error) {
-        Logger.error('D1 Migration failed', error);
-        ErrorFactory.createCliError('D1 Migration failed', error);
-        const err = error;
-        if (err.stdout !== undefined && err.stdout.length > 0)
-            cmd.info(err.stdout.toString());
-        if (err.stderr !== undefined && err.stderr.length > 0)
-            Logger.error('Wrangler stderr', err.stderr.toString());
-        if (err.stderr !== undefined && err.stderr.length > 0)
-            ErrorFactory.createCliError('Wrangler stderr', err.stderr.toString());
-        throw error;
+        handleMigrationError(cmd, error);
     }
 };
 /**
@@ -60,6 +98,7 @@ export const D1MigrateCommand = Object.freeze({
         const cmd = BaseCommand.create({
             name: 'd1:migrate',
             description: 'Run Cloudflare D1 migrations',
+            aliases: ['d1:migrate:worker'],
             addOptions,
             execute: async (options) => executeD1Migrate(cmd, options),
         });

package/src/cli/commands/DeployCommand.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Deploy Command - Deploy ZinTrust to Cloudflare Workers
+ * Handles deployment of workers and proxies
+ */
+import type { IBaseCommand } from '../BaseCommand';
+/**
+ * Deploy Command Factory
+ * Sealed namespace for immutability
+ */
+export declare const DeployCommand: Readonly<{
+    /**
+     * Create a deploy command instance
+     */
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=DeployCommand.d.ts.map

package/src/cli/commands/DeployCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeployCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0HrE;;;GAGG;AACH,eAAO,MAAM,aAAa;IACxB;;OAEG;cACO,YAAY;EAGtB,CAAC"}

package/src/cli/commands/DeployCommand.js

@@ -0,0 +1,110 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { SpawnUtil } from '../utils/spawn.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { existsSync } from '../../node-singletons/fs.js';
+import { join } from '../../node-singletons/path.js';
+const runCompose = async (args) => {
+    try {
+        const exitCode = await SpawnUtil.spawnAndWait({ command: 'docker', args });
+        if (exitCode !== 0)
+            process.exit(exitCode);
+        return;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!message.includes("'docker' not found"))
+            throw error;
+    }
+    Logger.warn("'docker' not found. Falling back to 'docker-compose'.");
+    const exitCode = await SpawnUtil.spawnAndWait({
+        command: 'docker-compose',
+        args: args.slice(1),
+    });
+    if (exitCode !== 0)
+        process.exit(exitCode);
+};
+const deployContainerStack = async (label) => {
+    const composeFile = 'docker-compose.workers.yml';
+    const composePath = join(process.cwd(), composeFile);
+    if (!existsSync(composePath)) {
+        throw ErrorFactory.createCliError(`${composeFile} not found. Run \`zin init:cw\` first.`);
+    }
+    Logger.info(`Deploying ${label}...`);
+    await runCompose(['compose', '-f', composePath, 'up', '-d', '--build']);
+    Logger.info(`✅ ${label} deployed.`);
+};
+const deployProxyStack = async (label) => {
+    const composeFile = 'docker-compose.proxy.yml';
+    const composePath = join(process.cwd(), composeFile);
+    if (!existsSync(composePath)) {
+        throw ErrorFactory.createCliError(`${composeFile} not found.`);
+    }
+    Logger.info(`Deploying ${label}...`);
+    await runCompose(['compose', '-f', composePath, 'up', '-d', '--build']);
+    Logger.info(`✅ ${label} deployed.`);
+};
+const runDeploy = async (target, options) => {
+    const normalizedTarget = target.trim().toLowerCase();
+    if (normalizedTarget === 'cw' || normalizedTarget === 'cwr') {
+        const label = normalizedTarget === 'cwr'
+            ? 'container workers stack (cwr compatibility alias)'
+            : 'container workers stack';
+        await deployContainerStack(label);
+        return;
+    }
+    if (normalizedTarget === 'cp' || normalizedTarget === 'proxy') {
+        const label = normalizedTarget === 'proxy' ? 'proxy stack (proxy compatibility alias)' : 'proxy stack';
+        await deployProxyStack(label);
+        return;
+    }
+    const environment = options.env ?? target ?? 'worker';
+    Logger.info(`Deploying to Cloudflare environment: ${environment}`);
+    const exitCode = await SpawnUtil.spawnAndWait({
+        command: 'wrangler',
+        args: ['deploy', '--env', environment],
+    });
+    if (exitCode !== 0) {
+        process.exit(exitCode);
+    }
+};
+const createDeployCommand = () => {
+    return BaseCommand.create({
+        name: 'deploy',
+        description: 'Deploy ZinTrust to Cloudflare Workers',
+        addOptions: (command) => {
+            command
+                .argument('[target]', 'Deployment target (worker, d1-proxy, kv-proxy, production, cw, cp)', 'worker')
+                .option('-e, --env <env>', 'Wrangler environment (overrides target)');
+        },
+        execute: async (options) => {
+            // Note: BaseCommand.create sets up action handler that calls execute(options).
+            // However, since we define arguments '[target]', commander passes them to the action callback
+            // BEFORE the options object.
+            //
+            // The BaseCommand.create generic action handler:
+            // command.action(async (...args: unknown[]) => {
+            //   const options = args.at(-2) as CommandOptions;
+            //   const commandArgs = args.slice(0, -2) as string[];
+            //   options.args = commandArgs;
+            //   await config.execute(options);
+            // });
+            //
+            // So 'target' will be available in options.args[0]
+            const target = options.args?.[0] ?? 'worker';
+            await runDeploy(target, options);
+        },
+    });
+};
+/**
+ * Deploy Command Factory
+ * Sealed namespace for immutability
+ */
+export const DeployCommand = Object.freeze({
+    /**
+     * Create a deploy command instance
+     */
+    create() {
+        return createDeployCommand();
+    },
+});

package/src/cli/commands/DeployContainerProxiesCommand.d.ts

@@ -0,0 +1,5 @@
+import type { IBaseCommand } from '../BaseCommand';
+export declare const DeployContainerProxiesCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=DeployContainerProxiesCommand.d.ts.map

package/src/cli/commands/DeployContainerProxiesCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeployContainerProxiesCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployContainerProxiesCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrE,eAAO,MAAM,6BAA6B;cAC9B,YAAY;EAyBtB,CAAC"}

package/src/cli/commands/DeployContainerProxiesCommand.js

@@ -0,0 +1,27 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { resolveComposePath, runComposeWithFallback, } from '../commands/DockerComposeCommandUtils.js';
+import { Logger } from '../../config/logger.js';
+export const DeployContainerProxiesCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'deploy:cp',
+            aliases: ['deploy:container-proxies', 'deploy:proxy-stack'],
+            description: 'Deploy proxy stack (docker-compose.proxy.yml)',
+            addOptions: (command) => {
+                command.option('--no-build', 'Skip image build before up');
+                command.option('--remove-orphans', 'Remove containers for services not defined in compose');
+            },
+            execute: async (options) => {
+                const composePath = resolveComposePath('docker-compose.proxy.yml', 'docker-compose.proxy.yml not found.');
+                const args = ['compose', '-f', composePath, 'up', '-d'];
+                if (options.noBuild !== true)
+                    args.push('--build');
+                if (options.removeOrphans === true)
+                    args.push('--remove-orphans');
+                Logger.info('Deploying proxy stack...');
+                await runComposeWithFallback(args);
+                Logger.info('✅ Proxy stack deployed.');
+            },
+        });
+    },
+});

package/src/cli/commands/DeployContainerWorkersCommand.d.ts

@@ -0,0 +1,5 @@
+import type { IBaseCommand } from '../BaseCommand';
+export declare const DeployContainerWorkersCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=DeployContainerWorkersCommand.d.ts.map

package/src/cli/commands/DeployContainerWorkersCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeployContainerWorkersCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployContainerWorkersCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcrE,eAAO,MAAM,6BAA6B;cAC9B,YAAY;EAyBtB,CAAC"}

package/src/cli/commands/DeployContainerWorkersCommand.js

@@ -0,0 +1,27 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { resolveComposePath, runComposeWithFallback, } from '../commands/DockerComposeCommandUtils.js';
+import { Logger } from '../../config/logger.js';
+export const DeployContainerWorkersCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'deploy:cw',
+            aliases: ['deploy:container-workers', 'deploy:cwr', 'deploy:container-workers-routes'],
+            description: 'Deploy Container Workers stack (docker-compose.workers.yml)',
+            addOptions: (command) => {
+                command.option('--no-build', 'Skip image build before up');
+                command.option('--remove-orphans', 'Remove containers for services not defined in compose');
+            },
+            execute: async (options) => {
+                const composePath = resolveComposePath('docker-compose.workers.yml', 'docker-compose.workers.yml not found. Run `zin init:cw` first.');
+                const args = ['compose', '-f', composePath, 'up', '-d'];
+                if (options.noBuild !== true)
+                    args.push('--build');
+                if (options.removeOrphans === true)
+                    args.push('--remove-orphans');
+                Logger.info('Deploying container workers stack...');
+                await runComposeWithFallback(args);
+                Logger.info('✅ Container workers deployed.');
+            },
+        });
+    },
+});

package/src/cli/commands/DockerComposeCommandUtils.d.ts

@@ -0,0 +1,3 @@
+export declare const resolveComposePath: (composeFileName: string, missingMessage: string) => string;
+export declare const runComposeWithFallback: (args: string[]) => Promise<void>;
+//# sourceMappingURL=DockerComposeCommandUtils.d.ts.map

package/src/cli/commands/DockerComposeCommandUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DockerComposeCommandUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DockerComposeCommandUtils.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,kBAAkB,GAAI,iBAAiB,MAAM,EAAE,gBAAgB,MAAM,KAAG,MAMpF,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAqBzE,CAAC"}

package/src/cli/commands/DockerComposeCommandUtils.js

@@ -0,0 +1,34 @@
+import { SpawnUtil } from '../utils/spawn.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { existsSync } from '../../node-singletons/fs.js';
+import { join } from '../../node-singletons/path.js';
+export const resolveComposePath = (composeFileName, missingMessage) => {
+    const composePath = join(process.cwd(), composeFileName);
+    if (!existsSync(composePath)) {
+        throw ErrorFactory.createCliError(missingMessage);
+    }
+    return composePath;
+};
+export const runComposeWithFallback = async (args) => {
+    try {
+        const exitCode = await SpawnUtil.spawnAndWait({ command: 'docker', args });
+        if (exitCode !== 0)
+            process.exit(exitCode);
+        return;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!message.includes("'docker' not found")) {
+            throw error;
+        }
+    }
+    Logger.warn("'docker' not found. Falling back to 'docker-compose'.");
+    const exitCode = await SpawnUtil.spawnAndWait({
+        command: 'docker-compose',
+        args: args.slice(1),
+    });
+    if (exitCode !== 0) {
+        process.exit(exitCode);
+    }
+};

package/src/cli/commands/DoctorArchitectureCommand.d.ts

@@ -0,0 +1,5 @@
+import { type IBaseCommand } from '../BaseCommand';
+export declare const DoctorArchitectureCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=DoctorArchitectureCommand.d.ts.map

package/src/cli/commands/DoctorArchitectureCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DoctorArchitectureCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DoctorArchitectureCommand.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIlE,eAAO,MAAM,yBAAyB;cAC1B,YAAY;EAgEtB,CAAC"}

package/src/cli/commands/DoctorArchitectureCommand.js

@@ -0,0 +1,54 @@
+import { getRuntimeMode } from '../../runtime/detectRuntime.js';
+import { BaseCommand } from '../BaseCommand.js';
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
+export const DoctorArchitectureCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'doctor:architecture',
+            aliases: ['d'],
+            description: 'Validate producer/consumer architecture configuration',
+            async execute() {
+                Logger.info('🩺 Diagnosing Architecture Configuration...');
+                const mode = getRuntimeMode();
+                const workerEnabled = Env.getBool('WORKER_ENABLED', true);
+                const dockerWorker = Env.getBool('DOCKER_WORKER', false);
+                Logger.info('----------------------------------------');
+                Logger.info(`Runtime Mode:    ${mode}`);
+                Logger.info(`Docker Worker:   ${dockerWorker}`);
+                Logger.info(`Worker Enabled:  ${workerEnabled}`);
+                Logger.info('----------------------------------------');
+                const issues = [];
+                // Rule 1: Cloudflare Workers cannot run Consumers
+                if (mode === 'cloudflare-workers' && workerEnabled) {
+                    issues.push('❌ CRITICAL: Cloudflare Workers runtime detected but WORKER_ENABLED=true. Consumers will fail due to connection persistence limits. Set WORKER_ENABLED=false.');
+                }
+                // Rule 2: Containers should generally run Workers (unless dedicated to API)
+                if (mode === 'containers' && !workerEnabled) {
+                    issues.push('⚠️ WARNING: Container runtime detected but WORKER_ENABLED=false. Are these containers for API only? If attempting to process jobs, enable workers.');
+                }
+                // Rule 2b: Dedicated Docker worker containers must keep workers enabled
+                if (mode === 'containers' && dockerWorker && !workerEnabled) {
+                    issues.push('❌ CRITICAL: DOCKER_WORKER=true but WORKER_ENABLED=false. Dedicated worker containers must enable workers or unset DOCKER_WORKER.');
+                }
+                // Rule 3: Proxy requirement for Cloudflare
+                if (mode === 'cloudflare-workers') {
+                    const useProxy = Env.getBool('USE_REDIS_PROXY', false) ||
+                        Env.getBool('ENABLE_CLOUDFLARE_SOCKETS', false);
+                    if (!useProxy) {
+                        issues.push('❌ CRITICAL: Cloudflare runtime requires USE_REDIS_PROXY=true or ENABLE_CLOUDFLARE_SOCKETS=true for Queue producers.');
+                    }
+                }
+                if (issues.length > 0) {
+                    Logger.error('Found configuration issues:');
+                    issues.forEach((issue) => Logger.error(issue));
+                    process.exit(1);
+                }
+                else {
+                    Logger.info('✅ Architecture configuration looks valid for this runtime.');
+                }
+                await Promise.resolve();
+            },
+        });
+    },
+});

package/src/cli/commands/InitContainerCommand.d.ts

@@ -0,0 +1,5 @@
+import { type IBaseCommand } from '../BaseCommand';
+export declare const InitContainerCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=InitContainerCommand.d.ts.map

package/src/cli/commands/InitContainerCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InitContainerCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/InitContainerCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmOlE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAkBtB,CAAC"}

package/src/cli/commands/InitContainerCommand.js

@@ -0,0 +1,231 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { PromptHelper } from '../PromptHelper.js';
+import { Logger } from '../../config/logger.js';
+import { copyFileSync, existsSync, writeFileSync } from '../../node-singletons/fs.js';
+import { join } from '../../node-singletons/path.js';
+const DOCKER_COMPOSE_WORKERS_TEMPLATE = `name: zintrust-workers
+
+services:
+  # Workers/Jobs API Service (Port 7772)
+  # Exposes the Workers API to create/manage jobs
+  workers-api:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    command: ["node", "--experimental-specifier-resolution=node", "dist/src/boot/bootstrap.js"]
+    environment:
+      # Runtime
+      - NODE_ENV=\${NODE_ENV:-development}
+      - PORT=7772
+      - HOST=0.0.0.0
+      - RUNTIME_MODE=node-server
+
+      # Application
+      - APP_NAME=\${APP_NAME:-ZinTrust}
+      - APP_KEY=\${APP_KEY}
+      - ENCRYPTION_CIPHER=\${ENCRYPTION_CIPHER:-aes-256-cbc}
+      - LOG_LEVEL=\${LOG_LEVEL:-info}
+      - ZINTRUST_PROJECT_ROOT=/app/dist
+
+      # Workers & Queue
+      - WORKER_ENABLED=\${WORKER_ENABLED:-false}
+      - WORKER_AUTO_START=\${WORKER_AUTO_START:-false}
+      - QUEUE_ENABLED=true
+      - QUEUE_MONITOR_ENABLED=\${QUEUE_MONITOR_ENABLED:-false}
+      - QUEUE_MONITOR_MIDDLEWARE=\${QUEUE_MONITOR_MIDDLEWARE:-}
+      - WORKER_PERSISTENCE_DRIVER=\${WORKER_PERSISTENCE_DRIVER:-redis}
+      - WORKER_PERSISTENCE_DB_CONNECTION=\${WORKER_PERSISTENCE_DB_CONNECTION:-mysql}
+      - WORKER_PERSISTENCE_REDIS_KEY_PREFIX=\${WORKER_PERSISTENCE_REDIS_KEY_PREFIX}
+      - QUEUE_DRIVER=\${QUEUE_DRIVER:-redis}
+      - QUEUE_CONNECTION=\${QUEUE_CONNECTION:-redis}
+      - CACHE_DRIVER=\${CACHE_DRIVER:-redis}
+
+      # Redis
+      - REDIS_HOST=\${DOCKER_REDIS_HOST:-host.docker.internal}
+      - REDIS_PORT=\${REDIS_PORT:-6379}
+      - REDIS_PASSWORD=\${REDIS_PASSWORD}
+      - REDIS_QUEUE_DB=\${REDIS_QUEUE_DB:-1}
+
+      # Database
+      - DB_CONNECTION=\${DB_CONNECTION:-postgres}
+      - DB_HOST=\${DOCKER_DB_HOST:-host.docker.internal}
+      - DB_PORT=\${DB_PORT:-3306}
+      - DB_DATABASE=\${DB_DATABASE:-zintrust}
+      - DB_USERNAME=\${DB_USERNAME:-zintrust}
+      - DB_PASSWORD=\${DB_PASSWORD:-secret}
+
+      # SMTP Mail
+      - MAIL_DRIVER=\${MAIL_DRIVER:-smtp}
+      - MAIL_CONNECTION=\${MAIL_CONNECTION:-smtp}
+      - MAIL_HOST=\${MAIL_HOST}
+      - MAIL_PORT=\${MAIL_PORT:-587}
+      - MAIL_SECURE=\${MAIL_SECURE:-false}
+      - MAIL_USERNAME=\${MAIL_USERNAME}
+      - MAIL_PASSWORD=\${MAIL_PASSWORD}
+      - MAIL_FROM_ADDRESS=\${MAIL_FROM_ADDRESS}
+      - MAIL_FROM_NAME=\${MAIL_FROM_NAME:-ZinTrust}
+
+      # PostgreSQL
+      - DB_PORT_POSTGRESQL=\${DB_PORT_POSTGRESQL:-5432}
+      - DB_DATABASE_POSTGRESQL=\${DB_DATABASE_POSTGRESQL:-zintrust}
+      - DB_USERNAME_POSTGRESQL=\${DB_USERNAME_POSTGRESQL:-zintrust}
+      - DB_PASSWORD_POSTGRESQL=\${DB_PASSWORD_POSTGRESQL:-secret}
+
+      # MySQL
+      - DB_PORT_MYSQL=\${DB_PORT_MYSQL:-3306}
+      - DB_DATABASE_MYSQL=\${DB_DATABASE_MYSQL:-zintrust}
+      - DB_USERNAME_MYSQL=\${DB_USERNAME_MYSQL:-zintrust}
+      - DB_PASSWORD_MYSQL=\${DB_PASSWORD_MYSQL:-secret}
+
+      # Cloudflare D1
+      - D1_DATABASE_ID=\${D1_DATABASE_ID}
+      - D1_ACCOUNT_ID=\${D1_ACCOUNT_ID}
+      - D1_API_TOKEN=\${D1_API_TOKEN}
+      - D1_REMOTE_URL=\${D1_REMOTE_URL}
+      - D1_REMOTE_KEY_ID=\${D1_REMOTE_KEY_ID}
+      - D1_REMOTE_SECRET=\${D1_REMOTE_SECRET}
+
+      # Cloudflare KV
+      - KV_NAMESPACE_ID=\${KV_NAMESPACE_ID}
+      - KV_ACCOUNT_ID=\${KV_ACCOUNT_ID}
+      - KV_API_TOKEN=\${KV_API_TOKEN}
+      - KV_REMOTE_URL=\${KV_REMOTE_URL}
+      - KV_REMOTE_KEY_ID=\${KV_REMOTE_KEY_ID}
+      - KV_REMOTE_SECRET=\${KV_REMOTE_SECRET}
+    ports:
+      - '7772:7772'
+
+`;
+const DOCKERFILE_TEMPLATE = String.raw `# syntax=docker/dockerfile:1.6
+# Build Stage - Compile TypeScript
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Reuse npm cache across builds (requires BuildKit)
+ENV NPM_CONFIG_CACHE=/root/.npm
+ENV NPM_CONFIG_PREFER_OFFLINE=true
+
+# Reuse npm cache across builds (requires BuildKit)
+ENV NPM_CONFIG_CACHE=/root/.npm
+ENV NPM_CONFIG_PREFER_OFFLINE=true
+
+# Install build dependencies for native modules (better-sqlite3, bcrypt)
+RUN apk add --no-cache python3 make g++
+
+# Copy package files
+COPY package.json package-lock.json ./
+
+# Install dependencies (including dev dependencies needed for build)
+RUN --mount=type=cache,target=/root/.npm,id=zintrust-npm-cache,sharing=locked \
+  npm config set fetch-retries 5 \
+    && npm config set fetch-retry-mintimeout 20000 \
+    && npm config set fetch-retry-maxtimeout 120000 \
+   && npm ci
+
+# Copy source code using COPY . . to handle optional folders automatically
+COPY . .
+
+# Build TypeScript to JavaScript
+ARG BUILD_VARIANT=full
+RUN --mount=type=cache,target=/root/.npm,id=zintrust-npm-cache,sharing=locked npm run build:dk
+
+# Runtime Stage - Production image
+FROM node:20-alpine AS runtime
+
+WORKDIR /app
+
+# Set environment variables
+ENV NODE_ENV=production
+ENV PORT=7772
+ENV HOST=0.0.0.0
+
+# Create non-root user for security
+RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
+
+# Copy package files for production dependencies
+COPY package.json package-lock.json ./
+
+# Install only production dependencies (requires build tools for native modules)
+RUN --mount=type=cache,target=/root/.npm,id=zintrust-npm-cache,sharing=locked \
+  apk add --no-cache --virtual .build-deps python3 make g++ \
+  && npm ci --omit=dev \
+    && apk del .build-deps
+
+# Copy compiled code from builder stage
+COPY --from=builder /app/dist ./dist
+
+
+# Change ownership to nodejs user
+RUN chown -R nodejs:nodejs /app
+
+# Switch to non-root user
+USER nodejs
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+  CMD node -e "require('node:http').get('http://localhost:7772/health', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"
+
+# Expose port
+EXPOSE 7772
+
+# Start application (compiled JS; no tsx needed in runtime)
+CMD ["node", "dist/src/boot/bootstrap.js"]
+`;
+const backupSuffix = () => new Date().toISOString().replaceAll(/[:.]/g, '-');
+const backupFileIfExists = (filePath) => {
+    if (!existsSync(filePath))
+        return;
+    const backupPath = `${filePath}.bak.${backupSuffix()}`;
+    copyFileSync(filePath, backupPath);
+    Logger.info(`🗂️ Backup created: ${backupPath}`);
+};
+async function writeDockerComposeFile(cwd) {
+    const composePath = join(cwd, 'docker-compose.workers.yml');
+    let shouldWrite = true;
+    if (existsSync(composePath)) {
+        shouldWrite = await PromptHelper.confirm('docker-compose.workers.yml already exists. Overwrite?', false);
+    }
+    if (shouldWrite) {
+        backupFileIfExists(composePath);
+        writeFileSync(composePath, DOCKER_COMPOSE_WORKERS_TEMPLATE);
+        Logger.info('✅ Created docker-compose.workers.yml');
+    }
+    else {
+        Logger.info('Skipped docker-compose.workers.yml');
+    }
+}
+async function writeDockerfile(cwd) {
+    const dockerfilePath = join(cwd, 'Dockerfile');
+    let shouldWrite = true;
+    if (existsSync(dockerfilePath)) {
+        // Only ask if it's different or just generic confirm? Let's just ask.
+        shouldWrite = await PromptHelper.confirm('Dockerfile already exists. Overwrite with standard worker configuration?', false);
+    }
+    if (shouldWrite) {
+        backupFileIfExists(dockerfilePath);
+        writeFileSync(dockerfilePath, DOCKERFILE_TEMPLATE);
+        Logger.info('✅ Created Dockerfile');
+    }
+    else {
+        Logger.info('Skipped Dockerfile');
+    }
+}
+export const InitContainerCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'init:container-workers',
+            aliases: ['init:cw', 'init:cwr', 'init:container-workers-routes'],
+            description: 'Initialize container-based worker infrastructure',
+            async execute() {
+                Logger.info('Initializing container-based worker infrastructure...');
+                const cwd = process.cwd();
+                await writeDockerComposeFile(cwd);
+                await writeDockerfile(cwd);
+                Logger.info('✅ Container worker scaffolding complete.');
+                Logger.info('Run with: docker-compose -f docker-compose.workers.yml up');
+                await Promise.resolve();
+            },
+        });
+    },
+});