@zintrust/core 0.1.41 → 0.1.43

package/src/templates/docker/docker-compose.ecosystem.yml.tpl

@@ -0,0 +1,301 @@
+name: zintrust-ecosystem
+
+x-app-runtime: &app-runtime
+  build:
+    context: .
+    dockerfile: Dockerfile
+
+x-common-env: &common-env
+  NODE_ENV: ${NODE_ENV:-development}
+  CSRF_SKIP_PATHS: ${CSRF_SKIP_PATHS:-/api/*,/queue-monitor/*}
+
+  SCHEDULE_SHUTDOWN_TIMEOUT_MS: ${SCHEDULE_SHUTDOWN_TIMEOUT_MS:-30000}
+  SCHEDULE_OVERLAP_LOCK_TTL_MS: ${SCHEDULE_OVERLAP_LOCK_TTL_MS:-300000}
+
+  # Database & Redis
+  DB_CONNECTION: ${DB_CONNECTION:-postgresql}
+  DB_HOST: ${DB_HOST:-postgres}
+  DB_PORT: ${DB_PORT:-5432}
+  DB_DATABASE: ${DB_DATABASE:-zintrust}
+  DB_USERNAME: ${DB_USERNAME:-zintrust}
+  DB_PASSWORD: ${DB_PASSWORD:-zintrust}
+
+  REDIS_HOST: ${REDIS_HOST:-redis}
+  REDIS_PORT: ${REDIS_PORT:-6379}
+  REDIS_PASSWORD: ${REDIS_PASSWORD:-}
+  REDIS_DB: ${REDIS_DB:-0}
+
+services:
+  # Web Application (API)
+  web:
+    <<: *app-runtime
+    ports:
+      - '${PORT:-3000}:3000'
+    environment:
+      <<: *common-env
+      PORT: 3000
+      HOST: 0.0.0.0
+      RUNTIME_MODE: node-server
+      WORKER_ENABLED: 'false'
+      QUEUE_ENABLED: 'true'
+    command: npm run dev
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    volumes:
+      - .:/app
+      - /app/node_modules
+      - /app/dist
+    networks:
+      - zintrust-network
+
+  # Workers (Consumers)
+  workers:
+    <<: *app-runtime
+    environment:
+      <<: *common-env
+      RUNTIME_MODE: containers
+      WORKER_ENABLED: 'true'
+      WORKER_AUTO_START: 'true'
+      QUEUE_ENABLED: 'true'
+    command: npx tsx bin/zin.ts worker:start-all
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    volumes:
+      - .:/app
+      - /app/node_modules
+      - /app/dist
+    networks:
+      - zintrust-network
+
+  # Dedicated schedules service (auto-start schedules)
+  schedules:
+    <<: *app-runtime
+    environment:
+      <<: *common-env
+      # Dedicated schedules service enabled by default (override in .env)
+      SCHEDULES_ENABLED: ${SCHEDULES_ENABLED:-true}
+      # job tracking cleanup schedule
+      JOB_TRACKING_CLEANUP_ENABLED: ${JOB_TRACKING_CLEANUP_ENABLED:-false}
+      JOB_TRACKING_CLEANUP_INTERVAL_MS: ${JOB_TRACKING_CLEANUP_INTERVAL_MS:-21600000}
+      JOB_TRACKING_CLEANUP_RETENTION_DAYS: ${JOB_TRACKING_CLEANUP_RETENTION_DAYS:-30}
+      JOB_TRACKING_CLEANUP_BATCH_SIZE: ${JOB_TRACKING_CLEANUP_BATCH_SIZE:-5000}
+      JOB_TRACKING_CLEANUP_MAX_BATCHES: ${JOB_TRACKING_CLEANUP_MAX_BATCHES:-1}
+      JOB_TRACKING_CLEANUP_LOCK_PROVIDER: ${JOB_TRACKING_CLEANUP_LOCK_PROVIDER:-redis}
+    command: ['node', 'dist/bin/zin.js', 'schedule:start']
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    networks:
+      - zintrust-network
+
+  # Backing services
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: ${DB_DATABASE:-zintrust}
+      POSTGRES_USER: ${DB_USERNAME:-zintrust}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-zintrust}
+    ports:
+      - '${POSTGRES_PORT:-5432}:5432'
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U ${DB_USERNAME:-zintrust}']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - zintrust-network
+
+  redis:
+    image: redis:7-alpine
+    ports:
+      - '${REDIS_PORT:-6379}:6379'
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ['CMD', 'redis-cli', 'ping']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - zintrust-network
+
+  # Proxies (optional; separate blocks like docker-compose.proxy.yml)
+  # These can be started/stopped independently.
+  proxy-gateway:
+    image: ${PROXY_GATEWAY_IMAGE:-zintrust-proxy-gateway:local}
+    build:
+      context: ./docker/proxy-gateway
+      dockerfile: Dockerfile
+    restart: on-failure:3
+    depends_on:
+      - proxy-mysql
+      - proxy-pg
+      - proxy-redis
+      - proxy-mongodb
+      - proxy-sqlserver
+      - proxy-smtp
+    ports:
+      - ${PROXY_GATEWAY_PORT:-8800}:8080
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      CSRF_SKIP_PATHS: ${CSRF_SKIP_PATHS:-/api/*,/queue-monitor/*}
+    networks:
+      - zintrust-network
+
+  proxy-mysql:
+    image: ${PROXY_IMAGE:-zintrust-proxy:local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: ['node', 'dist/bin/zin.js', 'proxy:mysql', '--host', '0.0.0.0', '--port', '8789']
+    expose:
+      - '8789'
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      APP_NAME: ${APP_NAME:-ZinTrust}
+      APP_KEY: ${APP_KEY:-}
+      MYSQL_PROXY_REQUIRE_SIGNING: true
+      MYSQL_PROXY_KEY_ID: ${MYSQL_PROXY_KEY_ID:-}
+      MYSQL_PROXY_SECRET: ${MYSQL_PROXY_SECRET:-}
+      MYSQL_PROXY_SIGNING_WINDOW_MS: ${MYSQL_PROXY_SIGNING_WINDOW_MS:-60000}
+      MYSQL_DB_HOST: ${MYSQL_DB_HOST:-${DOCKER_DB_HOST:-host.docker.internal}}
+      MYSQL_DB_PORT: ${MYSQL_DB_PORT:-${DB_PORT:-3306}}
+      MYSQL_DB_DATABASE: ${MYSQL_DB_DATABASE:-${DB_DATABASE:-zintrust}}
+      MYSQL_DB_USERNAME: ${MYSQL_DB_USERNAME:-${DB_USERNAME:-zintrust}}
+      MYSQL_DB_PASSWORD: ${MYSQL_DB_PASSWORD:-${DB_PASSWORD:-secret}}
+    networks:
+      - zintrust-network
+
+  proxy-pg:
+    image: ${PROXY_IMAGE:-zintrust-proxy:local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: ['node', 'dist/bin/zin.js', 'proxy:postgres', '--host', '0.0.0.0', '--port', '8790']
+    expose:
+      - '8790'
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      APP_NAME: ${APP_NAME:-ZinTrust}
+      APP_KEY: ${APP_KEY:-}
+      POSTGRES_PROXY_REQUIRE_SIGNING: true
+      POSTGRES_PROXY_KEY_ID: ${POSTGRES_PROXY_KEY_ID:-}
+      POSTGRES_PROXY_SECRET: ${POSTGRES_PROXY_SECRET:-}
+      POSTGRES_PROXY_SIGNING_WINDOW_MS: ${POSTGRES_PROXY_SIGNING_WINDOW_MS:-60000}
+      DB_HOST: ${DOCKER_DB_HOST:-host.docker.internal}
+      DB_PORT_POSTGRESQL: ${POSTGRES_DB_PORT:-5432}
+      DB_DATABASE_POSTGRESQL: ${POSTGRES_DB_DATABASE:-postgres}
+      DB_USERNAME_POSTGRESQL: ${POSTGRES_DB_USERNAME:-postgres}
+      DB_PASSWORD_POSTGRESQL: ${POSTGRES_DB_PASSWORD:-postgres}
+    networks:
+      - zintrust-network
+
+  proxy-redis:
+    image: ${PROXY_IMAGE:-zintrust-proxy:local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: ['node', 'dist/bin/zin.js', 'proxy:redis', '--host', '0.0.0.0', '--port', '8791']
+    expose:
+      - '8791'
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      APP_NAME: ${APP_NAME:-ZinTrust}
+      APP_KEY: ${APP_KEY:-}
+      REDIS_PROXY_REQUIRE_SIGNING: true
+      REDIS_PROXY_KEY_ID: ${REDIS_PROXY_KEY_ID:-}
+      REDIS_PROXY_SECRET: ${REDIS_PROXY_SECRET:-}
+      REDIS_PROXY_SIGNING_WINDOW_MS: ${REDIS_PROXY_SIGNING_WINDOW_MS:-60000}
+      REDIS_PROXY_TARGET_HOST: ${REDIS_PROXY_TARGET_HOST:-${DOCKER_REDIS_HOST:-host.docker.internal}}
+      REDIS_PROXY_TARGET_PORT: ${REDIS_PROXY_TARGET_PORT:-${REDIS_PORT:-6379}}
+      REDIS_PROXY_TARGET_PASSWORD: ${REDIS_PROXY_TARGET_PASSWORD:-${REDIS_PASSWORD:-}}
+      REDIS_PROXY_TARGET_DB: ${REDIS_PROXY_TARGET_DB:-${REDIS_DB:-0}}
+    networks:
+      - zintrust-network
+
+  proxy-mongodb:
+    image: ${PROXY_IMAGE:-zintrust-proxy:local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: ['node', 'dist/bin/zin.js', 'proxy:mongodb', '--host', '0.0.0.0', '--port', '8792']
+    expose:
+      - '8792'
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      APP_NAME: ${APP_NAME:-ZinTrust}
+      APP_KEY: ${APP_KEY:-}
+      MONGODB_PROXY_REQUIRE_SIGNING: true
+      MONGODB_PROXY_KEY_ID: ${MONGODB_PROXY_KEY_ID:-}
+      MONGODB_PROXY_SECRET: ${MONGODB_PROXY_SECRET:-}
+      MONGODB_PROXY_SIGNING_WINDOW_MS: ${MONGODB_PROXY_SIGNING_WINDOW_MS:-60000}
+      MONGO_URI: ${MONGODB_PROXY_TARGET_URI:-mongodb://host.docker.internal:27017}
+      MONGO_DB: ${MONGODB_PROXY_TARGET_DB:-zintrust}
+    networks:
+      - zintrust-network
+
+  proxy-sqlserver:
+    image: ${PROXY_IMAGE:-zintrust-proxy:local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: ['node', 'dist/bin/zin.js', 'proxy:sqlserver', '--host', '0.0.0.0', '--port', '8793']
+    expose:
+      - '8793'
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      APP_NAME: ${APP_NAME:-ZinTrust}
+      APP_KEY: ${APP_KEY:-}
+      SQLSERVER_PROXY_REQUIRE_SIGNING: true
+      SQLSERVER_PROXY_KEY_ID: ${SQLSERVER_PROXY_KEY_ID:-}
+      SQLSERVER_PROXY_SECRET: ${SQLSERVER_PROXY_SECRET:-}
+      SQLSERVER_PROXY_SIGNING_WINDOW_MS: ${SQLSERVER_PROXY_SIGNING_WINDOW_MS:-60000}
+      DB_HOST_MSSQL: ${SQLSERVER_DB_HOST:-host.docker.internal}
+      DB_PORT_MSSQL: ${SQLSERVER_DB_PORT:-1433}
+      DB_DATABASE_MSSQL: ${SQLSERVER_DB_DATABASE:-zintrust}
+      DB_USERNAME_MSSQL: ${SQLSERVER_DB_USERNAME:-sa}
+      DB_PASSWORD_MSSQL: ${SQLSERVER_DB_PASSWORD:-}
+    networks:
+      - zintrust-network
+
+  proxy-smtp:
+    image: ${PROXY_IMAGE:-zintrust-proxy:local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: ['node', 'dist/bin/zin.js', 'proxy:smtp', '--host', '0.0.0.0', '--port', '8794']
+    expose:
+      - '8794'
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      APP_NAME: ${APP_NAME:-ZinTrust}
+      APP_KEY: ${APP_KEY:-}
+      SMTP_PROXY_REQUIRE_SIGNING: true
+      SMTP_PROXY_KEY_ID: ${SMTP_PROXY_KEY_ID:-}
+      SMTP_PROXY_SECRET: ${SMTP_PROXY_SECRET:-}
+      SMTP_PROXY_SIGNING_WINDOW_MS: ${SMTP_PROXY_SIGNING_WINDOW_MS:-60000}
+    networks:
+      - zintrust-network
+
+networks:
+  zintrust-network:
+
+volumes:
+  postgres_data:
+  redis_data:

package/src/templates/docker/docker-compose.schedules.yml.tpl

@@ -0,0 +1,84 @@
+name: zintrust-schedules
+
+services:
+  schedules:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    environment:
+      NODE_ENV: ${NODE_ENV:-development}
+      SCHEDULES_ENABLED: ${SCHEDULES_ENABLED:-true}
+      CSRF_SKIP_PATHS: ${CSRF_SKIP_PATHS:-/api/*,/queue-monitor/*}
+
+      # Scheduling
+      SCHEDULE_SHUTDOWN_TIMEOUT_MS: ${SCHEDULE_SHUTDOWN_TIMEOUT_MS:-30000}
+      SCHEDULE_OVERLAP_LOCK_TTL_MS: ${SCHEDULE_OVERLAP_LOCK_TTL_MS:-300000}
+
+      # Redis (for locks / queue / cache)
+      REDIS_HOST: ${REDIS_HOST:-redis}
+      REDIS_PORT: ${REDIS_PORT:-6379}
+      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
+      REDIS_DB: ${REDIS_DB:-0}
+
+      # Database (for job-tracking cleanup schedule)
+      DB_CONNECTION: ${DB_CONNECTION:-postgresql}
+      DB_HOST: ${DB_HOST:-postgres}
+      DB_PORT: ${DB_PORT:-5432}
+      DB_DATABASE: ${DB_DATABASE:-zintrust}
+      DB_USERNAME: ${DB_USERNAME:-zintrust}
+      DB_PASSWORD: ${DB_PASSWORD:-zintrust}
+
+      # Job tracking cleanup schedule
+      JOB_TRACKING_CLEANUP_ENABLED: ${JOB_TRACKING_CLEANUP_ENABLED:-false}
+      JOB_TRACKING_CLEANUP_INTERVAL_MS: ${JOB_TRACKING_CLEANUP_INTERVAL_MS:-21600000}
+      JOB_TRACKING_CLEANUP_RETENTION_DAYS: ${JOB_TRACKING_CLEANUP_RETENTION_DAYS:-30}
+      JOB_TRACKING_CLEANUP_BATCH_SIZE: ${JOB_TRACKING_CLEANUP_BATCH_SIZE:-5000}
+      JOB_TRACKING_CLEANUP_MAX_BATCHES: ${JOB_TRACKING_CLEANUP_MAX_BATCHES:-1}
+      JOB_TRACKING_CLEANUP_LOCK_PROVIDER: ${JOB_TRACKING_CLEANUP_LOCK_PROVIDER:-redis}
+    command: ['node', 'dist/bin/zin.js', 'schedule:start']
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    networks:
+      - zintrust-network
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: ${DB_DATABASE:-zintrust}
+      POSTGRES_USER: ${DB_USERNAME:-zintrust}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-zintrust}
+    ports:
+      - '${POSTGRES_PORT:-5432}:5432'
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U ${DB_USERNAME:-zintrust}']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - zintrust-network
+
+  redis:
+    image: redis:7-alpine
+    ports:
+      - '${REDIS_PORT:-6379}:6379'
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ['CMD', 'redis-cli', 'ping']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - zintrust-network
+
+networks:
+  zintrust-network:
+
+volumes:
+  postgres_data:
+  redis_data:

package/src/templates/project/basic/app/Controllers/AuthController.ts.tpl

@@ -148,9 +148,17 @@ async function register(req: IRequest, res: IResponse): Promise<void> {
       password: passwordHash,
     });
 
-    if (result.id !== null && result.id !== undefined) {
+    let insertedUserId: unknown = result.id;
+    if (insertedUserId === null || insertedUserId === undefined) {
+      const inserted = await User.where('email', '=', email).limit(1).first<UserRow>();
+      if (inserted?.id !== null && inserted?.id !== undefined) {
+        insertedUserId = inserted.id;
+      }
+    }
+
+    if (insertedUserId !== null && insertedUserId !== undefined) {
       Logger.info('AuthController.register: successful registration', {
-        user_id: result.id,
+        user_id: insertedUserId,
         email,
         ip: ipAddress,
         timestamp: new Date().toISOString(),
@@ -179,7 +187,7 @@ async function register(req: IRequest, res: IResponse): Promise<void> {
 async function logout(req: IRequest, res: IResponse): Promise<void> {
   const authHeader =
     typeof req.getHeader === 'function' ? req.getHeader('authorization') : undefined;
-  TokenRevocation.revoke(authHeader);
+  await TokenRevocation.revoke(authHeader);
   res.json({ message: 'Logged out' });
 }
 

package/src/templates/project/basic/config/database.ts.tpl

@@ -21,7 +21,7 @@ export default {
   connections: {
     sqlite: {
       driver: 'sqlite' as const,
-      database: 'database/sqlite.db',
+      database: '.zintrust/dbs/zintrust.sqlite',
       migrations: 'database/migrations',
     },
     postgresql: {

package/src/templates/project/basic/config/middleware.ts.tpl

@@ -1,3 +1,4 @@
+// @ts-ignore - config templates are excluded from the main TS project in this repo
 /**
  * Middleware Configuration (template)
  *
@@ -6,27 +7,27 @@
  * - Projects can override by editing `middlewareConfigObj`.
  */
 
-import { middlewareConfig as coreMiddlewareConfig } from '@zintrust/core';
-import { CsrfMiddleware } from '@zintrust/core';
+import { Env } from '@zintrust/core';
+import type { MiddlewaresType } from '@zintrust/core';
 
-type MiddlewareConfigShape = typeof coreMiddlewareConfig;
-
-// Optional: if you're building a pure Bearer-token API (no cookie auth),
-// you can bypass CSRF for API routes.
-// Example: ['\/api\/*'] skips CSRF for all API endpoints.
-const csrf = CsrfMiddleware.create({
-  skipPaths: [],
-});
-
-export const middlewareConfigObj = {
-  ...coreMiddlewareConfig,
-  route: {
-    ...coreMiddlewareConfig.route,
-    csrf,
+export default {
+  skipPaths: Env.get('CSRF_SKIP_PATHS', '')
+    .split(',')
+    .map((m: string) => m.trim())
+    .filter((m: string) => m.length > 0) as ReadonlyArray<string>,
+  fillRateLimit: {
+    windowMs: 60_000,
+    max: 5,
+    message: 'Too many fill requests, please try again later.',
   },
-  // Keep global middleware order but swap in the overridden CSRF middleware.
-  global: coreMiddlewareConfig.global.map((mw) => (mw === coreMiddlewareConfig.route.csrf ? csrf : mw)),
-} satisfies MiddlewareConfigShape;
-
-export const middlewareConfig = middlewareConfigObj;
-export default middlewareConfig;
+  authRateLimit: {
+    windowMs: 60_000,
+    max: 4,
+    message: 'Too many authentication attempts, please try again later.',
+  },
+  userMutationRateLimit: {
+    windowMs: 60_000,
+    max: 20,
+    message: 'Too many user mutation requests, please try again later.',
+  },
+} as MiddlewaresType;

package/src/templates/project/basic/wrangler.jsonc.tpl

@@ -0,0 +1,28 @@
+{
+  "name": "{{projectSlug}}",
+  "main": "./src/index.ts",
+  "compatibility_date": "2025-04-21",
+  "compatibility_flags": ["nodejs_compat"],
+  "workers_dev": true,
+  "minify": false,
+
+  "vars": {
+    "ENVIRONMENT": "development"
+  },
+
+  "d1_databases": [
+    {
+      "binding": "ZIN_DB",
+      "database_name": "{{projectSlug}}-db",
+      "database_id": "REPLACE_ME",
+      "migrations_dir": "database/migrations/d1"
+    }
+  ],
+
+  "kv_namespaces": [
+    {
+      "binding": "ZIN_KV",
+      "id": "REPLACE_ME"
+    }
+  ]
+}

package/src/toolkit/Secrets/Manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Manifest.d.ts","sourceRoot":"","sources":["../../../../src/toolkit/Secrets/Manifest.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,YAAY,CAAC;AAEvD,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACvC,CAAC;AA+DF,eAAO,MAAM,QAAQ;iBACA;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,eAAe,CAAC;EA4B5B,CAAC;AAEH,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"Manifest.d.ts","sourceRoot":"","sources":["../../../../src/toolkit/Secrets/Manifest.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,YAAY,CAAC;AAEvD,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACvC,CAAC;AAyDF,eAAO,MAAM,QAAQ;iBACA;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,eAAe,CAAC;EA4B5B,CAAC;AAEH,eAAe,QAAQ,CAAC"}

package/src/toolkit/Secrets/Manifest.js

@@ -1,9 +1,10 @@
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { isNonEmptyString, isObject } from '../../helper/index.js';
 import { fsPromises as fs } from '../../node-singletons/fs.js';
 import * as path from '../../node-singletons/path.js';
-const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isRecord = (value) => isObject(value);
 const assertString = (value, name) => {
-    if (typeof value !== 'string' || value.trim() === '') {
+    if (!isNonEmptyString(value)) {
         throw ErrorFactory.createCliError(`Manifest: missing/invalid ${name}`);
     }
     return value;
@@ -28,17 +29,14 @@ const parseKeySpec = (envKey, specUnknown) => {
     if (isRecord(awsUnknown)) {
         spec.aws = {
             secretId: assertString(awsUnknown['secretId'], `keys.${envKey}.aws.secretId`),
-            jsonKey: typeof awsUnknown['jsonKey'] === 'string' && awsUnknown['jsonKey'].trim() !== ''
-                ? awsUnknown['jsonKey']
-                : undefined,
+            jsonKey: isNonEmptyString(awsUnknown['jsonKey']) ? awsUnknown['jsonKey'] : undefined,
         };
     }
     const cloudflareUnknown = specUnknown['cloudflare'];
     if (isRecord(cloudflareUnknown)) {
         spec.cloudflare = {
             key: assertString(cloudflareUnknown['key'], `keys.${envKey}.cloudflare.key`),
-            namespaceId: typeof cloudflareUnknown['namespaceId'] === 'string' &&
-                cloudflareUnknown['namespaceId'].trim() !== ''
+            namespaceId: isNonEmptyString(cloudflareUnknown['namespaceId'])
                 ? cloudflareUnknown['namespaceId']
                 : undefined,
         };

package/src/tools/mail/drivers/Smtp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Smtp.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Smtp.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA+pBF,eAAO,MAAM,UAAU;IACrB;;;;OAIG;iBACgB,UAAU,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAuDzE,CAAC;AAEH,eAAe,UAAU,CAAC"}
+{"version":3,"file":"Smtp.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Smtp.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAuqBF,eAAO,MAAM,UAAU;IACrB;;;;OAIG;iBACgB,UAAU,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAuDzE,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/tools/mail/drivers/Smtp.js

@@ -85,7 +85,13 @@ const ensureSignedSettings = (settings) => {
 const shouldUseProxy = () => {
     if (Env.USE_SMTP_PROXY === true)
         return true;
-    return Env.SMTP_PROXY_URL.trim() !== '';
+    // In Cloudflare Workers, SMTP requires TCP sockets; if sockets are disabled,
+    // we must use the HTTP SMTP proxy transport when a URL is configured.
+    if (isWorkersRuntime() && Cloudflare.isCloudflareSocketsEnabled() === false) {
+        return Env.SMTP_PROXY_URL.trim() !== '';
+    }
+    // Default: do not use proxy unless explicitly enabled.
+    return false;
 };
 const serializeMessage = (message) => {
     const attachments = message.attachments?.map((attachment) => {

package/src/tools/queue/JobReconciliationRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JobReconciliationRunner.d.ts","sourceRoot":"","sources":["../../../../src/tools/queue/JobReconciliationRunner.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,uBAAuB;yBACP,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;8CA6B3B,OAAO,CAAC,MAAM,CAAC;eAwC3C,OAAO,CAAC;QAAE,QAAQ,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;EAc/F,CAAC;AAEH,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"JobReconciliationRunner.d.ts","sourceRoot":"","sources":["../../../../src/tools/queue/JobReconciliationRunner.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,uBAAuB;yBACP,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;8CA6B3B,OAAO,CAAC,MAAM,CAAC;eAqB3C,OAAO,CAAC;QAAE,QAAQ,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;EAc/F,CAAC;AAEH,eAAe,uBAAuB,CAAC"}

package/src/tools/queue/JobReconciliationRunner.js

@@ -4,24 +4,6 @@ import { useDatabase } from '../../orm/Database.js';
 import { JobStateTracker } from './JobStateTracker.js';
 const getDb = () => useDatabase(undefined, Env.get('JOB_TRACKING_DB_CONNECTION', 'default'));
 const toSqlDateTime = (value) => value.toISOString().slice(0, 19).replace('T', ' ');
-const mapPersistedStatus = (raw) => {
-    if (typeof raw !== 'string')
-        return null;
-    const value = raw.trim().toLowerCase();
-    const allowed = [
-        'pending',
-        'active',
-        'completed',
-        'failed',
-        'stalled',
-        'timeout',
-        'pending_recovery',
-        'dead_letter',
-        'manual_review',
-        'delayed',
-    ];
-    return (allowed.find((entry) => entry === value) ?? null);
-};
 export const JobReconciliationRunner = Object.freeze({
     async reconcileInMemory() {
         const timeoutMs = Math.max(1000, Env.getInt('QUEUE_JOB_TIMEOUT', 60) * 1000);
@@ -46,31 +28,17 @@ export const JobReconciliationRunner = Object.freeze({
         const db = getDb();
         const staleAfterMs = Math.max(1000, Env.getInt('JOB_RECONCILIATION_STALE_MS', 120000));
         const cutoff = new Date(Date.now() - staleAfterMs);
-        const rows = await db
+        // Persistence is an enqueue-fallback buffer (jobs that failed to enqueue).
+        // Do not reconcile stale 'pending'/'active' from DB: QUEUE_DRIVER is the source of truth.
+        // pending_recovery rows are handled by JobRecoveryDaemon, which performs the enqueue attempt.
+        const candidates = await db
             .table(Env.get('JOB_TRACKING_DB_TABLE', 'zintrust_jobs'))
-            .select('queue_name', 'job_id', 'status', 'updated_at')
-            .whereIn('status', ['active', 'pending'])
+            .select('queue_name', 'job_id')
+            .whereIn('status', ['pending_recovery'])
             .where('updated_at', '<=', toSqlDateTime(cutoff))
             .limit(Math.max(1, limit))
             .get();
-        const actionableRows = (rows ?? []).filter((row) => mapPersistedStatus(row.status) !== null);
-        await Promise.all(actionableRows.map(async (row) => {
-            const status = mapPersistedStatus(row.status);
-            if (status === 'active') {
-                await JobStateTracker.stalled({
-                    queueName: row.queue_name,
-                    jobId: row.job_id,
-                    reason: 'Persisted active job stale during reconciliation',
-                });
-                return;
-            }
-            await JobStateTracker.pendingRecovery({
-                queueName: row.queue_name,
-                jobId: row.job_id,
-                reason: 'Persisted pending job stale during reconciliation',
-            });
-        }));
-        return actionableRows.length;
+        return candidates.length;
     },
     async runOnce() {
         const inMemory = await this.reconcileInMemory();

package/src/tools/queue/JobRecoveryDaemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JobRecoveryDaemon.d.ts","sourceRoot":"","sources":["../../../../src/tools/queue/JobRecoveryDaemon.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAejF,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAE7F,KAAK,gBAAgB,GAAG;IACtB,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAuFF,eAAO,MAAM,iBAAiB;uBAElB,iBAAiB,GACxB,OAAO,CAAC,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;eAyCvC,OAAO,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;4BAkC4B,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;EA2DzE,CAAC;AAEH,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"JobRecoveryDaemon.d.ts","sourceRoot":"","sources":["../../../../src/tools/queue/JobRecoveryDaemon.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAejF,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAE7F,KAAK,gBAAgB,GAAG;IACtB,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAuFF,eAAO,MAAM,iBAAiB;uBAElB,iBAAiB,GACxB,OAAO,CAAC,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;eA2EvC,OAAO,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;4BAkD4B,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;EA2DzE,CAAC;AAiFH,eAAe,iBAAiB,CAAC"}