@zintrust/core 0.1.48 → 0.1.50

package/src/middleware/JwtAuthMiddleware.js

@@ -2,7 +2,7 @@ import { Logger } from '../config/logger.js';
 import { securityConfig } from '../config/security.js';
 import { RequestContext } from '../http/RequestContext.js';
 import { JwtManager } from '../security/JwtManager.js';
-import { TokenRevocation } from '../security/TokenRevocation.js';
+import { JwtSessions } from '../security/JwtSessions.js';
 const getHeaderValue = (value) => {
     if (Array.isArray(value))
         return typeof value[0] === 'string' ? value[0] : '';
@@ -37,6 +37,11 @@ export const JwtAuthMiddleware = Object.freeze({
             jwt.setHmacSecret(secret);
         }
         return async (req, res, next) => {
+            // If a stronger auth strategy already authenticated this request, do not re-verify.
+            if (req.context?.['authStrategy'] === 'bulletproof' && req.user !== undefined) {
+                await next();
+                return;
+            }
             const authorizationHeader = getHeaderValue(req.getHeader('authorization'));
             if (authorizationHeader === '') {
                 res.setStatus(401).json({ error: 'Missing authorization header' });
@@ -47,12 +52,13 @@ export const JwtAuthMiddleware = Object.freeze({
                 res.setStatus(401).json({ error: 'Invalid authorization header format' });
                 return;
             }
-            if (await TokenRevocation.isRevoked(token)) {
-                res.setStatus(401).json({ error: 'Invalid or expired token' });
-                return;
-            }
             try {
                 const payload = jwt.verify(token, algorithm);
+                // Session allowlist: token must exist in the session store to be accepted.
+                if (!(await JwtSessions.isActive(token))) {
+                    res.setStatus(401).json({ error: 'Invalid or expired token' });
+                    return;
+                }
                 req.user = payload;
                 // Standardize request-scoped context fields.
                 if (typeof payload.sub === 'string' && payload.sub.trim() !== '') {

package/src/orm/Database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Database.d.ts","sourceRoot":"","sources":["../../../src/orm/Database.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAWxD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,MAAM,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,SAAS;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;IACnC,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1F,cAAc,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1E,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3F,kBAAkB,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACvD,OAAO,IAAI,eAAe,CAAC;IAC3B,SAAS,IAAI,cAAc,CAAC;IAC5B,OAAO,IAAI,IAAI,CAAC;CACjB;AA4gBD,eAAO,MAAM,QAAQ;IACnB;;OAEG;oBACa,cAAc,GAAG,SAAS;EAI1C,CAAC;AAIH,eAAO,MAAM,oBAAoB,GAC/B,SAAQ,cAAc,GAAG,SAAqB,EAC9C,uBAA0B,KACzB,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAMxC,CAAC;AAEF,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,UAAU,SAAY,GAAG,SAAS,CAoBtF;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAWnD"}
+{"version":3,"file":"Database.d.ts","sourceRoot":"","sources":["../../../src/orm/Database.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAWxD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,MAAM,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,SAAS;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;IACnC,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1F,cAAc,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1E,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3F,kBAAkB,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACvD,OAAO,IAAI,eAAe,CAAC;IAC3B,SAAS,IAAI,cAAc,CAAC;IAC5B,OAAO,IAAI,IAAI,CAAC;CACjB;AAghBD,eAAO,MAAM,QAAQ;IACnB;;OAEG;oBACa,cAAc,GAAG,SAAS;EAI1C,CAAC;AAIH,eAAO,MAAM,oBAAoB,GAC/B,SAAQ,cAAc,GAAG,SAAqB,EAC9C,uBAA0B,KACzB,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAMxC,CAAC;AAEF,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,UAAU,SAAY,GAAG,SAAS,CAoBtF;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAWnD"}

package/src/orm/Database.js

@@ -31,52 +31,64 @@ const resolveMySqlProxyAdapter = (cfg) => {
         return null;
     const proxyUrl = Env.get('MYSQL_PROXY_URL', '').trim();
     const useProxy = Env.getBool('USE_MYSQL_PROXY', false);
-    if (useProxy || proxyUrl.length > 0) {
-        Logger.info('[Database] Selecting MySQL proxy adapter', {
+    if (!useProxy)
+        return null;
+    if (proxyUrl.length === 0) {
+        Logger.warn('[Database] USE_MYSQL_PROXY enabled but MYSQL_PROXY_URL is empty', {
             driver: cfg.driver,
-            useMySqlProxy: useProxy,
-            mysqlProxyUrlConfigured: proxyUrl.length > 0,
-            mysqlProxyUrl: proxyUrl,
         });
-        return MySQLProxyAdapter.create(cfg);
     }
-    return null;
+    Logger.info('[Database] Selecting MySQL proxy adapter', {
+        driver: cfg.driver,
+        useMySqlProxy: useProxy,
+        mysqlProxyUrlConfigured: proxyUrl.length > 0,
+        mysqlProxyUrl: proxyUrl,
+    });
+    return MySQLProxyAdapter.create(cfg);
 };
 const resolvePostgresProxyAdapter = (cfg) => {
     if (cfg.driver !== 'postgresql')
         return null;
     const proxyUrl = Env.get('POSTGRES_PROXY_URL', '').trim();
     const useProxy = Env.getBool('USE_POSTGRES_PROXY', false);
-    if (useProxy || proxyUrl.length > 0) {
-        Logger.info('[Database] Selecting PostgreSQL proxy adapter', {
+    if (!useProxy)
+        return null;
+    if (proxyUrl.length === 0) {
+        Logger.warn('[Database] USE_POSTGRES_PROXY enabled but POSTGRES_PROXY_URL is empty', {
             driver: cfg.driver,
-            usePostgresProxy: useProxy,
-            postgresProxyUrlConfigured: proxyUrl.length > 0,
-            postgresProxyUrl: proxyUrl,
         });
-        return PostgreSQLProxyAdapter.create(cfg);
     }
-    return null;
+    Logger.info('[Database] Selecting PostgreSQL proxy adapter', {
+        driver: cfg.driver,
+        usePostgresProxy: useProxy,
+        postgresProxyUrlConfigured: proxyUrl.length > 0,
+        postgresProxyUrl: proxyUrl,
+    });
+    return PostgreSQLProxyAdapter.create(cfg);
 };
 const resolveSqlServerProxyAdapter = (cfg) => {
     if (cfg.driver !== 'sqlserver')
         return null;
     const proxyUrl = Env.get('SQLSERVER_PROXY_URL', '').trim();
     const useProxy = Env.getBool('USE_SQLSERVER_PROXY', false);
-    if (useProxy || proxyUrl.length > 0) {
-        Logger.info('[Database] Selecting SQL Server proxy adapter', {
+    if (!useProxy)
+        return null;
+    if (proxyUrl.length === 0) {
+        Logger.warn('[Database] USE_SQLSERVER_PROXY enabled but SQLSERVER_PROXY_URL is empty', {
             driver: cfg.driver,
-            useSqlServerProxy: useProxy,
-            sqlServerProxyUrlConfigured: proxyUrl.length > 0,
-            sqlServerProxyUrl: proxyUrl,
         });
-        return createSqlServerProxyAdapter();
     }
-    return null;
+    Logger.info('[Database] Selecting SQL Server proxy adapter', {
+        driver: cfg.driver,
+        useSqlServerProxy: useProxy,
+        sqlServerProxyUrlConfigured: proxyUrl.length > 0,
+        sqlServerProxyUrl: proxyUrl,
+    });
+    return createSqlServerProxyAdapter();
 };
 const resolveExplicitProxyAdapter = (cfg) => {
     // Allow proxy adapters to be forced in any runtime (Node or Workers) when
-    // the feature flags or proxy URLs are configured.
+    // the feature flags are enabled.
     const mysqlProxy = resolveMySqlProxyAdapter(cfg);
     if (mysqlProxy)
         return mysqlProxy;
@@ -266,45 +278,42 @@ const createConnectionHandlers = (writeAdapter, readAdapters, connected, connect
  * Create query handlers
  */
 const createQueryHandlers = (writeAdapter, _readAdapters, eventEmitter, connected, db, getAdapter) => {
+    let registryChecked = false;
+    const assertRegistryReady = () => {
+        if (registryChecked)
+            return;
+        registryChecked = true;
+        const registry = DatabaseAdapterRegistry.list();
+        if (registry.length === 0) {
+            throw ErrorFactory.createConfigError('No database adapters are registered. Call DatabaseAdapterRegistry.register() during startup to register database adapters.');
+        }
+    };
     return {
         async query(sql, parameters = [], isRead = false) {
             if (connected.value === false)
                 await db.connect();
             const adapter = getAdapter(isRead);
-            const registry = DatabaseAdapterRegistry.list();
-            // Validate that database adapters are registered
-            if (registry.length === 0) {
-                throw ErrorFactory.createConfigError('No database adapters are registered. Call DatabaseAdapterRegistry.register() during startup to register database adapters.');
-            }
+            assertRegistryReady();
             return executeQuery(adapter, eventEmitter, sql, parameters, 'query');
         },
         async queryOne(sql, parameters = [], isRead = false) {
             if (connected.value === false)
                 await db.connect();
             const adapter = getAdapter(isRead);
-            // Validate that database adapters are registered
-            if (DatabaseAdapterRegistry.list().length === 0) {
-                throw ErrorFactory.createConfigError('No database adapters are registered. Call DatabaseAdapterRegistry.register() during startup to register database adapters.');
-            }
+            assertRegistryReady();
             return executeQueryOne(adapter, eventEmitter, sql, parameters);
         },
         async execute(sql, parameters = [], isRead = false) {
             if (connected.value === false)
                 await db.connect();
             const adapter = getAdapter(isRead);
-            // Validate that database adapters are registered
-            if (DatabaseAdapterRegistry.list().length === 0) {
-                throw ErrorFactory.createConfigError('No database adapters are registered. Call DatabaseAdapterRegistry.register() during startup to register database adapters.');
-            }
+            assertRegistryReady();
             return executeFullQuery(adapter, eventEmitter, sql, parameters);
         },
         async transaction(callback) {
             if (connected.value === false)
                 await db.connect();
-            // Validate that database adapters are registered
-            if (DatabaseAdapterRegistry.list().length === 0) {
-                throw ErrorFactory.createConfigError('No database adapters are registered. Call DatabaseAdapterRegistry.register() during startup to register database adapters.');
-            }
+            assertRegistryReady();
             return writeAdapter.transaction(async () => callback(db));
         },
     };

package/src/orm/adapters/MySQLProxyAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MySQLProxyAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/MySQLProxyAdapter.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAkBH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAiN1F,eAAO,MAAM,iBAAiB;oBACZ,cAAc,GAAG,gBAAgB;EAajD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"MySQLProxyAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/MySQLProxyAdapter.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAuO1F,eAAO,MAAM,iBAAiB;oBACZ,cAAc,GAAG,gBAAgB;EAcjD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}

package/src/orm/adapters/MySQLProxyAdapter.js

@@ -4,54 +4,53 @@
  *
  * Used in Cloudflare Workers when MYSQL_PROXY_URL is configured.
  */
-import { Env } from '../../config/env.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { AdaptersEnum } from '../../migrations/enum/index.js';
-import { ensureSignedSettings, isRecord, requestSignedProxy, } from '../adapters/SqlProxyAdapterUtils.js';
-import { createStatementPayload, getExecMetaWithLastRowId, resolveSqlProxyMode, } from '../adapters/SqlProxyRegistryMode.js';
+import { ensureSignedSettings, isRecord, } from '../adapters/SqlProxyAdapterUtils.js';
+import { SqlProxyHttpAdapterShared } from '../adapters/SqlProxyHttpAdapterShared.js';
+import { createStatementPayload, getExecMetaWithLastRowId, } from '../adapters/SqlProxyRegistryMode.js';
 import { QueryBuilder } from '../QueryBuilder.js';
 const buildProxySettings = () => {
-    const baseUrl = Env.MYSQL_PROXY_URL;
-    const keyId = Env.MYSQL_PROXY_KEY_ID ?? '';
-    const secret = Env.MYSQL_PROXY_SECRET ?? '';
-    const timeoutMs = Env.MYSQL_PROXY_TIMEOUT_MS;
-    return { baseUrl, keyId, secret, timeoutMs };
+    return SqlProxyHttpAdapterShared.buildProxySettingsFromEnv({
+        urlKey: 'MYSQL_PROXY_URL',
+        keyIdKey: 'MYSQL_PROXY_KEY_ID',
+        secretKey: 'MYSQL_PROXY_SECRET',
+        timeoutKey: 'MYSQL_PROXY_TIMEOUT_MS',
+        sharedKeyIdKey: 'ZT_PROXY_KEY_ID',
+        sharedSecretKey: 'ZT_PROXY_SECRET',
+        sharedTimeoutKey: 'ZT_PROXY_TIMEOUT_MS',
+    });
+};
+const buildSignedProxyConfig = (settings) => {
+    return SqlProxyHttpAdapterShared.buildStandardSignedProxyConfig({
+        settings,
+        label: 'MySQL',
+        urlKey: 'MYSQL_PROXY_URL',
+        keyIdKey: 'MYSQL_PROXY_KEY_ID',
+        secretKey: 'MYSQL_PROXY_SECRET',
+    });
 };
-const buildSignedProxyConfig = (settings) => ({
-    settings,
-    missingUrlMessage: 'MySQL proxy URL is missing (MYSQL_PROXY_URL)',
-    missingCredentialsMessage: 'MySQL proxy signing credentials are missing (MYSQL_PROXY_KEY_ID / MYSQL_PROXY_SECRET)',
-    messages: {
-        unauthorized: 'MySQL proxy unauthorized',
-        forbidden: 'MySQL proxy forbidden',
-        rateLimited: 'MySQL proxy rate limited',
-        rejected: 'MySQL proxy rejected request',
-        error: 'MySQL proxy error',
-        timedOut: 'MySQL proxy request timed out',
-    },
-});
 const isQueryResponse = (value) => isRecord(value) && Array.isArray(value['rows']) && typeof value['rowCount'] === 'number';
 const isQueryOneResponse = (value) => isRecord(value) && 'row' in value;
-const requestProxy = async (settings, path, payload) => {
-    const signedProxyConfig = buildSignedProxyConfig(settings);
+const requestProxy = async (state, path, payload) => {
     try {
-        return await requestSignedProxy(signedProxyConfig, path, payload);
+        return await SqlProxyHttpAdapterShared.requestProxy(state.signed, path, payload);
     }
     catch (error) {
         Logger.error('[MySQLProxyAdapter] Proxy request failed', {
             path,
-            baseUrl: settings.baseUrl,
-            timeoutMs: settings.timeoutMs,
-            hasKeyId: (settings.keyId ?? '').trim() !== '',
-            hasSecret: (settings.secret ?? '').trim() !== '',
+            baseUrl: state.settings.baseUrl,
+            timeoutMs: state.settings.timeoutMs,
+            hasKeyId: (state.settings.keyId ?? '').trim() !== '',
+            hasSecret: (state.settings.secret ?? '').trim() !== '',
             error: error instanceof Error ? error.message : String(error),
         });
         throw error;
     }
 };
 const resolveProxyMode = () => {
-    return resolveSqlProxyMode('MYSQL_PROXY_MODE');
+    return SqlProxyHttpAdapterShared.resolveProxyModeFromEnv('MYSQL_PROXY_MODE');
 };
 const requireConnected = (state) => {
     if (!state.connected)
@@ -76,8 +75,8 @@ const createQuery = (state) => async (sql, parameters) => {
     requireConnected(state);
     const mode = resolveProxyMode();
     const out = mode === 'registry'
-        ? await requestProxy(state.settings, '/zin/mysql/statement', await createStatementPayload(sql, parameters))
-        : await requestProxy(state.settings, '/zin/mysql/query', {
+        ? await requestProxy(state, '/zin/mysql/statement', await createStatementPayload(sql, parameters))
+        : await requestProxy(state, '/zin/mysql/query', {
             sql,
             params: parameters,
         });
@@ -87,13 +86,13 @@ const createQueryOne = (state) => async (sql, parameters) => {
     requireConnected(state);
     const mode = resolveProxyMode();
     if (mode !== 'registry') {
-        const out = await requestProxy(state.settings, '/zin/mysql/queryOne', {
+        const out = await requestProxy(state, '/zin/mysql/queryOne', {
             sql,
             params: parameters,
         });
         return out.row ?? null;
     }
-    const out = await requestProxy(state.settings, '/zin/mysql/statement', await createStatementPayload(sql, parameters));
+    const out = await requestProxy(state, '/zin/mysql/statement', await createStatementPayload(sql, parameters));
     if (isQueryOneResponse(out))
         return out.row ?? null;
     if (isQueryResponse(out))
@@ -123,7 +122,7 @@ const createAdapter = (state) => {
     const ping = createPing(queryOne);
     const adapter = {
         async connect() {
-            ensureSignedSettings(buildSignedProxyConfig(state.settings));
+            ensureSignedSettings(state.signed);
             state.connected = true;
         },
         async disconnect() {
@@ -134,6 +133,25 @@ const createAdapter = (state) => {
         ping,
         transaction: createTransaction(state, () => adapter),
         rawQuery: createRawQuery(state, query),
+        async ensureMigrationsTable() {
+            requireConnected(state);
+            try {
+                await query(`CREATE TABLE IF NOT EXISTS migrations (
+            id INTEGER PRIMARY KEY AUTO_INCREMENT,
+            name VARCHAR(255) NOT NULL,
+            scope VARCHAR(255) NOT NULL DEFAULT 'global',
+            service VARCHAR(255) NOT NULL DEFAULT '',
+            batch INTEGER NOT NULL,
+            status VARCHAR(255) NOT NULL,
+            applied_at DATETIME NULL,
+            created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+            UNIQUE(name, scope, service)
+          )`, []);
+            }
+            catch (error) {
+                throw SqlProxyHttpAdapterShared.createProxyNotReachableCliError('MySQL proxy', state.settings.baseUrl, error);
+            }
+        },
         getType() {
             return AdaptersEnum.mysql;
         },
@@ -149,7 +167,8 @@ const createAdapter = (state) => {
 export const MySQLProxyAdapter = Object.freeze({
     create(_config) {
         const settings = buildProxySettings();
-        const state = { connected: false, settings };
+        const signed = buildSignedProxyConfig(settings);
+        const state = { connected: false, settings, signed };
         Logger.info('[MySQLProxyAdapter] Created with runtime settings', {
             baseUrl: settings.baseUrl,
             timeoutMs: settings.timeoutMs,

package/src/orm/adapters/PostgreSQLProxyAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSQLProxyAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/PostgreSQLProxyAdapter.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAaH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAiH1F,eAAO,MAAM,sBAAsB;oBACjB,cAAc,GAAG,gBAAgB;EAwFjD,CAAC;AAEH,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"PostgreSQLProxyAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/PostgreSQLProxyAdapter.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAWH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AA4P1F,eAAO,MAAM,sBAAsB;oBACjB,cAAc,GAAG,gBAAgB;EAMjD,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/src/orm/adapters/PostgreSQLProxyAdapter.js

@@ -4,40 +4,36 @@
  *
  * Used in Cloudflare Workers when POSTGRES_PROXY_URL is configured.
  */
-import { Env } from '../../config/env.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { AdaptersEnum } from '../../migrations/enum/index.js';
-import { ensureSignedSettings, isRecord, requestSignedProxy, } from '../adapters/SqlProxyAdapterUtils.js';
-import { createStatementPayload, resolveSqlProxyMode } from '../adapters/SqlProxyRegistryMode.js';
+import { isRecord, } from '../adapters/SqlProxyAdapterUtils.js';
+import { SqlProxyHttpAdapterShared } from '../adapters/SqlProxyHttpAdapterShared.js';
+import { createStatementPayload } from '../adapters/SqlProxyRegistryMode.js';
 import { QueryBuilder } from '../QueryBuilder.js';
-const resolveBaseUrl = () => {
-    const explicit = Env.POSTGRES_PROXY_URL.trim();
-    if (explicit !== '')
-        return explicit;
-    const host = Env.POSTGRES_PROXY_HOST || '127.0.0.1';
-    const port = Env.POSTGRES_PROXY_PORT;
-    return `http://${host}:${port}`;
-};
 const buildProxySettings = () => {
-    const baseUrl = resolveBaseUrl();
-    const keyId = Env.POSTGRES_PROXY_KEY_ID ?? '';
-    const secret = Env.POSTGRES_PROXY_SECRET ?? '';
-    const timeoutMs = Env.POSTGRES_PROXY_TIMEOUT_MS;
-    return { baseUrl, keyId, secret, timeoutMs };
+    return SqlProxyHttpAdapterShared.buildProxySettingsFromEnv({
+        urlKey: 'POSTGRES_PROXY_URL',
+        hostKey: 'POSTGRES_PROXY_HOST',
+        portKey: 'POSTGRES_PROXY_PORT',
+        defaultHost: '127.0.0.1',
+        defaultPort: 8790,
+        keyIdKey: 'POSTGRES_PROXY_KEY_ID',
+        secretKey: 'POSTGRES_PROXY_SECRET',
+        timeoutKey: 'POSTGRES_PROXY_TIMEOUT_MS',
+        sharedKeyIdKey: 'ZT_PROXY_KEY_ID',
+        sharedSecretKey: 'ZT_PROXY_SECRET',
+        sharedTimeoutKey: 'ZT_PROXY_TIMEOUT_MS',
+    });
+};
+const buildSignedProxyConfig = (settings) => {
+    return SqlProxyHttpAdapterShared.buildStandardSignedProxyConfig({
+        settings,
+        label: 'PostgreSQL',
+        urlKey: 'POSTGRES_PROXY_URL',
+        keyIdKey: 'POSTGRES_PROXY_KEY_ID',
+        secretKey: 'POSTGRES_PROXY_SECRET',
+    });
 };
-const buildSignedProxyConfig = (settings) => ({
-    settings,
-    missingUrlMessage: 'PostgreSQL proxy URL is missing (POSTGRES_PROXY_URL)',
-    missingCredentialsMessage: 'PostgreSQL proxy signing credentials are missing (POSTGRES_PROXY_KEY_ID / POSTGRES_PROXY_SECRET)',
-    messages: {
-        unauthorized: 'PostgreSQL proxy unauthorized',
-        forbidden: 'PostgreSQL proxy forbidden',
-        rateLimited: 'PostgreSQL proxy rate limited',
-        rejected: 'PostgreSQL proxy rejected request',
-        error: 'PostgreSQL proxy error',
-        timedOut: 'PostgreSQL proxy request timed out',
-    },
-});
 const isQueryResponse = (value) => isRecord(value) && Array.isArray(value['rows']) && typeof value['rowCount'] === 'number';
 const isQueryOneResponse = (value) => isRecord(value) && 'row' in value;
 const normalizeLastInsertId = (value) => {
@@ -79,85 +75,112 @@ const toQueryResult = (out) => {
     const meta = getExecMeta(out);
     return { rows: [], rowCount: meta.changes };
 };
-const requestProxy = async (settings, path, payload) => {
-    return requestSignedProxy(buildSignedProxyConfig(settings), path, payload);
-};
 const resolveProxyMode = () => {
-    return resolveSqlProxyMode('POSTGRES_PROXY_MODE');
+    return SqlProxyHttpAdapterShared.resolveProxyModeFromEnv('POSTGRES_PROXY_MODE');
+};
+const requireConnected = (state) => {
+    if (!state.connected)
+        throw ErrorFactory.createConnectionError('Database not connected');
+};
+const createQuery = (state) => async (sql, parameters) => {
+    requireConnected(state);
+    const mode = resolveProxyMode();
+    const out = mode === 'registry'
+        ? await SqlProxyHttpAdapterShared.requestProxy(state.signed, '/zin/postgres/statement', await createStatementPayload(sql, parameters))
+        : await SqlProxyHttpAdapterShared.requestProxy(state.signed, '/zin/postgres/query', {
+            sql,
+            params: parameters,
+        });
+    return toQueryResult(out);
+};
+const createQueryOne = (state) => async (sql, parameters) => {
+    requireConnected(state);
+    const mode = resolveProxyMode();
+    if (mode !== 'registry') {
+        const out = await SqlProxyHttpAdapterShared.requestProxy(state.signed, '/zin/postgres/queryOne', {
+            sql,
+            params: parameters,
+        });
+        return out.row ?? null;
+    }
+    const out = await SqlProxyHttpAdapterShared.requestProxy(state.signed, '/zin/postgres/statement', await createStatementPayload(sql, parameters));
+    if (isQueryOneResponse(out))
+        return out.row ?? null;
+    if (isQueryResponse(out))
+        return out.rows[0] ?? null;
+    return null;
+};
+const createPing = (queryOne) => async () => {
+    await queryOne(QueryBuilder.create('').select('1').toSQL(), []);
+};
+const createTransaction = (state, getAdapter) => async (callback) => {
+    requireConnected(state);
+    try {
+        return await callback(getAdapter());
+    }
+    catch (error) {
+        throw ErrorFactory.createTryCatchError('PostgreSQL proxy transaction failed', error);
+    }
+};
+const createRawQuery = (state, query) => async (sql, parameters = []) => {
+    requireConnected(state);
+    const out = await query(sql, parameters);
+    return out.rows;
+};
+const createEnsureMigrationsTable = (state, query) => async () => {
+    requireConnected(state);
+    try {
+        await query(`CREATE TABLE IF NOT EXISTS migrations (
+            id SERIAL PRIMARY KEY,
+            name VARCHAR(255) NOT NULL,
+            scope VARCHAR(255) NOT NULL DEFAULT 'global',
+            service VARCHAR(255) NOT NULL DEFAULT '',
+            batch INTEGER NOT NULL,
+            status VARCHAR(255) NOT NULL,
+            applied_at TIMESTAMP NULL,
+            created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+            UNIQUE(name, scope, service)
+          )`, []);
+    }
+    catch (error) {
+        throw SqlProxyHttpAdapterShared.createProxyNotReachableCliError('PostgreSQL proxy', state.settings.baseUrl, error);
+    }
+};
+const createAdapter = (state) => {
+    const query = createQuery(state);
+    const queryOne = createQueryOne(state);
+    const adapter = {
+        async connect() {
+            SqlProxyHttpAdapterShared.ensureSignedProxyConfig(state.signed);
+            state.connected = true;
+        },
+        async disconnect() {
+            state.connected = false;
+        },
+        query,
+        queryOne,
+        ping: createPing(queryOne),
+        transaction: createTransaction(state, () => adapter),
+        rawQuery: createRawQuery(state, query),
+        ensureMigrationsTable: createEnsureMigrationsTable(state, query),
+        getType() {
+            return AdaptersEnum.postgresql;
+        },
+        isConnected() {
+            return state.connected;
+        },
+        getPlaceholder(index) {
+            return `$${index}`;
+        },
+    };
+    return adapter;
 };
 export const PostgreSQLProxyAdapter = Object.freeze({
     create(_config) {
-        let connected = true;
         const settings = buildProxySettings();
-        return {
-            async connect() {
-                ensureSignedSettings(buildSignedProxyConfig(settings));
-                connected = true;
-            },
-            async disconnect() {
-                connected = true;
-            },
-            async query(sql, parameters) {
-                if (!connected)
-                    throw ErrorFactory.createConnectionError('Database not connected');
-                const mode = resolveProxyMode();
-                const out = mode === 'registry'
-                    ? await requestProxy(settings, '/zin/postgres/statement', await createStatementPayload(sql, parameters))
-                    : await requestProxy(settings, '/zin/postgres/query', {
-                        sql,
-                        params: parameters,
-                    });
-                return toQueryResult(out);
-            },
-            async queryOne(sql, parameters) {
-                if (!connected)
-                    throw ErrorFactory.createConnectionError('Database not connected');
-                const mode = resolveProxyMode();
-                if (mode !== 'registry') {
-                    const out = await requestProxy(settings, '/zin/postgres/queryOne', {
-                        sql,
-                        params: parameters,
-                    });
-                    return out.row ?? null;
-                }
-                const out = await requestProxy(settings, '/zin/postgres/statement', await createStatementPayload(sql, parameters));
-                if (isQueryOneResponse(out))
-                    return out.row ?? null;
-                if (isQueryResponse(out))
-                    return out.rows[0] ?? null;
-                return null;
-            },
-            async ping() {
-                if (!connected)
-                    throw ErrorFactory.createConnectionError('Database not connected');
-                await this.queryOne(QueryBuilder.create('').select('1').toSQL(), []);
-            },
-            async transaction(callback) {
-                if (!connected)
-                    throw ErrorFactory.createConnectionError('Database not connected');
-                try {
-                    return await callback(this);
-                }
-                catch (error) {
-                    throw ErrorFactory.createTryCatchError('PostgreSQL proxy transaction failed', error);
-                }
-            },
-            async rawQuery(sql, parameters = []) {
-                if (!connected)
-                    throw ErrorFactory.createConnectionError('Database not connected');
-                const out = await this.query(sql, parameters);
-                return out.rows;
-            },
-            getType() {
-                return AdaptersEnum.postgresql;
-            },
-            isConnected() {
-                return connected;
-            },
-            getPlaceholder(index) {
-                return `$${index}`;
-            },
-        };
+        const signed = buildSignedProxyConfig(settings);
+        const state = { connected: false, settings, signed };
+        return createAdapter(state);
     },
 });
 export default PostgreSQLProxyAdapter;

package/src/orm/adapters/SqlProxyHttpAdapterShared.d.ts

@@ -0,0 +1,30 @@
+import { type ProxySettings, type SignedProxyConfig } from '../adapters/SqlProxyAdapterUtils';
+export type ProxyMode = 'sql' | 'registry';
+export type ProxySettingsBuildInput = {
+    urlKey: string;
+    hostKey?: string;
+    portKey?: string;
+    defaultHost?: string;
+    defaultPort?: number;
+    keyIdKey: string;
+    secretKey: string;
+    timeoutKey: string;
+    sharedKeyIdKey?: string;
+    sharedSecretKey?: string;
+    sharedTimeoutKey?: string;
+};
+export declare const SqlProxyHttpAdapterShared: Readonly<{
+    buildProxySettingsFromEnv: (input: ProxySettingsBuildInput) => ProxySettings;
+    buildStandardSignedProxyConfig: (input: {
+        settings: ProxySettings;
+        label: string;
+        urlKey: string;
+        keyIdKey: string;
+        secretKey: string;
+    }) => SignedProxyConfig;
+    ensureSignedProxyConfig: (signed: SignedProxyConfig) => void;
+    requestProxy: <T>(signed: SignedProxyConfig, path: string, payload: Record<string, unknown>) => Promise<T>;
+    resolveProxyModeFromEnv: (envKey: string) => ProxyMode;
+    createProxyNotReachableCliError: (label: string, baseUrl: string, error: unknown) => Error;
+}>;
+//# sourceMappingURL=SqlProxyHttpAdapterShared.d.ts.map

package/src/orm/adapters/SqlProxyHttpAdapterShared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlProxyHttpAdapterShared.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/SqlProxyHttpAdapterShared.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,oCAAoC,CAAC;AAG5C,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,UAAU,CAAC;AAE3C,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAmFF,eAAO,MAAM,yBAAyB;uCA9DI,uBAAuB,KAAG,aAAa;4CAalC;QAC7C,QAAQ,EAAE,aAAa,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAG,iBAAiB;sCAmBoB,iBAAiB,KAAG,IAAI;mBAIrC,CAAC,UACnB,iBAAiB,QACnB,MAAM,WACH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,CAAC,CAAC;sCAI4B,MAAM,KAAG,SAAS;6CAIX,MAAM,WAAW,MAAM,SAAS,OAAO,KAAG,KAAK;EAe7F,CAAC"}