@zintrust/core 0.1.48 → 0.1.50

package/src/security/NonceReplay.js

@@ -0,0 +1,42 @@
+const DEFAULTS = {
+    cleanupEvery: 500,
+    maxEntries: 25_000,
+};
+export const NonceReplay = Object.freeze({
+    /**
+     * In-memory, best-effort replay protection.
+     *
+     * Works in both Node and Workers, but does not provide cross-instance guarantees.
+     * For strict production replay protection, supply your own verifier backed by Redis/KV.
+     */
+    createMemoryVerifier(options = {}) {
+        const cleanupEvery = options.cleanupEvery ?? DEFAULTS.cleanupEvery;
+        const maxEntries = options.maxEntries ?? DEFAULTS.maxEntries;
+        const store = new Map();
+        let accepted = 0;
+        const cleanup = (nowMs) => {
+            for (const [key, entry] of store.entries()) {
+                if (entry.expiresAtMs <= nowMs)
+                    store.delete(key);
+            }
+        };
+        return async (keyId, nonce, ttlMs) => {
+            const nowMs = Date.now();
+            const expiresAtMs = nowMs + Math.max(1, ttlMs);
+            const compositeKey = `${keyId}:${nonce}`;
+            const existing = store.get(compositeKey);
+            if (existing !== undefined && existing.expiresAtMs > nowMs) {
+                await Promise.resolve();
+                return false;
+            }
+            store.set(compositeKey, { expiresAtMs });
+            accepted += 1;
+            if (store.size > maxEntries || accepted % cleanupEvery === 0) {
+                cleanup(nowMs);
+            }
+            await Promise.resolve();
+            return true;
+        };
+    },
+});
+export default NonceReplay;

package/src/security/TokenRevocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenRevocation.d.ts","sourceRoot":"","sources":["../../../src/security/TokenRevocation.ts"],"names":[],"mappings":"AAUA,KAAK,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AAEzD,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAwsB7F,eAAO,MAAM,eAAe;IAC1B;;;;OAIG;mBACkB,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUjE;;OAEG;qBACoB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhD;;OAEG;iBACU,yBAAyB;IAItC;;OAEG;sBACe,IAAI;EAItB,CAAC;AAEH,eAAe,eAAe,CAAC"}
+{"version":3,"file":"TokenRevocation.d.ts","sourceRoot":"","sources":["../../../src/security/TokenRevocation.ts"],"names":[],"mappings":"AAUA,KAAK,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AAEzD,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAysB7F,eAAO,MAAM,eAAe;IAC1B;;;;OAIG;mBACkB,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUjE;;OAEG;qBACoB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhD;;OAEG;iBACU,yBAAyB;IAItC;;OAEG;sBACe,IAAI;EAItB,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/src/security/TokenRevocation.js

@@ -150,6 +150,7 @@ const createDatabaseStore = (params) => {
                 const payload = {
                     jti: key.id,
                     sub: key.sub ?? null,
+                    user_id: key.sub ?? null,
                     expires_at_ms: key.expiresAtMs,
                 };
                 if (existing) {

package/src/tools/http/Http.d.ts

@@ -19,6 +19,11 @@ export interface IHttpRequest {
     asJson(): IHttpRequest;
     asForm(): IHttpRequest;
     send(): Promise<IHttpResponse>;
+    sendRaw(): Promise<Response>;
+    sendStream(): Promise<{
+        response: Response;
+        stream: ReadableStream<Uint8Array> | null;
+    }>;
 }
 /**
  * HTTP Client - Sealed namespace for making HTTP requests

package/src/tools/http/Http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Http.d.ts","sourceRoot":"","sources":["../../../../src/tools/http/Http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAElF,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IACtD,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,YAAY,CAAC;IACnE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAChE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC;IACtC,MAAM,IAAI,YAAY,CAAC;IACvB,MAAM,IAAI,YAAY,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CAChC;AAqJD;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;aACM,MAAM,GAAG,YAAY;IAI9B;;OAEG;cACO,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAQ/D;;OAEG;aACM,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAQ9D;;OAEG;eACQ,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAQhE;;OAEG;gBACS,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;EAOjE,CAAC;AAEH,eAAe,UAAU,CAAC"}
+{"version":3,"file":"Http.d.ts","sourceRoot":"","sources":["../../../../src/tools/http/Http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAElF,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;IACtD,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,YAAY,CAAC;IACnE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAChE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC;IACtC,MAAM,IAAI,YAAY,CAAC;IACvB,MAAM,IAAI,YAAY,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AA6KD;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;aACM,MAAM,GAAG,YAAY;IAI9B;;OAEG;cACO,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAQ/D;;OAEG;aACM,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAQ9D;;OAEG;eACQ,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAQhE;;OAEG;gBACS,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;EAOjE,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/tools/http/Http.js

@@ -14,6 +14,20 @@ import { createHttpResponse } from './HttpResponse.js';
  * Perform the actual request for a given state. Separated to keep the builder small
  */
 async function performRequest(state) {
+    const { response, bodyText, durationMs } = await performRequestRaw(state);
+    Logger.debug(`HTTP ${state.method} ${state.url}`, {
+        status: response.status,
+        duration: `${durationMs}ms`,
+        size: bodyText.length,
+    });
+    return createHttpResponse(response, bodyText);
+}
+async function performRequestRaw(state) {
+    const { response, durationMs } = await performFetch(state);
+    const bodyText = await response.text();
+    return { response, bodyText, durationMs };
+}
+async function performFetch(state) {
     const timeout = state.timeout ?? Env.getInt('HTTP_TIMEOUT', 30000);
     const controller = new AbortController();
     let timeoutId;
@@ -40,14 +54,8 @@ async function performRequest(state) {
         const init = buildInit();
         const startTime = Date.now();
         const response = await globalThis.fetch(state.url, init);
-        const responseBody = await response.text();
         const duration = Date.now() - startTime;
-        Logger.debug(`HTTP ${state.method} ${state.url}`, {
-            status: response.status,
-            duration: `${duration}ms`,
-            size: responseBody.length,
-        });
-        return createHttpResponse(response, responseBody);
+        return { response, durationMs: duration };
     }
     catch (error) {
         if (error instanceof Error && error.name === 'AbortError') {
@@ -72,7 +80,7 @@ async function performRequest(state) {
 /**
  * Create request builder with fluent API
  */
-const createRequestBuilder = (method, url, initialBody) => {
+function createRequestBuilder(method, url, initialBody) {
     const state = {
         method,
         url,
@@ -116,9 +124,17 @@ const createRequestBuilder = (method, url, initialBody) => {
         async send() {
             return performRequest(state);
         },
+        async sendRaw() {
+            const { response } = await performFetch(state);
+            return response;
+        },
+        async sendStream() {
+            const { response } = await performFetch(state);
+            return { response, stream: response.body };
+        },
     };
     return self;
-};
+}
 /**
  * HTTP Client - Sealed namespace for making HTTP requests
  */

package/src/tools/queue/QueueReliabilityOrchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"QueueReliabilityOrchestrator.d.ts","sourceRoot":"","sources":["../../../../src/tools/queue/QueueReliabilityOrchestrator.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,4BAA4B;iBAC1B,OAAO;aAIX,IAAI;YA4BL,IAAI;EAUZ,CAAC;AAEH,eAAe,4BAA4B,CAAC"}
+{"version":3,"file":"QueueReliabilityOrchestrator.d.ts","sourceRoot":"","sources":["../../../../src/tools/queue/QueueReliabilityOrchestrator.ts"],"names":[],"mappings":"AAmDA,eAAO,MAAM,4BAA4B;iBAC1B,OAAO;aAIX,IAAI;YA4BL,IAAI;EAUZ,CAAC;AAEH,eAAe,4BAA4B,CAAC"}

package/src/tools/queue/QueueReliabilityOrchestrator.js

@@ -3,6 +3,12 @@ import { Logger } from '../../config/logger.js';
 import { JobReconciliationRunner } from './JobReconciliationRunner.js';
 import { JobRecoveryDaemon } from './JobRecoveryDaemon.js';
 import { StalledJobMonitor } from './StalledJobMonitor.js';
+const isUnrefableTimer = (timer) => {
+    return (typeof timer === 'object' &&
+        timer !== null &&
+        'unref' in timer &&
+        typeof timer.unref === 'function');
+};
 const state = {
     started: false,
 };
@@ -11,13 +17,19 @@ const clearTimer = (timer) => {
         return;
     clearInterval(timer);
 };
-const startInterval = (handler, intervalMs) => setInterval(() => {
-    handler().catch((error) => {
-        Logger.warn('Queue reliability interval failed', {
-            error: error instanceof Error ? error : String(error),
+const startInterval = (handler, intervalMs) => {
+    const timer = setInterval(() => {
+        handler().catch((error) => {
+            Logger.warn('Queue reliability interval failed', {
+                error: error instanceof Error ? error : String(error),
+            });
         });
-    });
-}, intervalMs);
+    }, intervalMs);
+    if (isUnrefableTimer(timer)) {
+        timer.unref();
+    }
+    return timer;
+};
 export const QueueReliabilityOrchestrator = Object.freeze({
     isEnabled() {
         return Env.getBool('JOB_RELIABILITY_ENABLED', true);

package/src/validation/Validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Validator.d.ts","sourceRoot":"","sources":["../../../src/validation/Validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,MAAM,IAAI,GACZ,UAAU,GACV,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,OAAO,GACP,SAAS,GACT,KAAK,GACL,KAAK,GACL,WAAW,GACX,WAAW,GACX,OAAO,GACP,IAAI,GACJ,QAAQ,GACR,cAAc,GACd,MAAM,GACN,OAAO,GACP,WAAW,GACX,gBAAgB,GAChB,QAAQ,GACR,SAAS,GACT,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,iBAAiB,GACzB,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,GAC7B,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC;AAEjE,MAAM,WAAW,WAAW,CAAC,OAAO;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/E,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/C,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;AAE3C,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAEnF,MAAM,MAAM,WAAW,CAAC,OAAO,IAAI,OAAO,SAAS;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5E,OAAO,SAAS,CAAC,GACf,KAAK,GACL,CAAC,GACH,KAAK,CAAC;AA2BV,MAAM,WAAW,UAAU;IACzB,MAAM,IAAI,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,MAAM;IACjB;;OAEG;cACO,OAAO;IAkCjB;;;OAGG;UACG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC;EAG1B,CAAC;AA8EH,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AACzC,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAsa5D;;GAEG;AAEH,eAAO,MAAM,SAAS;;QAriBpB;;WAEG;kBACO,OAAO;QAkCjB;;;WAGG;cACG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC;;qBAQJ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;oBAyBnE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,OAAO,KAAG,OAAO;2BAmN3C,aAAa,KAAG,OAAO;0BA6B7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,aAAa,KACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;yBAIE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,aAAa,KAAG,OAAO;EA4OjF,CAAC;AAEH;;GAEG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"Validator.d.ts","sourceRoot":"","sources":["../../../src/validation/Validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,MAAM,MAAM,IAAI,GACZ,UAAU,GACV,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,OAAO,GACP,SAAS,GACT,KAAK,GACL,KAAK,GACL,WAAW,GACX,WAAW,GACX,OAAO,GACP,IAAI,GACJ,QAAQ,GACR,cAAc,GACd,MAAM,GACN,OAAO,GACP,WAAW,GACX,gBAAgB,GAChB,QAAQ,GACR,SAAS,GACT,KAAK,GACL,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,iBAAiB,GACzB,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,GAC7B,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC;AAEjE,MAAM,WAAW,WAAW,CAAC,OAAO;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/E,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpD,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/C,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;AAE3C,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAEnF,MAAM,MAAM,WAAW,CAAC,OAAO,IAAI,OAAO,SAAS;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5E,OAAO,SAAS,CAAC,GACf,KAAK,GACL,CAAC,GACH,KAAK,CAAC;AA2BV,MAAM,WAAW,UAAU;IACzB,MAAM,IAAI,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,MAAM;IACjB;;OAEG;cACO,OAAO;IAkCjB;;;OAGG;UACG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC;EAG1B,CAAC;AA8EH,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AACzC,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAsa5D;;GAEG;AAEH,eAAO,MAAM,SAAS;;QAriBpB;;WAEG;kBACO,OAAO;QAkCjB;;;WAGG;cACG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC;;qBAQJ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;oBAyBnE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,OAAO,KAAG,OAAO;2BAmN3C,aAAa,KAAG,OAAO;0BA6B7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SACtB,aAAa,KACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;yBAIE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,aAAa,KAAG,OAAO;EA4OjF,CAAC;AAEH;;GAEG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC"}

package/src/validation/Validator.js

@@ -4,6 +4,7 @@
  * Sealed namespace pattern - all exports through Validator namespace
  */
 import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 import { createValidationError } from './ValidationError.js';
 const addSimpleRule = (schema, rules, field, rule, message) => {
     if (!rules.has(field))
@@ -279,8 +280,9 @@ const ruleStringTokenHandlers = {
     nullable: () => {
         // Not needed here; missing/undefined is already allowed unless required.
     },
-    unique: ({ schema, field }) => {
-        schema.custom(field, () => false, `${field} unique validation is not supported in the core rule-string API yet`);
+    unique: ({ field }) => {
+        // Rule-string validation is intentionally "pure" (no DB access). Uniqueness requires a backing store.
+        throw ErrorFactory.createConfigError('Validator rule-string token "unique" is not supported (requires a database-backed validator).', { field });
     },
 };
 const rulesToSchema = (rules) => {

package/src/zintrust.comon.d.ts

@@ -0,0 +1,9 @@
+import '../packages/db-d1/src/register.js';
+import '../packages/db-mysql/src/register.js';
+import '../packages/db-postgres/src/register.js';
+import '../packages/db-sqlite/src/register.js';
+import '../packages/db-sqlserver/src/register.js';
+import '../packages/mail-sendgrid/src/register.js';
+import '../packages/mail-smtp/src/register.js';
+import '../packages/queue-redis/src/register.js';
+//# sourceMappingURL=zintrust.comon.d.ts.map

package/src/zintrust.comon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zintrust.comon.d.ts","sourceRoot":"","sources":["../../src/zintrust.comon.ts"],"names":[],"mappings":"AAQA,OAAO,mCAAmC,CAAC;AAC3C,OAAO,sCAAsC,CAAC;AAC9C,OAAO,yCAAyC,CAAC;AACjD,OAAO,uCAAuC,CAAC;AAC/C,OAAO,0CAA0C,CAAC;AAClD,OAAO,2CAA2C,CAAC;AACnD,OAAO,uCAAuC,CAAC;AAC/C,OAAO,yCAAyC,CAAC"}

package/src/zintrust.comon.js

@@ -0,0 +1,15 @@
+/* eslint-disable no-restricted-imports */
+// /**
+//  * ZinTrust comon plugin auto-imports
+//  *
+//  * This file is managed by `zin plugin install` and contains side-effect
+//  * imports that register optional adapters/drivers into core registries.
+//  */
+import '../packages/db-d1/src/register.js';
+import '../packages/db-mysql/src/register.js';
+import '../packages/db-postgres/src/register.js';
+import '../packages/db-sqlite/src/register.js';
+import '../packages/db-sqlserver/src/register.js';
+import '../packages/mail-sendgrid/src/register.js';
+import '../packages/mail-smtp/src/register.js';
+import '../packages/queue-redis/src/register.js';

package/src/zintrust.plugins.d.ts

@@ -1,8 +1,14 @@
 /**
- * Auto-generated fallback module.
- * This file is created by scripts/ensure-worker-plugins.mjs when missing.
- * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
+ * ZinTrust plugin auto-imports
+ *
+ * In real projects, this file is managed by `zin plugin install` and contains
+ * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
+ * optional adapters/drivers into core registries.
+ *
+ * In the ZinTrust monorepo/dev workspace, we import a local bundle of plugin
+ * registrations so `zin s` works out-of-the-box (database adapters, queue, mail).
  */
+import './zintrust.comon';
 export declare const __zintrustGeneratedPluginStub = "zintrust.plugins.ts";
 declare const _default: {};
 export default _default;

package/src/zintrust.plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}
+{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,kBAAkB,CAAC;AAE1B,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}

package/src/zintrust.plugins.js

@@ -1,7 +1,14 @@
 /**
- * Auto-generated fallback module.
- * This file is created by scripts/ensure-worker-plugins.mjs when missing.
- * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
+ * ZinTrust plugin auto-imports
+ *
+ * In real projects, this file is managed by `zin plugin install` and contains
+ * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
+ * optional adapters/drivers into core registries.
+ *
+ * In the ZinTrust monorepo/dev workspace, we import a local bundle of plugin
+ * registrations so `zin s` works out-of-the-box (database adapters, queue, mail).
  */
+/* eslint-disable no-restricted-imports */
+import './zintrust.comon.js';
 export const __zintrustGeneratedPluginStub = 'zintrust.plugins.ts';
 export default {};

package/src/zintrust.plugins.wg.d.ts

@@ -3,6 +3,7 @@
  * This file is created by scripts/ensure-worker-plugins.mjs when missing.
  * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
+import './zintrust.comon';
 export declare const __zintrustGeneratedPluginStub = "zintrust.plugins.wg.ts";
 declare const _default: {};
 export default _default;

package/src/zintrust.plugins.wg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zintrust.plugins.wg.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.wg.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;;AACtE,wBAAkB"}
+{"version":3,"file":"zintrust.plugins.wg.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.wg.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,kBAAkB,CAAC;AAC1B,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;;AACtE,wBAAkB"}

package/src/zintrust.plugins.wg.js

@@ -3,5 +3,6 @@
  * This file is created by scripts/ensure-worker-plugins.mjs when missing.
  * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
+import './zintrust.comon.js';
 export const __zintrustGeneratedPluginStub = 'zintrust.plugins.wg.ts';
 export default {};

package/app/Controllers/AuthController.d.ts

@@ -1,10 +0,0 @@
-/**
- * Auth Controller
- * Minimal, real auth endpoints backing the example API routes.
- */
-import type { AuthControllerApi } from '../Types/controller';
-export declare const AuthController: Readonly<{
-    create(): AuthControllerApi;
-}>;
-export default AuthController;
-//# sourceMappingURL=AuthController.d.ts.map

package/app/Controllers/AuthController.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../../app/Controllers/AuthController.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAuB,MAAM,uBAAuB,CAAC;AA+MpF,eAAO,MAAM,cAAc;cACf,iBAAiB;EAQ3B,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/app/Controllers/AuthController.js

@@ -1,201 +0,0 @@
-/**
- * Auth Controller
- * Minimal, real auth endpoints backing the example API routes.
- */
-import { Auth } from '../../src/auth/Auth.js';
-import { User } from '../Models/User.js';
-import { getString } from '../../src/common/utility.js';
-import { Logger } from '../../src/config/logger.js';
-import { getValidatedBody } from '../../src/http/ValidationHelper.js';
-import { JwtManager } from '../../src/security/JwtManager.js';
-import { TokenRevocation } from '../../src/security/TokenRevocation.js';
-const pickPublicUser = (row) => {
-    return {
-        id: row.id,
-        name: getString(row.name),
-        email: getString(row.email),
-    };
-};
-/**
- * Authenticates a user by email and password.
- * Validates credentials against the database and returns a JWT access token on success.
- * Logs all authentication attempts for security auditing.
- * @param req - HTTP request containing email and password
- * @param res - HTTP response to send authentication result
- * @returns Promise that resolves after sending the response
- */
-async function login(req, res) {
-    const body = getValidatedBody(req);
-    if (!body) {
-        Logger.error('AuthController.login: validation middleware did not populate req.validated.body');
-        return res.setStatus(500).json({ error: 'Internal server error' });
-    }
-    const email = getString(body['email']);
-    const password = getString(body['password']);
-    const ipAddress = req.getRaw().socket.remoteAddress ?? 'unknown';
-    try {
-        const existing = await User.where('email', '=', email).limit(1).first();
-        if (existing === null) {
-            Logger.warn('AuthController.login: failed login attempt', {
-                email,
-                ip: ipAddress,
-                reason: 'user_not_found',
-                timestamp: new Date().toISOString(),
-            });
-            res.setStatus(401).json({ error: 'Invalid credentials' });
-            return;
-        }
-        const passwordHash = getString(existing.password);
-        const ok = await Auth.compare(password, passwordHash);
-        if (!ok) {
-            Logger.warn('AuthController.login: failed login attempt', {
-                email,
-                ip: ipAddress,
-                reason: 'invalid_password',
-                timestamp: new Date().toISOString(),
-            });
-            res.setStatus(401).json({ error: 'Invalid credentials' });
-            return;
-        }
-        const user = pickPublicUser(existing);
-        const subject = (() => {
-            const id = user.id;
-            if (typeof id === 'string' && id.length > 0)
-                return id;
-            if (typeof id === 'number' && Number.isFinite(id))
-                return String(id);
-            return undefined;
-        })();
-        const token = JwtManager.signAccessToken({
-            sub: subject,
-            email,
-        });
-        Logger.info('AuthController.login: successful login', {
-            userId: subject,
-            email,
-            ip: ipAddress,
-            timestamp: new Date().toISOString(),
-        });
-        res.json({
-            token,
-            token_type: 'Bearer',
-            user,
-        });
-    }
-    catch (error) {
-        Logger.error('AuthController.login: unexpected error', {
-            email,
-            ip: ipAddress,
-            error: error instanceof Error ? error.message : String(error),
-            timestamp: new Date().toISOString(),
-        });
-        res.setStatus(500).json({ error: 'Login failed' });
-    }
-}
-/**
- * Registers a new user with name, email, and password.
- * Validates email uniqueness, hashes password, and stores user in database.
- * Returns 201 on success, 409 if email already exists.
- * @param req - HTTP request containing name, email, and password
- * @param res - HTTP response to send registration result
- * @returns Promise that resolves after sending the response
- */
-async function register(req, res) {
-    const body = getValidatedBody(req);
-    if (!body) {
-        Logger.error('AuthController.register: validation middleware did not populate req.validated.body');
-        res.setStatus(500).json({ error: 'Internal server error' });
-        return;
-    }
-    const name = getString(body['name']);
-    const email = getString(body['email']);
-    const password = getString(body['password']);
-    const ipAddress = req.getRaw().socket.remoteAddress ?? 'unknown';
-    try {
-        const existing = await User.where('email', '=', email).limit(1).first();
-        if (existing !== null) {
-            Logger.warn('AuthController.register: duplicate email attempt', {
-                email,
-                ip: ipAddress,
-                timestamp: new Date().toISOString(),
-            });
-            res.setStatus(409).json({ error: 'Email already registered' });
-            return;
-        }
-        const passwordHash = await Auth.hash(password);
-        const result = await User.query().insert({
-            name,
-            email,
-            password: passwordHash,
-        });
-        let insertedUserId = result.id;
-        if (insertedUserId === null || insertedUserId === undefined) {
-            const inserted = await User.where('email', '=', email).limit(1).first();
-            if (inserted?.id !== null && inserted?.id !== undefined) {
-                insertedUserId = inserted.id;
-            }
-        }
-        if (insertedUserId !== null && insertedUserId !== undefined) {
-            Logger.info('AuthController.register: successful registration', {
-                user_id: insertedUserId,
-                email,
-                ip: ipAddress,
-                timestamp: new Date().toISOString(),
-            });
-            res.setStatus(201).json({ message: 'Registered' });
-        }
-        else {
-            Logger.error('Failed to retrieve inserted user ID', {
-                email,
-                ip: ipAddress,
-            });
-            res.setStatus(500).json({ error: 'Registration failed' });
-        }
-        return;
-    }
-    catch (error) {
-        Logger.error('AuthController.register failed', error);
-        res.setStatus(500).json({ error: 'Registration failed' });
-    }
-}
-/**
- * Logs out the current user by revoking their JWT token.
- * Extracts authorization header and marks token as revoked.
- * Requires persistent token revocation store for stateless JWT validation.
- * @param req - HTTP request containing authorization header with JWT token
- * @param res - HTTP response to send logout confirmation
- * @returns Promise that resolves after sending the response
- */
-async function logout(req, res) {
-    const authHeader = typeof req.getHeader === 'function' ? req.getHeader('authorization') : undefined;
-    await TokenRevocation.revoke(authHeader);
-    res.json({ message: 'Logged out' });
-}
-/**
- * Refreshes the user's JWT access token.
- * Generates a new token with the same claims as the current user.
- * Returns 401 if user is not authenticated.
- * @param req - HTTP request with user populated by authentication middleware
- * @param res - HTTP response to send refreshed token
- * @returns Promise that resolves after sending the response
- */
-async function refresh(req, res) {
-    const user = req.user;
-    if (user === undefined) {
-        res.setStatus(401).json({ error: 'Unauthorized' });
-        return;
-    }
-    const token = JwtManager.signAccessToken(user);
-    res.json({ token, token_type: 'Bearer' });
-}
-export const AuthController = Object.freeze({
-    create() {
-        return {
-            login,
-            register,
-            logout,
-            refresh,
-        };
-    },
-});
-export default AuthController;

package/app/Controllers/UserController.d.ts

@@ -1,9 +0,0 @@
-/**
- * User Controller (compat)
- *
- * This file remains for backwards-compatibility. The actual implementation is
- * QueryBuilder-backed and lives in UserQueryBuilderController.
- */
-export { UserQueryBuilderController as UserController, UserQueryBuilderController, } from '../Controllers/UserQueryBuilderController';
-export { UserQueryBuilderController as default } from '../Controllers/UserQueryBuilderController';
-//# sourceMappingURL=UserController.d.ts.map

package/app/Controllers/UserController.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserController.d.ts","sourceRoot":"","sources":["../../../app/Controllers/UserController.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,0BAA0B,IAAI,cAAc,EAC5C,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,0BAA0B,IAAI,OAAO,EAAE,MAAM,6CAA6C,CAAC"}

package/app/Controllers/UserController.js

@@ -1,8 +0,0 @@
-/**
- * User Controller (compat)
- *
- * This file remains for backwards-compatibility. The actual implementation is
- * QueryBuilder-backed and lives in UserQueryBuilderController.
- */
-export { UserQueryBuilderController as UserController, UserQueryBuilderController, } from '../Controllers/UserQueryBuilderController.js';
-export { UserQueryBuilderController as default } from '../Controllers/UserQueryBuilderController.js';

package/app/Controllers/UserQueryBuilderController.d.ts

@@ -1,16 +0,0 @@
-/**
- * User QueryBuilder Controller
- * QueryBuilder-backed controller for the users resource.
- */
-import type { IUserController } from '../Types/controller';
-/**
- * User QueryBuilder Controller Factory
- */
-export declare const UserQueryBuilderController: {
-    /**
-     * Create a new user controller instance
-     */
-    create(): IUserController;
-};
-export default UserQueryBuilderController;
-//# sourceMappingURL=UserQueryBuilderController.d.ts.map

package/app/Controllers/UserQueryBuilderController.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UserQueryBuilderController.d.ts","sourceRoot":"","sources":["../../../app/Controllers/UserQueryBuilderController.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAmC,MAAM,uBAAuB,CAAC;AAkc9F;;GAEG;AACH,eAAO,MAAM,0BAA0B;IACrC;;OAEG;cACO,eAAe;CAG1B,CAAC;AAEF,eAAe,0BAA0B,CAAC"}