@zintrust/core 0.1.49 → 0.1.51

package/src/cli/scaffolding/env.js

@@ -0,0 +1,549 @@
+const HeaderAndApp = (name, port, baseUrl, appKey) => [
+    '# ZinTrust — Project Environment (.env)',
+    '#',
+    '# Generated by: zin new / ProjectScaffolder',
+    '#',
+    '# Notes:',
+    '# - No ${VAR} interpolation: compatible with standard Node dotenv behavior.',
+    '# - Secrets are intentionally empty unless auto-generated (APP_KEY).',
+    '# - For the complete key list (auto-generated), see: -envexample.generated',
+    '',
+    '# ============================================================================',
+    '# APP',
+    '# ============================================================================',
+    '',
+    'NODE_ENV=development',
+    `APP_NAME=${name}`,
+    'HOST=localhost',
+    `PORT=${port}`,
+    `BASE_URL=${baseUrl}`,
+    '',
+    '# Runtime override (optional): auto | nodejs | cloudflare | deno | lambda',
+    'RUNTIME=',
+    '',
+    'DEBUG=true',
+    'METRICS_ENABLED=false',
+    '',
+    '# Cloudflare Workers (TCP sockets) — set true if using TCP adapters on Workers.',
+    'ENABLE_CLOUDFLARE_SOCKETS=false',
+    '',
+    '# CLI / tooling',
+    'ZINTRUST_RUN_FROM_SOURCE=0',
+    'ZINTRUST_VERSION_CHECK=true',
+    'ZINTRUST_VERSION_CHECK_INTERVAL=24',
+    'ZINTRUST_CLI_DEBUG_ARGS=0',
+    '',
+    '# Optional debug output (local only)',
+    'ZIN_DEBUG_VALIDATION_BODY=false',
+    'ZIN_DEBUG_BODY_PARSING=false',
+    'ZIN_DEBUG_FILE_UPLOAD=false',
+    '',
+    '# ============================================================================',
+    '# STARTUP (boot-time checks)',
+    '# ============================================================================',
+    '',
+    'STARTUP_HEALTH_CHECKS=true',
+    'STARTUP_VALIDATE_SECRETS=true',
+    '',
+    '# Strict required-env validation. Recommended for new projects.',
+    'STARTUP_REQUIRE_ENV=true',
+    '',
+    'STARTUP_CHECK_DB=false',
+    'STARTUP_CHECK_CACHE=false',
+    'STARTUP_HEALTH_TIMEOUT_MS=2500',
+    'STARTUP_CONTINUE_ON_FAILURE=false',
+    '',
+    '# ============================================================================',
+    '# SECURITY (keys, auth, headers)',
+    '# ============================================================================',
+    '',
+    '# Auto-generated secure APP_KEY for encryption interoperability (32 bytes, base64).',
+    `APP_KEY=${appKey}`,
+    '',
+];
+const SecurityAndDeployment = () => [
+    '# Optional: key rotation support (comma-separated OR JSON array of base64 keys)',
+    'APP_PREVIOUS_KEYS=',
+    '',
+    '# Supported: aes-256-cbc | aes-256-gcm',
+    'ENCRYPTION_CIPHER=aes-256-cbc',
+    '',
+    'JWT_ENABLED=true',
+    '# If empty, JWT uses APP_KEY in dev. For production, set a dedicated JWT_SECRET.',
+    'JWT_SECRET=',
+    'JWT_ALGORITHM=HS256',
+    'JWT_EXPIRES_IN=3600',
+    'JWT_REFRESH_EXPIRES_IN=7d',
+    'JWT_ISSUER=zintrust',
+    'JWT_AUDIENCE=zintrust-api',
+    '',
+    'API_KEY_ENABLED=false',
+    'API_KEY_HEADER=x-api-key',
+    'API_KEY_SECRET=',
+    '',
+    'CSRF_ENABLED=true',
+    'CSRF_HEADER_NAME=x-csrf-token',
+    'CSRF_TOKEN_NAME=_csrf',
+    'CSRF_COOKIE_NAME=XSRF-TOKEN',
+    'CSRF_COOKIE_SECURE=false',
+    'CSRF_COOKIE_HTTP_ONLY=true',
+    'CSRF_COOKIE_SAME_SITE=lax',
+    'CSRF_SKIP_PATHS=/api/*,/queue-monitor/*,/api/_sys/queue/*,/api/_sys/schedule/*',
+    '',
+    'CORS_ENABLED=true',
+    'CORS_ORIGINS=*',
+    'CORS_METHODS=GET,POST,PUT,PATCH,DELETE',
+    'CORS_ALLOWED_HEADERS=Content-Type,Authorization',
+    'CORS_EXPOSED_HEADERS=',
+    'CORS_CREDENTIALS=false',
+    'CORS_MAX_AGE=86400',
+    '',
+    'RATE_LIMIT_ENABLED=true',
+    'RATE_LIMIT_WINDOW_MS=900000',
+    'RATE_LIMIT_MAX_REQUESTS=100',
+    'RATE_LIMIT_MESSAGE=Too many requests, please try again later',
+    '',
+    'HELMET_ENABLED=true',
+    'CSP_ENABLED=false',
+    'HSTS_ENABLED=false',
+    'HSTS_MAX_AGE=31536000',
+    'HSTS_INCLUDE_SUBDOMAINS=true',
+    'XSS_ENABLED=true',
+    'XSS_REPORT_URI=',
+    '',
+    'SESSION_NAME=zintrust_session',
+    'SESSION_SECRET=',
+    'SESSION_EXPIRES_IN=1800000',
+    'SESSION_SECURE=false',
+    'SESSION_HTTP_ONLY=true',
+    'SESSION_SAME_SITE=lax',
+    '',
+    'PASSWORD_MIN_LENGTH=8',
+    'PASSWORD_REQUIRE_UPPERCASE=true',
+    'PASSWORD_REQUIRE_NUMBERS=true',
+    'PASSWORD_REQUIRE_SPECIAL_CHARS=true',
+    'BCRYPT_ROUNDS=10',
+    '',
+    '# ============================================================================',
+    '# DEPLOYMENT / LIMITS',
+    '# ============================================================================',
+    '',
+    'ENVIRONMENT=development',
+    'REQUEST_TIMEOUT=30000',
+    'APP_TIMEZONE=UTC',
+    'MAX_BODY_SIZE=10485760',
+    'SHUTDOWN_TIMEOUT=10000',
+    '',
+];
+const DatabaseAndCloudflare = (databaseNormalized, dbLines, sqliteDbPath) => [
+    '# ============================================================================',
+    '# DATABASE',
+    '# ============================================================================',
+    '',
+    '# Options: sqlite | postgresql | mysql | sqlserver | d1 | d1-remote',
+    `DB_CONNECTION=${databaseNormalized}`,
+    '',
+    ...(databaseNormalized === 'sqlite' ? [`DB_PATH=${sqliteDbPath}`, ''] : []),
+    ...dbLines,
+    '',
+    '# Generic SQL defaults (used by some adapters)',
+    'DB_HOST=localhost',
+    'DB_PORT=5432',
+    'DB_DATABASE=',
+    'DB_USERNAME=postgres',
+    'DB_PASSWORD=',
+    'DB_READ_HOSTS=',
+    '',
+    '# PostgreSQL (optional)',
+    'DB_PORT_POSTGRESQL=5432',
+    'DB_DATABASE_POSTGRESQL=postgres',
+    'DB_USERNAME_POSTGRESQL=postgres',
+    'DB_PASSWORD_POSTGRESQL=',
+    'DB_READ_HOSTS_POSTGRESQL=',
+    '',
+    '# SQL Server (MSSQL) (optional)',
+    'DB_HOST_MSSQL=localhost',
+    'DB_PORT_MSSQL=1433',
+    'DB_DATABASE_MSSQL=zintrust',
+    'DB_USERNAME_MSSQL=sa',
+    'DB_PASSWORD_MSSQL=',
+    'DB_READ_HOSTS_MSSQL=',
+    '',
+    '# Pooling / logging (optional)',
+    'DB_POOLING=true',
+    'DB_POOL_MIN=5',
+    'DB_POOL_MAX=20',
+    'DB_IDLE_TIMEOUT=30000',
+    'DB_CONNECTION_TIMEOUT=10000',
+    'DB_SSL=false',
+    'DB_LOG_QUERIES=false',
+    'DB_LOG_LEVEL=info',
+    'DB_MIGRATION_EXT=ts',
+    '',
+    '# ============================================================================',
+    '# CLOUDFLARE (D1 / KV)',
+    '# ============================================================================',
+    '',
+    'D1_DATABASE_ID=',
+    'KV_NAMESPACE_ID=',
+    '',
+    '# Remote D1 (outside Cloudflare) via proxy',
+    'D1_REMOTE_URL=',
+    'D1_REMOTE_KEY_ID=',
+    'D1_REMOTE_SECRET=',
+    'D1_REMOTE_MODE=registry',
+    '',
+    '# Remote KV (outside Cloudflare) via proxy',
+    'KV_REMOTE_URL=',
+    'KV_REMOTE_KEY_ID=',
+    'KV_REMOTE_SECRET=',
+    'KV_REMOTE_NAMESPACE=',
+    '',
+    '# Cloudflare API (only needed for CLI provisioning)',
+    'CLOUDFLARE_ACCOUNT_ID=',
+    'CLOUDFLARE_API_TOKEN=',
+    'CLOUDFLARE_KV_NAMESPACE_ID=',
+    '',
+];
+const HttpProxies = () => [
+    '# ============================================================================',
+    '# HTTP PROXIES (for Workers compatibility)',
+    '# ============================================================================',
+    '',
+    'ZT_PROXY_TIMEOUT_MS=30000',
+    'ZT_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+    'USE_MYSQL_PROXY=false',
+    'MYSQL_PROXY_URL=',
+    'MYSQL_PROXY_HOST=127.0.0.1',
+    'MYSQL_PROXY_PORT=8789',
+    'MYSQL_PROXY_MAX_BODY_BYTES=131072',
+    'MYSQL_PROXY_POOL_LIMIT=10',
+    'MYSQL_PROXY_KEY_ID=',
+    'MYSQL_PROXY_SECRET=',
+    'MYSQL_PROXY_TIMEOUT_MS=30000',
+    'MYSQL_PROXY_REQUIRE_SIGNING=true',
+    'MYSQL_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+    'USE_POSTGRES_PROXY=false',
+    'POSTGRES_PROXY_URL=',
+    'POSTGRES_PROXY_HOST=127.0.0.1',
+    'POSTGRES_PROXY_PORT=8790',
+    'POSTGRES_PROXY_MAX_BODY_BYTES=131072',
+    'POSTGRES_PROXY_POOL_LIMIT=10',
+    'POSTGRES_PROXY_KEY_ID=',
+    'POSTGRES_PROXY_SECRET=',
+    'POSTGRES_PROXY_TIMEOUT_MS=30000',
+    'POSTGRES_PROXY_REQUIRE_SIGNING=true',
+    'POSTGRES_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+    'USE_REDIS_PROXY=false',
+    'REDIS_PROXY_URL=',
+    'REDIS_PROXY_HOST=127.0.0.1',
+    'REDIS_PROXY_PORT=8791',
+    'REDIS_PROXY_MAX_BODY_BYTES=131072',
+    'REDIS_PROXY_KEY_ID=',
+    'REDIS_PROXY_SECRET=',
+    'REDIS_PROXY_TIMEOUT_MS=30000',
+    'REDIS_PROXY_REQUIRE_SIGNING=true',
+    'REDIS_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+    'USE_SMTP_PROXY=false',
+    'SMTP_PROXY_URL=',
+    'SMTP_PROXY_HOST=127.0.0.1',
+    'SMTP_PROXY_PORT=8794',
+    'SMTP_PROXY_MAX_BODY_BYTES=131072',
+    'SMTP_PROXY_KEY_ID=',
+    'SMTP_PROXY_SECRET=',
+    'SMTP_PROXY_TIMEOUT_MS=30000',
+    'SMTP_PROXY_REQUIRE_SIGNING=true',
+    'SMTP_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+    'USE_MONGODB_PROXY=false',
+    'MONGODB_PROXY_URL=',
+    'MONGODB_PROXY_HOST=127.0.0.1',
+    'MONGODB_PROXY_PORT=8792',
+    'MONGODB_PROXY_MAX_BODY_BYTES=131072',
+    'MONGODB_PROXY_KEY_ID=',
+    'MONGODB_PROXY_SECRET=',
+    'MONGODB_PROXY_TIMEOUT_MS=30000',
+    'MONGODB_PROXY_REQUIRE_SIGNING=true',
+    'MONGODB_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+    'USE_SQLSERVER_PROXY=false',
+    'SQLSERVER_PROXY_URL=',
+    'SQLSERVER_PROXY_HOST=127.0.0.1',
+    'SQLSERVER_PROXY_PORT=8793',
+    'SQLSERVER_PROXY_MAX_BODY_BYTES=131072',
+    'SQLSERVER_PROXY_POOL_LIMIT=10',
+    'SQLSERVER_PROXY_KEY_ID=',
+    'SQLSERVER_PROXY_SECRET=',
+    'SQLSERVER_PROXY_TIMEOUT_MS=30000',
+    'SQLSERVER_PROXY_REQUIRE_SIGNING=true',
+    'SQLSERVER_PROXY_SIGNING_WINDOW_MS=60000',
+    '',
+];
+const CacheAndRedis = () => [
+    '# ============================================================================',
+    '# CACHE / REDIS',
+    '# ============================================================================',
+    '',
+    'CACHE_DRIVER=memory',
+    'CACHE_CONNECTION=',
+    'CACHE_KEY_PREFIX=zintrust:',
+    '',
+    'CACHE_MEMORY_TTL=3600',
+    'CACHE_REDIS_TTL=3600',
+    'CACHE_MONGO_TTL=3600',
+    'CACHE_KV_TTL=3600',
+    '',
+    'REDIS_HOST=localhost',
+    'REDIS_PORT=6379',
+    'REDIS_PASSWORD=',
+    'REDIS_DB=0',
+    'REDIS_QUEUE_DB=1',
+    'REDIS_URL=',
+    '',
+    'REDIS_HTTPS_ENDPOINT=',
+    'REDIS_HTTPS_TOKEN=',
+    '',
+    'MONGO_URI=',
+    'MONGO_DB=zintrust_cache',
+    '',
+];
+const QueueConfig = () => [
+    '# ============================================================================',
+    '# QUEUE',
+    '# ============================================================================',
+    '',
+    '# Options: sync | memory | database | redis | rabbitmq | sqs',
+    'QUEUE_DRIVER=sync',
+    'QUEUE_CONNECTION=',
+    '',
+    'QUEUE_TABLE=jobs',
+    'QUEUE_DB_CONNECTION=default',
+    '',
+    'FAILED_JOBS_DB_CONNECTION=default',
+    'FAILED_JOBS_TABLE=failed_jobs',
+    '',
+    'QUEUE_JOB_TIMEOUT=60',
+    'QUEUE_JOB_RETRIES=3',
+    'QUEUE_JOB_BACKOFF=0',
+    'QUEUE_WORKERS=1',
+    'QUEUE_MEMORY_TTL=3600000',
+    '',
+    'QUEUE_MONITOR_ENABLED=true',
+    'QUEUE_MONITOR_BASE_PATH=/queue-monitor',
+    'QUEUE_MONITOR_MIDDLEWARE=',
+    'QUEUE_MONITOR_AUTO_REFRESH=true',
+    'QUEUE_MONITOR_REFRESH_MS=5000',
+    '',
+    'QUEUE_HTTP_PROXY_ENABLED=false',
+    'QUEUE_HTTP_PROXY_GATEWAY_ENABLED=true',
+    'QUEUE_HTTP_PROXY_URL=',
+    'QUEUE_HTTP_PROXY_PATH=/api/_sys/queue/rpc',
+    'QUEUE_HTTP_PROXY_KEY_ID=',
+    'QUEUE_HTTP_PROXY_KEY=',
+    'QUEUE_HTTP_PROXY_TIMEOUT_MS=30000',
+    'QUEUE_HTTP_PROXY_MAX_SKEW_MS=60000',
+    'QUEUE_HTTP_PROXY_NONCE_TTL_MS=120000',
+    'QUEUE_HTTP_PROXY_MIDDLEWARE=',
+    '',
+];
+const WorkersSchedulingAndSSE = () => [
+    '# ============================================================================',
+    '# WORKERS / SCHEDULER',
+    '# ============================================================================',
+    '',
+    'WORKER_ENABLED=true',
+    'WORKER_AUTO_START=false',
+    'WORKER_CONCURRENCY=5',
+    'WORKER_TIMEOUT=60',
+    'WORKER_RETRIES=3',
+    'WORKER_PRIORITY=1',
+    'WORKER_HEALTH_CHECK_INTERVAL=60',
+    'WORKER_CLUSTER_MODE=true',
+    'WORKER_REGION=us-east-1',
+    '',
+    'WORKER_PERSISTENCE_DRIVER=memory',
+    'WORKER_PERSISTENCE_TABLE=zintrust_workers',
+    'WORKER_PERSISTENCE_DB_CONNECTION=default',
+    'WORKER_PERSISTENCE_REDIS_DB=',
+    'WORKER_PERSISTENCE_REDIS_KEY_PREFIX=',
+    '',
+    'WORKER_SHUTDOWN_ON_APP_EXIT=true',
+    '',
+    'SCHEDULES_ENABLED=false',
+    'SCHEDULE_SHUTDOWN_TIMEOUT_MS=30000',
+    'SCHEDULE_OVERLAP_LOCK_TTL_MS=300000',
+    'SCHEDULE_OVERLAP_LOCK_ACQUIRE_TIMEOUT_MS=2000',
+    '',
+    'SCHEDULE_LEADER_ENABLED=false',
+    'SCHEDULE_LEADER_LOCK_PROVIDER=redis',
+    'SCHEDULE_LEADER_LOCK_KEY=scheduler:leader',
+    'SCHEDULE_LEADER_LOCK_TTL_MS=30000',
+    'SCHEDULE_LEADER_LOCK_RENEW_MS=15000',
+    'SCHEDULE_LEADER_LOCK_RETRY_MS=5000',
+    'SCHEDULE_LEADER_LOCK_ACQUIRE_TIMEOUT_MS=2000',
+    '',
+    'SCHEDULE_HTTP_PROXY_PATH=/api/_sys/schedule/rpc',
+    'SCHEDULE_HTTP_PROXY_KEY_ID=',
+    'SCHEDULE_HTTP_PROXY_KEY=',
+    'SCHEDULE_HTTP_PROXY_MAX_SKEW_MS=60000',
+    'SCHEDULE_HTTP_PROXY_NONCE_TTL_MS=120000',
+    'SCHEDULE_HTTP_PROXY_MIDDLEWARE=',
+    '',
+    'JOB_TRACKING_CLEANUP_ENABLED=false',
+    'JOB_TRACKING_CLEANUP_INTERVAL_MS=21600000',
+    'JOB_TRACKING_CLEANUP_RETENTION_DAYS=30',
+    'JOB_TRACKING_CLEANUP_RETENTION_HOURS=',
+    'JOB_TRACKING_CLEANUP_BATCH_SIZE=5000',
+    'JOB_TRACKING_CLEANUP_MAX_BATCHES=1',
+    'JOB_TRACKING_CLEANUP_LOCK_PROVIDER=redis',
+    '',
+    '# ============================================================================',
+    '# SSE',
+    '# ============================================================================',
+    '',
+    'SSE_HEARTBEAT_INTERVAL=15000',
+    'SSE_SNAPSHOT_INTERVAL=5000',
+    '',
+];
+const LoggingAndMail = () => [
+    '# ============================================================================',
+    '# LOGGING',
+    '# ============================================================================',
+    '',
+    'LOG_LEVEL=debug',
+    'LOG_FORMAT=text',
+    'LOG_CHANNEL=file',
+    'DISABLE_LOGGING=false',
+    'LOG_HTTP_REQUEST=false',
+    'LOG_TO_FILE=false',
+    'LOG_ROTATION_SIZE=10485760',
+    'LOG_ROTATION_DAYS=7',
+    'DOCKER_WORKER=false',
+    '',
+    '# ============================================================================',
+    '# MAIL',
+    '# ============================================================================',
+    '',
+    'MAIL_DRIVER=disabled',
+    'MAIL_CONNECTION=',
+    'MAIL_FROM_ADDRESS=',
+    'MAIL_FROM_NAME=',
+    'MAIL_HOST=',
+    'MAIL_PORT=587',
+    'MAIL_USERNAME=',
+    'MAIL_PASSWORD',
+    'MAIL_SECURE=starttls',
+    'SENDGRID_API_KEY=',
+    'MAILGUN_API_KEY=',
+    'MAILGUN_DOMAIN=',
+    'MAILGUN_BASE_URL=https://api.mailgun.net',
+    '',
+];
+const StorageAndBroadcast = () => [
+    '# ============================================================================',
+    '# STORAGE',
+    '# ============================================================================',
+    '',
+    'STORAGE_CONNECTION=local',
+    'STORAGE_PATH=storage',
+    'STORAGE_URL=/storage',
+    'STORAGE_VISIBILITY=private',
+    'TEMP_PATH=storage/temp',
+    'TEMP_FILE_MAX_AGE=86400',
+    'MAX_UPLOAD_SIZE=100mb',
+    'ALLOWED_UPLOAD_MIMES=jpg,jpeg,png,pdf,doc,docx',
+    'UPLOADS_PATH=storage/uploads',
+    'BACKUP_DRIVER=s3',
+    'BACKUPS_PATH=storage/backups',
+    '',
+    'AWS_REGION=us-east-1',
+    'AWS_DEFAULT_REGION=',
+    'AWS_ACCESS_KEY_ID=',
+    'AWS_SECRET_ACCESS_KEY=',
+    'AWS_SESSION_TOKEN=',
+    'AWS_S3_BUCKET=',
+    'AWS_S3_ENDPOINT=',
+    'AWS_S3_URL=',
+    'AWS_S3_USE_PATH_STYLE_URL=false',
+    'AWS_SQS_QUEUE_URL=',
+    '',
+    'R2_ACCESS_KEY_ID=',
+    'R2_SECRET_ACCESS_KEY=',
+    'R2_REGION=',
+    'R2_BUCKET=',
+    'R2_ENDPOINT=',
+    'R2_URL=',
+    'R2_BINDING=',
+    '',
+    'GCS_PROJECT_ID=',
+    'GCS_KEY_FILE=',
+    'GCS_BUCKET=',
+    'GCS_URL=',
+    '',
+    '# ============================================================================',
+    '# BROADCAST',
+    '# ============================================================================',
+    '',
+    'BROADCAST_CONNECTION=inmemory',
+    'PUSHER_APP_ID=',
+    'PUSHER_APP_KEY=',
+    'PUSHER_APP_SECRET=',
+    'PUSHER_APP_CLUSTER=',
+    'PUSHER_USE_TLS=true',
+    'BROADCAST_REDIS_HOST=',
+    'BROADCAST_REDIS_PORT=',
+    'BROADCAST_REDIS_PASSWORD=',
+    'BROADCAST_CHANNEL_PREFIX=broadcast:',
+    '',
+];
+const NotificationsAndObservability = () => [
+    '# ============================================================================',
+    '# NOTIFICATIONS',
+    '# ============================================================================',
+    '',
+    'NOTIFICATION_CONNECTION=console',
+    'TERMII_API_KEY=',
+    'TERMII_SENDER=ZinTrust',
+    'TERMII_ENDPOINT=https://api.termii.com/sms/send',
+    'TWILIO_ACCOUNT_SID=',
+    'TWILIO_AUTH_TOKEN=',
+    'TWILIO_FROM_NUMBER=',
+    'SLACK_WEBHOOK_URL=',
+    '',
+    '# ============================================================================',
+    '# OBSERVABILITY (optional)',
+    '# ============================================================================',
+    '',
+    'OTEL_ENABLED=false',
+    'OTEL_EXPORTER_OTLP_ENDPOINT=',
+    'TRACING_EXPORT_INTERVAL=',
+    'JAEGER_AGENT_HOST=',
+    '',
+    '# ============================================================================',
+    '# CI / SCANNING (optional)',
+    '# ============================================================================',
+    '',
+    'SNYK_TOKEN=',
+    'SONAR_ORGANIZATION=',
+    'SONAR_PROJECT_ID=',
+    'SONAR_HOST_URL=',
+    'SONAR_TOKEN=',
+    'CODECOV_TOKEN=',
+    '',
+];
+export const EnvData = (name, port, baseUrl, appKey, databaseNormalized, dbLines, sqliteDbPath) => [
+    ...HeaderAndApp(name, port, baseUrl, appKey),
+    ...SecurityAndDeployment(),
+    ...DatabaseAndCloudflare(databaseNormalized, dbLines, sqliteDbPath),
+    ...HttpProxies(),
+    ...CacheAndRedis(),
+    ...QueueConfig(),
+    ...WorkersSchedulingAndSSE(),
+    ...LoggingAndMail(),
+    ...StorageAndBroadcast(),
+    ...NotificationsAndObservability(),
+];

package/src/cli/utils/EnvFileLoader.js

@@ -166,7 +166,7 @@ const load = (options = {}) => {
     cached = { loadedFiles: files, mode };
     return cached;
 };
-const ensureLoaded = () => load({ overrideExisting: true });
+const ensureLoaded = () => load({ overrideExisting: false });
 const applyCliOverrides = (overrides) => {
     // Ensure base env is loaded first.
     ensureLoaded();

package/src/config/index.d.ts

@@ -18,6 +18,7 @@ export { createRedisConnection } from './workers';
  * Sealed namespace for immutability
  */
 export declare const config: Readonly<{
+    readonly middleware: import("./type").MiddlewareConfigType;
     readonly app: Readonly<{
         readonly name: string;
         readonly prefix: string;
@@ -156,7 +157,6 @@ export declare const config: Readonly<{
             readonly bcryptRounds: number;
         };
     }>;
-    readonly middleware: import("./type").MiddlewareConfigType;
     readonly microservices: Readonly<{
         readonly enabled: boolean;
         readonly services: string[];

package/src/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;8BAZc,CAAC;;;;;;;;;;;;;;;;;;;;2EAAC,CAAA;;;;;;;;;;;;;;;;;;;;8BAD2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA2BomB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;EAHzpB,CAAC;AAEZ,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;8BAZc,CAAC;;;;;;;;;;;;;;;;;;;;2EAAC,CAAA;;;;;;;;;;;;;;;;;;;;8BAD2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA+C8X,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;EAHnb,CAAC;AAEZ,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC"}

package/src/config/index.js

@@ -28,14 +28,34 @@ export { createRedisConnection } from './workers.js';
  * Sealed namespace for immutability
  */
 export const config = Object.freeze({
-    app: appConfig,
-    broadcast: broadcastConfig,
-    database: databaseConfig,
-    storage: storageConfig,
-    notification: notificationConfig,
-    security: securityConfig,
-    middleware: middlewareConfig,
-    microservices: microservicesConfig,
-    cache: cacheConfig,
-    queue: queueConfig,
+    get middleware() {
+        return middlewareConfig;
+    },
+    get app() {
+        return appConfig;
+    },
+    get broadcast() {
+        return broadcastConfig;
+    },
+    get database() {
+        return databaseConfig;
+    },
+    get storage() {
+        return storageConfig;
+    },
+    get notification() {
+        return notificationConfig;
+    },
+    get security() {
+        return securityConfig;
+    },
+    get microservices() {
+        return microservicesConfig;
+    },
+    get cache() {
+        return cacheConfig;
+    },
+    get queue() {
+        return queueConfig;
+    },
 });

package/src/config/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/config/logger.ts"],"names":[],"mappings":"AASA,UAAU,OAAO;IACf,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClE;AAiYD,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,MAAM,EAAE,CAYtD,CAAC;AAEF,eAAO,MAAM,MAAM;qBA5JQ,MAAM,SAAS,OAAO,aAAa,MAAM,KAAG,IAAI;oBAqBjD,MAAM,SAAS,OAAO,aAAa,MAAM,KAAG,IAAI;oBAqBhD,MAAM,SAAS,OAAO,aAAa,MAAM,KAAG,IAAI;qBAqB/C,MAAM,UAAU,OAAO,aAAa,MAAM,KAAG,IAAI;qBA2BjD,MAAM,UAAU,OAAO,aAAa,MAAM,KAAG,IAAI;yBAoDrC,OAAO,CAAC,MAAM,EAAE,CAAC;mBArBtB,MAAM,KAAG,OAAO;EA2ChD,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/config/logger.ts"],"names":[],"mappings":"AAUA,UAAU,OAAO;IACf,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClE;AA8aD,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,MAAM,EAAE,CAYtD,CAAC;AAEF,eAAO,MAAM,MAAM;qBA5JQ,MAAM,SAAS,OAAO,aAAa,MAAM,KAAG,IAAI;oBAqBjD,MAAM,SAAS,OAAO,aAAa,MAAM,KAAG,IAAI;oBAqBhD,MAAM,SAAS,OAAO,aAAa,MAAM,KAAG,IAAI;qBAqB/C,MAAM,UAAU,OAAO,aAAa,MAAM,KAAG,IAAI;qBA2BjD,MAAM,UAAU,OAAO,aAAa,MAAM,KAAG,IAAI;yBAoDrC,OAAO,CAAC,MAAM,EAAE,CAAC;mBArBtB,MAAM,KAAG,OAAO;EA2ChD,CAAC;AAEH,eAAe,MAAM,CAAC"}