@zintrust/core 0.4.15 → 0.4.17

package/src/config/queue.js

@@ -1,229 +0,0 @@
-/**
- * Queue Configuration
- * Background job and message queue settings
- * Sealed namespace for immutability
- */
-import { Cloudflare } from './cloudflare.js';
-import { Env } from './env.js';
-import { Logger } from './logger.js';
-import { middlewareConfig } from './middleware.js';
-import { ErrorFactory } from '../exceptions/ZintrustError.js';
-import { ZintrustLang } from '../lang/lang.js';
-import { StartupConfigFile, StartupConfigFileRegistry } from '../runtime/StartupConfigFileRegistry.js';
-const getQueueDriver = (driverConfig) => {
-    const driverName = driverConfig.default;
-    return driverConfig.drivers[driverName];
-};
-const readWorkersEnvString = (key) => {
-    const workerValue = Cloudflare.getWorkersVar(key);
-    if (workerValue !== null && workerValue.trim() !== '')
-        return workerValue;
-    return '';
-};
-const readWorkersFallbackString = (workersKey, fallbackKey, fallback = '') => {
-    const workerValue = readWorkersEnvString(workersKey);
-    if (workerValue.trim() !== '')
-        return workerValue;
-    return Env.get(fallbackKey, fallback);
-};
-const readWorkersFallbackInt = (workersKey, fallbackKey, fallback) => {
-    const raw = readWorkersFallbackString(workersKey, fallbackKey, String(fallback));
-    if (raw.trim() === '')
-        return fallback;
-    const parsed = Number.parseInt(raw, 10);
-    return Number.isFinite(parsed) ? parsed : fallback;
-};
-const parseRedisUrl = (rawUrl) => {
-    try {
-        const url = new URL(rawUrl);
-        if (url.protocol !== 'redis:' && url.protocol !== 'rediss:')
-            return null;
-        const host = url.hostname;
-        const port = url.port ? Number.parseInt(url.port, 10) : 6379;
-        const password = url.password ? decodeURIComponent(url.password) : undefined;
-        const db = url.pathname ? Number.parseInt(url.pathname.replace('/', ''), 10) : undefined;
-        return { host, port, password, database: Number.isFinite(db ?? Number.NaN) ? db : undefined };
-    }
-    catch {
-        return null;
-    }
-};
-const resolveRedisProxyConfig = () => {
-    const isWorkersRuntime = Cloudflare.getWorkersEnv() !== null;
-    if (!isWorkersRuntime) {
-        return null;
-    }
-    const proxyUrl = Env.get('REDIS_PROXY_URL', '').trim();
-    const parsed = proxyUrl ? parseRedisUrl(proxyUrl) : null;
-    if (parsed)
-        return parsed;
-    if (Env.getBool('USE_REDIS_PROXY', false)) {
-        return {
-            host: Env.get('REDIS_PROXY_HOST', ''),
-            port: Env.getInt('REDIS_PROXY_PORT', 6379),
-            password: Env.get('REDIS_PASSWORD', ''),
-            database: Env.getInt('REDIS_QUEUE_DB', ZintrustLang.REDIS_DEFAULT_DB),
-        };
-    }
-    return null;
-};
-/**
- * Helper: Create base driver configurations from environment
- */
-export const createBaseDrivers = () => ({
-    sync: {
-        driver: 'sync',
-    },
-    memory: {
-        driver: 'memory',
-        ttl: Env.getInt('QUEUE_MEMORY_TTL', 3600000), // 1 hour default
-    },
-    database: {
-        driver: 'database',
-        table: Env.get('QUEUE_TABLE', 'jobs'),
-        connection: Env.get('QUEUE_DB_CONNECTION', 'default'),
-    },
-    redis: {
-        driver: 'redis',
-        host: resolveRedisProxyConfig()?.host ??
-            readWorkersFallbackString('WORKERS_REDIS_HOST', 'REDIS_HOST', 'localhost'),
-        port: resolveRedisProxyConfig()?.port ??
-            readWorkersFallbackInt('WORKERS_REDIS_PORT', 'REDIS_PORT', 6379),
-        password: resolveRedisProxyConfig()?.password ??
-            readWorkersFallbackString('WORKERS_REDIS_PASSWORD', 'REDIS_PASSWORD'),
-        database: resolveRedisProxyConfig()?.database ??
-            readWorkersFallbackInt('WORKERS_REDIS_QUEUE_DB', 'REDIS_QUEUE_DB', ZintrustLang.REDIS_DEFAULT_DB),
-    },
-    rabbitmq: {
-        driver: 'rabbitmq',
-        host: readWorkersFallbackString('WORKERS_RABBITMQ_HOST', 'RABBITMQ_HOST', 'localhost'),
-        port: readWorkersFallbackInt('WORKERS_RABBITMQ_PORT', 'RABBITMQ_PORT', 5672),
-        username: readWorkersFallbackString('WORKERS_RABBITMQ_USER', 'RABBITMQ_USER', 'guest'),
-        password: readWorkersFallbackString('WORKERS_RABBITMQ_PASSWORD', 'RABBITMQ_PASSWORD', 'guest'),
-        vhost: readWorkersFallbackString('WORKERS_RABBITMQ_VHOST', 'RABBITMQ_VHOST', '/'),
-        httpGatewayUrl: readWorkersFallbackString('WORKERS_RABBITMQ_HTTP_GATEWAY_URL', 'RABBITMQ_HTTP_GATEWAY_URL'),
-        httpGatewayToken: readWorkersFallbackString('WORKERS_RABBITMQ_HTTP_GATEWAY_TOKEN', 'RABBITMQ_HTTP_GATEWAY_TOKEN'),
-        httpGatewayTimeoutMs: readWorkersFallbackInt('WORKERS_RABBITMQ_HTTP_GATEWAY_TIMEOUT_MS', 'RABBITMQ_HTTP_GATEWAY_TIMEOUT_MS', 15000),
-    },
-    sqs: {
-        driver: 'sqs',
-        key: Env.get('AWS_ACCESS_KEY_ID'),
-        secret: Env.get('AWS_SECRET_ACCESS_KEY'),
-        region: Env.AWS_REGION,
-        queueUrl: Env.get('AWS_SQS_QUEUE_URL'),
-    },
-});
-/**
- * Helper: Create monitor configuration from environment
- */
-const createBaseMonitor = () => {
-    const enabled = Env.getBool('QUEUE_MONITOR_ENABLED', false);
-    const basePath = Env.get('QUEUE_MONITOR_BASE_PATH', '/queue-monitor');
-    const middleware = Env.get('QUEUE_MONITOR_MIDDLEWARE', '')
-        .split(',')
-        .map((m) => m.trim())
-        .filter((m) => m.length > 0);
-    if (enabled && middleware.length > 0) {
-        const knownKeys = new Set(Object.keys(middlewareConfig.route ?? {}));
-        const unknownKeys = middleware.filter((name) => !knownKeys.has(name));
-        if (unknownKeys.length > 0) {
-            Logger.error('Unknown QUEUE_MONITOR_MIDDLEWARE keys configured', {
-                unknownKeys,
-                basePath,
-            });
-            throw ErrorFactory.createConfigError(`Unknown QUEUE_MONITOR_MIDDLEWARE key(s): ${unknownKeys.join(', ')}. These must match registered route middleware keys in your app.`);
-        }
-    }
-    return {
-        enabled,
-        basePath,
-        middleware,
-        autoRefresh: Env.getBool('QUEUE_MONITOR_AUTO_REFRESH', true),
-        refreshIntervalMs: Env.getInt('QUEUE_MONITOR_REFRESH_MS', 5000),
-    };
-};
-const createQueueConfig = () => {
-    const overrides = StartupConfigFileRegistry.get(StartupConfigFile.Queue) ?? {};
-    const baseDefault = Env.get('QUEUE_DRIVER', 'sync');
-    const baseDrivers = createBaseDrivers();
-    const baseFailed = {
-        database: Env.get('FAILED_JOBS_DB_CONNECTION', 'default'),
-        table: Env.get('FAILED_JOBS_TABLE', 'failed_jobs'),
-    };
-    const baseProcessing = {
-        timeout: Env.getInt('QUEUE_JOB_TIMEOUT', 60),
-        retries: Env.getInt('QUEUE_JOB_RETRIES', 3),
-        backoff: Env.getInt('QUEUE_JOB_BACKOFF', 0),
-        workers: Env.getInt('QUEUE_WORKERS', 1),
-    };
-    const baseMonitor = createBaseMonitor();
-    const mergedDrivers = {
-        ...baseDrivers,
-        ...overrides.drivers,
-    };
-    const queueConfigObj = {
-        /**
-         * Default queue driver
-         */
-        default: overrides.default ?? baseDefault,
-        /**
-         * Queue drivers
-         */
-        drivers: mergedDrivers,
-        /**
-         * Get queue driver config
-         */
-        getDriver(driverConfig) {
-            return getQueueDriver(driverConfig);
-        },
-        /**
-         * Failed jobs table
-         */
-        failed: {
-            ...baseFailed,
-            ...overrides.failed,
-        },
-        /**
-         * Job processing
-         */
-        processing: {
-            ...baseProcessing,
-            ...overrides.processing,
-        },
-        /**
-         * Queue Monitor settings
-         */
-        monitor: {
-            ...baseMonitor,
-            ...overrides.monitor,
-        },
-    };
-    return Object.freeze(queueConfigObj);
-};
-let cached = null;
-const proxyTarget = {};
-const ensureQueueConfig = () => {
-    if (cached)
-        return cached;
-    cached = createQueueConfig();
-    try {
-        Object.defineProperties(proxyTarget, Object.getOwnPropertyDescriptors(cached));
-    }
-    catch {
-        // best-effort
-    }
-    return cached;
-};
-export const queueConfig = new Proxy(proxyTarget, {
-    get(_target, prop) {
-        return ensureQueueConfig()[prop];
-    },
-    ownKeys() {
-        ensureQueueConfig();
-        return Reflect.ownKeys(proxyTarget);
-    },
-    getOwnPropertyDescriptor(_target, prop) {
-        ensureQueueConfig();
-        return Object.getOwnPropertyDescriptor(proxyTarget, prop);
-    },
-});

package/src/config/redis.d.ts

@@ -1,17 +0,0 @@
-import type { RedisBroadcastDriverConfig } from './type';
-import type { QueueMessage } from '../tools/queue/Queue';
-export type QueueDriver = {
-    enqueue<T = unknown>(queue: string, payload: T): Promise<string>;
-    dequeue<T = unknown>(queue: string): Promise<QueueMessage<T> | undefined>;
-    ack(queue: string, id: string): Promise<void>;
-    length(queue: string): Promise<number>;
-    drain(queue: string): Promise<void>;
-};
-export type RedisPublishClient = {
-    connect?: () => Promise<void>;
-    publish(channel: string, message: string): Promise<number>;
-};
-export declare const buildRedisUrl: (config?: RedisBroadcastDriverConfig) => string;
-export declare const getRedisUrl: (config?: RedisBroadcastDriverConfig) => string | null;
-export declare const ensureDriver: <T = QueueDriver>(type?: "queue" | "publish") => Promise<T>;
-//# sourceMappingURL=redis.d.ts.map

package/src/config/redis.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/config/redis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAM/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1E,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,0BAA0B,KAAG,MAYnE,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,SAAS,0BAA0B,KAAG,MAAM,GAAG,IAW1E,CAAC;AAqDF,eAAO,MAAM,YAAY,GAAU,CAAC,GAAG,WAAW,EAAE,OAAO,OAAO,GAAG,SAAS,KAAG,OAAO,CAAC,CAAC,CA0BzF,CAAC"}

package/src/config/redis.js

@@ -1,90 +0,0 @@
-import { Env } from './env.js';
-import { ErrorFactory } from '../exceptions/ZintrustError.js';
-import { ZintrustLang } from '../lang/lang.js';
-import { existsSync } from '../node-singletons/fs.js';
-import * as path from '../node-singletons/path.js';
-import { pathToFileURL } from '../node-singletons/url.js';
-import { Queue } from '../tools/queue/Queue.js';
-export const buildRedisUrl = (config) => {
-    // Otherwise build URL from individual settings (like cache driver)
-    const host = config?.host ?? Env.get('REDIS_HOST', 'localhost');
-    const port = config?.port ?? Env.getInt('REDIS_PORT', ZintrustLang.REDIS_DEFAULT_PORT);
-    const password = config?.password ?? Env.get('REDIS_PASSWORD');
-    const database = config?.database ?? Env.getInt('REDIS_QUEUE_DB', ZintrustLang.REDIS_DEFAULT_DB);
-    let redisUrl = `redis://`;
-    if (password)
-        redisUrl += `:${password}@`;
-    redisUrl += `${host}:${port}`;
-    if (database > 0)
-        redisUrl += `/${database}`;
-    return redisUrl;
-};
-export const getRedisUrl = (config) => {
-    const fromEnv = Env.get('REDIS_URL', '');
-    const hasProcess = typeof process === 'object' && process !== null;
-    const fallback = hasProcess ? (process.env?.['REDIS_URL'] ?? '') : '';
-    const trimmed = fromEnv.trim();
-    const url = (trimmed.length > 0 ? fromEnv : String(fallback)).trim();
-    // If REDIS_URL exists, use it
-    if (url.length > 0)
-        return url;
-    return buildRedisUrl(config);
-};
-const resolveLocalQueueRedisEntry = () => {
-    const cwd = typeof process !== 'undefined' && typeof process.cwd === 'function' ? process.cwd() : '';
-    if (cwd.trim() === '')
-        return null;
-    const localEntry = path.join(cwd, 'dist', 'packages', 'queue-redis', 'src', 'index.js');
-    return existsSync(localEntry) ? localEntry : null;
-};
-const importQueueRedisModule = async () => {
-    try {
-        return (await import('@zintrust/queue-redis'));
-    }
-    catch {
-        const localEntry = resolveLocalQueueRedisEntry();
-        if (localEntry === null)
-            return undefined;
-        const url = pathToFileURL(localEntry).href;
-        return (await import(url));
-    }
-};
-const loadPluginDriver = async () => {
-    try {
-        const mod = await importQueueRedisModule();
-        if (mod === undefined) {
-            throw ErrorFactory.createConfigError('queue-redis package not found');
-        }
-        if (mod.RedisQueue !== undefined) {
-            Queue.register('redis', mod.RedisQueue);
-        }
-        else if (mod.BullMQRedisQueue !== undefined) {
-            Queue.register('redis', mod.BullMQRedisQueue);
-        }
-        return Queue.get('redis');
-    }
-    catch (error) {
-        throw ErrorFactory.createConfigError('Redis queue driver is not registered. Install queue:redis via zin plugin install.', error);
-    }
-};
-export const ensureDriver = async (type) => {
-    if (type === 'publish') {
-        // Return Redis publish client with publish() method from package
-        const mod = await importQueueRedisModule();
-        if (mod?.createRedisPublishClient) {
-            return mod.createRedisPublishClient();
-        }
-        throw ErrorFactory.createConfigError('Redis publish client is not available in queue-redis package');
-    }
-    // Return queue driver (current behavior)
-    try {
-        const resolved = Queue.get('redis');
-        if (!(resolved.__zintrustCoreRedisQueue ?? false)) {
-            return resolved;
-        }
-        return await loadPluginDriver();
-    }
-    catch {
-        return loadPluginDriver();
-    }
-};

package/src/config/security.d.ts

@@ -1,123 +0,0 @@
-/**
- * Security Configuration
- * JWT, CSRF, encryption and other security settings
- * Sealed namespace for immutability
- *
- * APP_KEY: Primary encryption key for storage signing and app-level encryption.
- *          Set automatically during project scaffolding.
- *
- * Security keys can be configured per domain:
- * - APP_KEY: Default encryption key for all operations (auto-generated)
- * - API_KEY_SECRET: Optional API key authentication (if API_KEY_ENABLED=true)
- * - ENCRYPTION_CIPHER: Cipher for encrypted envelope interoperability
- * - JWT_SECRET: JWT token signing key
- *
- * Developers can use a single APP_KEY or configure separate keys for different
- * security domains (e.g., different keys for different microservices).
- */
-export declare const securityConfig: Readonly<{
-    /**
-     * JWT Configuration
-     */
-    readonly jwt: {
-        readonly enabled: boolean;
-        readonly secret: string;
-        readonly algorithm: "HS256" | "HS512" | "RS256";
-        readonly expiresIn: number;
-        readonly refreshExpiresIn: string;
-        readonly issuer: string;
-        readonly audience: string;
-    };
-    /**
-     * CSRF Protection
-     */
-    readonly csrf: {
-        readonly enabled: boolean;
-        readonly headerName: string;
-        readonly tokenName: string;
-        readonly cookieName: string;
-        readonly cookieHttpOnly: boolean;
-        readonly cookieSecure: boolean;
-        readonly cookieSameSite: "strict" | "lax" | "none";
-    };
-    /**
-     * Encryption
-     */
-    readonly encryption: {
-        readonly cipher: string;
-        readonly appKey: string;
-        readonly appPreviousKeys: string;
-        readonly algorithm: string;
-        readonly key: string;
-    };
-    /**
-     * API Key Authentication
-     */
-    readonly apiKey: {
-        readonly enabled: boolean;
-        readonly headerName: string;
-        readonly secret: string;
-    };
-    /**
-     * CORS Configuration
-     */
-    readonly cors: {
-        readonly enabled: boolean;
-        readonly origins: string[];
-        readonly methods: string[];
-        readonly allowedHeaders: string[];
-        readonly exposedHeaders: string[];
-        readonly credentials: boolean;
-        readonly maxAge: number;
-    };
-    /**
-     * Rate Limiting
-     */
-    readonly rateLimit: {
-        readonly enabled: boolean;
-        readonly windowMs: number;
-        readonly maxRequests: number;
-        readonly message: string;
-    };
-    /**
-     * XSS Protection
-     */
-    readonly xss: {
-        readonly enabled: boolean;
-        readonly reportUri: string;
-    };
-    /**
-     * Helmet Security Headers
-     */
-    readonly helmet: {
-        readonly enabled: boolean;
-        readonly contentSecurityPolicy: boolean;
-        readonly hsts: {
-            readonly enabled: boolean;
-            readonly maxAge: number;
-            readonly includeSubDomains: boolean;
-        };
-    };
-    /**
-     * Session Configuration
-     */
-    readonly session: {
-        readonly name: string;
-        readonly secret: string;
-        readonly expiresIn: number;
-        readonly secure: boolean;
-        readonly httpOnly: boolean;
-        readonly sameSite: "strict" | "lax" | "none";
-    };
-    /**
-     * Password settings
-     */
-    readonly password: {
-        readonly minLength: number;
-        readonly requireUppercase: boolean;
-        readonly requireNumbers: boolean;
-        readonly requireSpecialChars: boolean;
-        readonly bcryptRounds: number;
-    };
-}>;
-//# sourceMappingURL=security.d.ts.map

package/src/config/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/config/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyJH,eAAO,MAAM,cAAc;IAhIzB;;OAEG;;;yBAGa,MAAM;4BAQ4B,OAAO,GAAG,OAAO,GAAG,OAAO;;;;;;IAO7E;;OAEG;;;;;;;;iCAQ6D,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAGzF;;OAEG;;;;;;;;IAgBH;;OAEG;;;;;;IAOH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;IAQH;;OAEG;;;;;IAMH;;OAEG;;;;;;;;;;IAWH;;OAEG;;;;;;;2BAOmD,QAAQ,GAAG,KAAK,GAAG,MAAM;;IAG/E;;OAEG;;;;;;;;EAUyD,CAAC"}

package/src/config/security.js

@@ -1,154 +0,0 @@
-/**
- * Security Configuration
- * JWT, CSRF, encryption and other security settings
- * Sealed namespace for immutability
- *
- * APP_KEY: Primary encryption key for storage signing and app-level encryption.
- *          Set automatically during project scaffolding.
- *
- * Security keys can be configured per domain:
- * - APP_KEY: Default encryption key for all operations (auto-generated)
- * - API_KEY_SECRET: Optional API key authentication (if API_KEY_ENABLED=true)
- * - ENCRYPTION_CIPHER: Cipher for encrypted envelope interoperability
- * - JWT_SECRET: JWT token signing key
- *
- * Developers can use a single APP_KEY or configure separate keys for different
- * security domains (e.g., different keys for different microservices).
- */
-import { appConfig } from './app.js';
-import { Env } from './env.js';
-import { Logger } from './logger.js';
-import { ErrorFactory } from '../exceptions/ZintrustError.js';
-/**
- * Helper to warn about missing secrets
- */
-function warnMissingSecret(secretName) {
-    Logger.error(`❌ CRITICAL: ${secretName} environment variable is not set!`);
-    Logger.error('⚠️  Application may not function correctly. Set this in production immediately.');
-    if (appConfig.isProduction()) {
-        throw ErrorFactory.createConfigError(`Missing required secret: ${secretName}`, { secretName });
-    }
-    // In non-production environments, allow the app/CLI to start while still warning loudly.
-    // This is intentionally predictable for local development and test tooling.
-    return 'dev-unsafe-jwt-secret';
-}
-let cachedJwtSecret;
-const securityConfigObj = {
-    /**
-     * JWT Configuration
-     */
-    jwt: {
-        enabled: Env.getBool('JWT_ENABLED', true),
-        get secret() {
-            if (cachedJwtSecret !== undefined)
-                return cachedJwtSecret;
-            const isEnabled = Env.getBool('JWT_ENABLED', true);
-            cachedJwtSecret = isEnabled
-                ? Env.get('JWT_SECRET') || Env.get('APP_KEY') || warnMissingSecret('JWT_SECRET')
-                : Env.get('JWT_SECRET') || Env.get('APP_KEY') || '';
-            return cachedJwtSecret;
-        },
-        algorithm: Env.get('JWT_ALGORITHM', 'HS256'),
-        expiresIn: Env.getInt('JWT_EXPIRES_IN', 60 * 60),
-        refreshExpiresIn: Env.get('JWT_REFRESH_EXPIRES_IN', '7d'),
-        issuer: Env.get('JWT_ISSUER', 'zintrust'),
-        audience: Env.get('JWT_AUDIENCE', 'zintrust-api'),
-    },
-    /**
-     * CSRF Protection
-     */
-    csrf: {
-        enabled: Env.getBool('CSRF_ENABLED', true),
-        headerName: Env.get('CSRF_HEADER_NAME', 'x-csrf-token'),
-        tokenName: Env.get('CSRF_TOKEN_NAME', '_csrf'),
-        cookieName: Env.get('CSRF_COOKIE_NAME', 'XSRF-TOKEN'),
-        cookieHttpOnly: Env.getBool('CSRF_COOKIE_HTTP_ONLY', true),
-        cookieSecure: Env.getBool('CSRF_COOKIE_SECURE', true),
-        cookieSameSite: Env.get('CSRF_COOKIE_SAME_SITE', 'strict'),
-    },
-    /**
-     * Encryption
-     */
-    encryption: {
-        // Required for framework-compatible encrypted payloads.
-        // Supported values: aes-256-cbc | aes-256-gcm (case-insensitive)
-        cipher: Env.get('ENCRYPTION_CIPHER', ''),
-        // Primary key used for encryption interoperability (framework-compatible envelopes).
-        // APP_KEY supports both `base64:...` and raw base64.
-        appKey: Env.get('APP_KEY', ''),
-        appPreviousKeys: Env.get('APP_PREVIOUS_KEYS', ''),
-        // Back-compat fields (not used by EncryptedEnvelope)
-        algorithm: Env.get('ENCRYPTION_ALGORITHM', 'aes-256-cbc'),
-        key: Env.get('ENCRYPTION_KEY', 'your-encryption-key'),
-    },
-    /**
-     * API Key Authentication
-     */
-    apiKey: {
-        enabled: Env.getBool('API_KEY_ENABLED', false),
-        headerName: Env.get('API_KEY_HEADER', 'x-api-key'),
-        secret: Env.get('API_KEY_SECRET'),
-    },
-    /**
-     * CORS Configuration
-     */
-    cors: {
-        enabled: Env.getBool('CORS_ENABLED', true),
-        origins: Env.get('CORS_ORIGINS', '*').split(','),
-        methods: Env.get('CORS_METHODS', 'GET,POST,PUT,PATCH,DELETE').split(','),
-        allowedHeaders: Env.get('CORS_ALLOWED_HEADERS', 'Content-Type,Authorization').split(','),
-        exposedHeaders: Env.get('CORS_EXPOSED_HEADERS', '').split(','),
-        credentials: Env.getBool('CORS_CREDENTIALS', false),
-        maxAge: Env.getInt('CORS_MAX_AGE', 86400),
-    },
-    /**
-     * Rate Limiting
-     */
-    rateLimit: {
-        enabled: Env.getBool('RATE_LIMIT_ENABLED', true),
-        windowMs: Env.getInt('RATE_LIMIT_WINDOW_MS', 900000), // 15 minutes
-        maxRequests: Env.getInt('RATE_LIMIT_MAX_REQUESTS', 100),
-        message: Env.get('RATE_LIMIT_MESSAGE', 'Too many requests, please try again later'),
-    },
-    /**
-     * XSS Protection
-     */
-    xss: {
-        enabled: Env.getBool('XSS_ENABLED', true),
-        reportUri: Env.get('XSS_REPORT_URI'),
-    },
-    /**
-     * Helmet Security Headers
-     */
-    helmet: {
-        enabled: Env.getBool('HELMET_ENABLED', true),
-        contentSecurityPolicy: Env.getBool('CSP_ENABLED', true),
-        hsts: {
-            enabled: Env.getBool('HSTS_ENABLED', true),
-            maxAge: Env.getInt('HSTS_MAX_AGE', 31536000),
-            includeSubDomains: Env.getBool('HSTS_INCLUDE_SUBDOMAINS', true),
-        },
-    },
-    /**
-     * Session Configuration
-     */
-    session: {
-        name: Env.get('SESSION_NAME', 'zintrust_session'),
-        secret: Env.get('SESSION_SECRET', 'your-session-secret'),
-        expiresIn: Env.getInt('SESSION_EXPIRES_IN', 1800000), // 30 minutes
-        secure: Env.getBool('SESSION_SECURE', true),
-        httpOnly: Env.getBool('SESSION_HTTP_ONLY', true),
-        sameSite: Env.get('SESSION_SAME_SITE', 'strict'),
-    },
-    /**
-     * Password settings
-     */
-    password: {
-        minLength: Env.getInt('PASSWORD_MIN_LENGTH', 8),
-        requireUppercase: Env.getBool('PASSWORD_REQUIRE_UPPERCASE', true),
-        requireNumbers: Env.getBool('PASSWORD_REQUIRE_NUMBERS', true),
-        requireSpecialChars: Env.getBool('PASSWORD_REQUIRE_SPECIAL_CHARS', true),
-        bcryptRounds: Env.getInt('BCRYPT_ROUNDS', 10),
-    },
-};
-export const securityConfig = Object.freeze(securityConfigObj);

package/src/config/startup.d.ts

@@ -1,25 +0,0 @@
-/**
- * Startup Configuration
- *
- * Startup-only controls (evaluated during Application.boot()).
- */
-export type StartupConfig = {
-    healthChecksEnabled: boolean;
-    validateSecrets: boolean;
-    requireEnv: boolean;
-    checkDatabase: boolean;
-    checkCache: boolean;
-    timeoutMs: number;
-    continueOnFailure: boolean;
-};
-export declare const startupConfig: Readonly<{
-    healthChecksEnabled: boolean;
-    validateSecrets: boolean;
-    requireEnv: boolean;
-    checkDatabase: boolean;
-    checkCache: boolean;
-    timeoutMs: number;
-    continueOnFailure: boolean;
-}>;
-export default startupConfig;
-//# sourceMappingURL=startup.d.ts.map

package/src/config/startup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../../../src/config/startup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,aAAa,GAAG;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;EAQA,CAAC;AAE3B,eAAe,aAAa,CAAC"}

package/src/config/startup.js

@@ -1,16 +0,0 @@
-/**
- * Startup Configuration
- *
- * Startup-only controls (evaluated during Application.boot()).
- */
-import { Env } from './env.js';
-export const startupConfig = Object.freeze({
-    healthChecksEnabled: Env.getBool('STARTUP_HEALTH_CHECKS', true),
-    validateSecrets: Env.getBool('STARTUP_VALIDATE_SECRETS', true),
-    requireEnv: Env.getBool('STARTUP_REQUIRE_ENV', false),
-    checkDatabase: Env.getBool('STARTUP_CHECK_DB', false),
-    checkCache: Env.getBool('STARTUP_CHECK_CACHE', false),
-    timeoutMs: Env.getInt('STARTUP_HEALTH_TIMEOUT_MS', 2500),
-    continueOnFailure: Env.getBool('STARTUP_CONTINUE_ON_FAILURE', false),
-});
-export default startupConfig;