@zintrust/core 0.4.15 → 0.4.17

package/src/cli/commands/ScheduleStartCommand.ts

@@ -0,0 +1,56 @@
+import type { CommandOptions, IBaseCommand } from '@cli/BaseCommand';
+import { BaseCommand } from '@cli/BaseCommand';
+import { ScheduleCliSupport } from '@cli/commands/schedule/ScheduleCliSupport';
+import { Env } from '@config/env';
+import { Logger } from '@config/logger';
+import { ErrorFactory } from '@exceptions/ZintrustError';
+import { SchedulerRuntime } from '@scheduler/SchedulerRuntime';
+
+type Options = CommandOptions & {
+  json?: boolean;
+};
+
+const waitForSignal = async (): Promise<'SIGTERM' | 'SIGINT'> => {
+  if (typeof process === 'undefined' || typeof process.once !== 'function') {
+    throw ErrorFactory.createGeneralError('schedule:start is only supported in Node.js runtimes');
+  }
+
+  return new Promise<'SIGTERM' | 'SIGINT'>((resolve) => {
+    process.once('SIGTERM', () => resolve('SIGTERM'));
+    process.once('SIGINT', () => resolve('SIGINT'));
+  });
+};
+
+const execute = async (_options: Options): Promise<void> => {
+  if (Env.getBool('SCHEDULES_ENABLED', false) === false) {
+    Logger.info('Schedules are disabled (SCHEDULES_ENABLED=false); exiting');
+    return;
+  }
+
+  await ScheduleCliSupport.registerAll();
+
+  const registeredCount = SchedulerRuntime.list().length;
+  Logger.info('Starting schedules daemon', { registeredCount });
+
+  SchedulerRuntime.start();
+
+  const signal = await waitForSignal();
+  Logger.info('Stopping schedules daemon', { signal });
+
+  const timeoutMs = Env.getInt('SCHEDULE_SHUTDOWN_TIMEOUT_MS', 30000);
+  await SchedulerRuntime.stop(timeoutMs);
+
+  Logger.info('Schedules daemon stopped');
+};
+
+export const ScheduleStartCommand = Object.freeze({
+  create(): IBaseCommand {
+    return BaseCommand.create({
+      name: 'schedule:start',
+      description: 'Start schedules and keep running until SIGINT/SIGTERM',
+      execute,
+    });
+  },
+});
+
+export default ScheduleStartCommand;

package/src/cli/commands/SecretsCommand.ts

@@ -0,0 +1,143 @@
+/**
+ * Secrets Command
+ *
+ * CLI-first secrets sync using the core internal toolkit.
+ *
+ * Usage:
+ *   zin secrets pull   --provider aws|cloudflare [--manifest secrets.manifest.json] [--out .env.pull] [--dry-run]
+ *   zin secrets push   --provider aws|cloudflare [--manifest secrets.manifest.json] [--in .env] [--dry-run]
+ *   zin secrets doctor --provider aws|cloudflare
+ */
+
+import { BaseCommand, type CommandOptions, type IBaseCommand } from '@cli/BaseCommand';
+import { ErrorFactory } from '@exceptions/ZintrustError';
+import { isArray } from '@helper/index';
+import type { Command } from 'commander';
+
+import { SecretsToolkit } from '@toolkit/Secrets';
+import type { SecretsProviderName } from '@toolkit/Secrets/Manifest';
+
+type SecretsCommandOptions = CommandOptions & {
+  provider?: string;
+  manifest?: string;
+  out?: string;
+  in?: string;
+  dryRun?: boolean;
+};
+
+const getArg = (args: unknown, index: number): string | undefined => {
+  if (!isArray(args)) return undefined;
+  const v = args[index];
+  return typeof v === 'string' ? v : undefined;
+};
+
+const coerceProvider = (provider: string | undefined): SecretsProviderName | undefined =>
+  provider === 'aws' || provider === 'cloudflare' ? provider : undefined;
+
+type ParsedSecretsArgs = {
+  cwd: string;
+  action: string;
+  provider?: SecretsProviderName;
+  manifestPath?: string;
+  outFile?: string;
+  inFile?: string;
+  dryRun: boolean;
+};
+
+const parseOptions = (options: SecretsCommandOptions): ParsedSecretsArgs => {
+  const cwd = process.cwd();
+  const action = getArg(options.args, 0) ?? 'pull';
+
+  const provider =
+    typeof options.provider === 'string' ? coerceProvider(options.provider) : undefined;
+
+  const manifestPath = typeof options.manifest === 'string' ? options.manifest : undefined;
+  const outFile = typeof options.out === 'string' ? options.out : undefined;
+  const inFile = typeof options.in === 'string' ? options.in : undefined;
+  const dryRun = options.dryRun === true;
+
+  return { cwd, action, provider, manifestPath, outFile, inFile, dryRun };
+};
+
+const addOptions = (command: Command): void => {
+  command
+    .argument('[action]', 'pull | push | doctor', 'pull')
+    .option('--provider <provider>', 'aws | cloudflare')
+    .option(
+      '--manifest <path>',
+      'Manifest path (default: secrets.manifest.json)',
+      'secrets.manifest.json'
+    )
+    .option('--out <path>', 'Output env file for pull (default: .env.pull)', '.env.pull')
+    .option('--in <path>', 'Input env file for push (default: .env)', '.env')
+    .option('--dry-run', 'Do not write/upload, just show what would change');
+};
+
+const execute = async (cmd: IBaseCommand, options: SecretsCommandOptions): Promise<void> => {
+  const parsed = parseOptions(options);
+
+  switch (parsed.action) {
+    case 'pull': {
+      const result = await SecretsToolkit.pull({
+        cwd: parsed.cwd,
+        provider: parsed.provider,
+        manifestPath: parsed.manifestPath,
+        outFile: parsed.outFile,
+        dryRun: parsed.dryRun,
+      });
+
+      cmd.success(
+        `Pulled ${result.keys.length} keys to ${result.outFile}${parsed.dryRun ? ' (dry-run)' : ''}`
+      );
+      return;
+    }
+
+    case 'push': {
+      const result = await SecretsToolkit.push({
+        cwd: parsed.cwd,
+        provider: parsed.provider,
+        manifestPath: parsed.manifestPath,
+        inFile: parsed.inFile,
+        dryRun: parsed.dryRun,
+      });
+
+      cmd.success(
+        `Pushed ${result.keys.length} keys from ${result.inFile}${parsed.dryRun ? ' (dry-run)' : ''}`
+      );
+      return;
+    }
+
+    case 'doctor': {
+      const result = SecretsToolkit.doctor({ provider: parsed.provider });
+
+      if (result.ok) {
+        cmd.success(`Secrets doctor OK (${result.provider})`);
+      } else {
+        cmd.warn(
+          `Secrets doctor failed (${result.provider}). Missing: ${result.missing.join(', ')}`
+        );
+      }
+
+      return;
+    }
+
+    default:
+      throw ErrorFactory.createCliError(`Unknown secrets action: ${parsed.action}`);
+  }
+};
+
+export const SecretsCommand = Object.freeze({
+  create(): IBaseCommand {
+    const cmd: IBaseCommand = BaseCommand.create({
+      name: 'secrets',
+      description: 'Pull/push secrets to local .env.pull via core toolkit',
+      addOptions,
+      execute: async (options: CommandOptions): Promise<void> =>
+        execute(cmd, options as SecretsCommandOptions),
+    });
+
+    return cmd;
+  },
+});
+
+export default SecretsCommand;

package/src/cli/commands/SimulateCommand.ts

@@ -0,0 +1,97 @@
+/**
+ * Simulate Command
+ * Internal dev tool that generates a simulated ZinTrust app under ./simulate/
+ * IMPORTANT: this uses the same ProjectScaffolder as `zin new`.
+ * Usage: zin -sim my-blog
+ */
+
+import type { IBaseCommand } from '@cli/BaseCommand';
+import { ProjectScaffolder } from '@cli/scaffolding/ProjectScaffolder';
+import { DistPackager } from '@cli/utils/DistPackager';
+import { Logger } from '@config/logger';
+import { ErrorFactory } from '@exceptions/ZintrustError';
+import fs from '@node-singletons/fs';
+import * as path from '@node-singletons/path';
+import chalk from 'chalk';
+import { Command } from 'commander';
+
+const rewriteSimulatedAppDependencyToDist = (appPath: string, distPath: string): void => {
+  const packageJsonPath = path.join(appPath, 'package.json');
+  if (!fs.existsSync(packageJsonPath)) {
+    throw ErrorFactory.createCliError(`Missing simulated app package.json at: ${packageJsonPath}`);
+  }
+
+  const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) as {
+    dependencies?: Record<string, string>;
+  };
+
+  const dependencies: Record<string, string> = { ...pkg.dependencies };
+  dependencies['@zintrust/core'] = `file:${distPath}`;
+
+  const nextPkg = {
+    ...pkg,
+    dependencies,
+  };
+
+  fs.writeFileSync(packageJsonPath, JSON.stringify(nextPkg, null, 2) + '\n');
+};
+
+/**
+ * SimulateCommand - Generate simulated apps for testing
+ */
+export const SimulateCommand = {
+  name: 'simulate',
+  description: '[INTERNAL] Generate simulated ZinTrust app for testing new developer experience',
+
+  getCommand(): Command {
+    const command = new Command('simulate')
+      .alias('-sim')
+      .alias('--sim')
+      .description('[INTERNAL DEV] Create a simulated ZinTrust application in simulate/ folder')
+      .argument('<name>', 'Name of the simulated app')
+      .action(async (appName: string) => {
+        try {
+          const simulateBasePath = path.join(process.cwd(), 'simulate');
+
+          if (!appName || appName.trim() === '') {
+            throw ErrorFactory.createValidationError('App name is required');
+          }
+
+          // Delegate validation + file generation to the same scaffolder used by `zin new`.
+          Logger.info(`Creating simulated app via ProjectScaffolder: ${chalk.cyan(appName)}`);
+
+          const result = await ProjectScaffolder.scaffold(simulateBasePath, {
+            name: appName,
+            template: 'basic',
+            database: 'sqlite',
+            author: 'Internal',
+            description: `Simulated ZinTrust app - ${appName}`,
+          });
+
+          if (!result.success) {
+            throw ErrorFactory.createCliError(result.message, result.error);
+          }
+
+          const appPath = path.join(simulateBasePath, appName);
+
+          // For simulate apps only: install the locally-built framework from dist/
+          // so the dev experience matches "fresh install" of the current build output.
+          const distPath = path.join(process.cwd(), 'dist');
+          DistPackager.prepare(distPath, process.cwd());
+          rewriteSimulatedAppDependencyToDist(appPath, distPath);
+
+          Logger.info('✅ Simulated app created successfully!');
+          Logger.info(`📁 Location: ${chalk.cyan(appPath)}`);
+          Logger.info(`\n${chalk.bold('Next steps:')}`);
+          Logger.info(`  cd ${path.relative(process.cwd(), appPath)}`);
+          Logger.info('  npm install');
+          Logger.info('  zin start');
+        } catch (error) {
+          Logger.error('Failed to create simulated app', error);
+          process.exit(1);
+        }
+      });
+
+    return command;
+  },
+} as IBaseCommand;

package/src/cli/commands/SmtpProxyCommand.ts

@@ -0,0 +1,99 @@
+import type { CommandOptions, IBaseCommand } from '@cli/BaseCommand';
+import { BaseCommand } from '@cli/BaseCommand';
+import {
+  maybeRunProxyWatchMode,
+  parseIntOption,
+  trimOption,
+} from '@cli/commands/ProxyCommandUtils';
+import { Env } from '@config/env';
+import { SmtpProxyServer } from '@proxy/smtp/SmtpProxyServer';
+import type { Command } from 'commander';
+
+type SmtpProxyOptions = CommandOptions & {
+  host?: string;
+  port?: string;
+  maxBodyBytes?: string;
+  smtpHost?: string;
+  smtpPort?: string;
+  smtpUsername?: string;
+  smtpPassword?: string;
+  smtpSecure?: string;
+  requireSigning?: boolean;
+  keyId?: string;
+  secret?: string;
+  signingWindowMs?: string;
+  watch?: boolean;
+};
+
+const addOptions = (command: Command): void => {
+  command.option('--host <host>', 'Host to bind', Env.get('SMTP_PROXY_HOST', '127.0.0.1'));
+  command.option('--port <port>', 'Port to bind', String(Env.getInt('SMTP_PROXY_PORT', 8794)));
+  command.option(
+    '--max-body-bytes <bytes>',
+    'Max request size in bytes',
+    String(Env.getInt('SMTP_PROXY_MAX_BODY_BYTES', 131072))
+  );
+  command.option('--watch', 'Auto-restart proxy on file changes');
+
+  command.option('--smtp-host <host>', 'SMTP host');
+  command.option('--smtp-port <port>', 'SMTP port');
+  command.option('--smtp-username <user>', 'SMTP username');
+  command.option('--smtp-password <password>', 'SMTP password');
+  command.option('--smtp-secure <mode>', "SMTP secure: true, false, or 'starttls'");
+
+  command.option(
+    '--require-signing',
+    'Require signed requests',
+    Env.getBool('SMTP_PROXY_REQUIRE_SIGNING', true)
+  );
+  command.option('--key-id <id>', 'Signing key id', Env.get('SMTP_PROXY_KEY_ID', ''));
+  command.option('--secret <secret>', 'Signing secret', Env.get('SMTP_PROXY_SECRET', ''));
+  command.option(
+    '--signing-window-ms <ms>',
+    'Signing time window in ms',
+    String(Env.getInt('SMTP_PROXY_SIGNING_WINDOW_MS', 60000))
+  );
+};
+
+export const SmtpProxyCommand = Object.freeze({
+  create(): IBaseCommand {
+    return BaseCommand.create({
+      name: 'proxy:smtp',
+      aliases: ['smtp:proxy', 'smtp-proxy', 'proxy:mail'],
+      description: 'Start the SMTP HTTP proxy for Cloudflare Workers',
+      addOptions,
+      execute: async (options: SmtpProxyOptions) => {
+        await maybeRunProxyWatchMode(options.watch);
+
+        const host = trimOption(options.host);
+        const port = parseIntOption(options.port, 'port');
+        const maxBodyBytes = parseIntOption(options.maxBodyBytes, 'max-body-bytes');
+
+        const smtpHost = trimOption(options.smtpHost);
+        const smtpPort = parseIntOption(options.smtpPort, 'smtp-port');
+        const smtpUsername = trimOption(options.smtpUsername);
+        const smtpPassword = options.smtpPassword;
+        const smtpSecure = options.smtpSecure;
+
+        const signingWindowMs = parseIntOption(options.signingWindowMs, 'signing-window-ms');
+
+        await SmtpProxyServer.start({
+          host,
+          port,
+          maxBodyBytes,
+          smtpHost,
+          smtpPort,
+          smtpUsername,
+          smtpPassword,
+          smtpSecure,
+          requireSigning: options.requireSigning === true,
+          keyId: options.keyId,
+          secret: options.secret,
+          signingWindowMs,
+        });
+      },
+    });
+  },
+});
+
+export default SmtpProxyCommand;

package/src/cli/commands/SqlProxyCommandUtils.ts

@@ -0,0 +1,120 @@
+import type { CommandOptions } from '@cli/BaseCommand';
+import {
+  maybeRunProxyWatchMode,
+  parseIntOption,
+  trimOption,
+} from '@cli/commands/ProxyCommandUtils';
+import type { Command } from 'commander';
+
+export type SqlProxyCommandOptions = CommandOptions & {
+  host?: string;
+  port?: string;
+  maxBodyBytes?: string;
+  dbHost?: string;
+  dbPort?: string;
+  dbName?: string;
+  dbUser?: string;
+  dbPass?: string;
+  connectionLimit?: string;
+  requireSigning?: boolean;
+  keyId?: string;
+  secret?: string;
+  signingWindowMs?: string;
+  watch?: boolean;
+};
+
+export type ParsedSqlProxyStartOptions = {
+  host: string | undefined;
+  port: number | undefined;
+  maxBodyBytes: number | undefined;
+  dbHost: string | undefined;
+  dbPort: number | undefined;
+  dbName: string | undefined;
+  dbUser: string | undefined;
+  dbPass: string | undefined;
+  connectionLimit: number | undefined;
+  requireSigning: boolean;
+  keyId: string | undefined;
+  secret: string | undefined;
+  signingWindowMs: number | undefined;
+};
+
+export const addSqlProxyOptions = (
+  command: Command,
+  input: {
+    hostDefault: string;
+    portDefault: number;
+    maxBodyBytesDefault: number;
+    dbVendorLabel: string;
+    requireSigningDefault: boolean;
+    keyIdDefault: string;
+    secretDefault: string;
+    signingWindowMsDefault: number;
+  }
+): void => {
+  command.option('--host <host>', 'Host to bind', input.hostDefault);
+  command.option('--port <port>', 'Port to bind', String(input.portDefault));
+  command.option(
+    '--max-body-bytes <bytes>',
+    'Max request size in bytes',
+    String(input.maxBodyBytesDefault)
+  );
+  command.option('--watch', 'Auto-restart proxy on file changes');
+
+  command.option('--db-host <host>', `${input.dbVendorLabel} host`);
+  command.option('--db-port <port>', `${input.dbVendorLabel} port`);
+  command.option('--db-name <name>', `${input.dbVendorLabel} database`);
+  command.option('--db-user <user>', `${input.dbVendorLabel} username`);
+  command.option('--db-pass <pass>', `${input.dbVendorLabel} password`);
+  command.option('--connection-limit <max>', `${input.dbVendorLabel} connection pool limit`);
+
+  command.option('--require-signing', 'Require signed requests', input.requireSigningDefault);
+  command.option('--key-id <id>', 'Signing key id', input.keyIdDefault);
+  command.option('--secret <secret>', 'Signing secret', input.secretDefault);
+  command.option(
+    '--signing-window-ms <ms>',
+    'Signing time window in ms',
+    String(input.signingWindowMsDefault)
+  );
+};
+
+export const parseSqlProxyStartOptions = (
+  options: SqlProxyCommandOptions
+): ParsedSqlProxyStartOptions => {
+  const host = trimOption(options.host);
+  const port = parseIntOption(options.port, 'port');
+  const maxBodyBytes = parseIntOption(options.maxBodyBytes, 'max-body-bytes');
+
+  const dbHost = trimOption(options.dbHost);
+  const dbPort = parseIntOption(options.dbPort, 'db-port');
+  const dbName = trimOption(options.dbName);
+  const dbUser = trimOption(options.dbUser);
+  const dbPass = options.dbPass;
+
+  const connectionLimit = parseIntOption(options.connectionLimit, 'connection-limit');
+  const signingWindowMs = parseIntOption(options.signingWindowMs, 'signing-window-ms');
+
+  return {
+    host,
+    port,
+    maxBodyBytes,
+    dbHost,
+    dbPort,
+    dbName,
+    dbUser,
+    dbPass,
+    connectionLimit,
+    requireSigning: options.requireSigning === true,
+    keyId: options.keyId,
+    secret: options.secret,
+    signingWindowMs,
+  };
+};
+
+export const runSqlProxyCommand = async (
+  options: SqlProxyCommandOptions,
+  start: (input: ReturnType<typeof parseSqlProxyStartOptions>) => Promise<void>
+): Promise<void> => {
+  await maybeRunProxyWatchMode(options.watch);
+  await start(parseSqlProxyStartOptions(options));
+};

package/src/cli/commands/SqlServerProxyCommand.ts

@@ -0,0 +1,133 @@
+import { Env } from '@config/env';
+import { Logger } from '@config/logger';
+import { Command } from 'commander';
+
+type ProxyOptions = Record<string, unknown>;
+
+type BuildServer = {
+  host: string;
+  port: number;
+  dbHost: string;
+  dbPort: number;
+  dbName: string;
+  dbUser: string;
+  dbPass: string;
+  connectionLimit: number;
+  keyId: string;
+  secret: string;
+  requireSigning: boolean;
+  signingWindowMs: number;
+};
+
+const startWatchMode = async (options: ProxyOptions): Promise<void> => {
+  Logger.info('Starting SQL Server proxy in watch mode...');
+  const { watch } = await import('node:fs');
+  const { spawn } = await import('node:child_process');
+
+  let child: ReturnType<typeof spawn> | null = null;
+
+  const startProxy = (): void => {
+    if (child) {
+      child.kill();
+    }
+    const args = ['run', 'cli', 'proxy:sqlserver'];
+    Object.entries(options).forEach(([key, value]) => {
+      if (key !== 'watch' && value !== undefined) {
+        args.push(`--${key}`, String(value));
+      }
+    });
+    child = spawn('npm', args, { stdio: 'inherit' });
+  };
+
+  const watcher = watch('./src', { recursive: true }, (_eventType, filename) => {
+    if (
+      filename !== null &&
+      filename.length > 0 &&
+      (filename.endsWith('.ts') || filename.endsWith('.js'))
+    ) {
+      Logger.info(`File changed: ${String(filename)}, restarting proxy...`);
+      startProxy();
+    }
+  });
+
+  startProxy();
+
+  process.on('SIGINT', () => {
+    watcher.close();
+    if (child) child.kill();
+    process.exit(0);
+  });
+};
+
+export const SqlServerProxyCommand = Object.freeze({
+  create(): Command {
+    const cmd = new Command('proxy:sqlserver');
+    cmd.description('Start SQL Server HTTP proxy server');
+
+    const configureOptions = (): void => {
+      cmd.option('--host <host>', 'Proxy host', Env.get('SQLSERVER_PROXY_HOST', '127.0.0.1'));
+      cmd.option('--port <port>', 'Proxy port', String(Env.getInt('SQLSERVER_PROXY_PORT', 8793)));
+      cmd.option('--db-host <host>', 'SQL Server host', Env.get('DB_HOST_MSSQL', '127.0.0.1'));
+      cmd.option('--db-port <port>', 'SQL Server port', String(Env.getInt('DB_PORT_MSSQL', 1433)));
+      cmd.option('--db-name <name>', 'Database name', Env.get('DB_DATABASE_MSSQL', 'zintrust'));
+      cmd.option('--db-user <user>', 'Database user', Env.get('DB_USERNAME_MSSQL', 'sa'));
+      cmd.option('--db-pass <pass>', 'Database password', Env.get('DB_PASSWORD_MSSQL', ''));
+      cmd.option(
+        '--connection-limit <limit>',
+        'Connection pool limit',
+        String(Env.getInt('SQLSERVER_PROXY_POOL_LIMIT', 10))
+      );
+      cmd.option(
+        '--key-id <keyId>',
+        'Signing key ID',
+        Env.get('SQLSERVER_PROXY_KEY_ID', 'default')
+      );
+      cmd.option('--secret <secret>', 'Signing secret', Env.get('SQLSERVER_PROXY_SECRET', ''));
+      cmd.option(
+        '--require-signing',
+        'Require request signing',
+        Env.SQLSERVER_PROXY_REQUIRE_SIGNING
+      );
+      cmd.option(
+        '--signing-window-ms <ms>',
+        'Signing window in milliseconds',
+        String(Env.getInt('SQLSERVER_PROXY_SIGNING_WINDOW_MS', 60000))
+      );
+      cmd.option('--watch', 'Watch mode: restart on file changes');
+    };
+
+    const buildServerConfig = (options: ProxyOptions): BuildServer => ({
+      host: String(options['host']),
+      port: Number(options['port']),
+      dbHost: String(options['dbHost']),
+      dbPort: Number(options['dbPort']),
+      dbName: String(options['dbName']),
+      dbUser: String(options['dbUser']),
+      dbPass: String(options['dbPass']),
+      connectionLimit: Number(options['connectionLimit']),
+      keyId: String(options['keyId']),
+      secret: String(options['secret']),
+      requireSigning: Boolean(options['requireSigning']),
+      signingWindowMs: Number(options['signingWindowMs']),
+    });
+
+    const startNormalMode = async (options: ProxyOptions): Promise<void> => {
+      const { SqlServerProxyServer } = await import('@proxy/sqlserver/SqlServerProxyServer');
+      await SqlServerProxyServer.start(buildServerConfig(options));
+    };
+
+    const execute = async (options: ProxyOptions): Promise<void> => {
+      if (options['watch'] === true) {
+        await startWatchMode(options);
+        return;
+      }
+
+      await startNormalMode(options);
+    };
+
+    configureOptions();
+    cmd.action(execute);
+
+    return cmd;
+  },
+});