@zintrust/core 0.4.17 → 0.4.18

package/src/cli/scaffolding/templates/env.scaffold.dotenv.tpl

@@ -1,561 +0,0 @@
-# ZinTrust — Project Environment (.env)
-#
-# Generated by: zin new / ProjectScaffolder
-#
-# Notes:
-# - No $VAR interpolation: compatible with standard Node dotenv behavior.
-# - Secrets are intentionally empty unless auto-generated (APP_KEY).
-# - For the complete key list (auto-generated), see: -envexample.generated
-
-# ============================================================================
-# APP
-# ============================================================================
-
-# Environment: development | production | testing
-NODE_ENV=development
-
-APP_NAME={{APP_NAME}}
-HOST=localhost
-PORT={{PORT}}
-BASE_URL={{BASE_URL}}
-
-# Runtime override (optional): auto | nodejs | cloudflare | deno | lambda
-RUNTIME=
-
-# Developer toggles
-DEBUG=true
-METRICS_ENABLED=false
-
-# Cloudflare Workers (TCP sockets) — set true if using TCP adapters on Workers.
-ENABLE_CLOUDFLARE_SOCKETS=false
-
-# CLI / tooling
-ZINTRUST_RUN_FROM_SOURCE=0
-ZINTRUST_VERSION_CHECK=true
-ZINTRUST_VERSION_CHECK_INTERVAL=24
-ZINTRUST_CLI_DEBUG_ARGS=0
-
-# Optional debug output (local only)
-ZIN_DEBUG_VALIDATION_BODY=false
-ZIN_DEBUG_BODY_PARSING=false
-ZIN_DEBUG_FILE_UPLOAD=false
-
-
-# ============================================================================
-# STARTUP (boot-time checks)
-# ============================================================================
-
-STARTUP_HEALTH_CHECKS=true
-STARTUP_VALIDATE_SECRETS=true
-
-# Strict required-env validation. Recommended for new projects.
-STARTUP_REQUIRE_ENV=true
-
-STARTUP_CHECK_DB=false
-STARTUP_CHECK_CACHE=false
-STARTUP_HEALTH_TIMEOUT_MS=2500
-STARTUP_CONTINUE_ON_FAILURE=false
-
-
-# ============================================================================
-# SECURITY (keys, auth, headers)
-# ============================================================================
-
-# Auto-generated secure APP_KEY for encryption interoperability (32 bytes, base64).
-APP_KEY={{APP_KEY}}
-
-# Optional: key rotation support (comma-separated OR JSON array of base64 keys)
-APP_PREVIOUS_KEYS=
-
-# Supported: aes-256-cbc | aes-256-gcm
-ENCRYPTION_CIPHER=aes-256-cbc
-
-JWT_ENABLED=true
-# If empty, JWT uses APP_KEY in dev. For production, set a dedicated JWT_SECRET.
-JWT_SECRET=
-
-# Bulletproof Auth signing secret (SignedRequest proof-of-possession).
-# If empty, ZinTrust will fallback to APP_KEY (convenient, but not recommended).
-# Strongly recommended: set a dedicated BULLETPROOF_SIGNING_SECRET.
-# Rotation: old secrets can be kept in BULLETPROOF_SIGNING_SECRET_BK as a JSON array.
-BULLETPROOF_SIGNING_SECRET=
-BULLETPROOF_SIGNING_SECRET_BK=[]
-JWT_ALGORITHM=HS256
-JWT_EXPIRES_IN=3600
-JWT_REFRESH_EXPIRES_IN=7d
-JWT_ISSUER=zintrust
-JWT_AUDIENCE=zintrust-api
-
-# JWT revocation (token invalidation)
-# Options: database | redis | kv | kv-remote | memory
-JWT_REVOCATION_DRIVER=database
-JWT_REVOCATION_DB_CONNECTION=default
-JWT_REVOCATION_DB_TABLE=zintrust_jwt_revocations
-JWT_REVOCATION_REDIS_DB=0
-JWT_REVOCATION_REDIS_PREFIX=zt:jwt:revoked:
-JWT_REVOCATION_KV_BINDING=CACHE
-JWT_REVOCATION_KV_PREFIX=zt:jwt:revoked:
-
-API_KEY_ENABLED=false
-API_KEY_HEADER=x-api-key
-API_KEY_SECRET=
-
-CSRF_ENABLED=true
-CSRF_HEADER_NAME=x-csrf-token
-CSRF_TOKEN_NAME=_csrf
-CSRF_COOKIE_NAME=XSRF-TOKEN
-
-# Local dev often uses http; set true in production.
-CSRF_COOKIE_SECURE=false
-CSRF_COOKIE_HTTP_ONLY=true
-CSRF_COOKIE_SAME_SITE=lax
-
-# Comma-separated path globs that skip CSRF checks.
-CSRF_SKIP_PATHS=/api/*,/queue-monitor/*,/api/_sys/queue/*,/api/_sys/schedule/*
-
-CORS_ENABLED=true
-CORS_ORIGINS=*
-CORS_METHODS=GET,POST,PUT,PATCH,DELETE
-CORS_ALLOWED_HEADERS=Content-Type,Authorization
-CORS_EXPOSED_HEADERS=
-CORS_CREDENTIALS=false
-CORS_MAX_AGE=86400
-
-RATE_LIMIT_ENABLED=true
-RATE_LIMIT_WINDOW_MS=900000
-RATE_LIMIT_MAX_REQUESTS=100
-RATE_LIMIT_MESSAGE=Too many requests, please try again later
-
-HELMET_ENABLED=true
-CSP_ENABLED=false
-HSTS_ENABLED=false
-HSTS_MAX_AGE=31536000
-HSTS_INCLUDE_SUBDOMAINS=true
-XSS_ENABLED=true
-XSS_REPORT_URI=
-
-SESSION_NAME=zintrust_session
-SESSION_SECRET=
-SESSION_EXPIRES_IN=1800000
-SESSION_SECURE=false
-SESSION_HTTP_ONLY=true
-SESSION_SAME_SITE=lax
-
-PASSWORD_MIN_LENGTH=8
-PASSWORD_REQUIRE_UPPERCASE=true
-PASSWORD_REQUIRE_NUMBERS=true
-PASSWORD_REQUIRE_SPECIAL_CHARS=true
-BCRYPT_ROUNDS=10
-
-
-# ============================================================================
-# DEPLOYMENT / LIMITS
-# ============================================================================
-
-ENVIRONMENT=development
-REQUEST_TIMEOUT=30000
-APP_TIMEZONE=UTC
-MAX_BODY_SIZE=10485760
-SHUTDOWN_TIMEOUT=10000
-
-
-# ============================================================================
-# DATABASE
-# ============================================================================
-
-# Options: sqlite | postgresql | mysql | sqlserver | d1 | d1-remote
-DB_CONNECTION={{DB_CONNECTION}}
-
-# SQLite (recommended for local dev)
-DB_PATH={{SQLITE_DB_PATH}}
-
-# Generic SQL defaults (used by some adapters)
-DB_HOST=localhost
-DB_PORT=5432
-DB_DATABASE=
-DB_USERNAME=postgres
-DB_PASSWORD=
-DB_READ_HOSTS=
-
-# PostgreSQL (optional)
-DB_PORT_POSTGRESQL=5432
-DB_DATABASE_POSTGRESQL=postgres
-DB_USERNAME_POSTGRESQL=postgres
-DB_PASSWORD_POSTGRESQL=
-DB_READ_HOSTS_POSTGRESQL=
-
-# SQL Server (MSSQL) (optional)
-DB_HOST_MSSQL=localhost
-DB_PORT_MSSQL=1433
-DB_DATABASE_MSSQL=zintrust
-DB_USERNAME_MSSQL=sa
-DB_PASSWORD_MSSQL=
-DB_READ_HOSTS_MSSQL=
-
-# Pooling / logging (optional)
-DB_POOLING=true
-DB_POOL_MIN=5
-DB_POOL_MAX=20
-DB_IDLE_TIMEOUT=30000
-DB_CONNECTION_TIMEOUT=10000
-DB_SSL=false
-DB_LOG_QUERIES=false
-DB_LOG_LEVEL=info
-DB_MIGRATION_EXT=ts
-
-# Database overrides (generated by scaffolder)
-{{DB_LINES}}
-
-
-# ============================================================================
-# CLOUDFLARE (D1 / KV)
-# ============================================================================
-
-D1_DATABASE_ID=
-KV_NAMESPACE_ID=
-
-# Remote D1 (outside Cloudflare) via proxy
-D1_REMOTE_URL=
-D1_REMOTE_KEY_ID=
-D1_REMOTE_SECRET=
-D1_REMOTE_MODE=registry
-
-# Remote KV (outside Cloudflare) via proxy
-KV_REMOTE_URL=
-KV_REMOTE_KEY_ID=
-KV_REMOTE_SECRET=
-KV_REMOTE_NAMESPACE=
-
-# Cloudflare API (only needed for CLI provisioning)
-CLOUDFLARE_ACCOUNT_ID=
-CLOUDFLARE_API_TOKEN=
-CLOUDFLARE_KV_NAMESPACE_ID=
-
-
-# ============================================================================
-# HTTP PROXIES (for Workers compatibility)
-# ============================================================================
-
-ZT_PROXY_TIMEOUT_MS=30000
-ZT_PROXY_SIGNING_WINDOW_MS=60000
-
-USE_MYSQL_PROXY=false
-MYSQL_PROXY_URL=
-MYSQL_PROXY_HOST=127.0.0.1
-MYSQL_PROXY_PORT=8789
-MYSQL_PROXY_MAX_BODY_BYTES=131072
-MYSQL_PROXY_POOL_LIMIT=10
-MYSQL_PROXY_KEY_ID=
-MYSQL_PROXY_SECRET=
-MYSQL_PROXY_TIMEOUT_MS=30000
-MYSQL_PROXY_REQUIRE_SIGNING=true
-MYSQL_PROXY_SIGNING_WINDOW_MS=60000
-
-USE_POSTGRES_PROXY=false
-POSTGRES_PROXY_URL=
-POSTGRES_PROXY_HOST=127.0.0.1
-POSTGRES_PROXY_PORT=8790
-POSTGRES_PROXY_MAX_BODY_BYTES=131072
-POSTGRES_PROXY_POOL_LIMIT=10
-POSTGRES_PROXY_KEY_ID=
-POSTGRES_PROXY_SECRET=
-POSTGRES_PROXY_TIMEOUT_MS=30000
-POSTGRES_PROXY_REQUIRE_SIGNING=true
-POSTGRES_PROXY_SIGNING_WINDOW_MS=60000
-
-USE_REDIS_PROXY=false
-REDIS_PROXY_URL=
-REDIS_PROXY_HOST=127.0.0.1
-REDIS_PROXY_PORT=8791
-REDIS_PROXY_MAX_BODY_BYTES=131072
-REDIS_PROXY_KEY_ID=
-REDIS_PROXY_SECRET=
-REDIS_PROXY_TIMEOUT_MS=30000
-REDIS_PROXY_REQUIRE_SIGNING=true
-REDIS_PROXY_SIGNING_WINDOW_MS=60000
-
-USE_SMTP_PROXY=false
-SMTP_PROXY_URL=
-SMTP_PROXY_HOST=127.0.0.1
-SMTP_PROXY_PORT=8794
-SMTP_PROXY_MAX_BODY_BYTES=131072
-SMTP_PROXY_KEY_ID=
-SMTP_PROXY_SECRET=
-SMTP_PROXY_TIMEOUT_MS=30000
-SMTP_PROXY_REQUIRE_SIGNING=true
-SMTP_PROXY_SIGNING_WINDOW_MS=60000
-
-USE_MONGODB_PROXY=false
-MONGODB_PROXY_URL=
-MONGODB_PROXY_HOST=127.0.0.1
-MONGODB_PROXY_PORT=8792
-MONGODB_PROXY_MAX_BODY_BYTES=131072
-MONGODB_PROXY_KEY_ID=
-MONGODB_PROXY_SECRET=
-MONGODB_PROXY_TIMEOUT_MS=30000
-MONGODB_PROXY_REQUIRE_SIGNING=true
-MONGODB_PROXY_SIGNING_WINDOW_MS=60000
-
-USE_SQLSERVER_PROXY=false
-SQLSERVER_PROXY_URL=
-SQLSERVER_PROXY_HOST=127.0.0.1
-SQLSERVER_PROXY_PORT=8793
-SQLSERVER_PROXY_MAX_BODY_BYTES=131072
-SQLSERVER_PROXY_POOL_LIMIT=10
-SQLSERVER_PROXY_KEY_ID=
-SQLSERVER_PROXY_SECRET=
-SQLSERVER_PROXY_TIMEOUT_MS=30000
-SQLSERVER_PROXY_REQUIRE_SIGNING=true
-SQLSERVER_PROXY_SIGNING_WINDOW_MS=60000
-
-
-# ============================================================================
-# CACHE / REDIS
-# ============================================================================
-
-CACHE_DRIVER=memory
-CACHE_CONNECTION=
-CACHE_KEY_PREFIX=zintrust:
-
-CACHE_MEMORY_TTL=3600
-CACHE_REDIS_TTL=3600
-CACHE_MONGO_TTL=3600
-CACHE_KV_TTL=3600
-
-REDIS_HOST=localhost
-REDIS_PORT=6379
-REDIS_PASSWORD=
-REDIS_DB=0
-REDIS_QUEUE_DB=1
-REDIS_URL=
-
-REDIS_HTTPS_ENDPOINT=
-REDIS_HTTPS_TOKEN=
-
-MONGO_URI=
-MONGO_DB=zintrust_cache
-
-
-# ============================================================================
-# QUEUE
-# ============================================================================
-
-# Options: sync | memory | database | redis | rabbitmq | sqs
-QUEUE_DRIVER=sync
-QUEUE_CONNECTION=
-
-QUEUE_TABLE=jobs
-QUEUE_DB_CONNECTION=default
-
-FAILED_JOBS_DB_CONNECTION=default
-FAILED_JOBS_TABLE=failed_jobs
-
-QUEUE_JOB_TIMEOUT=60
-QUEUE_JOB_RETRIES=3
-QUEUE_JOB_BACKOFF=0
-QUEUE_WORKERS=1
-QUEUE_MEMORY_TTL=3600000
-
-QUEUE_MONITOR_ENABLED=false
-QUEUE_MONITOR_BASE_PATH=/queue-monitor
-QUEUE_MONITOR_MIDDLEWARE=
-QUEUE_MONITOR_AUTO_REFRESH=true
-QUEUE_MONITOR_REFRESH_MS=5000
-
-QUEUE_HTTP_PROXY_ENABLED=false
-QUEUE_HTTP_PROXY_GATEWAY_ENABLED=true
-QUEUE_HTTP_PROXY_URL=
-QUEUE_HTTP_PROXY_PATH=/api/_sys/queue/rpc
-QUEUE_HTTP_PROXY_KEY_ID=
-QUEUE_HTTP_PROXY_KEY=
-QUEUE_HTTP_PROXY_TIMEOUT_MS=30000
-QUEUE_HTTP_PROXY_MAX_SKEW_MS=60000
-QUEUE_HTTP_PROXY_NONCE_TTL_MS=120000
-QUEUE_HTTP_PROXY_MIDDLEWARE=
-
-
-# ============================================================================
-# WORKERS / SCHEDULER
-# ============================================================================
-
-WORKER_ENABLED=true
-WORKER_AUTO_START=false
-WORKER_CONCURRENCY=5
-WORKER_TIMEOUT=60
-WORKER_RETRIES=3
-WORKER_PRIORITY=1
-WORKER_HEALTH_CHECK_INTERVAL=60
-WORKER_CLUSTER_MODE=true
-WORKER_REGION=us-east-1
-
-WORKER_PERSISTENCE_DRIVER=memory
-WORKER_PERSISTENCE_TABLE=zintrust_workers
-WORKER_PERSISTENCE_DB_CONNECTION=default
-WORKER_PERSISTENCE_REDIS_DB=
-WORKER_PERSISTENCE_REDIS_KEY_PREFIX=
-
-WORKER_SHUTDOWN_ON_APP_EXIT=true
-
-SCHEDULES_ENABLED=false
-SCHEDULE_SHUTDOWN_TIMEOUT_MS=30000
-
-SCHEDULE_OVERLAP_LOCK_TTL_MS=300000
-SCHEDULE_OVERLAP_LOCK_ACQUIRE_TIMEOUT_MS=2000
-
-SCHEDULE_LEADER_ENABLED=false
-SCHEDULE_LEADER_LOCK_PROVIDER=memory
-SCHEDULE_LEADER_LOCK_KEY=scheduler:leader
-SCHEDULE_LEADER_LOCK_TTL_MS=30000
-SCHEDULE_LEADER_LOCK_RENEW_MS=15000
-SCHEDULE_LEADER_LOCK_RETRY_MS=5000
-SCHEDULE_LEADER_LOCK_ACQUIRE_TIMEOUT_MS=2000
-
-SCHEDULE_HTTP_PROXY_PATH=/api/_sys/schedule/rpc
-SCHEDULE_HTTP_PROXY_KEY_ID=
-SCHEDULE_HTTP_PROXY_KEY=
-SCHEDULE_HTTP_PROXY_MAX_SKEW_MS=60000
-SCHEDULE_HTTP_PROXY_NONCE_TTL_MS=120000
-SCHEDULE_HTTP_PROXY_MIDDLEWARE=
-
-JOB_TRACKING_CLEANUP_ENABLED=false
-JOB_TRACKING_CLEANUP_INTERVAL_MS=21600000
-JOB_TRACKING_CLEANUP_RETENTION_DAYS=30
-JOB_TRACKING_CLEANUP_RETENTION_HOURS=
-JOB_TRACKING_CLEANUP_BATCH_SIZE=5000
-JOB_TRACKING_CLEANUP_MAX_BATCHES=1
-JOB_TRACKING_CLEANUP_LOCK_PROVIDER=memory
-
-
-# ============================================================================
-# SSE
-# ============================================================================
-
-SSE_HEARTBEAT_INTERVAL=15000
-SSE_SNAPSHOT_INTERVAL=5000
-
-
-# ============================================================================
-# LOGGING
-# ============================================================================
-
-LOG_LEVEL=debug
-LOG_FORMAT=text
-LOG_CHANNEL=file
-DISABLE_LOGGING=false
-LOG_HTTP_REQUEST=false
-LOG_TO_FILE=false
-LOG_ROTATION_SIZE=10485760
-LOG_ROTATION_DAYS=7
-DOCKER_WORKER=false
-
-
-# ============================================================================
-# MAIL
-# ============================================================================
-
-MAIL_DRIVER=disabled
-MAIL_CONNECTION=
-MAIL_FROM_ADDRESS=
-MAIL_FROM_NAME=
-MAIL_HOST=
-MAIL_PORT=587
-MAIL_USERNAME=
-MAIL_PASSWORD=
-MAIL_SECURE=starttls
-SENDGRID_API_KEY=
-MAILGUN_API_KEY=
-MAILGUN_DOMAIN=
-MAILGUN_BASE_URL=https://api.mailgun.net
-
-
-# ============================================================================
-# STORAGE
-# ============================================================================
-
-STORAGE_CONNECTION=local
-STORAGE_PATH=storage
-STORAGE_URL=/storage
-STORAGE_VISIBILITY=private
-TEMP_PATH=storage/temp
-TEMP_FILE_MAX_AGE=86400
-MAX_UPLOAD_SIZE=100mb
-ALLOWED_UPLOAD_MIMES=jpg,jpeg,png,pdf,doc,docx
-UPLOADS_PATH=storage/uploads
-BACKUP_DRIVER=s3
-BACKUPS_PATH=storage/backups
-
-AWS_REGION=us-east-1
-AWS_DEFAULT_REGION=
-AWS_ACCESS_KEY_ID=
-AWS_SECRET_ACCESS_KEY=
-AWS_SESSION_TOKEN=
-AWS_S3_BUCKET=
-AWS_S3_ENDPOINT=
-AWS_S3_URL=
-AWS_S3_USE_PATH_STYLE_URL=false
-AWS_SQS_QUEUE_URL=
-
-R2_ACCESS_KEY_ID=
-R2_SECRET_ACCESS_KEY=
-R2_REGION=
-R2_BUCKET=
-R2_ENDPOINT=
-R2_URL=
-R2_BINDING=
-
-GCS_PROJECT_ID=
-GCS_KEY_FILE=
-GCS_BUCKET=
-GCS_URL=
-
-
-# ============================================================================
-# BROADCAST
-# ============================================================================
-
-BROADCAST_CONNECTION=inmemory
-PUSHER_APP_ID=
-PUSHER_APP_KEY=
-PUSHER_APP_SECRET=
-PUSHER_APP_CLUSTER=
-PUSHER_USE_TLS=true
-BROADCAST_REDIS_HOST=
-BROADCAST_REDIS_PORT=
-BROADCAST_REDIS_PASSWORD=
-BROADCAST_CHANNEL_PREFIX=broadcast:
-
-
-# ============================================================================
-# NOTIFICATIONS
-# ============================================================================
-
-NOTIFICATION_CONNECTION=console
-TERMII_API_KEY=
-TERMII_SENDER=ZinTrust
-TERMII_ENDPOINT=https://api.termii.com/sms/send
-TWILIO_ACCOUNT_SID=
-TWILIO_AUTH_TOKEN=
-TWILIO_FROM_NUMBER=
-SLACK_WEBHOOK_URL=
-
-
-# ============================================================================
-# OBSERVABILITY (optional)
-# ============================================================================
-
-OTEL_ENABLED=false
-OTEL_EXPORTER_OTLP_ENDPOINT=
-TRACING_EXPORT_INTERVAL=
-JAEGER_AGENT_HOST=
-
-
-# ============================================================================
-# CI / SCANNING (optional)
-# ============================================================================
-
-SNYK_TOKEN=
-SONAR_ORGANIZATION=
-SONAR_PROJECT_ID=
-SONAR_HOST_URL=
-SONAR_TOKEN=
-CODECOV_TOKEN=