@zintrust/core 0.4.17 → 0.4.19

package/src/cli/commands/PluginCommand.js

@@ -0,0 +1,98 @@
+/**
+ * Plugin Command
+ * Manage framework plugins (install, uninstall, list)
+ */
+import { BaseCommand } from '../BaseCommand.js';
+import { Logger } from '../../config/logger.js';
+import { PluginManager } from '../../runtime/PluginManager.js';
+export const PluginCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'plugin',
+            description: 'Manage framework plugins',
+            addOptions: (command) => {
+                command.alias('p');
+                // Options for short syntax (zin p -i a:sqlite)
+                command.option('-i, --install <pluginId>', 'Install a plugin');
+                command.option('-u, --uninstall <pluginId>', 'Uninstall a plugin');
+                command.option('-l, --list', 'List available plugins');
+                command
+                    .command('list')
+                    .alias('ls')
+                    .description('List available plugins')
+                    .action(async () => {
+                    await listPlugins();
+                });
+                command
+                    .command('install <pluginId>')
+                    .alias('i')
+                    .description('Install a plugin')
+                    .option('--package-manager <pm>', 'Specify package manager to use (npm|yarn|pnpm)')
+                    .action(async (pluginId, options) => {
+                    await installPlugin(pluginId, options);
+                });
+                command
+                    .command('uninstall <pluginId>')
+                    .alias('un')
+                    .description('Uninstall a plugin')
+                    .action(async (pluginId) => {
+                    await uninstallPlugin(pluginId);
+                });
+            },
+            execute: async (options) => {
+                const installId = options['install'];
+                const uninstallId = options['uninstall'];
+                const shouldList = options['list'];
+                if (typeof installId === 'string' && installId.length > 0) {
+                    await installPlugin(installId);
+                }
+                else if (typeof uninstallId === 'string' && uninstallId.length > 0) {
+                    await uninstallPlugin(uninstallId);
+                }
+                else if (shouldList === true) {
+                    await listPlugins();
+                }
+                else {
+                    Logger.info('Use "plugin list", "plugin install <id>", or "plugin uninstall <id>"');
+                    Logger.info('Shortcuts: "zin p -l", "zin p -i <id>", "zin p -u <id>"');
+                }
+            },
+        });
+    },
+});
+async function listPlugins() {
+    const plugins = PluginManager.list();
+    Logger.info('Available Plugins:');
+    const pluginEntries = Object.entries(plugins);
+    const installedStatuses = await Promise.all(pluginEntries.map(async ([id]) => PluginManager.isInstalled(id)));
+    for (let i = 0; i < pluginEntries.length; i++) {
+        const [id, plugin] = pluginEntries[i];
+        const isInstalled = installedStatuses[i] ?? false;
+        const status = isInstalled ? '✓ Installed' : '- Available';
+        const aliases = plugin.aliases !== undefined && plugin.aliases.length > 0
+            ? `(aliases: ${plugin.aliases.join(', ')})`
+            : '';
+        Logger.info(`  ${id.padEnd(20)} ${status.padEnd(15)} ${plugin.description} ${aliases}`);
+    }
+}
+async function installPlugin(pluginId, options) {
+    try {
+        const pm = typeof options?.['packageManager'] === 'string'
+            ? String(options?.['packageManager'])
+            : undefined;
+        await PluginManager.install(pluginId, { packageManager: pm });
+    }
+    catch (error) {
+        Logger.error(`Failed to install plugin ${pluginId}`, error);
+        process.exit(1);
+    }
+}
+async function uninstallPlugin(pluginId) {
+    try {
+        await PluginManager.uninstall(pluginId);
+    }
+    catch (error) {
+        Logger.error(`Failed to uninstall plugin ${pluginId}`, error);
+        process.exit(1);
+    }
+}

package/src/cli/commands/PostgresProxyCommand.d.ts

@@ -0,0 +1,6 @@
+import type { IBaseCommand } from '../BaseCommand';
+export declare const PostgresProxyCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+export default PostgresProxyCommand;
+//# sourceMappingURL=PostgresProxyCommand.d.ts.map

package/src/cli/commands/PostgresProxyCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresProxyCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PostgresProxyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0BrE,eAAO,MAAM,oBAAoB;cACrB,YAAY;EAatB,CAAC;AAEH,eAAe,oBAAoB,CAAC"}

package/src/cli/commands/PostgresProxyCommand.js

@@ -0,0 +1,32 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { addSqlProxyOptions, runSqlProxyCommand, } from '../commands/SqlProxyCommandUtils.js';
+import { Env } from '../../config/env.js';
+import { PostgresProxyServer } from '../../proxy/postgres/PostgresProxyServer.js';
+const addOptions = (command) => {
+    addSqlProxyOptions(command, {
+        hostDefault: Env.POSTGRES_PROXY_HOST,
+        portDefault: Env.POSTGRES_PROXY_PORT,
+        maxBodyBytesDefault: Env.POSTGRES_PROXY_MAX_BODY_BYTES,
+        dbVendorLabel: 'PostgreSQL',
+        requireSigningDefault: Env.POSTGRES_PROXY_REQUIRE_SIGNING,
+        keyIdDefault: Env.POSTGRES_PROXY_KEY_ID,
+        secretDefault: Env.POSTGRES_PROXY_SECRET,
+        signingWindowMsDefault: Env.POSTGRES_PROXY_SIGNING_WINDOW_MS,
+    });
+};
+export const PostgresProxyCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'proxy:postgres',
+            aliases: ['postgres:proxy', 'postgres-proxy', 'proxy:pg', 'pg:proxy', 'pg-proxy'],
+            description: 'Start the PostgreSQL HTTP proxy for Cloudflare Workers',
+            addOptions,
+            execute: async (options) => {
+                await runSqlProxyCommand(options, async (input) => {
+                    await PostgresProxyServer.start(input);
+                });
+            },
+        });
+    },
+});
+export default PostgresProxyCommand;

package/src/cli/commands/PrepareCommand.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Prepare Command
+ * Makes the local dist/ folder installable via `file:/.../dist`.
+ * Usage: zintrust prepare
+ */
+import type { IBaseCommand } from '../BaseCommand';
+export declare const PrepareCommand: IBaseCommand;
+//# sourceMappingURL=PrepareCommand.d.ts.map

package/src/cli/commands/PrepareCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PrepareCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PrepareCommand.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAerD,eAAO,MAAM,cAAc,EA2CtB,YAAY,CAAC"}

package/src/cli/commands/PrepareCommand.js

@@ -0,0 +1,51 @@
+/**
+ * Prepare Command
+ * Makes the local dist/ folder installable via `file:/.../dist`.
+ * Usage: zintrust prepare
+ */
+import { DistPackager } from '../utils/DistPackager.js';
+import { SpawnUtil } from '../utils/spawn.js';
+import { resolveNpmPath } from '../../common/index.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import * as path from '../../node-singletons/path.js';
+import chalk from 'chalk';
+import { Command } from 'commander';
+export const PrepareCommand = {
+    name: 'prepare',
+    description: 'Prepare local dist/ for file: installs (simulate/fresh install workflow)',
+    getCommand() {
+        return new Command('prepare')
+            .description('Prepare local dist/ so it can be installed via file:/.../dist')
+            .option('--dist <path>', 'Dist folder path (default: ./dist)')
+            .option('--link', 'Also run `npm link` to expose zintrust/zin/z/zt on PATH (dev-only)')
+            .action(async (options) => {
+            try {
+                const distRel = typeof options.dist === 'string' && options.dist.trim() !== '' ? options.dist : 'dist';
+                const distPath = path.resolve(process.cwd(), distRel);
+                DistPackager.prepare(distPath, process.cwd());
+                Logger.info(chalk.green('✅ Dist prepared.'));
+                Logger.info('Docs roots:');
+                Logger.info(`- Production/new apps: ${chalk.cyan('dist/public')}`);
+                Logger.info(`- Framework dev:      ${chalk.cyan('docs-website/public')}`);
+                if (options.link === true) {
+                    Logger.info(chalk.bold('\nLinking CLI globally (npm link)...'));
+                    const npm = resolveNpmPath();
+                    const exitCode = await SpawnUtil.spawnAndWait({
+                        command: npm,
+                        args: ['link'],
+                        cwd: process.cwd(),
+                    });
+                    if (exitCode !== 0) {
+                        throw ErrorFactory.createCliError(`npm link exited with code ${exitCode}`);
+                    }
+                    Logger.info(chalk.green('✅ Linked. You can now run `zintrust` from your shell.'));
+                }
+            }
+            catch (error) {
+                Logger.error('Failed to prepare dist', error);
+                throw ErrorFactory.createCliError('Prepare failed', error);
+            }
+        });
+    },
+};

package/src/cli/commands/ProxyCommand.d.ts

@@ -0,0 +1,12 @@
+import type { IBaseCommand } from '../BaseCommand';
+import '../../proxy/d1/register';
+import '../../proxy/kv/register';
+import '../../proxy/mysql/register';
+import '../../proxy/postgres/register';
+import '../../proxy/redis/register';
+import '../../proxy/smtp/register';
+export declare const ProxyCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+export default ProxyCommand;
+//# sourceMappingURL=ProxyCommand.d.ts.map

package/src/cli/commands/ProxyCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/ProxyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrE,OAAO,oBAAoB,CAAC;AAC5B,OAAO,oBAAoB,CAAC;AAC5B,OAAO,uBAAuB,CAAC;AAC/B,OAAO,0BAA0B,CAAC;AAClC,OAAO,uBAAuB,CAAC;AAC/B,OAAO,sBAAsB,CAAC;AAyD9B,eAAO,MAAM,YAAY;cACb,YAAY;EAyBtB,CAAC;AAEH,eAAe,YAAY,CAAC"}

package/src/cli/commands/ProxyCommand.js

@@ -0,0 +1,80 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { SpawnUtil } from '../utils/spawn.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import * as path from '../../node-singletons/path.js';
+import { ProxyRegistry } from '../../proxy/ProxyRegistry.js';
+import '../../proxy/d1/register.js';
+import '../../proxy/kv/register.js';
+import '../../proxy/mysql/register.js';
+import '../../proxy/postgres/register.js';
+import '../../proxy/redis/register.js';
+import '../../proxy/smtp/register.js';
+const PROXY_TARGET_MAP = Object.freeze({
+    mysql: 'proxy:mysql',
+    my: 'proxy:mysql',
+    postgres: 'proxy:postgres',
+    postgresql: 'proxy:postgres',
+    pg: 'proxy:postgres',
+    redis: 'proxy:redis',
+    smtp: 'proxy:smtp',
+    mail: 'proxy:smtp',
+    mongodb: 'proxy:mongodb',
+    mongo: 'proxy:mongodb',
+    sqlserver: 'proxy:sqlserver',
+    mssql: 'proxy:sqlserver',
+});
+const addOptions = (command) => {
+    command.argument('[target]', 'Proxy target (e.g. postgres, mysql, redis, smtp)');
+};
+const parseForwardArgs = () => {
+    const argv = process.argv.slice(2);
+    const proxyIndex = argv.indexOf('proxy');
+    if (proxyIndex < 0) {
+        return { target: null, extra: [] };
+    }
+    const target = argv[proxyIndex + 1] ?? null;
+    const extra = argv.slice(proxyIndex + 2);
+    return { target, extra };
+};
+const dispatchProxyTarget = async (targetRaw) => {
+    const target = targetRaw.trim().toLowerCase();
+    const mapped = PROXY_TARGET_MAP[target];
+    if (!mapped) {
+        throw ErrorFactory.createCliError(`Unknown proxy target '${targetRaw}'. Use one of: ${Object.keys(PROXY_TARGET_MAP).join(', ')}`);
+    }
+    const { extra } = parseForwardArgs();
+    const exitCode = await SpawnUtil.spawnAndWait({
+        command: 'tsx',
+        args: [path.join('bin', 'zin.ts'), mapped, ...extra],
+        env: {
+            ...process.env,
+        },
+        forwardSignals: false,
+    });
+    process.exit(exitCode);
+};
+export const ProxyCommand = Object.freeze({
+    create() {
+        const cmd = BaseCommand.create({
+            name: 'proxy',
+            description: 'List available proxy servers',
+            addOptions,
+            execute: async (options) => {
+                const firstArg = Array.isArray(options.args) ? options.args[0] : undefined;
+                if (typeof firstArg === 'string' && firstArg.trim() !== '') {
+                    await dispatchProxyTarget(firstArg);
+                    return;
+                }
+                const list = ProxyRegistry.list();
+                if (list.length === 0) {
+                    throw ErrorFactory.createCliError('No proxies registered');
+                }
+                for (const proxy of list) {
+                    cmd.info(`${proxy.name}: ${proxy.description}`);
+                }
+            },
+        });
+        return cmd;
+    },
+});
+export default ProxyCommand;

package/src/cli/commands/ProxyCommandUtils.d.ts

@@ -0,0 +1,6 @@
+type NumberExpectation = 'positive' | 'non-negative';
+export declare const parseIntOption: (raw: string | undefined, name: string, expectation?: NumberExpectation) => number | undefined;
+export declare const trimOption: (value: string | undefined) => string | undefined;
+export declare const maybeRunProxyWatchMode: (watch: boolean | undefined) => Promise<void>;
+export {};
+//# sourceMappingURL=ProxyCommandUtils.d.ts.map

package/src/cli/commands/ProxyCommandUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyCommandUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/ProxyCommandUtils.ts"],"names":[],"mappings":"AAIA,KAAK,iBAAiB,GAAG,UAAU,GAAG,cAAc,CAAC;AAErD,eAAO,MAAM,cAAc,GACzB,KAAK,MAAM,GAAG,SAAS,EACvB,MAAM,MAAM,EACZ,cAAa,iBAA8B,KAC1C,MAAM,GAAG,SAeX,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAA0B,CAAC;AAU3F,eAAO,MAAM,sBAAsB,GAAU,OAAO,OAAO,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAerF,CAAC"}

package/src/cli/commands/ProxyCommandUtils.js

@@ -0,0 +1,38 @@
+import { SpawnUtil } from '../utils/spawn.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import * as path from '../../node-singletons/path.js';
+export const parseIntOption = (raw, name, expectation = 'positive') => {
+    if (raw === undefined)
+        return undefined;
+    const parsed = Number.parseInt(raw, 10);
+    const isValid = expectation === 'non-negative'
+        ? Number.isFinite(parsed) && parsed >= 0
+        : Number.isFinite(parsed) && parsed > 0;
+    if (!isValid) {
+        const expected = expectation === 'non-negative' ? 'a non-negative number' : 'a positive number';
+        throw ErrorFactory.createCliError(`Invalid --${name} '${raw}'. Expected ${expected}.`);
+    }
+    return parsed;
+};
+export const trimOption = (value) => value?.trim();
+const isWatchChild = () => process.env['ZINTRUST_PROXY_WATCH_CHILD'] === '1';
+const buildWatchArgs = () => {
+    const rawArgs = process.argv.slice(2);
+    const filtered = rawArgs.filter((arg) => arg !== '--watch');
+    return ['watch', path.join('bin', 'zin.ts'), ...filtered];
+};
+export const maybeRunProxyWatchMode = async (watch) => {
+    if (watch !== true || isWatchChild())
+        return;
+    const args = buildWatchArgs();
+    const exitCode = await SpawnUtil.spawnAndWait({
+        command: 'tsx',
+        args,
+        env: {
+            ...process.env,
+            ZINTRUST_PROXY_WATCH_CHILD: '1',
+        },
+        forwardSignals: false,
+    });
+    process.exit(exitCode);
+};

package/src/cli/commands/PublishCommand.d.ts

@@ -0,0 +1,5 @@
+import { type IBaseCommand } from '../BaseCommand';
+export declare const PublishCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+//# sourceMappingURL=PublishCommand.d.ts.map

package/src/cli/commands/PublishCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublishCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PublishCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0DlE,eAAO,MAAM,cAAc;cACf,YAAY;EAmBtB,CAAC"}

package/src/cli/commands/PublishCommand.js

@@ -0,0 +1,54 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import fs from '../../node-singletons/fs.js';
+import path from '../../node-singletons/path.js';
+const publishQueueMonitorConfig = (cwd) => {
+    const targetPath = path.join(cwd, 'config', 'queueMonitor.ts');
+    if (fs.existsSync(targetPath)) {
+        Logger.warn('Configuration file already exists: config/queueMonitor.ts');
+        return;
+    }
+    // 1. Try resolving through node_modules (production usage)
+    const nodeModulesPath = path.join(cwd, 'node_modules', '@zintrust', 'queue-monitor', 'src', 'config', 'queueMonitor.ts');
+    // 2. Fallback for monorepo development (local usage)
+    const monorepoPath = path.join(cwd, 'packages', 'queue-monitor', 'src', 'config', 'queueMonitor.ts');
+    let sourcePath = '';
+    if (fs.existsSync(nodeModulesPath)) {
+        sourcePath = nodeModulesPath;
+    }
+    else if (fs.existsSync(monorepoPath)) {
+        sourcePath = monorepoPath;
+    }
+    else {
+        throw ErrorFactory.createCliError(`Could not locate source configuration file. Ensure @zintrust/queue-monitor is installed.`);
+    }
+    // Ensure config directory exists
+    const configDir = path.dirname(targetPath);
+    if (!fs.existsSync(configDir)) {
+        fs.mkdirSync(configDir, { recursive: true });
+    }
+    fs.copyFileSync(sourcePath, targetPath);
+    Logger.info('Published configuration: config/queueMonitor.ts');
+};
+export const PublishCommand = Object.freeze({
+    create() {
+        return BaseCommand.create({
+            name: 'publish:config',
+            description: 'Publish configuration files from packages to your project',
+            aliases: ['p:config'],
+            addOptions: (command) => {
+                command.option('--queue-monitor', 'Publish Queue Monitor configuration');
+            },
+            execute: async (options) => {
+                const cwd = process.cwd();
+                if (options['queueMonitor'] !== undefined && options['queueMonitor'] !== null) {
+                    await publishQueueMonitorConfig(cwd); //NOSONAR
+                }
+                else {
+                    Logger.warn('Please specify a configuration to publish (e.g., --queue-monitor)');
+                }
+            },
+        });
+    },
+});

package/src/cli/commands/PutCommand.d.ts

@@ -0,0 +1,6 @@
+import { type IBaseCommand } from '../BaseCommand';
+export declare const PutCommand: Readonly<{
+    create(): IBaseCommand;
+}>;
+export default PutCommand;
+//# sourceMappingURL=PutCommand.d.ts.map

package/src/cli/commands/PutCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0OvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/cli/commands/PutCommand.js

@@ -0,0 +1,183 @@
+import { BaseCommand } from '../BaseCommand.js';
+import { resolveNpmPath } from '../../common/index.js';
+import { appConfig } from '../../config/app.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { execFileSync } from '../../node-singletons/child-process.js';
+import { existsSync, readFileSync } from '../../node-singletons/fs.js';
+import * as path from '../../node-singletons/path.js';
+import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
+const toStringArray = (value) => {
+    if (typeof value === 'string')
+        return [value];
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === 'string');
+};
+const uniq = (items) => {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+};
+const readZintrustConfig = (cwd) => {
+    const filePath = path.join(cwd, '.zintrust.json');
+    if (!existsSync(filePath)) {
+        return {};
+    }
+    try {
+        const raw = readFileSync(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return typeof parsed === 'object' && parsed !== null ? parsed : {};
+    }
+    catch (error) {
+        throw ErrorFactory.createCliError('Failed to parse .zintrust.json', error);
+    }
+};
+const getConfigArray = (config, key) => {
+    const raw = config[key];
+    if (!Array.isArray(raw))
+        return [];
+    return uniq(raw.filter((item) => typeof item === 'string'));
+};
+const resolveConfigGroups = (options) => {
+    return uniq(toStringArray(options.var));
+};
+const resolveWranglerEnvs = (options) => {
+    const requested = uniq(toStringArray(options.wg));
+    if (requested.length === 0)
+        return ['worker'];
+    return requested;
+};
+const parseEnvPath = (options) => {
+    const direct = options['env_path'];
+    if (typeof direct === 'string' && direct.trim() !== '')
+        return direct;
+    return '.env';
+};
+const resolveValue = (key, envMap) => {
+    const fromFile = envMap[key];
+    const fromProcess = process.env[key];
+    return fromFile ?? fromProcess ?? '';
+};
+const getPutTimeoutMs = () => {
+    const raw = process.env['ZT_PUT_TIMEOUT_MS'];
+    if (typeof raw !== 'string')
+        return 120000;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return 120000;
+    return parsed;
+};
+const putSecret = (wranglerEnv, key, value, configPath) => {
+    const npmPath = resolveNpmPath();
+    const args = ['exec', '--yes', '--', 'wrangler'];
+    if (typeof configPath === 'string' && configPath.trim().length > 0) {
+        args.push('--config', configPath.trim());
+    }
+    args.push('secret', 'put', key, '--env', wranglerEnv);
+    execFileSync(npmPath, args, {
+        stdio: ['pipe', 'inherit', 'inherit'],
+        input: value,
+        encoding: 'utf8',
+        timeout: getPutTimeoutMs(),
+        killSignal: 'SIGTERM',
+        env: appConfig.getSafeEnv(),
+    });
+};
+const addOptions = (command) => {
+    command
+        .argument('[provider]', 'Secret provider (cloudflare)', 'cloudflare')
+        .option('--wg <env...>', 'Wrangler environment target(s), e.g. d1-proxy kv-proxy')
+        .option('--var <configKey...>', 'Config array key(s) from .zintrust.json (e.g. d1_env kv_env)')
+        .option('--env_path <path>', 'Path to env file used as source values', '.env')
+        .option('-c, --config <path>', 'Wrangler config file to target (optional)')
+        .option('--dry-run', 'Show what would be uploaded without calling wrangler');
+};
+const ensureCloudflareProvider = (providerRaw) => {
+    if (providerRaw.toLowerCase() === 'cloudflare')
+        return;
+    throw ErrorFactory.createCliError('Only cloudflare provider is supported for `zin put`');
+};
+const resolveSelectedKeys = (cmd, config, options) => {
+    const configGroups = resolveConfigGroups(options);
+    if (configGroups.length === 0) {
+        throw ErrorFactory.createCliError('No config groups selected. Use --var <group>.');
+    }
+    const selectedKeys = uniq(configGroups.flatMap((groupKey) => {
+        const keys = getConfigArray(config, groupKey);
+        if (keys.length === 0) {
+            cmd.warn(`Group \`${groupKey}\` is missing or empty in .zintrust.json`);
+        }
+        return keys;
+    }));
+    if (selectedKeys.length === 0) {
+        throw ErrorFactory.createCliError('No secret keys resolved from selected groups.');
+    }
+    return selectedKeys;
+};
+const getFailureReason = (error) => error instanceof Error ? error.message : String(error);
+const reportResult = (cmd, pushed, failures) => {
+    cmd.success(`Cloudflare secrets report: pushed=${pushed}, failed=${failures.length}`);
+    for (const item of failures) {
+        cmd.warn(`${item.key} -> ${item.wranglerEnv}: ${item.reason}`);
+    }
+};
+const processPut = (cmd, wranglerEnvs, selectedKeys, envMap, dryRun, configPath) => {
+    let pushed = 0;
+    const failures = [];
+    for (const wranglerEnv of wranglerEnvs) {
+        for (const key of selectedKeys) {
+            const value = resolveValue(key, envMap);
+            if (value.trim() === '') {
+                failures.push({ wranglerEnv, key, reason: 'empty value' });
+                continue;
+            }
+            try {
+                if (!dryRun) {
+                    cmd.info(`putting ${key} -> ${wranglerEnv}...`);
+                    putSecret(wranglerEnv, key, value, configPath);
+                }
+                pushed += 1;
+                cmd.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnv}`);
+            }
+            catch (error) {
+                failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
+            }
+        }
+    }
+    return { pushed, failures };
+};
+const execute = async (cmd, options) => {
+    ensureCloudflareProvider(String(options.args?.[0] ?? 'cloudflare'));
+    const cwd = process.cwd();
+    const config = readZintrustConfig(cwd);
+    const selectedKeys = resolveSelectedKeys(cmd, config, options);
+    const envFilePath = parseEnvPath(options);
+    const envMap = await EnvFile.read({ cwd, path: envFilePath });
+    const wranglerEnvs = resolveWranglerEnvs(options);
+    const dryRun = options.dryRun === true;
+    const configPath = typeof options.config === 'string' ? options.config.trim() : '';
+    if (configPath !== '' && !existsSync(path.join(cwd, configPath))) {
+        throw ErrorFactory.createCliError(`Wrangler config not found: ${configPath}`);
+    }
+    const result = processPut(cmd, wranglerEnvs, selectedKeys, envMap, dryRun, configPath === '' ? undefined : configPath);
+    reportResult(cmd, result.pushed, result.failures);
+};
+export const PutCommand = Object.freeze({
+    create() {
+        const cmd = BaseCommand.create({
+            name: 'put',
+            description: 'Put secrets to Cloudflare with dynamic groups from .zintrust.json',
+            addOptions,
+            execute: async (options) => execute(cmd, options),
+        });
+        return cmd;
+    },
+});
+export default PutCommand;

package/src/cli/commands/QACommand.d.ts

@@ -0,0 +1,33 @@
+/**
+ * QA Command - Unified Quality Assurance
+ * Runs linting, type-checking, tests, and SonarQube
+ */
+import type { CommandOptions, IBaseCommand } from '../BaseCommand';
+import type { Command } from 'commander';
+/**
+ * QA Result interface
+ */
+interface QAResult {
+    status: 'pending' | 'passed' | 'failed' | 'skipped';
+    output: string;
+}
+interface QAResults {
+    lint: QAResult;
+    typeCheck: QAResult;
+    tests: QAResult;
+    sonar: QAResult;
+}
+interface IQACommand extends IBaseCommand {
+    addOptions(command: Command): void;
+    runLint(result: QAResult): Promise<void>;
+    runTypeCheck(result: QAResult): Promise<void>;
+    runTests(result: QAResult): Promise<void>;
+    runSonar(result: QAResult, options: CommandOptions): void;
+    generateReport(results: QAResults): Promise<void>;
+}
+/**
+ * QA Command Factory - Create a new QA command instance
+ */
+export declare const QACommand: () => IQACommand;
+export {};
+//# sourceMappingURL=QACommand.d.ts.map

package/src/cli/commands/QACommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QACommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/QACommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAQrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC;;GAEG;AACH,UAAU,QAAQ;IAChB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,SAAS;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,QAAQ,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,EAAE,QAAQ,CAAC;CACjB;AAiaD,UAAU,UAAW,SAAQ,YAAY;IACvC,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC1D,cAAc,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAgFD;;GAEG;AACH,eAAO,MAAM,SAAS,QAAO,UAe5B,CAAC"}