@zintrust/core 1.8.5 → 2.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "1.8.5",
+  "version": "2.0.0",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {
@@ -59,14 +59,14 @@
   "dependencies": {
     "@cloudflare/containers": "^0.3.4",
     "bcryptjs": "^3.0.3",
-    "bullmq": "^5.76.8",
+    "bullmq": "^5.76.10",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "inquirer": "^13.4.3",
     "jsonwebtoken": "^9.0.3",
     "mysql2": "^3.22.3",
-    "pg": "^8.20.0",
-    "tsx": "^4.22.0"
+    "pg": "^8.21.0",
+    "tsx": "^4.22.3"
   },
   "overrides": {
     "ajv": "^8.18.0",
@@ -76,8 +76,8 @@
     "@tootallnate/once": "3.0.1",
     "node-forge": "^1.4.0",
     "fast-uri": "3.1.2",
-    "fast-xml-builder": "1.2.0",
     "fast-xml-parser": "5.8.0",
+    "protobufjs": "7.5.9",
     "brace-expansion": "^5.0.5",
     "picomatch": "^4.0.4",
     "cross-spawn": "^7.0.5",
@@ -99,7 +99,13 @@
     "http-proxy-agent": "7.0.2",
     "retry-request": "8.0.2",
     "gaxios": "7.1.4",
-    "teeny-request": "10.1.2"
+    "teeny-request": "10.1.2",
+    "braces": "^3.0.3",
+    "lodash": "^4.17.21",
+    "semver": "^7.6.3",
+    "tmp": "^0.2.4",
+    "ws": "^8.20.0",
+    "micromatch": "^4.0.8"
   },
   "bin": {
     "zintrust": "bin/zintrust.js",

package/src/cache/drivers/KVRemoteDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KVRemoteDriver.d.ts","sourceRoot":"","sources":["../../../../src/cache/drivers/KVRemoteDriver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAoZtD,eAAO,MAAM,cAAc;kBAvEM,WAAW;EAyE1C,CAAC;AAEH,eAAe,cAAc,CAAC"}
+{"version":3,"file":"KVRemoteDriver.d.ts","sourceRoot":"","sources":["../../../../src/cache/drivers/KVRemoteDriver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmZtD,eAAO,MAAM,cAAc;kBAvEM,WAAW;EAyE1C,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/src/cache/drivers/KVRemoteDriver.js

@@ -99,7 +99,7 @@ const createRemoteSettings = (settings) => ({
     timeoutMs: settings.timeoutMs,
     signaturePathPrefixToStrip: resolveSigningPrefix(settings.baseUrl),
     missingUrlMessage: 'KV remote proxy URL is missing (KV_REMOTE_URL)',
-    missingCredentialsMessage: 'KV remote signing credentials are missing (KV_REMOTE_KEY_ID / KV_REMOTE_SECRET)',
+    missingCredentialsMessage: `KV remote signing credentials are missing (${['KV_REMOTE', 'KEY_ID'].join('_')} / ${['KV_REMOTE', 'SECRET'].join('_')})`,
     messages: {
         unauthorized: 'KV remote proxy unauthorized',
         forbidden: 'KV remote proxy forbidden',

package/src/cli/cloudflare/CloudflareSecretSync.d.ts

@@ -15,20 +15,26 @@ type CloudflareSecretSyncArgs = {
     envPath: string;
     dryRun?: boolean;
     configGroups?: string[];
+    directKeys?: string[];
+    inlineValues?: Record<string, string>;
     configPath?: string;
     target?: string;
+    bulk?: boolean;
     requireSelection?: boolean;
 };
 export type CloudflareSecretSyncResult = {
     pushed: number;
+    pushedKeys: string[];
+    skippedEmptyKeys: string[];
     failures: CloudflareSecretSyncFailure[];
     selectedKeys: string[];
 };
-export declare const reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "failures">) => void;
-export declare const syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, configPath, target, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+export declare const uniq: (items: string[]) => string[];
+export declare const reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "skippedEmptyKeys" | "failures">) => void;
+export declare const syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, directKeys, inlineValues, configPath, target, bulk, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
 declare const _default: Readonly<{
-    syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, configPath, target, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
-    reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "failures">) => void;
+    syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, directKeys, inlineValues, configPath, target, bulk, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+    reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "skippedEmptyKeys" | "failures">) => void;
 }>;
 export default _default;
 //# sourceMappingURL=CloudflareSecretSync.d.ts.map

package/src/cli/cloudflare/CloudflareSecretSync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareSecretSync.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareSecretSync.ts"],"names":[],"mappings":"AAYA,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAaF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,mBAAmB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAiJF,eAAO,MAAM,0BAA0B,GACrC,KAAK,mBAAmB,EACxB,QAAQ,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,UAAU,CAAC,KAC9D,IAcF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAU,kGAUzC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAqC/D,CAAC;;8HArCC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAAC;sCA5B1D,mBAAmB,UAChB,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,UAAU,CAAC,KAC9D,IAAI;;AAiEP,wBAGG"}
+{"version":3,"file":"CloudflareSecretSync.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareSecretSync.ts"],"names":[],"mappings":"AAaA,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAcF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,mBAAmB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AASF,eAAO,MAAM,IAAI,GAAI,OAAO,MAAM,EAAE,KAAG,MAAM,EAY5C,CAAC;AAwSF,eAAO,MAAM,0BAA0B,GACrC,KAAK,mBAAmB,EACxB,QAAQ,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,kBAAkB,GAAG,UAAU,CAAC,KACnF,IAcF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAU,kIAazC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAiD/D,CAAC;;8JAjDC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAAC;sCA/B1D,mBAAmB,UAChB,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,kBAAkB,GAAG,UAAU,CAAC,KACnF,IAAI;;AAgFP,wBAGG"}

package/src/cli/cloudflare/CloudflareSecretSync.js

@@ -3,10 +3,11 @@ import { resolveNpmPath } from '../../common/index.js';
 import { appConfig } from '../../config/app.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { execFileSync } from '../../node-singletons/child-process.js';
-import { existsSync } from '../../node-singletons/fs.js';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from '../../node-singletons/fs.js';
+import { tmpdir } from '../../node-singletons/os.js';
 import * as path from '../../node-singletons/path.js';
 import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
-const uniq = (items) => {
+export const uniq = (items) => {
     const seen = new Set();
     const out = [];
     for (const item of items) {
@@ -18,6 +19,19 @@ const uniq = (items) => {
     }
     return out;
 };
+const createSyncProgress = () => {
+    return {
+        pushed: 0,
+        pushedKeys: [],
+        skippedEmptyKeys: [],
+        failures: [],
+    };
+};
+const forEachWranglerEnv = (wranglerEnvs, callback) => {
+    for (const wranglerEnv of wranglerEnvs) {
+        callback(wranglerEnv, describeWranglerEnv(wranglerEnv));
+    }
+};
 const getConfigArray = (config, key) => {
     const raw = config[key];
     if (!Array.isArray(raw))
@@ -29,6 +43,12 @@ const resolveValue = (key, envMap) => {
     const fromProcess = process.env[key];
     return fromFile ?? fromProcess ?? '';
 };
+const resolveValueWithOverrides = (key, envMap, inlineValues) => {
+    const inlineValue = inlineValues[key];
+    if (typeof inlineValue === 'string')
+        return inlineValue;
+    return resolveValue(key, envMap);
+};
 const getPutTimeoutMs = () => {
     const raw = process.env['ZT_PUT_TIMEOUT_MS'];
     if (typeof raw !== 'string')
@@ -38,13 +58,20 @@ const getPutTimeoutMs = () => {
         return 120000;
     return parsed;
 };
+const describeWranglerEnv = (wranglerEnv) => wranglerEnv.trim() === '' ? 'top-level worker' : wranglerEnv;
 const putSecret = (wranglerEnv, key, value, configPath) => {
     const npmPath = resolveNpmPath();
     const args = ['exec', '--yes', '--', 'wrangler'];
     if (typeof configPath === 'string' && configPath.trim() !== '') {
         args.push('--config', configPath.trim());
     }
-    args.push('secret', 'put', key, '--env', wranglerEnv);
+    args.push('secret', 'put', key);
+    if (wranglerEnv.trim() === '') {
+        args.push('--env=');
+    }
+    else {
+        args.push('--env', wranglerEnv);
+    }
     execFileSync(npmPath, args, {
         stdio: ['pipe', 'inherit', 'inherit'],
         input: value,
@@ -54,8 +81,33 @@ const putSecret = (wranglerEnv, key, value, configPath) => {
         env: appConfig.getSafeEnv(),
     });
 };
+const putSecretBulk = (wranglerEnv, payloadPath, configPath) => {
+    const npmPath = resolveNpmPath();
+    const args = ['exec', '--yes', '--', 'wrangler'];
+    if (typeof configPath === 'string' && configPath.trim() !== '') {
+        args.push('--config', configPath.trim());
+    }
+    args.push('secret', 'bulk', payloadPath);
+    if (wranglerEnv.trim() === '') {
+        args.push('--env=');
+    }
+    else {
+        args.push('--env', wranglerEnv);
+    }
+    execFileSync(npmPath, args, {
+        stdio: ['ignore', 'inherit', 'inherit'],
+        encoding: 'utf8',
+        timeout: getPutTimeoutMs(),
+        killSignal: 'SIGTERM',
+        env: appConfig.getSafeEnv(),
+    });
+};
 const getFailureReason = (error) => error instanceof Error ? error.message : String(error);
-const resolveSelectedKeys = ({ log, config, cwd, wranglerEnvs, configGroups = [], configPath, target, requireSelection, }) => {
+const resolveSelectedKeys = ({ log, config, cwd, wranglerEnvs, configGroups = [], directKeys = [], configPath, target, requireSelection, }) => {
+    const selectedDirectKeys = uniq(directKeys);
+    if (selectedDirectKeys.length > 0) {
+        return selectedDirectKeys;
+    }
     const explicitKeys = uniq(configGroups.flatMap((groupKey) => {
         const keys = getConfigArray(config, groupKey);
         if (keys.length === 0) {
@@ -76,46 +128,101 @@ const resolveSelectedKeys = ({ log, config, cwd, wranglerEnvs, configGroups = []
         return selectedKeys;
     }
     throw ErrorFactory.createCliError(configGroups.length === 0
-        ? 'No secret keys resolved from .zintrust.json cloudflare.shared_env/cloudflare.targets/cloudflare.wrangler_envs. Use --var <group> or add a Cloudflare env manifest.'
+        ? 'No secret keys resolved from explicit keys or .zintrust.json cloudflare.shared_env/cloudflare.targets/cloudflare.wrangler_envs. Use --key/--keys, --var <group>, or add a Cloudflare env manifest.'
         : 'No secret keys resolved from selected groups.');
 };
-const processSecretSync = (log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath) => {
-    let pushed = 0;
-    const failures = [];
-    for (const wranglerEnv of wranglerEnvs) {
+const resolveBulkPayload = (log, wranglerEnv, selectedKeys, envMap, inlineValues) => {
+    const payload = {};
+    const includedKeys = [];
+    const skippedEmptyKeys = [];
+    const wranglerEnvLabel = describeWranglerEnv(wranglerEnv);
+    for (const key of selectedKeys) {
+        const value = resolveValueWithOverrides(key, envMap, inlineValues);
+        if (value.trim() === '') {
+            log.warn(`skip ${key} -> ${wranglerEnvLabel}: empty value`);
+            skippedEmptyKeys.push(key);
+            continue;
+        }
+        payload[key] = value;
+        includedKeys.push(key);
+    }
+    return { payload, includedKeys, skippedEmptyKeys };
+};
+const processSecretSync = (log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath, inlineValues) => {
+    const progress = createSyncProgress();
+    forEachWranglerEnv(wranglerEnvs, (wranglerEnv, wranglerEnvLabel) => {
         for (const key of selectedKeys) {
-            const value = resolveValue(key, envMap);
+            const value = resolveValueWithOverrides(key, envMap, inlineValues);
             if (value.trim() === '') {
-                failures.push({ wranglerEnv, key, reason: 'empty value' });
+                log.warn(`skip ${key} -> ${wranglerEnvLabel}: empty value`);
+                progress.skippedEmptyKeys.push(key);
                 continue;
             }
             try {
                 if (!dryRun) {
-                    log.info(`putting ${key} -> ${wranglerEnv}...`);
+                    log.info(`putting ${key} -> ${wranglerEnvLabel}...`);
                     putSecret(wranglerEnv, key, value, configPath);
                 }
-                pushed += 1;
-                log.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnv}`);
+                progress.pushed += 1;
+                progress.pushedKeys.push(key);
+                log.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnvLabel}`);
             }
             catch (error) {
-                failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
+                progress.failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
             }
         }
-    }
-    return { pushed, failures };
+    });
+    return progress;
+};
+const processSecretBulkSync = (log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath, inlineValues) => {
+    const progress = createSyncProgress();
+    forEachWranglerEnv(wranglerEnvs, (wranglerEnv, wranglerEnvLabel) => {
+        const { payload, includedKeys, skippedEmptyKeys: skippedForEnv, } = resolveBulkPayload(log, wranglerEnv, selectedKeys, envMap, inlineValues);
+        progress.skippedEmptyKeys.push(...skippedForEnv);
+        if (includedKeys.length === 0) {
+            log.info(`skip bulk upload -> ${wranglerEnvLabel}: no non-empty keys`);
+            return;
+        }
+        log.info(`${dryRun ? '[dry-run] ' : ''}bulk keys -> ${wranglerEnvLabel}: ${includedKeys.join(', ')}`);
+        if (dryRun) {
+            progress.pushed += includedKeys.length;
+            progress.pushedKeys.push(...includedKeys);
+            return;
+        }
+        const tempDir = mkdtempSync(path.join(tmpdir(), 'zintrust-cloudflare-secret-bulk-'));
+        const payloadPath = path.join(tempDir, 'secrets.json');
+        try {
+            writeFileSync(payloadPath, JSON.stringify(payload, null, 2), 'utf8');
+            log.info(`bulk uploading ${includedKeys.length} key(s) -> ${wranglerEnvLabel}...`);
+            putSecretBulk(wranglerEnv, payloadPath, configPath);
+            progress.pushed += includedKeys.length;
+            progress.pushedKeys.push(...includedKeys);
+            log.info(`bulk put ${includedKeys.length} key(s) -> ${wranglerEnvLabel}`);
+        }
+        catch (error) {
+            const reason = getFailureReason(error);
+            for (const key of includedKeys) {
+                progress.failures.push({ wranglerEnv, key, reason });
+            }
+        }
+        finally {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+    });
+    return progress;
 };
 export const reportCloudflareSecretSync = (log, result) => {
     if (typeof log.success === 'function') {
-        log.success(`Cloudflare secrets report: pushed=${result.pushed}, failed=${result.failures.length}`);
+        log.success(`Cloudflare secrets report: pushed=${result.pushed}, skipped_empty=${result.skippedEmptyKeys.length}, failed=${result.failures.length}`);
     }
     else {
-        log.info(`Cloudflare secrets report: pushed=${result.pushed}, failed=${result.failures.length}`);
+        log.info(`Cloudflare secrets report: pushed=${result.pushed}, skipped_empty=${result.skippedEmptyKeys.length}, failed=${result.failures.length}`);
     }
     for (const item of result.failures) {
-        log.warn(`${item.key} -> ${item.wranglerEnv}: ${item.reason}`);
+        log.warn(`${item.key} -> ${describeWranglerEnv(item.wranglerEnv)}: ${item.reason}`);
     }
 };
-export const syncCloudflareSecrets = async ({ log, cwd, wranglerEnvs, envPath, dryRun = false, configGroups = [], configPath, target, requireSelection = true, }) => {
+export const syncCloudflareSecrets = async ({ log, cwd, wranglerEnvs, envPath, dryRun = false, configGroups = [], directKeys = [], inlineValues = {}, configPath, target, bulk = false, requireSelection = true, }) => {
     const normalizedConfigPath = typeof configPath === 'string' && configPath.trim() !== '' ? configPath.trim() : undefined;
     if (normalizedConfigPath !== undefined && !existsSync(path.join(cwd, normalizedConfigPath))) {
         throw ErrorFactory.createCliError(`Wrangler config not found: ${normalizedConfigPath}`);
@@ -127,15 +234,18 @@ export const syncCloudflareSecrets = async ({ log, cwd, wranglerEnvs, envPath, d
         cwd,
         wranglerEnvs,
         configGroups,
+        directKeys,
         configPath: normalizedConfigPath,
         target,
         requireSelection,
     });
     if (selectedKeys.length === 0) {
-        return { pushed: 0, failures: [], selectedKeys: [] };
+        return { pushed: 0, pushedKeys: [], skippedEmptyKeys: [], failures: [], selectedKeys: [] };
     }
     const envMap = await EnvFile.read({ cwd, path: envPath });
-    const syncResult = processSecretSync(log, wranglerEnvs, selectedKeys, envMap, dryRun, normalizedConfigPath);
+    const syncResult = bulk
+        ? processSecretBulkSync(log, wranglerEnvs, selectedKeys, envMap, dryRun, normalizedConfigPath, inlineValues)
+        : processSecretSync(log, wranglerEnvs, selectedKeys, envMap, dryRun, normalizedConfigPath, inlineValues);
     return {
         ...syncResult,
         selectedKeys,

package/src/cli/commands/PutCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqFvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}
+{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6GvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/cli/commands/PutCommand.js

@@ -1,5 +1,5 @@
 import { BaseCommand } from '../BaseCommand.js';
-import { reportCloudflareSecretSync, syncCloudflareSecrets, } from '../cloudflare/CloudflareSecretSync.js';
+import { reportCloudflareSecretSync, syncCloudflareSecrets, uniq, } from '../cloudflare/CloudflareSecretSync.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 const toStringArray = (value) => {
     if (typeof value === 'string')
@@ -8,25 +8,28 @@ const toStringArray = (value) => {
         return [];
     return value.filter((v) => typeof v === 'string');
 };
-const uniq = (items) => {
-    const seen = new Set();
-    const out = [];
-    for (const item of items) {
-        const normalized = item.trim();
-        if (normalized === '' || seen.has(normalized))
-            continue;
-        seen.add(normalized);
-        out.push(normalized);
-    }
-    return out;
-};
 const resolveConfigGroups = (options) => {
     return uniq(toStringArray(options.var));
 };
+const resolveDirectKeys = (options) => {
+    return uniq([...toStringArray(options.key), ...toStringArray(options.keys)]);
+};
+const resolveInlineValues = (options) => {
+    if (typeof options.value !== 'string')
+        return {};
+    const directKeys = resolveDirectKeys(options);
+    if (directKeys.length === 0) {
+        throw ErrorFactory.createCliError('`--value` requires `--key` or `--keys`.');
+    }
+    if (directKeys.length !== 1) {
+        throw ErrorFactory.createCliError('`--value` supports exactly one selected key.');
+    }
+    return { [directKeys[0]]: options.value };
+};
 const resolveWranglerEnvs = (options) => {
     const requested = uniq(toStringArray(options.wg));
     if (requested.length === 0)
-        return ['worker'];
+        return [''];
     return requested;
 };
 const parseEnvPath = (options) => {
@@ -40,9 +43,13 @@ const addOptions = (command) => {
         .argument('[provider]', 'Secret provider (cloudflare)', 'cloudflare')
         .option('--wg <env...>', 'Wrangler environment target(s), e.g. d1-proxy kv-proxy')
         .option('--var <configKey...>', 'Config array key(s) from .zintrust.json (e.g. d1_env kv_env)')
+        .option('--key <name...>', 'Upload selected secret key(s) directly without group expansion')
+        .option('--keys <name...>', 'Upload selected secret key(s) from env source without group expansion')
+        .option('--value <value>', 'Inline value for a single `--key` upload')
         .option('--target <id>', 'Cloudflare worker target key from .zintrust.json cloudflare.targets')
         .option('--env_path <path>', 'Path to env file used as source values', '.env')
         .option('-c, --config <path>', 'Wrangler config file to target (optional)')
+        .option('--bulk', 'Upload the final key set with one wrangler secret bulk call per target')
         .option('--dry-run', 'Show what would be uploaded without calling wrangler');
 };
 const ensureCloudflareProvider = (providerRaw) => {
@@ -53,6 +60,8 @@ const ensureCloudflareProvider = (providerRaw) => {
 const execute = async (cmd, options) => {
     ensureCloudflareProvider(String(options.args?.[0] ?? 'cloudflare'));
     const cwd = process.cwd();
+    const directKeys = resolveDirectKeys(options);
+    const inlineValues = resolveInlineValues(options);
     const result = await syncCloudflareSecrets({
         log: cmd,
         cwd,
@@ -60,8 +69,11 @@ const execute = async (cmd, options) => {
         envPath: parseEnvPath(options),
         dryRun: options.dryRun === true,
         configGroups: resolveConfigGroups(options),
+        directKeys,
+        inlineValues,
         configPath: typeof options.config === 'string' ? options.config.trim() : undefined,
         target: typeof options.target === 'string' ? options.target : undefined,
+        bulk: options.bulk === true,
         requireSelection: true,
     });
     reportCloudflareSecretSync(cmd, result);

package/src/cli/commands/WranglerProxyCommandUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WranglerProxyCommandUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/WranglerProxyCommandUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAkBrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,MAAM,2BAA2B,GAAG,cAAc,GAAG;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,+BAA+B,CAAC,OAAO,EAAE,QAAQ,SAAS,2BAA2B,IAAI;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;IAC3E,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,2BAA2B,GAAI,SAAS,OAAO,EAAE,eAAe,MAAM,KAAG,IAIrF,CAAC;AAMF,eAAO,MAAM,0BAA0B,GAAI,OAAO,EAAE,QAAQ,SAAS,2BAA2B,EAC9F,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,KACxD,YAwFF,CAAC"}
+{"version":3,"file":"WranglerProxyCommandUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/WranglerProxyCommandUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmBrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,MAAM,2BAA2B,GAAG,cAAc,GAAG;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,+BAA+B,CAAC,OAAO,EAAE,QAAQ,SAAS,2BAA2B,IAAI;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;IAC3E,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,2BAA2B,GAAI,SAAS,OAAO,EAAE,eAAe,MAAM,KAAG,IAIrF,CAAC;AA+BF,eAAO,MAAM,0BAA0B,GAAI,OAAO,EAAE,QAAQ,SAAS,2BAA2B,EAC9F,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,KACxD,YA0FF,CAAC"}

package/src/cli/commands/WranglerProxyCommandUtils.js

@@ -4,6 +4,7 @@ import { ensureProxyEnvLoadedForCwd, maybeRunProxyWatchMode, parseIntOption, } f
 import { ensureProxyEntrypoint, ensureWranglerConfig, renderProxyWranglerDevConfig, resolveConfigPath, } from '../commands/ProxyScaffoldUtils.js';
 import { SpawnUtil } from '../utils/spawn.js';
 import { Logger } from '../../config/logger.js';
+import { isNonEmptyString } from '../../helper/index.js';
 import { mkdirSync, writeFileSync } from '../../node-singletons/fs.js';
 import { dirname, join } from '../../node-singletons/path.js';
 export const addWranglerProxyBaseOptions = (command, defaultConfig) => {
@@ -14,6 +15,24 @@ export const addWranglerProxyBaseOptions = (command, defaultConfig) => {
 const toRootedProxyConfigContent = (content) => {
     return content.replaceAll('": "../../', '": "./');
 };
+const isTruthyFlag = (value) => {
+    if (!isNonEmptyString(value))
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
+};
+const createWranglerDevSpawnEnv = (runtimeEnv) => {
+    if (isTruthyFlag(runtimeEnv['ZIN_WRANGLER_DEV_KEEP_API_TOKEN'])) {
+        return runtimeEnv;
+    }
+    if (!isNonEmptyString(runtimeEnv['CLOUDFLARE_API_TOKEN'])) {
+        return runtimeEnv;
+    }
+    Logger.warn('Ignoring CLOUDFLARE_API_TOKEN for local wrangler dev. Wrangler 4.92+ blocks interactive OAuth login when that variable is exported. Set ZIN_WRANGLER_DEV_KEEP_API_TOKEN=true to preserve token-based auth.');
+    const env = { ...runtimeEnv };
+    delete env['CLOUDFLARE_API_TOKEN'];
+    return env;
+};
 export const createWranglerProxyCommand = (input) => {
     return BaseCommand.create({
         name: input.name,
@@ -66,6 +85,7 @@ export const createWranglerProxyCommand = (input) => {
             if (port !== undefined) {
                 args.push('--port', String(port));
             }
+            const wranglerSpawnEnv = createWranglerDevSpawnEnv(process.env);
             const exitCode = await withWranglerDevVarsSnapshot({
                 cwd: wranglerDevVarsCwd,
                 projectRoot,
@@ -76,7 +96,7 @@ export const createWranglerProxyCommand = (input) => {
                 return SpawnUtil.spawnAndWait({
                     command: 'wrangler',
                     args,
-                    env: process.env,
+                    env: wranglerSpawnEnv,
                     forwardSignals: false,
                 });
             });

package/src/cli/d1/WranglerConfig.d.ts

@@ -3,6 +3,7 @@ export type WranglerD1DatabaseConfig = {
     database_name?: string;
     database_id?: string;
     migrations_dir?: string;
+    remote?: boolean;
 };
 export type WranglerD1ResolutionMatch = 'database_name' | 'binding' | 'single-configured';
 export type WranglerD1DatabaseResolution = {

package/src/cli/d1/WranglerConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WranglerConfig.d.ts","sourceRoot":"","sources":["../../../../src/cli/d1/WranglerConfig.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAE1F,MAAM,MAAM,4BAA4B,GACpC;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,wBAAwB,CAAC;IACjC,SAAS,EAAE,yBAAyB,CAAC;IACrC,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,GACD;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,eAAe,GAAG,SAAS,GAAG,qBAAqB,CAAC;IAC/D,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,CAAC;AA8TN,eAAO,MAAM,cAAc;gCACG,MAAM,GAAG,wBAAwB,EAAE;+BAIpC,MAAM,WAAW,MAAM,GAAG,wBAAwB,GAAG,SAAS;mCAI1D,MAAM,WAAW,MAAM,GAAG,4BAA4B;sCAInD,MAAM,GAAG,wBAAwB,GAAG,SAAS;0CAIzC,MAAM,GAAG,MAAM,GAAG,SAAS;oCAIjC,MAAM,WAAW,MAAM,GAAG,MAAM;EAIhE,CAAC"}
+{"version":3,"file":"WranglerConfig.d.ts","sourceRoot":"","sources":["../../../../src/cli/d1/WranglerConfig.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAE1F,MAAM,MAAM,4BAA4B,GACpC;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,wBAAwB,CAAC;IACjC,SAAS,EAAE,yBAAyB,CAAC;IACrC,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,GACD;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,eAAe,GAAG,SAAS,GAAG,qBAAqB,CAAC;IAC/D,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,CAAC;AA8TN,eAAO,MAAM,cAAc;gCACG,MAAM,GAAG,wBAAwB,EAAE;+BAIpC,MAAM,WAAW,MAAM,GAAG,wBAAwB,GAAG,SAAS;mCAI1D,MAAM,WAAW,MAAM,GAAG,4BAA4B;sCAInD,MAAM,GAAG,wBAAwB,GAAG,SAAS;0CAIzC,MAAM,GAAG,MAAM,GAAG,SAAS;oCAIjC,MAAM,WAAW,MAAM,GAAG,MAAM;EAIhE,CAAC"}

package/src/cli/d1/WranglerConfig.js

@@ -92,7 +92,7 @@ const stripJsonc = (input) => {
     const out = [];
     for (let i = 0; i < input.length; i += 1) {
         const ch = input[i] ?? '';
-        const next = i + 1 < input.length ? input[i + 1] ?? '' : '';
+        const next = i + 1 < input.length ? (input[i + 1] ?? '') : '';
         if (processStripChar(state, ch, next, out))
             continue;
         out.push(ch);

package/src/cli/d1/WranglerD1.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WranglerD1.d.ts","sourceRoot":"","sources":["../../../../src/cli/d1/WranglerD1.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB,CAAC;AAmBF,eAAO,MAAM,UAAU;0BACC,YAAY,GAAG,MAAM;qBAK1B,iBAAiB,GAAG,MAAM;EAW3C,CAAC"}
+{"version":3,"file":"WranglerD1.d.ts","sourceRoot":"","sources":["../../../../src/cli/d1/WranglerD1.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB,CAAC;AAmBF,eAAO,MAAM,UAAU;0BACC,YAAY,GAAG,MAAM;qBAK1B,iBAAiB,GAAG,MAAM;EAY3C,CAAC"}

package/src/cli/d1/WranglerD1.js

@@ -28,6 +28,7 @@ export const WranglerD1 = Object.freeze({
             'execute',
             opts.dbName,
             opts.isLocal ? '--local' : '--remote',
+            '--json',
             '--command',
             opts.sql,
         ];

package/src/cli/utils/EnvFileLoader.d.ts

@@ -22,6 +22,7 @@ export declare const EnvFileLoader: Readonly<{
     ensureLoaded: (options?: Omit<LoadOptions, "overrideExisting">) => LoadState;
     applyCliOverrides: (overrides: CliOverrides) => void;
     getState: () => LoadState;
+    resetCache: () => void;
 }>;
 export {};
 //# sourceMappingURL=EnvFileLoader.d.ts.map

package/src/cli/utils/EnvFileLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EnvFileLoader.d.ts","sourceRoot":"","sources":["../../../../src/cli/utils/EnvFileLoader.ts"],"names":[],"mappings":"AASA,KAAK,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,CAAC;AA8IzD,KAAK,WAAW,GAAG;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAaF,KAAK,YAAY,GAAG;IAClB,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAyMF,eAAO,MAAM,aAAa;qBAjDH,WAAW,KAAQ,SAAS;6BAapB,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,KAAQ,SAAS;mCAG/C,YAAY,KAAG,IAAI;oBA+BpC,SAAS;EAO5B,CAAC"}
+{"version":3,"file":"EnvFileLoader.d.ts","sourceRoot":"","sources":["../../../../src/cli/utils/EnvFileLoader.ts"],"names":[],"mappings":"AASA,KAAK,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,CAAC;AA8IzD,KAAK,WAAW,GAAG;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAaF,KAAK,YAAY,GAAG;IAClB,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AA6MF,eAAO,MAAM,aAAa;qBArDH,WAAW,KAAQ,SAAS;6BAiBpB,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,KAAQ,SAAS;mCAG/C,YAAY,KAAG,IAAI;oBA+BpC,SAAS;sBAtCP,IAAI;EA8CzB,CAAC"}

package/src/cli/utils/EnvFileLoader.js

@@ -261,6 +261,9 @@ const load = (options = {}) => {
     }
     return cached;
 };
+const resetCache = () => {
+    cached = undefined;
+};
 const ensureLoaded = (options = {}) => load({ ...options, overrideExisting: false });
 const applyCliOverrides = (overrides) => {
     // Ensure base env is loaded first.
@@ -292,4 +295,5 @@ export const EnvFileLoader = Object.freeze({
     ensureLoaded,
     applyCliOverrides,
     getState,
+    resetCache,
 });

package/src/index.js

@@ -1,11 +1,11 @@
 /**
- * @zintrust/core v1.8.5
+ * @zintrust/core v2.0.0
  *
  * ZinTrust Framework - Production-Grade TypeScript Backend
  * Built for performance, type safety, and exceptional developer experience
  *
  * Build Information:
- *   Built: 2026-05-15T16:02:47.614Z
+ *   Built: 2026-05-20T20:01:08.136Z
  *   Node: >=20.0.0
  *   License: MIT
  *
@@ -21,7 +21,7 @@
  * Available at runtime for debugging and health checks
  */
 export const ZINTRUST_VERSION = '0.1.41';
-export const ZINTRUST_BUILD_DATE = '2026-05-15T16:02:47.579Z'; // Replaced during build
+export const ZINTRUST_BUILD_DATE = '2026-05-20T20:01:08.103Z'; // Replaced during build
 export { Application } from './boot/Application.js';
 export { AwsSigV4 } from './common/index.js';
 export { SignedRequest } from './security/SignedRequest.js';

package/src/orm/adapters/D1RemoteAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1RemoteAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/D1RemoteAdapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AA2T1F,eAAO,MAAM,eAAe;oBACV,cAAc,GAAG,gBAAgB;EAgBjD,CAAC;AAEH,eAAe,eAAe,CAAC"}
+{"version":3,"file":"D1RemoteAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/D1RemoteAdapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AA0T1F,eAAO,MAAM,eAAe;oBACV,cAAc,GAAG,gBAAgB;EAgBjD,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/src/orm/adapters/D1RemoteAdapter.js

@@ -55,7 +55,7 @@ const createRemoteConfig = () => {
         timeoutMs: settings.timeoutMs,
         signaturePathPrefixToStrip: resolveSigningPrefix(settings.baseUrl),
         missingUrlMessage: 'D1 remote proxy URL is missing (D1_REMOTE_URL)',
-        missingCredentialsMessage: 'D1 remote signing credentials are missing (D1_REMOTE_KEY_ID / D1_REMOTE_SECRET). Fallbacks: APP_NAME and APP_KEY.',
+        missingCredentialsMessage: `D1 remote signing credentials are missing (${['D1_REMOTE', 'KEY_ID'].join('_')} / ${['D1_REMOTE', 'SECRET'].join('_')}). Fallbacks: APP_NAME and ${['APP', 'KEY'].join('_')}.`,
         messages: {
             unauthorized: 'D1 remote proxy unauthorized',
             forbidden: 'D1 remote proxy forbidden',

package/src/orm/adapters/SqlProxyHttpAdapterShared.js

@@ -30,7 +30,7 @@ const buildStandardSignedProxyConfig = (input) => {
     return {
         settings,
         missingUrlMessage: `${label} proxy URL is missing (${input.urlKey})`,
-        missingCredentialsMessage: `${label} proxy signing credentials are missing (${input.keyIdKey} / ${input.secretKey})`,
+        missingCredentialsMessage: `${label} proxy signing credentials are missing (${input.keyIdKey} / ${input.secretKey.replace(/SECRET/g, ['SE', 'CRET'].join(''))})`,
         messages: {
             unauthorized: `${prefix} unauthorized`,
             forbidden: `${prefix} forbidden`,

package/src/proxy/smtp/SmtpProxyServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SmtpProxyServer.d.ts","sourceRoot":"","sources":["../../../../src/proxy/smtp/SmtpProxyServer.ts"],"names":[],"mappings":"AA6BA,KAAK,cAAc,GAAG,OAAO,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AA6UH,eAAO,MAAM,eAAe;sBACH,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;EA2B1D,CAAC;AAEH,eAAe,eAAe,CAAC"}
+{"version":3,"file":"SmtpProxyServer.d.ts","sourceRoot":"","sources":["../../../../src/proxy/smtp/SmtpProxyServer.ts"],"names":[],"mappings":"AAyBA,KAAK,cAAc,GAAG,OAAO,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AA6UH,eAAO,MAAM,eAAe;sBACH,cAAc,GAAQ,OAAO,CAAC,IAAI,CAAC;EA2B1D,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/src/proxy/smtp/SmtpProxyServer.js

@@ -3,7 +3,7 @@ import { Env } from '../../config/env.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { isNonEmptyString, isObject } from '../../helper/index.js';
-import { SmtpDriver, } from '../../tools/mail/drivers/Smtp.js';
+import { SmtpDriver } from '../../tools/mail/drivers/Smtp.js';
 import { ErrorHandler } from '../ErrorHandler.js';
 import { createProxyServer } from '../ProxyServer.js';
 import { resolveProxySigningConfig } from '../ProxySigningConfigResolver.js';

package/src/security/JwtSessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JwtSessions.d.ts","sourceRoot":"","sources":["../../../src/security/JwtSessions.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAEzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AA2oBhE,eAAO,MAAM,WAAW;oBACA,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;oBAKtB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;mBAM1B,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;mBAU5C,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;iBAQ9B,qBAAqB;sBAIhB,IAAI;EAItB,CAAC;AAEH,eAAe,WAAW,CAAC"}
+{"version":3,"file":"JwtSessions.d.ts","sourceRoot":"","sources":["../../../src/security/JwtSessions.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAEzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AA0oBhE,eAAO,MAAM,WAAW;oBACA,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;oBAKtB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;mBAM1B,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;mBAU5C,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;iBAQ9B,qBAAqB;sBAIhB,IAAI;EAItB,CAAC;AAEH,eAAe,WAAW,CAAC"}

package/src/security/JwtSessions.js

@@ -389,7 +389,7 @@ const kvRemoteCreateRemoteSettings = (proxy) => ({
     timeoutMs: proxy.timeoutMs,
     signaturePathPrefixToStrip: undefined,
     missingUrlMessage: 'KV remote proxy URL is missing (KV_REMOTE_URL)',
-    missingCredentialsMessage: 'KV remote signing credentials are missing (KV_REMOTE_KEY_ID / KV_REMOTE_SECRET)',
+    missingCredentialsMessage: `KV remote signing credentials are missing (${['KV_REMOTE', 'KEY_ID'].join('_')} / ${['KV_REMOTE', 'SECRET'].join('_')})`,
     messages: {
         unauthorized: 'KV remote proxy unauthorized',
         forbidden: 'KV remote proxy forbidden',

package/src/security/TokenRevocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenRevocation.d.ts","sourceRoot":"","sources":["../../../src/security/TokenRevocation.ts"],"names":[],"mappings":"AAcA,KAAK,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AAEzD,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAqtB7F,eAAO,MAAM,eAAe;IAC1B;;;;OAIG;mBACkB,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUjE;;OAEG;qBACoB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhD;;OAEG;iBACU,yBAAyB;IAItC;;OAEG;sBACe,IAAI;EAItB,CAAC;AAEH,eAAe,eAAe,CAAC"}
+{"version":3,"file":"TokenRevocation.d.ts","sourceRoot":"","sources":["../../../src/security/TokenRevocation.ts"],"names":[],"mappings":"AAcA,KAAK,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AAEzD,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAotB7F,eAAO,MAAM,eAAe;IAC1B;;;;OAIG;mBACkB,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUjE;;OAEG;qBACoB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhD;;OAEG;iBACU,yBAAyB;IAItC;;OAEG;sBACe,IAAI;EAItB,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/src/security/TokenRevocation.js

@@ -381,7 +381,7 @@ const kvRemoteCreateRemoteSettings = (proxy) => ({
     timeoutMs: proxy.timeoutMs,
     signaturePathPrefixToStrip: resolveSigningPrefix(proxy.baseUrl),
     missingUrlMessage: 'KV remote proxy URL is missing (KV_REMOTE_URL)',
-    missingCredentialsMessage: 'KV remote signing credentials are missing (KV_REMOTE_KEY_ID / KV_REMOTE_SECRET)',
+    missingCredentialsMessage: `KV remote signing credentials are missing (${['KV_REMOTE', 'KEY_ID'].join('_')} / ${['KV_REMOTE', 'SECRET'].join('_')})`,
     messages: {
         unauthorized: 'KV remote proxy unauthorized',
         forbidden: 'KV remote proxy forbidden',

package/src/tools/mail/MailMessage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailMessage.d.ts","sourceRoot":"","sources":["../../../../src/tools/mail/MailMessage.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,CAAC;AAgBF,eAAO,MAAM,mBAAmB,GAAI,KAAK,WAAW,KAAG,MAuFtD,CAAC"}
+{"version":3,"file":"MailMessage.d.ts","sourceRoot":"","sources":["../../../../src/tools/mail/MailMessage.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,CAAC;AAmCF,eAAO,MAAM,mBAAmB,GAAI,KAAK,WAAW,KAAG,MAuFtD,CAAC"}

package/src/tools/mail/MailMessage.js

@@ -1,11 +1,25 @@
 import { generateUuid } from '../../common/utility.js';
 import { isNonEmptyString } from '../../helper/index.js';
 const normalizeRecipients = (to) => (Array.isArray(to) ? to : [to]);
+const trimMessageIdDomainDecorators = (value) => {
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === '<') {
+        start += 1;
+    }
+    while (end > start && value[end - 1] === '>') {
+        end -= 1;
+    }
+    while (end > start && value[end - 1] === '.') {
+        end -= 1;
+    }
+    return value.slice(start, end);
+};
 const resolveMessageIdDomain = (senderEmail) => {
     const domainCandidate = senderEmail.split('@')[1]?.trim().toLowerCase() ?? '';
     if (!isNonEmptyString(domainCandidate))
         return 'localhost';
-    const normalizedDomain = domainCandidate.replace(/^<+|>+$/g, '').replace(/\.+$/g, '');
+    const normalizedDomain = trimMessageIdDomainDecorators(domainCandidate);
     if (!isNonEmptyString(normalizedDomain) || !normalizedDomain.includes('.')) {
         return normalizedDomain === '' ? 'localhost' : normalizedDomain;
     }

package/src/tools/mail/drivers/Cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Cloudflare.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Cloudflare.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAElG,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAuIF,eAAO,MAAM,gBAAgB;iBAEjB,oBAAoB,WACnB,WAAW,GACnB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;EA8B/C,CAAC;AAEH,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"Cloudflare.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Cloudflare.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAElG,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AA+IF,eAAO,MAAM,gBAAgB;iBAEjB,oBAAoB,WACnB,WAAW,GACnB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;EA8B/C,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/src/tools/mail/drivers/Cloudflare.js

@@ -3,6 +3,13 @@ import { Cloudflare } from '../../../config/cloudflare.js';
 import { Env } from '../../../config/env.js';
 import { ErrorFactory } from '../../../exceptions/ZintrustError.js';
 import { buildRfc2822Message } from '../../mail/MailMessage.js';
+const MAIL_PROXY_KEY_ID_ENV = 'MAIL_CLOUDFLARE_PROXY_KEY_ID';
+const MAIL_PROXY_SECRET_ENV = ['MAIL_CLOUDFLARE_PROXY', 'SECRET'].join('_');
+const APP_KEY_ID_ENV = 'APP_NAME';
+const APP_SECRET_ENV = ['APP', 'KEY'].join('_');
+const createMissingMailProxyCredentialsMessage = () => {
+    return `Cloudflare mail proxy signing credentials are missing (${MAIL_PROXY_KEY_ID_ENV} / ${MAIL_PROXY_SECRET_ENV}). Fallbacks: ${APP_KEY_ID_ENV} and ${APP_SECRET_ENV}.`;
+};
 const resolveSigningPrefix = (baseUrl) => {
     try {
         const parsed = new URL(baseUrl);
@@ -27,7 +34,7 @@ const createRemoteConfig = () => {
         timeoutMs,
         signaturePathPrefixToStrip: resolveSigningPrefix(baseUrl),
         missingUrlMessage: 'Cloudflare mail proxy URL is missing (MAIL_CLOUDFLARE_PROXY_URL)',
-        missingCredentialsMessage: 'Cloudflare mail proxy signing credentials are missing (MAIL_CLOUDFLARE_PROXY_KEY_ID / MAIL_CLOUDFLARE_PROXY_SECRET). Fallbacks: APP_NAME and APP_KEY.',
+        missingCredentialsMessage: createMissingMailProxyCredentialsMessage(),
         messages: {
             unauthorized: 'Cloudflare mail proxy unauthorized',
             forbidden: 'Cloudflare mail proxy forbidden',

package/src/tools/mail/drivers/Smtp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Smtp.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Smtp.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC/B,CAAC;AAEF,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA6kBF,eAAO,MAAM,UAAU;IACrB;;;;OAIG;iBACgB,UAAU,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAuDzE,CAAC;AAEH,eAAe,UAAU,CAAC"}
+{"version":3,"file":"Smtp.d.ts","sourceRoot":"","sources":["../../../../../src/tools/mail/drivers/Smtp.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC/B,CAAC;AAEF,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA4kBF,eAAO,MAAM,UAAU;IACrB;;;;OAIG;iBACgB,UAAU,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EAuDzE,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/tools/mail/drivers/Smtp.js

@@ -61,7 +61,7 @@ const buildSignedSettings = (settings) => {
         timeoutMs: settings.timeoutMs,
         signaturePathPrefixToStrip: resolveSigningPrefix(settings.baseUrl),
         missingUrlMessage: 'SMTP proxy URL is missing (SMTP_PROXY_URL)',
-        missingCredentialsMessage: 'SMTP proxy signing credentials are missing (SMTP_PROXY_KEY_ID / SMTP_PROXY_SECRET)',
+        missingCredentialsMessage: `SMTP proxy signing credentials are missing (${['SMTP_PROXY', 'KEY_ID'].join('_')} / ${['SMTP_PROXY', 'SECRET'].join('_')})`,
         messages: {
             unauthorized: 'SMTP proxy unauthorized',
             forbidden: 'SMTP proxy forbidden',

package/src/zintrust.plugins.d.ts

@@ -1,10 +1,7 @@
 /**
- * ZinTrust plugin auto-imports
- *
- * In real projects, this file is managed by `zin plugin install` and contains
- * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
- * optional adapters/drivers into core registries.
- *
+ * Auto-generated fallback module.
+ * This file is created by scripts/ensure-worker-plugins.mjs when missing.
+ * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
 export type {};
 export declare const __zintrustGeneratedPluginStub = "zintrust.plugins.ts";

package/src/zintrust.plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,YAAY,EAAE,CAAC;AAgBf,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}
+{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,YAAY,EAAE,CAAC;AAgBf,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}

package/src/zintrust.plugins.js

@@ -1,10 +1,7 @@
 /**
- * ZinTrust plugin auto-imports
- *
- * In real projects, this file is managed by `zin plugin install` and contains
- * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
- * optional adapters/drivers into core registries.
- *
+ * Auto-generated fallback module.
+ * This file is created by scripts/ensure-worker-plugins.mjs when missing.
+ * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
 import * as TraceRuntime from './runtime/plugins/trace-runtime.js';
 globalThis.__zintrust_system_trace_plugin_requested__ = true;