@zintrust/core 2.3.0 → 2.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {
@@ -210,7 +210,7 @@
     "bullmq": "^5.77.6",
     "chalk": "^5.6.2",
     "commander": "^15.0.0",
-    "inquirer": "^14.0.0",
+    "inquirer": "^14.0.1",
     "ioredis": "^5.11.0",
     "jsonwebtoken": "^9.0.3",
     "mysql2": "^3.22.4",
@@ -227,7 +227,6 @@
     "fast-uri": "3.1.2",
     "fast-xml-parser": "5.8.0",
     "protobufjs": "7.5.9",
-    "brace-expansion": "^5.0.5",
     "picomatch": "^4.0.4",
     "cross-spawn": "^7.0.5",
     "glob": "^11.1.0",
@@ -238,6 +237,10 @@
     "uuid": "14.0.0",
     "ioredis": "^5.11.0",
     "axios": "^1.16.1",
+    "tmp": "^0.2.6",
+    "sonarqube-scanner": {
+      "axios": "^1.16.1"
+    },
     "@actions/github": {
       "undici": "^6.24.0"
     },
@@ -254,9 +257,10 @@
     "braces": "^3.0.3",
     "lodash": "^4.17.21",
     "semver": "^7.6.3",
-    "tmp": "^0.2.4",
     "ws": "^8.20.0",
-    "micromatch": "^4.0.8"
+    "micromatch": "^4.0.8",
+    "brace-expansion": "^5.0.6",
+    "qs": "^6.15.2"
   },
   "bin": {
     "zintrust": "bin/zintrust.js",

package/src/cache/drivers/RedisDriver.js

@@ -38,7 +38,7 @@ const createIoredisClient = (params) => {
             port: Env.REDIS_PORT,
             password: Env.get('REDIS_PASSWORD', ''),
             db,
-        }, 3, { subsystem: 'cache' });
+        }, 3, { subsystem: 'cache', requireDirectForScripts: false });
         return client !== null && typeof client.get === 'function' ? client : null;
     }
     catch (error) {

package/src/index.js

@@ -1,11 +1,11 @@
 /**
- * @zintrust/core v2.3.0
+ * @zintrust/core v2.4.0
  *
  * ZinTrust Framework - Production-Grade TypeScript Backend
  * Built for performance, type safety, and exceptional developer experience
  *
  * Build Information:
- *   Built: 2026-05-29T19:55:12.757Z
+ *   Built: 2026-05-30T23:27:53.523Z
  *   Node: >=20.0.0
  *   License: MIT
  *
@@ -21,7 +21,7 @@
  * Available at runtime for debugging and health checks
  */
 export const ZINTRUST_VERSION = '0.1.41';
-export const ZINTRUST_BUILD_DATE = '2026-05-29T19:55:12.719Z'; // Replaced during build
+export const ZINTRUST_BUILD_DATE = '2026-05-30T23:27:53.490Z'; // Replaced during build
 export { Application } from './boot/Application.js';
 export { AwsSigV4 } from './common/index.js';
 export { SignedRequest } from './security/SignedRequest.js';

package/src/middleware/SecurityMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SecurityMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACvC,CAAC;CACH;AAkPD,eAAO,MAAM,kBAAkB;IAC7B;;OAEG;qBACa,eAAe,GAAQ,UAAU;EAgBjD,CAAC"}
+{"version":3,"file":"SecurityMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SecurityMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACvC,CAAC;CACH;AAmRD,eAAO,MAAM,kBAAkB;IAC7B;;OAEG;qBACa,eAAe,GAAQ,UAAU;EAgBjD,CAAC"}

package/src/middleware/SecurityMiddleware.js

@@ -4,6 +4,7 @@
  * Zero-dependency implementation replacing helmet/cors
  */
 import { securityConfig } from '../config/security.js';
+import { isNullish, isUndefinedOrNull } from '../helper/index.js';
 const normalizeCorsList = (values, fallback) => {
     const normalized = (values ?? [])
         .map((value) => (typeof value === 'string' ? value.trim() : ''))
@@ -169,24 +170,54 @@ function applyCors(req, res, cors) {
     const method = req.getMethod();
     const originHeader = req.getHeader('origin');
     const origin = typeof originHeader === 'string' ? originHeader : undefined;
-    const requestedMethodHeader = method === 'OPTIONS' ? req.getHeader('access-control-request-method') : undefined;
-    const requestedMethod = typeof requestedMethodHeader === 'string' ? requestedMethodHeader : undefined;
-    const requestedHeadersHeader = method === 'OPTIONS' ? req.getHeader('access-control-request-headers') : undefined;
-    const requestedHeaders = typeof requestedHeadersHeader === 'string' ? parseHeaderList(requestedHeadersHeader) : [];
-    applyCorsHeaders(res, {
-        origin: resolveAllowedOrigin(cors.origin, origin, cors.credentials),
-        methods: resolveAllowedMethods(cors.methods, requestedMethod),
-        allowedHeaders: resolveAllowedHeaders(cors.allowedHeaders, requestedHeaders),
-        exposedHeaders: resolveExposedHeaders(cors.exposedHeaders),
-        credentials: cors.credentials,
-        maxAge: cors.maxAge,
-    });
     // Handle Preflight
     if (method === 'OPTIONS') {
+        const requestedMethodHeader = req.getHeader('access-control-request-method');
+        const requestedMethod = typeof requestedMethodHeader === 'string' ? requestedMethodHeader : undefined;
+        const requestedHeadersHeader = req.getHeader('access-control-request-headers');
+        const requestedHeaders = typeof requestedHeadersHeader === 'string' ? parseHeaderList(requestedHeadersHeader) : [];
+        // Validate origin first
+        const allowedOrigin = resolveAllowedOrigin(cors.origin, origin, cors.credentials);
+        if (allowedOrigin === undefined) {
+            // Origin not allowed - don't set CORS headers and let request fail
+            return false;
+        }
+        // Validate requested method is allowed
+        const allowedMethods = resolveAllowedMethods(cors.methods, requestedMethod);
+        if (allowedMethods.length === 0 || (allowedMethods.length === 1 && allowedMethods[0] === '*')) {
+            // No specific methods configured or wildcard - allow
+        }
+        else if (!isUndefinedOrNull(requestedMethod) &&
+            !isNullish(requestedMethod) &&
+            !allowedMethods.includes(requestedMethod)) {
+            // Requested method not in allowed list
+            return false;
+        }
+        // Apply CORS headers for preflight
+        applyCorsHeaders(res, {
+            origin: allowedOrigin,
+            methods: allowedMethods,
+            allowedHeaders: resolveAllowedHeaders(cors.allowedHeaders, requestedHeaders),
+            exposedHeaders: resolveExposedHeaders(cors.exposedHeaders),
+            credentials: cors.credentials,
+            maxAge: cors.maxAge,
+        });
         res.setStatus(204);
         res.send('');
         return true;
     }
+    // Handle actual requests
+    const allowedOrigin = resolveAllowedOrigin(cors.origin, origin, cors.credentials);
+    if (allowedOrigin !== undefined) {
+        applyCorsHeaders(res, {
+            origin: allowedOrigin,
+            methods: resolveAllowedMethods(cors.methods, undefined),
+            allowedHeaders: resolveAllowedHeaders(cors.allowedHeaders, []),
+            exposedHeaders: resolveExposedHeaders(cors.exposedHeaders),
+            credentials: cors.credentials,
+            maxAge: cors.maxAge,
+        });
+    }
     return false;
 }
 export const SecurityMiddleware = Object.freeze({

package/src/zintrust.plugins.d.ts

@@ -1,10 +1,7 @@
 /**
- * ZinTrust plugin auto-imports
- *
- * In real projects, this file is managed by `zin plugin install` and contains
- * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
- * optional adapters/drivers into core registries.
- *
+ * Auto-generated fallback module.
+ * This file is created by scripts/ensure-worker-plugins.mjs when missing.
+ * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
 export type {};
 export declare const __zintrustGeneratedPluginStub = "zintrust.plugins.ts";

package/src/zintrust.plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,YAAY,EAAE,CAAC;AAgBf,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}
+{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,YAAY,EAAE,CAAC;AAgBf,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}

package/src/zintrust.plugins.js

@@ -1,10 +1,7 @@
 /**
- * ZinTrust plugin auto-imports
- *
- * In real projects, this file is managed by `zin plugin install` and contains
- * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
- * optional adapters/drivers into core registries.
- *
+ * Auto-generated fallback module.
+ * This file is created by scripts/ensure-worker-plugins.mjs when missing.
+ * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
 import * as TraceRuntime from './runtime/plugins/trace-runtime.js';
 globalThis.__zintrust_system_trace_plugin_requested__ = true;