@zintrust/core 3.4.0 → 3.5.1

package/src/cli/scaffolding/env.ts

@@ -0,0 +1,598 @@
+const HeaderAndApp = (name: string, port: number, baseUrl: string, appKey: string): string[] => [
+  '# ZinTrust — Project Environment (.env)',
+  '#',
+  '# Generated by: zin new / ProjectScaffolder',
+  '#',
+  '# Notes:',
+  '# - No ${VAR} interpolation: compatible with standard Node dotenv behavior.',
+  '# - Secrets are intentionally empty unless auto-generated (APP_KEY).',
+  '# - For the complete key list (auto-generated), see: -envexample.generated',
+  '',
+  '# ============================================================================',
+  '# APP',
+  '# ============================================================================',
+  '',
+  'NODE_ENV=development',
+  `APP_NAME=${name}`,
+  'HOST=localhost',
+  `PORT=${port}`,
+  `BASE_URL=${baseUrl}`,
+  '',
+  '# Runtime override (optional): auto | nodejs | cloudflare | deno | lambda',
+  'RUNTIME=',
+  '',
+  'DEBUG=true',
+  'METRICS_ENABLED=false',
+  '',
+  '# Cloudflare Workers (TCP sockets) — set true if using TCP adapters on Workers.',
+  'ENABLE_CLOUDFLARE_SOCKETS=false',
+  '# When true, Wrangler reads .env directly and ZinTrust will not materialize .dev.vars files.',
+  'USE_ENV=false',
+  '',
+  '# CLI / tooling',
+  'ZINTRUST_RUN_FROM_SOURCE=0',
+  'ZINTRUST_VERSION_CHECK=true',
+  'ZINTRUST_VERSION_CHECK_INTERVAL=24',
+  'ZINTRUST_CLI_DEBUG_ARGS=0',
+  '',
+  '# Optional debug output (local only)',
+  'ZIN_DEBUG_VALIDATION_BODY=false',
+  'ZIN_DEBUG_BODY_PARSING=false',
+  'ZIN_DEBUG_FILE_UPLOAD=false',
+  '',
+  '# ============================================================================',
+  '# STARTUP (boot-time checks)',
+  '# ============================================================================',
+  '',
+  'STARTUP_HEALTH_CHECKS=true',
+  'STARTUP_VALIDATE_SECRETS=true',
+  '',
+  '# Strict required-env validation. Recommended for new projects.',
+  'STARTUP_REQUIRE_ENV=true',
+  '',
+  'STARTUP_CHECK_DB=false',
+  'STARTUP_CHECK_CACHE=false',
+  'STARTUP_HEALTH_TIMEOUT_MS=2500',
+  'STARTUP_CONTINUE_ON_FAILURE=false',
+  '',
+  '# ============================================================================',
+  '# SECURITY (keys, auth, headers)',
+  '# ============================================================================',
+  '',
+  '# Auto-generated secure APP_KEY for encryption interoperability (32 bytes, base64).',
+  `APP_KEY=${appKey}`,
+  '',
+];
+
+const SecurityAndDeployment = (): string[] => [
+  '# Optional: key rotation support (comma-separated OR JSON array of base64 keys)',
+  'APP_PREVIOUS_KEYS=',
+  '',
+  '# Supported: aes-256-cbc | aes-256-gcm',
+  'ENCRYPTION_CIPHER=aes-256-cbc',
+  '',
+  'JWT_ENABLED=true',
+  '# If empty, JWT uses APP_KEY in dev. For production, set a dedicated JWT_SECRET.',
+  'JWT_SECRET=',
+  'JWT_ALGORITHM=HS256',
+  'JWT_EXPIRES_IN=3600',
+  'JWT_REFRESH_EXPIRES_IN=7d',
+  'JWT_ISSUER=zintrust',
+  'JWT_AUDIENCE=zintrust-api',
+  '',
+  'API_KEY_ENABLED=false',
+  'API_KEY_HEADER=x-api-key',
+  'API_KEY_SECRET=',
+  '',
+  'CSRF_ENABLED=true',
+  'CSRF_HEADER_NAME=x-csrf-token',
+  'CSRF_TOKEN_NAME=_csrf',
+  'CSRF_COOKIE_NAME=XSRF-TOKEN',
+  'CSRF_COOKIE_SECURE=false',
+  'CSRF_COOKIE_HTTP_ONLY=true',
+  'CSRF_COOKIE_SAME_SITE=lax',
+  'CSRF_SKIP_PATHS=/api/*,/queue-monitor/*,/api/_sys/queue/*,/api/_sys/schedule/*',
+  '',
+  'CORS_ENABLED=true',
+  'CORS_ORIGINS=*',
+  'CORS_METHODS=GET,POST,PUT,PATCH,DELETE',
+  'CORS_ALLOWED_HEADERS=Content-Type,Authorization',
+  'CORS_EXPOSED_HEADERS=',
+  'CORS_CREDENTIALS=false',
+  'CORS_MAX_AGE=86400',
+  '',
+  'RATE_LIMIT_ENABLED=true',
+  'RATE_LIMIT_WINDOW_MS=900000',
+  'RATE_LIMIT_MAX_REQUESTS=100',
+  'RATE_LIMIT_MESSAGE=Too many requests, please try again later',
+  '',
+  'HELMET_ENABLED=true',
+  'CSP_ENABLED=false',
+  'HSTS_ENABLED=false',
+  'HSTS_MAX_AGE=31536000',
+  'HSTS_INCLUDE_SUBDOMAINS=true',
+  'XSS_ENABLED=true',
+  'XSS_REPORT_URI=',
+  '',
+  'SESSION_NAME=zintrust_session',
+  'SESSION_SECRET=',
+  'SESSION_EXPIRES_IN=1800000',
+  'SESSION_SECURE=false',
+  'SESSION_HTTP_ONLY=true',
+  'SESSION_SAME_SITE=lax',
+  '',
+  'PASSWORD_MIN_LENGTH=8',
+  'PASSWORD_REQUIRE_UPPERCASE=true',
+  'PASSWORD_REQUIRE_NUMBERS=true',
+  'PASSWORD_REQUIRE_SPECIAL_CHARS=true',
+  'BCRYPT_ROUNDS=10',
+  '',
+  '# ============================================================================',
+  '# DEPLOYMENT / LIMITS',
+  '# ============================================================================',
+  '',
+  'ENVIRONMENT=development',
+  'REQUEST_TIMEOUT=30000',
+  'APP_TIMEZONE=UTC',
+  'MAX_BODY_SIZE=10485760',
+  'SHUTDOWN_TIMEOUT=10000',
+  '',
+];
+
+const DatabaseAndCloudflare = (
+  databaseNormalized: string,
+  dbLines: string[],
+  sqliteDbPath: string
+): string[] => [
+  '# ============================================================================',
+  '# DATABASE',
+  '# ============================================================================',
+  '',
+  '# Options: sqlite | postgresql | mysql | sqlserver | d1 | d1-remote',
+  `DB_CONNECTION=${databaseNormalized}`,
+  '',
+  ...(databaseNormalized === 'sqlite' ? [`DB_PATH=${sqliteDbPath}`, ''] : []),
+  ...dbLines,
+  '',
+  '# Generic SQL defaults (used by some adapters)',
+  '',
+  '# PostgreSQL (optional)',
+  'DB_PORT_POSTGRESQL=5432',
+  'DB_DATABASE_POSTGRESQL=postgres',
+  'DB_USERNAME_POSTGRESQL=postgres',
+  'DB_PASSWORD_POSTGRESQL=',
+  'DB_READ_HOSTS_POSTGRESQL=',
+  '',
+  '# SQL Server (MSSQL) (optional)',
+  'DB_HOST_MSSQL=localhost',
+  'DB_PORT_MSSQL=1433',
+  'DB_DATABASE_MSSQL=zintrust',
+  'DB_USERNAME_MSSQL=sa',
+  'DB_PASSWORD_MSSQL=',
+  'DB_READ_HOSTS_MSSQL=',
+  '',
+  '# Pooling / logging (optional)',
+  'DB_POOLING=true',
+  'DB_POOL_MIN=5',
+  'DB_POOL_MAX=20',
+  'DB_IDLE_TIMEOUT=30000',
+  'DB_CONNECTION_TIMEOUT=10000',
+  'DB_SSL=false',
+  'DB_LOG_QUERIES=false',
+  'DB_LOG_LEVEL=info',
+  'DB_MIGRATION_EXT=ts',
+  '',
+  '# ============================================================================',
+  '# CLOUDFLARE (D1 / KV)',
+  '# ============================================================================',
+  '',
+  'D1_DATABASE_ID=',
+  'KV_NAMESPACE_ID=',
+  '',
+  '# Remote D1 (outside Cloudflare) via proxy',
+  'D1_REMOTE_URL=',
+  'D1_REMOTE_KEY_ID=',
+  'D1_REMOTE_SECRET=',
+  'D1_REMOTE_MODE=registry',
+  '',
+  '# Remote KV (outside Cloudflare) via proxy',
+  'KV_REMOTE_URL=',
+  'KV_REMOTE_KEY_ID=',
+  'KV_REMOTE_SECRET=',
+  'KV_REMOTE_NAMESPACE=',
+  '',
+  '# Cloudflare API (only needed for CLI provisioning)',
+  'CLOUDFLARE_ACCOUNT_ID=',
+  'CLOUDFLARE_API_TOKEN=',
+  'CLOUDFLARE_KV_NAMESPACE_ID=',
+  '',
+];
+
+// eslint-disable-next-line max-lines-per-function
+const HttpProxies = (): string[] => [
+  '# ============================================================================',
+  '# HTTP PROXIES (for Workers compatibility)',
+  '# ============================================================================',
+  '',
+  'ZT_PROXY_TIMEOUT_MS=30000',
+  'ZT_PROXY_SIGNING_WINDOW_MS=60000',
+  '',
+  'USE_ZEDGI=false',
+  'ZEDGI_URL=',
+  'ZEDGI_KEY=',
+  'ZEDGI_SIGNING_SECRET=',
+  'ZEDGI_SECRET=',
+  'ZEDGI_PUBLIC_KEY=',
+  'ZEDGI_ACCOUNT_ID=',
+  'ZEDGI_KEY_VERSION=',
+  'ZEDGI_TIMEOUT=10000',
+  'ZEDGI_REDIS_HEADER=',
+  'ZEDGI_QUEUE_HEADER=',
+  'ZEDGI_MYSQL_HEADER=',
+  'ZEDGI_POSTGRES_HEADER=',
+  '',
+  'USE_MYSQL_PROXY=false',
+  'MYSQL_PROXY_URL=',
+  'MYSQL_PROXY_HOST=127.0.0.1',
+  'MYSQL_PROXY_PORT=8789',
+  'MYSQL_PROXY_MAX_BODY_BYTES=131072',
+  'MYSQL_PROXY_POOL_LIMIT=10',
+  'MYSQL_PROXY_KEY_ID=',
+  'MYSQL_PROXY_SECRET=',
+  'MYSQL_PROXY_TIMEOUT_MS=30000',
+  'MYSQL_PROXY_REQUIRE_SIGNING=true',
+  'MYSQL_PROXY_SIGNING_WINDOW_MS=60000',
+  '',
+  'USE_POSTGRES_PROXY=false',
+  'POSTGRES_PROXY_URL=',
+  'POSTGRES_PROXY_HOST=127.0.0.1',
+  'POSTGRES_PROXY_PORT=8790',
+  'POSTGRES_PROXY_MAX_BODY_BYTES=131072',
+  'POSTGRES_PROXY_POOL_LIMIT=10',
+  'POSTGRES_PROXY_KEY_ID=',
+  'POSTGRES_PROXY_SECRET=',
+  'POSTGRES_PROXY_TIMEOUT_MS=30000',
+  'POSTGRES_PROXY_REQUIRE_SIGNING=true',
+  'POSTGRES_PROXY_SIGNING_WINDOW_MS=60000',
+  '',
+  'USE_REDIS_PROXY=false',
+  'REDIS_PROXY_URL=',
+  'REDIS_PROXY_HOST=127.0.0.1',
+  'REDIS_PROXY_PORT=8791',
+  'REDIS_PROXY_MAX_BODY_BYTES=131072',
+  'REDIS_PROXY_KEY_ID=',
+  'REDIS_PROXY_SECRET=',
+  'REDIS_PROXY_TIMEOUT_MS=30000',
+  'REDIS_PROXY_REQUIRE_SIGNING=true',
+  'REDIS_PROXY_SIGNING_WINDOW_MS=60000',
+  '# Redis RPC is selected only when USE_REDIS_PROXY=true and REDIS_RPC_URL is non-empty.',
+  'REDIS_RPC_URL=',
+  'REDIS_RPC_HOST=127.0.0.1',
+  'REDIS_RPC_PORT=8794',
+  'REDIS_RPC_SECRET=',
+  'REDIS_RPC_TIMEOUT_MS=30000',
+  'REDIS_RPC_RETRY_MAX=2',
+  'REDIS_RPC_RETRY_DELAY_MS=500',
+  '',
+  'USE_SMTP_PROXY=false',
+  'SMTP_PROXY_URL=',
+  'SMTP_PROXY_HOST=127.0.0.1',
+  'SMTP_PROXY_PORT=8794',
+  'SMTP_PROXY_MAX_BODY_BYTES=131072',
+  'SMTP_PROXY_KEY_ID=',
+  'SMTP_PROXY_SECRET=',
+  'SMTP_PROXY_TIMEOUT_MS=30000',
+  'SMTP_PROXY_REQUIRE_SIGNING=true',
+  'SMTP_PROXY_SIGNING_WINDOW_MS=60000',
+  '',
+  'USE_MONGODB_PROXY=false',
+  'MONGODB_PROXY_URL=',
+  'MONGODB_PROXY_HOST=127.0.0.1',
+  'MONGODB_PROXY_PORT=8792',
+  'MONGODB_PROXY_MAX_BODY_BYTES=131072',
+  'MONGODB_PROXY_KEY_ID=',
+  'MONGODB_PROXY_SECRET=',
+  'MONGODB_PROXY_TIMEOUT_MS=30000',
+  'MONGODB_PROXY_REQUIRE_SIGNING=true',
+  'MONGODB_PROXY_SIGNING_WINDOW_MS=60000',
+  '',
+  'USE_SQLSERVER_PROXY=false',
+  'SQLSERVER_PROXY_URL=',
+  'SQLSERVER_PROXY_HOST=127.0.0.1',
+  'SQLSERVER_PROXY_PORT=8793',
+  'SQLSERVER_PROXY_MAX_BODY_BYTES=131072',
+  'SQLSERVER_PROXY_POOL_LIMIT=10',
+  'SQLSERVER_PROXY_KEY_ID=',
+  'SQLSERVER_PROXY_SECRET=',
+  'SQLSERVER_PROXY_TIMEOUT_MS=30000',
+  'SQLSERVER_PROXY_REQUIRE_SIGNING=true',
+  'SQLSERVER_PROXY_SIGNING_WINDOW_MS=60000',
+  '',
+];
+
+const CacheAndRedis = (): string[] => [
+  '# ============================================================================',
+  '# CACHE / REDIS',
+  '# ============================================================================',
+  '',
+  'CACHE_DRIVER=memory',
+  'CACHE_CONNECTION=',
+  'CACHE_KEY_PREFIX=zintrust:',
+  '',
+  'CACHE_MEMORY_TTL=3600',
+  'CACHE_REDIS_TTL=3600',
+  'CACHE_MONGO_TTL=3600',
+  'CACHE_KV_TTL=3600',
+  '',
+  'REDIS_HOST=localhost',
+  'REDIS_PORT=6379',
+  'REDIS_PASSWORD=',
+  'REDIS_DB=0',
+  'REDIS_QUEUE_DB=1',
+  'REDIS_URL=',
+  '',
+  'REDIS_HTTPS_ENDPOINT=',
+  'REDIS_HTTPS_TOKEN=',
+  '',
+  'MONGO_URI=',
+  'MONGO_DB=zintrust_cache',
+  '',
+];
+
+const QueueConfig = (): string[] => [
+  '# ============================================================================',
+  '# QUEUE',
+  '# ============================================================================',
+  '',
+  '# Options: sync | memory | database | redis | rabbitmq | sqs',
+  'QUEUE_DRIVER=sync',
+  'QUEUE_CONNECTION=',
+  '',
+  'QUEUE_TABLE=jobs',
+  'QUEUE_DB_CONNECTION=default',
+  '',
+  'FAILED_JOBS_DB_CONNECTION=default',
+  'FAILED_JOBS_TABLE=failed_jobs',
+  '',
+  'QUEUE_JOB_TIMEOUT=60',
+  'QUEUE_JOB_RETRIES=3',
+  'QUEUE_JOB_BACKOFF=0',
+  'QUEUE_WORKERS=1',
+  'QUEUE_MEMORY_TTL=3600000',
+  '',
+  'QUEUE_MONITOR_ENABLED=true',
+  'QUEUE_MONITOR_BASE_PATH=/queue-monitor',
+  'QUEUE_MONITOR_MIDDLEWARE=',
+  'QUEUE_MONITOR_AUTO_REFRESH=true',
+  'QUEUE_MONITOR_REFRESH_MS=5000',
+  'QUEUE_DATA_TIMEOUT_MS=10000',
+  '',
+  'QUEUE_HTTP_PROXY_ENABLED=false',
+  'QUEUE_HTTP_PROXY_GATEWAY_ENABLED=true',
+  'QUEUE_HTTP_PROXY_URL=',
+  'QUEUE_HTTP_PROXY_PATH=/api/_sys/queue/rpc',
+  'QUEUE_HTTP_PROXY_KEY_ID=',
+  'QUEUE_HTTP_PROXY_KEY=',
+  'QUEUE_HTTP_PROXY_TIMEOUT_MS=30000',
+  'QUEUE_HTTP_PROXY_MAX_SKEW_MS=60000',
+  'QUEUE_HTTP_PROXY_NONCE_TTL_MS=120000',
+  'QUEUE_HTTP_PROXY_MIDDLEWARE=',
+  '',
+];
+
+const WorkersSchedulingAndSSE = (): string[] => [
+  '# ============================================================================',
+  '# WORKERS / SCHEDULER',
+  '# ============================================================================',
+  '',
+  'WORKER_ENABLED=false',
+  'WORKER_AUTO_START=false',
+  'WORKER_CONCURRENCY=5',
+  'WORKER_TIMEOUT=60',
+  'WORKER_RETRIES=3',
+  'WORKER_PRIORITY=1',
+  'WORKER_HEALTH_CHECK_INTERVAL=60',
+  'WORKER_CLUSTER_MODE=false',
+  'WORKER_REGION=us-east-1',
+  '',
+  'WORKER_PERSISTENCE_DRIVER=memory',
+  'WORKER_PERSISTENCE_TABLE=zintrust_workers',
+  'WORKER_PERSISTENCE_DB_CONNECTION=default',
+  'WORKER_PERSISTENCE_REDIS_DB=',
+  'WORKER_PERSISTENCE_REDIS_KEY_PREFIX=',
+  '',
+  'WORKER_SHUTDOWN_ON_APP_EXIT=true',
+  '',
+  'SCHEDULES_ENABLED=false',
+  'SCHEDULE_SHUTDOWN_TIMEOUT_MS=30000',
+  'SCHEDULE_OVERLAP_LOCK_TTL_MS=300000',
+  'SCHEDULE_OVERLAP_LOCK_ACQUIRE_TIMEOUT_MS=2000',
+  '',
+  'SCHEDULE_LEADER_ENABLED=false',
+  'SCHEDULE_LEADER_LOCK_PROVIDER=redis',
+  'SCHEDULE_LEADER_LOCK_KEY=scheduler:leader',
+  'SCHEDULE_LEADER_LOCK_TTL_MS=30000',
+  'SCHEDULE_LEADER_LOCK_RENEW_MS=15000',
+  'SCHEDULE_LEADER_LOCK_RETRY_MS=5000',
+  'SCHEDULE_LEADER_LOCK_ACQUIRE_TIMEOUT_MS=2000',
+  '',
+  'SCHEDULE_HTTP_PROXY_PATH=/api/_sys/schedule/rpc',
+  'SCHEDULE_HTTP_PROXY_KEY_ID=',
+  'SCHEDULE_HTTP_PROXY_KEY=',
+  'SCHEDULE_HTTP_PROXY_MAX_SKEW_MS=60000',
+  'SCHEDULE_HTTP_PROXY_NONCE_TTL_MS=120000',
+  'SCHEDULE_HTTP_PROXY_MIDDLEWARE=',
+  '',
+  'JOB_TRACKING_CLEANUP_ENABLED=false',
+  'JOB_TRACKING_CLEANUP_INTERVAL_MS=21600000',
+  'JOB_TRACKING_CLEANUP_RETENTION_DAYS=30',
+  'JOB_TRACKING_CLEANUP_RETENTION_HOURS=',
+  'JOB_TRACKING_CLEANUP_BATCH_SIZE=5000',
+  'JOB_TRACKING_CLEANUP_MAX_BATCHES=1',
+  'JOB_TRACKING_CLEANUP_LOCK_PROVIDER=redis',
+  '',
+  '# ============================================================================',
+  '# SSE',
+  '# ============================================================================',
+  '',
+  'SSE_HEARTBEAT_INTERVAL=15000',
+  'SSE_SNAPSHOT_INTERVAL=5000',
+  '',
+];
+
+const LoggingAndMail = (): string[] => [
+  '# ============================================================================',
+  '# LOGGING',
+  '# ============================================================================',
+  '',
+  'LOG_LEVEL=debug',
+  'LOG_FORMAT=text',
+  'LOG_CHANNEL=file',
+  'DISABLE_LOGGING=false',
+  'LOG_HTTP_REQUEST=true',
+  'LOG_COLOR=true',
+  'LOG_COLOR_THEME=arctic',
+  'LOG_TO_FILE=false',
+  'LOG_ROTATION_SIZE=10485760',
+  'LOG_ROTATION_DAYS=7',
+  'DOCKER_WORKER=false',
+  '',
+  '# ============================================================================',
+  '# MAIL',
+  '# ============================================================================',
+  '',
+  'MAIL_DRIVER=disabled',
+  'MAIL_CONNECTION=',
+  'MAIL_FROM_ADDRESS=',
+  'MAIL_FROM_NAME=',
+  'MAIL_CLOUDFLARE_BINDING=SEND_EMAIL',
+  'MAIL_CLOUDFLARE_PROXY_URL=',
+  'MAIL_CLOUDFLARE_PROXY_KEY_ID=',
+  'MAIL_CLOUDFLARE_PROXY_SECRET=',
+  'MAIL_CLOUDFLARE_PROXY_TIMEOUT_MS=30000',
+  'MAIL_HOST=',
+  'MAIL_PORT=587',
+  'MAIL_USERNAME=',
+  'MAIL_PASSWORD',
+  'MAIL_SECURE=starttls',
+  'SENDGRID_API_KEY=',
+  'MAILGUN_API_KEY=',
+  'MAILGUN_DOMAIN=',
+  'MAILGUN_BASE_URL=https://api.mailgun.net',
+  '',
+];
+
+const StorageAndBroadcast = (): string[] => [
+  '# ============================================================================',
+  '# STORAGE',
+  '# ============================================================================',
+  '',
+  'STORAGE_CONNECTION=local',
+  'STORAGE_PATH=storage',
+  'STORAGE_URL=/storage',
+  'STORAGE_VISIBILITY=private',
+  'TEMP_PATH=storage/temp',
+  'TEMP_FILE_MAX_AGE=86400',
+  'MAX_UPLOAD_SIZE=100mb',
+  'ALLOWED_UPLOAD_MIMES=jpg,jpeg,png,pdf,doc,docx',
+  'UPLOADS_PATH=storage/uploads',
+  'BACKUP_DRIVER=s3',
+  'BACKUPS_PATH=storage/backups',
+  '',
+  'AWS_REGION=us-east-1',
+  'AWS_DEFAULT_REGION=',
+  'AWS_ACCESS_KEY_ID=',
+  'AWS_SECRET_ACCESS_KEY=',
+  'AWS_SESSION_TOKEN=',
+  'AWS_S3_BUCKET=',
+  'AWS_S3_ENDPOINT=',
+  'AWS_S3_URL=',
+  'AWS_S3_USE_PATH_STYLE_URL=false',
+  'AWS_SQS_QUEUE_URL=',
+  '',
+  'R2_ACCESS_KEY_ID=',
+  'R2_SECRET_ACCESS_KEY=',
+  'R2_REGION=',
+  'R2_BUCKET=',
+  'R2_ENDPOINT=',
+  'R2_URL=',
+  'R2_BINDING=',
+  '',
+  'GCS_PROJECT_ID=',
+  'GCS_KEY_FILE=',
+  'GCS_BUCKET=',
+  'GCS_URL=',
+  '',
+  '# ============================================================================',
+  '# BROADCAST',
+  '# ============================================================================',
+  '',
+  'BROADCAST_CONNECTION=inmemory',
+  'PUSHER_APP_ID=',
+  'PUSHER_APP_KEY=',
+  'PUSHER_APP_SECRET=',
+  'PUSHER_APP_CLUSTER=',
+  'PUSHER_USE_TLS=true',
+  'BROADCAST_REDIS_HOST=',
+  'BROADCAST_REDIS_PORT=',
+  'BROADCAST_REDIS_PASSWORD=',
+  'BROADCAST_CHANNEL_PREFIX=broadcast:',
+  '',
+];
+
+const NotificationsAndObservability = (): string[] => [
+  '# ============================================================================',
+  '# NOTIFICATIONS',
+  '# ============================================================================',
+  '',
+  'NOTIFICATION_CONNECTION=console',
+  'TERMII_API_KEY=',
+  'TERMII_SENDER=ZinTrust',
+  'TERMII_ENDPOINT=https://api.termii.com/sms/send',
+  'TWILIO_ACCOUNT_SID=',
+  'TWILIO_AUTH_TOKEN=',
+  'TWILIO_FROM_NUMBER=',
+  'SLACK_WEBHOOK_URL=',
+  '',
+  '# ============================================================================',
+  '# OBSERVABILITY (optional)',
+  '# ============================================================================',
+  '',
+  'OTEL_ENABLED=false',
+  'OTEL_EXPORTER_OTLP_ENDPOINT=',
+  'TRACING_EXPORT_INTERVAL=',
+  'JAEGER_AGENT_HOST=',
+  '',
+  '# ============================================================================',
+  '# CI / SCANNING (optional)',
+  '# ============================================================================',
+  '',
+  'SNYK_TOKEN=',
+  'SONAR_ORGANIZATION=',
+  'SONAR_PROJECT_ID=',
+  'SONAR_HOST_URL=',
+  'SONAR_TOKEN=',
+  'CODECOV_TOKEN=',
+  '',
+];
+
+export const EnvData = (
+  name: string,
+  port: number,
+  baseUrl: string,
+  appKey: string,
+  databaseNormalized: string,
+  dbLines: string[],
+  sqliteDbPath: string
+): string[] => [
+  ...HeaderAndApp(name, port, baseUrl, appKey),
+  ...SecurityAndDeployment(),
+  ...DatabaseAndCloudflare(databaseNormalized, dbLines, sqliteDbPath),
+  ...HttpProxies(),
+  ...CacheAndRedis(),
+  ...QueueConfig(),
+  ...WorkersSchedulingAndSSE(),
+  ...LoggingAndMail(),
+  ...StorageAndBroadcast(),
+  ...NotificationsAndObservability(),
+];

package/src/cli/scaffolding/index.ts

@@ -0,0 +1,89 @@
+/**
+ * Scaffolding Module Exports
+ */
+
+export { ControllerGenerator } from '@cli/scaffolding/ControllerGenerator';
+export type {
+  ControllerGeneratorResult,
+  ControllerOptions,
+  ControllerType,
+} from '@cli/scaffolding/ControllerGenerator';
+export { FactoryGenerator } from '@cli/scaffolding/FactoryGenerator';
+export type {
+  FactoryField,
+  FactoryGeneratorResult,
+  FactoryOptions,
+} from '@cli/scaffolding/FactoryGenerator';
+export { FeatureScaffolder } from '@cli/scaffolding/FeatureScaffolder';
+export type {
+  FeatureOptions,
+  FeatureScaffoldResult,
+  FeatureType,
+} from '@cli/scaffolding/FeatureScaffolder';
+export { FileGenerator } from '@cli/scaffolding/FileGenerator';
+export type { FileCreationOptions } from '@cli/scaffolding/FileGenerator';
+export { GovernanceScaffolder } from '@cli/scaffolding/GovernanceScaffolder';
+export type {
+  GovernanceScaffoldOptions,
+  GovernanceScaffoldResult,
+} from '@cli/scaffolding/GovernanceScaffolder';
+export { MigrationGenerator } from '@cli/scaffolding/MigrationGenerator';
+export type {
+  MigrationOptions,
+  MigrationScaffoldResult,
+} from '@cli/scaffolding/MigrationGenerator';
+export { ModelGenerator } from '@cli/scaffolding/ModelGenerator';
+export type {
+  FieldType,
+  ModelField,
+  ModelGeneratorResult,
+  ModelOptions,
+  ModelRelationship,
+} from '@cli/scaffolding/ModelGenerator';
+export { ProjectScaffolder } from '@cli/scaffolding/ProjectScaffolder';
+export type {
+  ProjectScaffoldOptions,
+  ProjectScaffoldResult,
+} from '@cli/scaffolding/ProjectScaffolder';
+export { RequestFactoryGenerator } from '@cli/scaffolding/RequestFactoryGenerator';
+export type {
+  RequestFactoryGeneratorResult,
+  RequestFactoryOptions,
+  RequestField,
+} from '@cli/scaffolding/RequestFactoryGenerator';
+export { ResponseFactoryGenerator } from '@cli/scaffolding/ResponseFactoryGenerator';
+export type {
+  ResponseFactoryGeneratorResult,
+  ResponseFactoryOptions,
+  ResponseField,
+} from '@cli/scaffolding/ResponseFactoryGenerator';
+export { RouteGenerator } from '@cli/scaffolding/RouteGenerator';
+export type {
+  RouteDefinition,
+  RouteGeneratorResult,
+  RouteMethod,
+  RouteOptions,
+} from '@cli/scaffolding/RouteGenerator';
+export { SeederGenerator } from '@cli/scaffolding/SeederGenerator';
+export type {
+  SeederField,
+  SeederGeneratorResult,
+  SeederOptions,
+} from '@cli/scaffolding/SeederGenerator';
+export { ServiceIntegrationTestGenerator } from '@cli/scaffolding/ServiceIntegrationTestGenerator';
+export type {
+  ServiceEndpoint,
+  ServiceIntegrationTestOptions,
+  ServiceIntegrationTestResult,
+} from '@cli/scaffolding/ServiceIntegrationTestGenerator';
+export { ServiceRequestFactoryGenerator } from '@cli/scaffolding/ServiceRequestFactoryGenerator';
+export type {
+  ServiceRequestFactoryResult,
+  ServiceRequestField,
+  ServiceRequestOptions,
+} from '@cli/scaffolding/ServiceRequestFactoryGenerator';
+export { ServiceScaffolder } from '@cli/scaffolding/ServiceScaffolder';
+export type { ServiceOptions, ServiceScaffoldResult } from '@cli/scaffolding/ServiceScaffolder';
+export { BUILT_IN_TEMPLATES, TemplateEngine } from '@cli/scaffolding/TemplateEngine';
+export type { Template, TemplateFile, TemplateVariables } from '@cli/scaffolding/TemplateEngine';
+export { TemplateGenerator } from '@cli/scaffolding/TemplateGenerator';