nucleus-core-ts 0.9.749 → 0.9.751

package/dist/src/Client/ApiCaller/types.d.ts

@@ -1490,6 +1490,7 @@ export type ResolvedEnvEntry = {
     envName: string;
     resolved: boolean;
     value: string | null;
+    isSecret: boolean;
 };
 export type ConfigGetResponse = StandardReturn<{
     config: Record<string, unknown>;

package/dist/src/ElysiaPlugin/routes/config/helpers.d.ts

@@ -1,6 +1,7 @@
 import type { NucleusConfigOptions } from '@types';
 import type { ConfigSectionMeta, ResolvedEnvEntry } from './types';
 export declare const maskUrlCredentials: (value: string) => string;
+export declare const looksSecretValue: (value: string) => boolean;
 export declare const maskSensitiveFields: (obj: Record<string, unknown>) => Record<string, unknown>;
 export declare const buildSectionsMeta: (config: NucleusConfigOptions) => ConfigSectionMeta[];
 export declare const extractSection: (config: NucleusConfigOptions, section: string) => unknown;
@@ -8,6 +9,7 @@ export declare const hasSection: (config: NucleusConfigOptions, section: string)
 export declare const applySectionUpdate: (config: NucleusConfigOptions, section: string, value: unknown) => void;
 export declare const isRestartRequired: (section: string) => boolean;
 export declare const scanEnvVars: (obj: Record<string, unknown>, parentPath?: string) => ResolvedEnvEntry[];
+export declare const scanUndeclaredEnv: (declaredNames: Set<string>) => ResolvedEnvEntry[];
 export declare const persistConfigToDisk: (configFilePath: string, config: NucleusConfigOptions) => Promise<void>;
 /**
  * Persist a single section override to Redis.

package/dist/src/ElysiaPlugin/routes/config/types.d.ts

@@ -12,13 +12,26 @@ export type ConfigSectionMeta = {
     restartRequired: boolean;
 };
 /**
- * A single resolved env var entry found by scanning the config tree.
+ * A single env var entry surfaced by GET /env.
+ *
+ * `recognized` distinguishes the two sources:
+ *  - `true`  — a DECLARED config field (the env var is referenced by the config
+ *    tree, found by `scanEnvVars`).
+ *  - `false` — present in `process.env` but NOT declared (orphaned / dead /
+ *    misconfigured "junk" surfaced by `scanUndeclaredEnv`, minus infra noise).
  */
 export type ResolvedEnvEntry = {
     configPath: string;
     envName: string;
     resolved: boolean;
     value: string | null;
+    /**
+     * Whether this entry is a secret — set when the KEY name is sensitive OR the
+     * VALUE is high-entropy/encoded (base64 SA key, PEM, ...). Drives the key icon
+     * in the Config Manager and guarantees the `value` above is masked.
+     */
+    isSecret: boolean;
+    recognized: boolean;
 };
 /**
  * GET /  — full config (masked)
@@ -62,6 +75,8 @@ export type ConfigEnvResponse = StandardReturn<{
     totalCount: number;
     resolvedCount: number;
     missingCount: number;
+    /** Count of `recognized:false` entries — env vars present but not declared. */
+    unrecognizedCount: number;
 }>;
 /**
  * GET /overrides

package/dist/src/ElysiaPlugin/signNewAccessToken.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/ElysiaPlugin/utils.d.ts

@@ -7,7 +7,14 @@ export declare function parseTokenValuesFromHeaders(headers: Headers, tokenNames
 export declare function initiateRedisManager(config: NucleusConfigOptions): Promise<void>;
 export declare function getRedisManager(): RedisManager | null;
 export declare function parseTimeToSeconds(timeString: string | number): number;
-export declare function signNewAccessToken({ sessionData, options, refreshTokenId, roles, claims, tenant, claimScopes, }: {
+/**
+ * Browsers reject cookies larger than ~4096 bytes (name+value+attributes). We warn well before
+ * that so an oversized access-token cookie fails LOUD with actionable guidance instead of being
+ * silently dropped by the browser (the classic "logged in but every request is 401" symptom).
+ */
+export declare const COOKIE_SAFE_TOKEN_BYTES = 3500;
+export declare function warnIfAccessTokenTooLargeForCookie(token: string, jwtClaimsMode?: string): void;
+export declare function signNewAccessToken({ sessionData, options, refreshTokenId, roles, claims, tenant, claimScopes, resolveMode, }: {
     sessionData: SessionRecord;
     options: NucleusConfigOptions;
     refreshTokenId: string;
@@ -17,6 +24,13 @@ export declare function signNewAccessToken({ sessionData, options, refreshTokenI
     tenant?: string;
     /** Per-action ownership scope embedded so embed-mode consumers enforce row-level scope. */
     claimScopes?: Record<string, Record<string, unknown>>;
+    /**
+     * When true (authorization.jwtClaimsMode === 'resolve' with a live claims cache), claims and
+     * claimScopes are NOT embedded — consumers resolve them from the shared Redis claims cache.
+     * This MUST mirror the login-path signAccessToken helper, otherwise the silent proactive
+     * refresh re-bloats the access-token cookie with claims even in resolve mode.
+     */
+    resolveMode?: boolean;
 }): string;
 /**
  * Resolve the shared `pg` Pool options from `database.pool`, applying safe

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.749",
+	"version": "0.9.751",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",