@authrim/setup 0.1.0

package/dist/core/config.d.ts

@@ -0,0 +1,891 @@
+/**
+ * Authrim Configuration Schema
+ *
+ * This module defines the configuration schema using Zod for type safety
+ * and validation. The configuration is stored in authrim-config.json.
+ */
+import { z } from 'zod';
+export declare const UrlConfigSchema: z.ZodObject<{
+    /** Custom domain (null = use auto-generated URL) */
+    custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    /** Auto-generated URL (workers.dev or pages.dev) */
+    auto: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    custom?: string | null | undefined;
+    auto?: string | undefined;
+}, {
+    custom?: string | null | undefined;
+    auto?: string | undefined;
+}>;
+export declare const UrlsConfigSchema: z.ZodObject<{
+    /** API / OIDC issuer URL */
+    api: z.ZodObject<{
+        /** Custom domain (null = use auto-generated URL) */
+        custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        /** Auto-generated URL (workers.dev or pages.dev) */
+        auto: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    }, {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    }>;
+    /** Login UI URL */
+    loginUi: z.ZodObject<{
+        /** Custom domain (null = use auto-generated URL) */
+        custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        /** Auto-generated URL (workers.dev or pages.dev) */
+        auto: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    }, {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    }>;
+    /** Admin UI URL */
+    adminUi: z.ZodObject<{
+        /** Custom domain (null = use auto-generated URL) */
+        custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        /** Auto-generated URL (workers.dev or pages.dev) */
+        auto: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    }, {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    api: {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    };
+    loginUi: {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    };
+    adminUi: {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    };
+}, {
+    api: {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    };
+    loginUi: {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    };
+    adminUi: {
+        custom?: string | null | undefined;
+        auto?: string | undefined;
+    };
+}>;
+export declare const SourceInfoSchema: z.ZodObject<{
+    /** GitHub repository (e.g., "sgrastar/authrim") */
+    repository: z.ZodString;
+    /** Git reference (tag or branch) */
+    gitRef: z.ZodString;
+    /** Full commit hash */
+    commitHash: z.ZodString;
+    /** SHA256 hash of the source artifact */
+    artifactHash: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    repository: string;
+    gitRef: string;
+    commitHash: string;
+    artifactHash?: string | undefined;
+}, {
+    repository: string;
+    gitRef: string;
+    commitHash: string;
+    artifactHash?: string | undefined;
+}>;
+export declare const EnvironmentConfigSchema: z.ZodObject<{
+    /** Environment prefix (e.g., "prod", "staging", "dev") */
+    prefix: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    prefix: string;
+}, {
+    prefix: string;
+}>;
+export declare const TenantConfigSchema: z.ZodObject<{
+    /** Tenant identifier */
+    name: z.ZodDefault<z.ZodString>;
+    /** Human-readable tenant name */
+    displayName: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    displayName: string;
+}, {
+    name?: string | undefined;
+    displayName?: string | undefined;
+}>;
+export declare const ComponentsConfigSchema: z.ZodObject<{
+    /** Core API components (always enabled) */
+    api: z.ZodDefault<z.ZodBoolean>;
+    /** Login UI component */
+    loginUi: z.ZodDefault<z.ZodBoolean>;
+    /** Admin UI component */
+    adminUi: z.ZodDefault<z.ZodBoolean>;
+    /** SAML IdP/SP support */
+    saml: z.ZodDefault<z.ZodBoolean>;
+    /** Async queue processing */
+    async: z.ZodDefault<z.ZodBoolean>;
+    /** Verifiable Credentials */
+    vc: z.ZodDefault<z.ZodBoolean>;
+    /** External IdP Bridge */
+    bridge: z.ZodDefault<z.ZodBoolean>;
+    /** ReBAC Policy service */
+    policy: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    api: boolean;
+    loginUi: boolean;
+    adminUi: boolean;
+    saml: boolean;
+    async: boolean;
+    vc: boolean;
+    bridge: boolean;
+    policy: boolean;
+}, {
+    api?: boolean | undefined;
+    loginUi?: boolean | undefined;
+    adminUi?: boolean | undefined;
+    saml?: boolean | undefined;
+    async?: boolean | undefined;
+    vc?: boolean | undefined;
+    bridge?: boolean | undefined;
+    policy?: boolean | undefined;
+}>;
+export declare const OidcConfigSchema: z.ZodObject<{
+    /** Access token TTL in seconds */
+    accessTokenTtl: z.ZodDefault<z.ZodNumber>;
+    /** Refresh token TTL in seconds */
+    refreshTokenTtl: z.ZodDefault<z.ZodNumber>;
+    /** Authorization code TTL in seconds */
+    authCodeTtl: z.ZodDefault<z.ZodNumber>;
+    /** Require PKCE for all clients */
+    pkceRequired: z.ZodDefault<z.ZodBoolean>;
+    /** Supported response types */
+    responseTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Supported grant types */
+    grantTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    accessTokenTtl: number;
+    refreshTokenTtl: number;
+    authCodeTtl: number;
+    pkceRequired: boolean;
+    responseTypes: string[];
+    grantTypes: string[];
+}, {
+    accessTokenTtl?: number | undefined;
+    refreshTokenTtl?: number | undefined;
+    authCodeTtl?: number | undefined;
+    pkceRequired?: boolean | undefined;
+    responseTypes?: string[] | undefined;
+    grantTypes?: string[] | undefined;
+}>;
+export declare const ShardingConfigSchema: z.ZodObject<{
+    /** Number of authorization code store shards */
+    authCodeShards: z.ZodDefault<z.ZodNumber>;
+    /** Number of refresh token rotator shards */
+    refreshTokenShards: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    authCodeShards: number;
+    refreshTokenShards: number;
+}, {
+    authCodeShards?: number | undefined;
+    refreshTokenShards?: number | undefined;
+}>;
+export declare const QueueFeatureSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+}, {
+    enabled?: boolean | undefined;
+}>;
+export declare const R2FeatureSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+}, {
+    enabled?: boolean | undefined;
+}>;
+export declare const EmailFeatureSchema: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodEnum<["none", "resend", "sendgrid", "ses"]>>;
+}, "strip", z.ZodTypeAny, {
+    provider: "none" | "resend" | "sendgrid" | "ses";
+}, {
+    provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+}>;
+export declare const FeaturesConfigSchema: z.ZodObject<{
+    queue: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+    }, {
+        enabled?: boolean | undefined;
+    }>>;
+    r2: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+    }, {
+        enabled?: boolean | undefined;
+    }>>;
+    email: z.ZodDefault<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodEnum<["none", "resend", "sendgrid", "ses"]>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "none" | "resend" | "sendgrid" | "ses";
+    }, {
+        provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    queue: {
+        enabled: boolean;
+    };
+    r2: {
+        enabled: boolean;
+    };
+    email: {
+        provider: "none" | "resend" | "sendgrid" | "ses";
+    };
+}, {
+    queue?: {
+        enabled?: boolean | undefined;
+    } | undefined;
+    r2?: {
+        enabled?: boolean | undefined;
+    } | undefined;
+    email?: {
+        provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+    } | undefined;
+}>;
+export declare const KeysConfigSchema: z.ZodObject<{
+    /** Key ID (kid) for JWK */
+    keyId: z.ZodOptional<z.ZodString>;
+    /** Public key in JWK format */
+    publicKeyJwk: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    /** Path to secrets directory */
+    secretsPath: z.ZodDefault<z.ZodString>;
+    /** Whether to include secrets in config (not recommended) */
+    includeSecrets: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    secretsPath: string;
+    includeSecrets: boolean;
+    keyId?: string | undefined;
+    publicKeyJwk?: Record<string, unknown> | undefined;
+}, {
+    keyId?: string | undefined;
+    publicKeyJwk?: Record<string, unknown> | undefined;
+    secretsPath?: string | undefined;
+    includeSecrets?: boolean | undefined;
+}>;
+export declare const CloudflareConfigSchema: z.ZodObject<{
+    /** Cloudflare account ID */
+    accountId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    accountId?: string | undefined;
+}, {
+    accountId?: string | undefined;
+}>;
+export declare const ProfileSchema: z.ZodEnum<["basic-op", "fapi-rw", "fapi2-security"]>;
+export declare const AuthrimConfigSchema: z.ZodObject<{
+    /** Configuration schema version */
+    version: z.ZodDefault<z.ZodString>;
+    /** Creation timestamp */
+    createdAt: z.ZodOptional<z.ZodString>;
+    /** Last update timestamp */
+    updatedAt: z.ZodOptional<z.ZodString>;
+    /** Source information */
+    source: z.ZodOptional<z.ZodObject<{
+        /** GitHub repository (e.g., "sgrastar/authrim") */
+        repository: z.ZodString;
+        /** Git reference (tag or branch) */
+        gitRef: z.ZodString;
+        /** Full commit hash */
+        commitHash: z.ZodString;
+        /** SHA256 hash of the source artifact */
+        artifactHash: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        repository: string;
+        gitRef: string;
+        commitHash: string;
+        artifactHash?: string | undefined;
+    }, {
+        repository: string;
+        gitRef: string;
+        commitHash: string;
+        artifactHash?: string | undefined;
+    }>>;
+    /** Environment configuration */
+    environment: z.ZodObject<{
+        /** Environment prefix (e.g., "prod", "staging", "dev") */
+        prefix: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        prefix: string;
+    }, {
+        prefix: string;
+    }>;
+    /** URL configuration */
+    urls: z.ZodOptional<z.ZodObject<{
+        /** API / OIDC issuer URL */
+        api: z.ZodObject<{
+            /** Custom domain (null = use auto-generated URL) */
+            custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            /** Auto-generated URL (workers.dev or pages.dev) */
+            auto: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        }, {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        }>;
+        /** Login UI URL */
+        loginUi: z.ZodObject<{
+            /** Custom domain (null = use auto-generated URL) */
+            custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            /** Auto-generated URL (workers.dev or pages.dev) */
+            auto: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        }, {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        }>;
+        /** Admin UI URL */
+        adminUi: z.ZodObject<{
+            /** Custom domain (null = use auto-generated URL) */
+            custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            /** Auto-generated URL (workers.dev or pages.dev) */
+            auto: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        }, {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        api: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        loginUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        adminUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+    }, {
+        api: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        loginUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        adminUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+    }>>;
+    /** Tenant configuration */
+    tenant: z.ZodDefault<z.ZodObject<{
+        /** Tenant identifier */
+        name: z.ZodDefault<z.ZodString>;
+        /** Human-readable tenant name */
+        displayName: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        displayName: string;
+    }, {
+        name?: string | undefined;
+        displayName?: string | undefined;
+    }>>;
+    /** Enabled components */
+    components: z.ZodDefault<z.ZodObject<{
+        /** Core API components (always enabled) */
+        api: z.ZodDefault<z.ZodBoolean>;
+        /** Login UI component */
+        loginUi: z.ZodDefault<z.ZodBoolean>;
+        /** Admin UI component */
+        adminUi: z.ZodDefault<z.ZodBoolean>;
+        /** SAML IdP/SP support */
+        saml: z.ZodDefault<z.ZodBoolean>;
+        /** Async queue processing */
+        async: z.ZodDefault<z.ZodBoolean>;
+        /** Verifiable Credentials */
+        vc: z.ZodDefault<z.ZodBoolean>;
+        /** External IdP Bridge */
+        bridge: z.ZodDefault<z.ZodBoolean>;
+        /** ReBAC Policy service */
+        policy: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        api: boolean;
+        loginUi: boolean;
+        adminUi: boolean;
+        saml: boolean;
+        async: boolean;
+        vc: boolean;
+        bridge: boolean;
+        policy: boolean;
+    }, {
+        api?: boolean | undefined;
+        loginUi?: boolean | undefined;
+        adminUi?: boolean | undefined;
+        saml?: boolean | undefined;
+        async?: boolean | undefined;
+        vc?: boolean | undefined;
+        bridge?: boolean | undefined;
+        policy?: boolean | undefined;
+    }>>;
+    /** OIDC profile */
+    profile: z.ZodDefault<z.ZodEnum<["basic-op", "fapi-rw", "fapi2-security"]>>;
+    /** OIDC settings */
+    oidc: z.ZodDefault<z.ZodObject<{
+        /** Access token TTL in seconds */
+        accessTokenTtl: z.ZodDefault<z.ZodNumber>;
+        /** Refresh token TTL in seconds */
+        refreshTokenTtl: z.ZodDefault<z.ZodNumber>;
+        /** Authorization code TTL in seconds */
+        authCodeTtl: z.ZodDefault<z.ZodNumber>;
+        /** Require PKCE for all clients */
+        pkceRequired: z.ZodDefault<z.ZodBoolean>;
+        /** Supported response types */
+        responseTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Supported grant types */
+        grantTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        accessTokenTtl: number;
+        refreshTokenTtl: number;
+        authCodeTtl: number;
+        pkceRequired: boolean;
+        responseTypes: string[];
+        grantTypes: string[];
+    }, {
+        accessTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        authCodeTtl?: number | undefined;
+        pkceRequired?: boolean | undefined;
+        responseTypes?: string[] | undefined;
+        grantTypes?: string[] | undefined;
+    }>>;
+    /** Sharding configuration */
+    sharding: z.ZodDefault<z.ZodObject<{
+        /** Number of authorization code store shards */
+        authCodeShards: z.ZodDefault<z.ZodNumber>;
+        /** Number of refresh token rotator shards */
+        refreshTokenShards: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        authCodeShards: number;
+        refreshTokenShards: number;
+    }, {
+        authCodeShards?: number | undefined;
+        refreshTokenShards?: number | undefined;
+    }>>;
+    /** Feature flags */
+    features: z.ZodDefault<z.ZodObject<{
+        queue: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+        }, {
+            enabled?: boolean | undefined;
+        }>>;
+        r2: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+        }, {
+            enabled?: boolean | undefined;
+        }>>;
+        email: z.ZodDefault<z.ZodObject<{
+            provider: z.ZodDefault<z.ZodEnum<["none", "resend", "sendgrid", "ses"]>>;
+        }, "strip", z.ZodTypeAny, {
+            provider: "none" | "resend" | "sendgrid" | "ses";
+        }, {
+            provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        queue: {
+            enabled: boolean;
+        };
+        r2: {
+            enabled: boolean;
+        };
+        email: {
+            provider: "none" | "resend" | "sendgrid" | "ses";
+        };
+    }, {
+        queue?: {
+            enabled?: boolean | undefined;
+        } | undefined;
+        r2?: {
+            enabled?: boolean | undefined;
+        } | undefined;
+        email?: {
+            provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+        } | undefined;
+    }>>;
+    /** Key configuration */
+    keys: z.ZodDefault<z.ZodObject<{
+        /** Key ID (kid) for JWK */
+        keyId: z.ZodOptional<z.ZodString>;
+        /** Public key in JWK format */
+        publicKeyJwk: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** Path to secrets directory */
+        secretsPath: z.ZodDefault<z.ZodString>;
+        /** Whether to include secrets in config (not recommended) */
+        includeSecrets: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        secretsPath: string;
+        includeSecrets: boolean;
+        keyId?: string | undefined;
+        publicKeyJwk?: Record<string, unknown> | undefined;
+    }, {
+        keyId?: string | undefined;
+        publicKeyJwk?: Record<string, unknown> | undefined;
+        secretsPath?: string | undefined;
+        includeSecrets?: boolean | undefined;
+    }>>;
+    /** Cloudflare configuration */
+    cloudflare: z.ZodDefault<z.ZodObject<{
+        /** Cloudflare account ID */
+        accountId: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        accountId?: string | undefined;
+    }, {
+        accountId?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    keys: {
+        secretsPath: string;
+        includeSecrets: boolean;
+        keyId?: string | undefined;
+        publicKeyJwk?: Record<string, unknown> | undefined;
+    };
+    version: string;
+    environment: {
+        prefix: string;
+    };
+    tenant: {
+        name: string;
+        displayName: string;
+    };
+    components: {
+        api: boolean;
+        loginUi: boolean;
+        adminUi: boolean;
+        saml: boolean;
+        async: boolean;
+        vc: boolean;
+        bridge: boolean;
+        policy: boolean;
+    };
+    profile: "basic-op" | "fapi-rw" | "fapi2-security";
+    oidc: {
+        accessTokenTtl: number;
+        refreshTokenTtl: number;
+        authCodeTtl: number;
+        pkceRequired: boolean;
+        responseTypes: string[];
+        grantTypes: string[];
+    };
+    sharding: {
+        authCodeShards: number;
+        refreshTokenShards: number;
+    };
+    features: {
+        queue: {
+            enabled: boolean;
+        };
+        r2: {
+            enabled: boolean;
+        };
+        email: {
+            provider: "none" | "resend" | "sendgrid" | "ses";
+        };
+    };
+    cloudflare: {
+        accountId?: string | undefined;
+    };
+    createdAt?: string | undefined;
+    updatedAt?: string | undefined;
+    source?: {
+        repository: string;
+        gitRef: string;
+        commitHash: string;
+        artifactHash?: string | undefined;
+    } | undefined;
+    urls?: {
+        api: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        loginUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        adminUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+    } | undefined;
+}, {
+    environment: {
+        prefix: string;
+    };
+    keys?: {
+        keyId?: string | undefined;
+        publicKeyJwk?: Record<string, unknown> | undefined;
+        secretsPath?: string | undefined;
+        includeSecrets?: boolean | undefined;
+    } | undefined;
+    version?: string | undefined;
+    createdAt?: string | undefined;
+    updatedAt?: string | undefined;
+    source?: {
+        repository: string;
+        gitRef: string;
+        commitHash: string;
+        artifactHash?: string | undefined;
+    } | undefined;
+    urls?: {
+        api: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        loginUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        adminUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+    } | undefined;
+    tenant?: {
+        name?: string | undefined;
+        displayName?: string | undefined;
+    } | undefined;
+    components?: {
+        api?: boolean | undefined;
+        loginUi?: boolean | undefined;
+        adminUi?: boolean | undefined;
+        saml?: boolean | undefined;
+        async?: boolean | undefined;
+        vc?: boolean | undefined;
+        bridge?: boolean | undefined;
+        policy?: boolean | undefined;
+    } | undefined;
+    profile?: "basic-op" | "fapi-rw" | "fapi2-security" | undefined;
+    oidc?: {
+        accessTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        authCodeTtl?: number | undefined;
+        pkceRequired?: boolean | undefined;
+        responseTypes?: string[] | undefined;
+        grantTypes?: string[] | undefined;
+    } | undefined;
+    sharding?: {
+        authCodeShards?: number | undefined;
+        refreshTokenShards?: number | undefined;
+    } | undefined;
+    features?: {
+        queue?: {
+            enabled?: boolean | undefined;
+        } | undefined;
+        r2?: {
+            enabled?: boolean | undefined;
+        } | undefined;
+        email?: {
+            provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+        } | undefined;
+    } | undefined;
+    cloudflare?: {
+        accountId?: string | undefined;
+    } | undefined;
+}>;
+export type AuthrimConfig = z.infer<typeof AuthrimConfigSchema>;
+export type UrlConfig = z.infer<typeof UrlConfigSchema>;
+export type UrlsConfig = z.infer<typeof UrlsConfigSchema>;
+export type SourceInfo = z.infer<typeof SourceInfoSchema>;
+export type EnvironmentConfig = z.infer<typeof EnvironmentConfigSchema>;
+export type TenantConfig = z.infer<typeof TenantConfigSchema>;
+export type ComponentsConfig = z.infer<typeof ComponentsConfigSchema>;
+export type OidcConfig = z.infer<typeof OidcConfigSchema>;
+export type ShardingConfig = z.infer<typeof ShardingConfigSchema>;
+export type FeaturesConfig = z.infer<typeof FeaturesConfigSchema>;
+export type KeysConfig = z.infer<typeof KeysConfigSchema>;
+export type CloudflareConfig = z.infer<typeof CloudflareConfigSchema>;
+export type Profile = z.infer<typeof ProfileSchema>;
+/**
+ * Create a default configuration with minimal settings
+ */
+export declare function createDefaultConfig(prefix: string): AuthrimConfig;
+/**
+ * Validate and parse a configuration object
+ */
+export declare function parseConfig(data: unknown): AuthrimConfig;
+/**
+ * Safely validate a configuration object (returns result instead of throwing)
+ */
+export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
+    environment: {
+        prefix: string;
+    };
+    keys?: {
+        keyId?: string | undefined;
+        publicKeyJwk?: Record<string, unknown> | undefined;
+        secretsPath?: string | undefined;
+        includeSecrets?: boolean | undefined;
+    } | undefined;
+    version?: string | undefined;
+    createdAt?: string | undefined;
+    updatedAt?: string | undefined;
+    source?: {
+        repository: string;
+        gitRef: string;
+        commitHash: string;
+        artifactHash?: string | undefined;
+    } | undefined;
+    urls?: {
+        api: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        loginUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        adminUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+    } | undefined;
+    tenant?: {
+        name?: string | undefined;
+        displayName?: string | undefined;
+    } | undefined;
+    components?: {
+        api?: boolean | undefined;
+        loginUi?: boolean | undefined;
+        adminUi?: boolean | undefined;
+        saml?: boolean | undefined;
+        async?: boolean | undefined;
+        vc?: boolean | undefined;
+        bridge?: boolean | undefined;
+        policy?: boolean | undefined;
+    } | undefined;
+    profile?: "basic-op" | "fapi-rw" | "fapi2-security" | undefined;
+    oidc?: {
+        accessTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        authCodeTtl?: number | undefined;
+        pkceRequired?: boolean | undefined;
+        responseTypes?: string[] | undefined;
+        grantTypes?: string[] | undefined;
+    } | undefined;
+    sharding?: {
+        authCodeShards?: number | undefined;
+        refreshTokenShards?: number | undefined;
+    } | undefined;
+    features?: {
+        queue?: {
+            enabled?: boolean | undefined;
+        } | undefined;
+        r2?: {
+            enabled?: boolean | undefined;
+        } | undefined;
+        email?: {
+            provider?: "none" | "resend" | "sendgrid" | "ses" | undefined;
+        } | undefined;
+    } | undefined;
+    cloudflare?: {
+        accountId?: string | undefined;
+    } | undefined;
+}, {
+    keys: {
+        secretsPath: string;
+        includeSecrets: boolean;
+        keyId?: string | undefined;
+        publicKeyJwk?: Record<string, unknown> | undefined;
+    };
+    version: string;
+    environment: {
+        prefix: string;
+    };
+    tenant: {
+        name: string;
+        displayName: string;
+    };
+    components: {
+        api: boolean;
+        loginUi: boolean;
+        adminUi: boolean;
+        saml: boolean;
+        async: boolean;
+        vc: boolean;
+        bridge: boolean;
+        policy: boolean;
+    };
+    profile: "basic-op" | "fapi-rw" | "fapi2-security";
+    oidc: {
+        accessTokenTtl: number;
+        refreshTokenTtl: number;
+        authCodeTtl: number;
+        pkceRequired: boolean;
+        responseTypes: string[];
+        grantTypes: string[];
+    };
+    sharding: {
+        authCodeShards: number;
+        refreshTokenShards: number;
+    };
+    features: {
+        queue: {
+            enabled: boolean;
+        };
+        r2: {
+            enabled: boolean;
+        };
+        email: {
+            provider: "none" | "resend" | "sendgrid" | "ses";
+        };
+    };
+    cloudflare: {
+        accountId?: string | undefined;
+    };
+    createdAt?: string | undefined;
+    updatedAt?: string | undefined;
+    source?: {
+        repository: string;
+        gitRef: string;
+        commitHash: string;
+        artifactHash?: string | undefined;
+    } | undefined;
+    urls?: {
+        api: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        loginUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+        adminUi: {
+            custom?: string | null | undefined;
+            auto?: string | undefined;
+        };
+    } | undefined;
+}>;
+//# sourceMappingURL=config.d.ts.map