@authrim/setup 0.1.140 → 0.1.142

package/dist/core/config.d.ts

@@ -7,21 +7,29 @@
 import { z } from 'zod';
 export declare const UrlConfigSchema: z.ZodObject<{
     /** Custom domain (null = use auto-generated URL) */
-    custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
     /** Auto-generated URL (workers.dev or pages.dev) */
-    auto: z.ZodOptional<z.ZodString>;
+    auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
+    /** Cloudflare zone ID for custom domain (populated during setup) */
+    zoneId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    /** Whether to configure Workers custom domain binding */
+    customDomainBinding: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     custom?: string | null | undefined;
     auto?: string | undefined;
+    zoneId?: string | null | undefined;
+    customDomainBinding?: boolean | undefined;
 }, {
     custom?: string | null | undefined;
     auto?: string | undefined;
+    zoneId?: string | null | undefined;
+    customDomainBinding?: boolean | undefined;
 }>;
 export declare const UiUrlConfigSchema: z.ZodObject<{
     /** Custom domain (null = use auto-generated URL) */
-    custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
     /** Auto-generated URL (workers.dev or pages.dev) */
-    auto: z.ZodOptional<z.ZodString>;
+    auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
     /**
      * Whether to serve this UI from the same domain as the API via proxy
      * - true: UI is proxied through ar-router (e.g., https://api.example.com/admin)
@@ -41,22 +49,30 @@ export declare const UrlsConfigSchema: z.ZodObject<{
     /** API / OIDC issuer URL */
     api: z.ZodObject<{
         /** Custom domain (null = use auto-generated URL) */
-        custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
         /** Auto-generated URL (workers.dev or pages.dev) */
-        auto: z.ZodOptional<z.ZodString>;
+        auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
+        /** Cloudflare zone ID for custom domain (populated during setup) */
+        zoneId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        /** Whether to configure Workers custom domain binding */
+        customDomainBinding: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         custom?: string | null | undefined;
         auto?: string | undefined;
+        zoneId?: string | null | undefined;
+        customDomainBinding?: boolean | undefined;
     }, {
         custom?: string | null | undefined;
         auto?: string | undefined;
+        zoneId?: string | null | undefined;
+        customDomainBinding?: boolean | undefined;
     }>;
     /** Login UI URL */
     loginUi: z.ZodObject<{
         /** Custom domain (null = use auto-generated URL) */
-        custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
         /** Auto-generated URL (workers.dev or pages.dev) */
-        auto: z.ZodOptional<z.ZodString>;
+        auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /**
          * Whether to serve this UI from the same domain as the API via proxy
          * - true: UI is proxied through ar-router (e.g., https://api.example.com/admin)
@@ -75,9 +91,9 @@ export declare const UrlsConfigSchema: z.ZodObject<{
     /** Admin UI URL */
     adminUi: z.ZodObject<{
         /** Custom domain (null = use auto-generated URL) */
-        custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
         /** Auto-generated URL (workers.dev or pages.dev) */
-        auto: z.ZodOptional<z.ZodString>;
+        auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /**
          * Whether to serve this UI from the same domain as the API via proxy
          * - true: UI is proxied through ar-router (e.g., https://api.example.com/admin)
@@ -97,6 +113,8 @@ export declare const UrlsConfigSchema: z.ZodObject<{
     api: {
         custom?: string | null | undefined;
         auto?: string | undefined;
+        zoneId?: string | null | undefined;
+        customDomainBinding?: boolean | undefined;
     };
     loginUi: {
         sameAsApi: boolean;
@@ -112,6 +130,8 @@ export declare const UrlsConfigSchema: z.ZodObject<{
     api: {
         custom?: string | null | undefined;
         auto?: string | undefined;
+        zoneId?: string | null | undefined;
+        customDomainBinding?: boolean | undefined;
     };
     loginUi: {
         custom?: string | null | undefined;
@@ -152,32 +172,63 @@ export declare const EnvironmentConfigSchema: z.ZodObject<{
 }, {
     prefix: string;
 }>;
+/**
+ * User ID format options
+ * - nanoid: URL-safe 21-character IDs (default, recommended)
+ * - uuid: Standard UUID v4 format
+ */
+export declare const UserIdFormatSchema: z.ZodDefault<z.ZodEnum<["nanoid", "uuid"]>>;
 export declare const TenantConfigSchema: z.ZodObject<{
-    /** Default tenant identifier (used in single-tenant mode) */
+    /** Default tenant identifier */
     name: z.ZodDefault<z.ZodString>;
     /** Human-readable tenant/organization name */
     displayName: z.ZodDefault<z.ZodString>;
     /**
-     * Multi-tenant mode with subdomain-based tenant isolation
-     * - true: issuer = https://{tenant}.{baseDomain}
-     * - false: issuer = ISSUER_URL (single-tenant)
+     * @deprecated Multi-tenant mode is always enabled.
+     * Kept for backward compatibility during migration.
      */
     multiTenant: z.ZodDefault<z.ZodBoolean>;
     /**
-     * Base domain for multi-tenant mode (e.g., "authrim.com")
-     * Issuer URL will be: https://{tenant}.{baseDomain}
+     * Base domain (root domain only, e.g., "authrim.com", "example.com")
+     * All tenant domains are subdomains of this: {tenant}.{baseDomain}
      */
     baseDomain: z.ZodOptional<z.ZodString>;
+    /**
+     * User ID format for new users
+     * - nanoid: URL-safe 21-character IDs (default, recommended)
+     * - uuid: Standard UUID v4 format (36 characters with hyphens)
+     *
+     * Note: This setting cannot be changed after users are created.
+     */
+    userIdFormat: z.ZodDefault<z.ZodEnum<["nanoid", "uuid"]>>;
+    /**
+     * Primary tenant ID for naked domain access.
+     * When set, naked domain (e.g., example.com) routes to this tenant.
+     * When unset, naked domain routes to the default tenant (name field).
+     */
+    primaryTenant: z.ZodOptional<z.ZodString>;
+    /**
+     * Use naked domain as issuer URL.
+     * When true: https://example.com (no tenant subdomain)
+     * When false: https://tenant.example.com (with tenant subdomain)
+     */
+    nakedDomain: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     displayName: string;
     multiTenant: boolean;
+    userIdFormat: "nanoid" | "uuid";
     baseDomain?: string | undefined;
+    primaryTenant?: string | undefined;
+    nakedDomain?: boolean | undefined;
 }, {
     name?: string | undefined;
     displayName?: string | undefined;
     multiTenant?: boolean | undefined;
     baseDomain?: string | undefined;
+    userIdFormat?: "nanoid" | "uuid" | undefined;
+    primaryTenant?: string | undefined;
+    nakedDomain?: boolean | undefined;
 }>;
 export declare const ComponentsConfigSchema: z.ZodObject<{
     /** Core API components (always enabled) */
@@ -375,16 +426,24 @@ export declare const KeysConfigSchema: z.ZodObject<{
     /** Public key in JWK format */
     publicKeyJwk: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     /**
-     * Path to secrets directory (relative from config file location)
-     * - New structure (.authrim/{env}/): './keys/'
-     * - Legacy structure: './.keys/{env}/'
+     * Path to secrets directory
+     * - External (.authrim-keys/{env}/): absolute path
+     * - Internal (.authrim/{env}/keys/): './keys/'
+     * - Legacy (.keys/{env}/): './.keys/{env}/'
      */
     secretsPath: z.ZodDefault<z.ZodString>;
     /** Whether to include secrets in config (not recommended) */
     includeSecrets: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Key storage type
+     * - 'external': Keys stored in {cwd}/.authrim-keys/{env}/ (new default)
+     * - 'internal': Keys stored in .authrim/{env}/keys/ (within source)
+     */
+    storageType: z.ZodDefault<z.ZodOptional<z.ZodEnum<["internal", "external"]>>>;
 }, "strip", z.ZodTypeAny, {
     secretsPath: string;
     includeSecrets: boolean;
+    storageType: "internal" | "external";
     keyId?: string | undefined;
     publicKeyJwk?: Record<string, unknown> | undefined;
 }, {
@@ -392,6 +451,7 @@ export declare const KeysConfigSchema: z.ZodObject<{
     publicKeyJwk?: Record<string, unknown> | undefined;
     secretsPath?: string | undefined;
     includeSecrets?: boolean | undefined;
+    storageType?: "internal" | "external" | undefined;
 }>;
 export declare const CloudflareConfigSchema: z.ZodObject<{
     /** Cloudflare account ID */
@@ -530,22 +590,30 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         /** API / OIDC issuer URL */
         api: z.ZodObject<{
             /** Custom domain (null = use auto-generated URL) */
-            custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
             /** Auto-generated URL (workers.dev or pages.dev) */
-            auto: z.ZodOptional<z.ZodString>;
+            auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
+            /** Cloudflare zone ID for custom domain (populated during setup) */
+            zoneId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            /** Whether to configure Workers custom domain binding */
+            customDomainBinding: z.ZodOptional<z.ZodBoolean>;
         }, "strip", z.ZodTypeAny, {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         }, {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         }>;
         /** Login UI URL */
         loginUi: z.ZodObject<{
             /** Custom domain (null = use auto-generated URL) */
-            custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
             /** Auto-generated URL (workers.dev or pages.dev) */
-            auto: z.ZodOptional<z.ZodString>;
+            auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
             /**
              * Whether to serve this UI from the same domain as the API via proxy
              * - true: UI is proxied through ar-router (e.g., https://api.example.com/admin)
@@ -564,9 +632,9 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         /** Admin UI URL */
         adminUi: z.ZodObject<{
             /** Custom domain (null = use auto-generated URL) */
-            custom: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            custom: z.ZodOptional<z.ZodNullable<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>>;
             /** Auto-generated URL (workers.dev or pages.dev) */
-            auto: z.ZodOptional<z.ZodString>;
+            auto: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
             /**
              * Whether to serve this UI from the same domain as the API via proxy
              * - true: UI is proxied through ar-router (e.g., https://api.example.com/admin)
@@ -586,6 +654,8 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         api: {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         };
         loginUi: {
             sameAsApi: boolean;
@@ -601,6 +671,8 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         api: {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         };
         loginUi: {
             custom?: string | null | undefined;
@@ -615,31 +687,56 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
     }>>;
     /** Tenant configuration */
     tenant: z.ZodDefault<z.ZodObject<{
-        /** Default tenant identifier (used in single-tenant mode) */
+        /** Default tenant identifier */
         name: z.ZodDefault<z.ZodString>;
         /** Human-readable tenant/organization name */
         displayName: z.ZodDefault<z.ZodString>;
         /**
-         * Multi-tenant mode with subdomain-based tenant isolation
-         * - true: issuer = https://{tenant}.{baseDomain}
-         * - false: issuer = ISSUER_URL (single-tenant)
+         * @deprecated Multi-tenant mode is always enabled.
+         * Kept for backward compatibility during migration.
          */
         multiTenant: z.ZodDefault<z.ZodBoolean>;
         /**
-         * Base domain for multi-tenant mode (e.g., "authrim.com")
-         * Issuer URL will be: https://{tenant}.{baseDomain}
+         * Base domain (root domain only, e.g., "authrim.com", "example.com")
+         * All tenant domains are subdomains of this: {tenant}.{baseDomain}
          */
         baseDomain: z.ZodOptional<z.ZodString>;
+        /**
+         * User ID format for new users
+         * - nanoid: URL-safe 21-character IDs (default, recommended)
+         * - uuid: Standard UUID v4 format (36 characters with hyphens)
+         *
+         * Note: This setting cannot be changed after users are created.
+         */
+        userIdFormat: z.ZodDefault<z.ZodEnum<["nanoid", "uuid"]>>;
+        /**
+         * Primary tenant ID for naked domain access.
+         * When set, naked domain (e.g., example.com) routes to this tenant.
+         * When unset, naked domain routes to the default tenant (name field).
+         */
+        primaryTenant: z.ZodOptional<z.ZodString>;
+        /**
+         * Use naked domain as issuer URL.
+         * When true: https://example.com (no tenant subdomain)
+         * When false: https://tenant.example.com (with tenant subdomain)
+         */
+        nakedDomain: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
     }, "strip", z.ZodTypeAny, {
         name: string;
         displayName: string;
         multiTenant: boolean;
+        userIdFormat: "nanoid" | "uuid";
         baseDomain?: string | undefined;
+        primaryTenant?: string | undefined;
+        nakedDomain?: boolean | undefined;
     }, {
         name?: string | undefined;
         displayName?: string | undefined;
         multiTenant?: boolean | undefined;
         baseDomain?: string | undefined;
+        userIdFormat?: "nanoid" | "uuid" | undefined;
+        primaryTenant?: string | undefined;
+        nakedDomain?: boolean | undefined;
     }>>;
     /** Enabled components */
     components: z.ZodDefault<z.ZodObject<{
@@ -807,16 +904,24 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         /** Public key in JWK format */
         publicKeyJwk: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         /**
-         * Path to secrets directory (relative from config file location)
-         * - New structure (.authrim/{env}/): './keys/'
-         * - Legacy structure: './.keys/{env}/'
+         * Path to secrets directory
+         * - External (.authrim-keys/{env}/): absolute path
+         * - Internal (.authrim/{env}/keys/): './keys/'
+         * - Legacy (.keys/{env}/): './.keys/{env}/'
          */
         secretsPath: z.ZodDefault<z.ZodString>;
         /** Whether to include secrets in config (not recommended) */
         includeSecrets: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Key storage type
+         * - 'external': Keys stored in {cwd}/.authrim-keys/{env}/ (new default)
+         * - 'internal': Keys stored in .authrim/{env}/keys/ (within source)
+         */
+        storageType: z.ZodDefault<z.ZodOptional<z.ZodEnum<["internal", "external"]>>>;
     }, "strip", z.ZodTypeAny, {
         secretsPath: string;
         includeSecrets: boolean;
+        storageType: "internal" | "external";
         keyId?: string | undefined;
         publicKeyJwk?: Record<string, unknown> | undefined;
     }, {
@@ -824,6 +929,7 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         publicKeyJwk?: Record<string, unknown> | undefined;
         secretsPath?: string | undefined;
         includeSecrets?: boolean | undefined;
+        storageType?: "internal" | "external" | undefined;
     }>>;
     /** Cloudflare configuration */
     cloudflare: z.ZodDefault<z.ZodObject<{
@@ -910,6 +1016,7 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
     keys: {
         secretsPath: string;
         includeSecrets: boolean;
+        storageType: "internal" | "external";
         keyId?: string | undefined;
         publicKeyJwk?: Record<string, unknown> | undefined;
     };
@@ -921,7 +1028,10 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         name: string;
         displayName: string;
         multiTenant: boolean;
+        userIdFormat: "nanoid" | "uuid";
         baseDomain?: string | undefined;
+        primaryTenant?: string | undefined;
+        nakedDomain?: boolean | undefined;
     };
     components: {
         api: boolean;
@@ -992,6 +1102,8 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         api: {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         };
         loginUi: {
             sameAsApi: boolean;
@@ -1013,6 +1125,7 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         publicKeyJwk?: Record<string, unknown> | undefined;
         secretsPath?: string | undefined;
         includeSecrets?: boolean | undefined;
+        storageType?: "internal" | "external" | undefined;
     } | undefined;
     version?: string | undefined;
     createdAt?: string | undefined;
@@ -1027,6 +1140,8 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         api: {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         };
         loginUi: {
             custom?: string | null | undefined;
@@ -1044,6 +1159,9 @@ export declare const AuthrimConfigSchema: z.ZodObject<{
         displayName?: string | undefined;
         multiTenant?: boolean | undefined;
         baseDomain?: string | undefined;
+        userIdFormat?: "nanoid" | "uuid" | undefined;
+        primaryTenant?: string | undefined;
+        nakedDomain?: boolean | undefined;
     } | undefined;
     components?: {
         api?: boolean | undefined;
@@ -1142,6 +1260,7 @@ export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
         publicKeyJwk?: Record<string, unknown> | undefined;
         secretsPath?: string | undefined;
         includeSecrets?: boolean | undefined;
+        storageType?: "internal" | "external" | undefined;
     } | undefined;
     version?: string | undefined;
     createdAt?: string | undefined;
@@ -1156,6 +1275,8 @@ export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
         api: {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         };
         loginUi: {
             custom?: string | null | undefined;
@@ -1173,6 +1294,9 @@ export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
         displayName?: string | undefined;
         multiTenant?: boolean | undefined;
         baseDomain?: string | undefined;
+        userIdFormat?: "nanoid" | "uuid" | undefined;
+        primaryTenant?: string | undefined;
+        nakedDomain?: boolean | undefined;
     } | undefined;
     components?: {
         api?: boolean | undefined;
@@ -1235,6 +1359,7 @@ export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
     keys: {
         secretsPath: string;
         includeSecrets: boolean;
+        storageType: "internal" | "external";
         keyId?: string | undefined;
         publicKeyJwk?: Record<string, unknown> | undefined;
     };
@@ -1246,7 +1371,10 @@ export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
         name: string;
         displayName: string;
         multiTenant: boolean;
+        userIdFormat: "nanoid" | "uuid";
         baseDomain?: string | undefined;
+        primaryTenant?: string | undefined;
+        nakedDomain?: boolean | undefined;
     };
     components: {
         api: boolean;
@@ -1317,6 +1445,8 @@ export declare function safeParseConfig(data: unknown): z.SafeParseReturnType<{
         api: {
             custom?: string | null | undefined;
             auto?: string | undefined;
+            zoneId?: string | null | undefined;
+            customDomainBinding?: boolean | undefined;
         };
         loginUi: {
             sameAsApi: boolean;

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,eAAe;IAC1B,oDAAoD;;IAEpD,oDAAoD;;;;;;;;EAEpD,CAAC;AAEH,eAAO,MAAM,iBAAiB;IAC5B,oDAAoD;;IAEpD,oDAAoD;;IAEpD;;;;OAIG;;;;;;;;;;EAEH,CAAC;AAEH,eAAO,MAAM,gBAAgB;IAC3B,4BAA4B;;QApB5B,oDAAoD;;QAEpD,oDAAoD;;;;;;;;;IAoBpD,mBAAmB;;QAfnB,oDAAoD;;QAEpD,oDAAoD;;QAEpD;;;;WAIG;;;;;;;;;;;IASH,mBAAmB;;QAjBnB,oDAAoD;;QAEpD,oDAAoD;;QAEpD;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWH,CAAC;AAMH,eAAO,MAAM,gBAAgB;IAC3B,mDAAmD;;IAEnD,oCAAoC;;IAEpC,uBAAuB;;IAEvB,yCAAyC;;;;;;;;;;;;EAEzC,CAAC;AAMH,eAAO,MAAM,uBAAuB;IAClC,0DAA0D;;;;;;EAK1D,CAAC;AAMH,eAAO,MAAM,kBAAkB;IAC7B,6DAA6D;;IAE7D,8CAA8C;;IAE9C;;;;OAIG;;IAEH;;;OAGG;;;;;;;;;;;;EAEH,CAAC;AAMH,eAAO,MAAM,sBAAsB;IACjC,2CAA2C;;IAE3C,yBAAyB;;IAEzB,yBAAyB;;IAEzB,0BAA0B;;IAE1B,6BAA6B;;IAE7B,6BAA6B;;IAE7B,8DAA8D;;IAE9D,gDAAgD;;;;;;;;;;;;;;;;;;;;EAEhD,CAAC;AAMH,eAAO,MAAM,gBAAgB;IAC3B,kCAAkC;;IAElC,mCAAmC;;IAEnC,wCAAwC;;IAExC,mCAAmC;;IAEnC,+BAA+B;;IAE/B,4BAA4B;;;;;;;;;;;;;;;;EAE5B,CAAC;AAMH,eAAO,MAAM,oBAAoB;IAC/B,gDAAgD;;IAEhD,6CAA6C;;IAE7C,qCAAqC;;IAErC,uCAAuC;;IAEvC,sDAAsD;;;;;;;;;;;;;;EAEtD,CAAC;AAMH,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;EAE1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;IAC7B,sDAAsD;;IAEtD,4DAA4D;;IAE5D,4CAA4C;;IAE5C;;;OAGG;;;;;;;;;;;;EAEH,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;QAb/B,sDAAsD;;QAEtD,4DAA4D;;QAE5D,4CAA4C;;QAE5C;;;WAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQH,CAAC;AAMH,eAAO,MAAM,gBAAgB;IAC3B,2BAA2B;;IAE3B,+BAA+B;;IAE/B;;;;OAIG;;IAEH,6DAA6D;;;;;;;;;;;;EAE7D,CAAC;AAMH,eAAO,MAAM,sBAAsB;IACjC,4BAA4B;;;;;;EAE5B,CAAC;AAMH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,mEAQ3B,CAAC;AAEH,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,2BAG/B,CAAC;AAEH,eAAO,MAAM,sBAAsB;IACjC,sEAAsE;;IAEtE,yEAAyE;;;;;;;;EAEzE,CAAC;AAEH,eAAO,MAAM,oBAAoB;IAC/B,2EAA2E;;QAP3E,sEAAsE;;QAEtE,yEAAyE;;;;;;;;;IAOzE,iEAAiE;;QATjE,sEAAsE;;QAEtE,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;EASzE,CAAC;AAMH,eAAO,MAAM,oBAAoB;IAC/B;;;;;;OAMG;;IAEH;;;;;;OAMG;;;;;;;;EAEH,CAAC;AAMH,eAAO,MAAM,aAAa,sDAIxB,CAAC;AAMH,eAAO,MAAM,mBAAmB;IAC9B,mCAAmC;;IAEnC,yBAAyB;;IAEzB,4BAA4B;;IAG5B,yBAAyB;;QAnPzB,mDAAmD;;QAEnD,oCAAoC;;QAEpC,uBAAuB;;QAEvB,yCAAyC;;;;;;;;;;;;;IAgPzC,gCAAgC;;QAvOhC,0DAA0D;;;;;;;IA0O1D,wBAAwB;;QAtQxB,4BAA4B;;YApB5B,oDAAoD;;YAEpD,oDAAoD;;;;;;;;;QAoBpD,mBAAmB;;YAfnB,oDAAoD;;YAEpD,oDAAoD;;YAEpD;;;;eAIG;;;;;;;;;;;QASH,mBAAmB;;YAjBnB,oDAAoD;;YAEpD,oDAAoD;;YAEpD;;;;eAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8QH,2BAA2B;;QAjO3B,6DAA6D;;QAE7D,8CAA8C;;QAE9C;;;;WAIG;;QAEH;;;WAGG;;;;;;;;;;;;;IAuNH,yBAAyB;;QA9MzB,2CAA2C;;QAE3C,yBAAyB;;QAEzB,yBAAyB;;QAEzB,0BAA0B;;QAE1B,6BAA6B;;QAE7B,6BAA6B;;QAE7B,8DAA8D;;QAE9D,gDAAgD;;;;;;;;;;;;;;;;;;;;;IAmMhD,mBAAmB;;IAGnB,oBAAoB;;QA7LpB,kCAAkC;;QAElC,mCAAmC;;QAEnC,wCAAwC;;QAExC,mCAAmC;;QAEnC,+BAA+B;;QAE/B,4BAA4B;;;;;;;;;;;;;;;;;IAsL5B,6BAA6B;;QA7K7B,gDAAgD;;QAEhD,6CAA6C;;QAE7C,qCAAqC;;QAErC,uCAAuC;;QAEvC,sDAAsD;;;;;;;;;;;;;;;IAwKtD,oBAAoB;;;;;;;;;;;;;;;;;YAvJpB,sDAAsD;;YAEtD,4DAA4D;;YAE5D,4CAA4C;;YAE5C;;;eAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiJH,wBAAwB;;QAlIxB,2BAA2B;;QAE3B,+BAA+B;;QAE/B;;;;WAIG;;QAEH,6DAA6D;;;;;;;;;;;;;IA2H7D,+BAA+B;;QAlH/B,4BAA4B;;;;;;;IAqH5B,wDAAwD;;QApFxD,2EAA2E;;YAP3E,sEAAsE;;YAEtE,yEAAyE;;;;;;;;;QAOzE,iEAAiE;;YATjE,sEAAsE;;YAEtE,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4FzE,8DAA8D;;QA5E9D;;;;;;WAMG;;QAEH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEH,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAQjE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAExD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAE5C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,eAAO,MAAM,eAAe;IAC1B,oDAAoD;;IAEpD,oDAAoD;;IAEpD,oEAAoE;;IAEpE,yDAAyD;;;;;;;;;;;;EAEzD,CAAC;AAEH,eAAO,MAAM,iBAAiB;IAC5B,oDAAoD;;IAEpD,oDAAoD;;IAEpD;;;;OAIG;;;;;;;;;;EAEH,CAAC;AAEH,eAAO,MAAM,gBAAgB;IAC3B,4BAA4B;;QAxB5B,oDAAoD;;QAEpD,oDAAoD;;QAEpD,oEAAoE;;QAEpE,yDAAyD;;;;;;;;;;;;;IAoBzD,mBAAmB;;QAfnB,oDAAoD;;QAEpD,oDAAoD;;QAEpD;;;;WAIG;;;;;;;;;;;IASH,mBAAmB;;QAjBnB,oDAAoD;;QAEpD,oDAAoD;;QAEpD;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWH,CAAC;AAMH,eAAO,MAAM,gBAAgB;IAC3B,mDAAmD;;IAEnD,oCAAoC;;IAEpC,uBAAuB;;IAEvB,yCAAyC;;;;;;;;;;;;EAEzC,CAAC;AAMH,eAAO,MAAM,uBAAuB;IAClC,0DAA0D;;;;;;EAK1D,CAAC;AAMH;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,6CAA+C,CAAC;AAE/E,eAAO,MAAM,kBAAkB;IAC7B,gCAAgC;;IAEhC,8CAA8C;;IAE9C;;;OAGG;;IAEH;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;IAOH;;;;OAIG;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAMH,eAAO,MAAM,sBAAsB;IACjC,2CAA2C;;IAE3C,yBAAyB;;IAEzB,yBAAyB;;IAEzB,0BAA0B;;IAE1B,6BAA6B;;IAE7B,6BAA6B;;IAE7B,8DAA8D;;IAE9D,gDAAgD;;;;;;;;;;;;;;;;;;;;EAEhD,CAAC;AAMH,eAAO,MAAM,gBAAgB;IAC3B,kCAAkC;;IAElC,mCAAmC;;IAEnC,wCAAwC;;IAExC,mCAAmC;;IAEnC,+BAA+B;;IAE/B,4BAA4B;;;;;;;;;;;;;;;;EAE5B,CAAC;AAMH,eAAO,MAAM,oBAAoB;IAC/B,gDAAgD;;IAEhD,6CAA6C;;IAE7C,qCAAqC;;IAErC,uCAAuC;;IAEvC,sDAAsD;;;;;;;;;;;;;;EAEtD,CAAC;AAMH,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;EAE1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;IAC7B,sDAAsD;;IAEtD,4DAA4D;;IAE5D,4CAA4C;;IAE5C;;;OAGG;;;;;;;;;;;;EAEH,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;QAb/B,sDAAsD;;QAEtD,4DAA4D;;QAE5D,4CAA4C;;QAE5C;;;WAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQH,CAAC;AAMH,eAAO,MAAM,gBAAgB;IAC3B,2BAA2B;;IAE3B,+BAA+B;;IAE/B;;;;;OAKG;;IAEH,6DAA6D;;IAE7D;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAC;AAMH,eAAO,MAAM,sBAAsB;IACjC,4BAA4B;;;;;;EAE5B,CAAC;AAMH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,mEAQ3B,CAAC;AAEH,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,2BAG/B,CAAC;AAEH,eAAO,MAAM,sBAAsB;IACjC,sEAAsE;;IAEtE,yEAAyE;;;;;;;;EAEzE,CAAC;AAEH,eAAO,MAAM,oBAAoB;IAC/B,2EAA2E;;QAP3E,sEAAsE;;QAEtE,yEAAyE;;;;;;;;;IAOzE,iEAAiE;;QATjE,sEAAsE;;QAEtE,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;EASzE,CAAC;AAMH,eAAO,MAAM,oBAAoB;IAC/B;;;;;;OAMG;;IAEH;;;;;;OAMG;;;;;;;;EAEH,CAAC;AAMH,eAAO,MAAM,aAAa,sDAIxB,CAAC;AAMH,eAAO,MAAM,mBAAmB;IAC9B,mCAAmC;;IAEnC,yBAAyB;;IAEzB,4BAA4B;;IAG5B,yBAAyB;;QAzRzB,mDAAmD;;QAEnD,oCAAoC;;QAEpC,uBAAuB;;QAEvB,yCAAyC;;;;;;;;;;;;;IAsRzC,gCAAgC;;QA7QhC,0DAA0D;;;;;;;IAgR1D,wBAAwB;;QA5SxB,4BAA4B;;YAxB5B,oDAAoD;;YAEpD,oDAAoD;;YAEpD,oEAAoE;;YAEpE,yDAAyD;;;;;;;;;;;;;QAoBzD,mBAAmB;;YAfnB,oDAAoD;;YAEpD,oDAAoD;;YAEpD;;;;eAIG;;;;;;;;;;;QASH,mBAAmB;;YAjBnB,oDAAoD;;YAEpD,oDAAoD;;YAEpD;;;;eAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoTH,2BAA2B;;QAhQ3B,gCAAgC;;QAEhC,8CAA8C;;QAE9C;;;WAGG;;QAEH;;;WAGG;;QAEH;;;;;;WAMG;;QAEH;;;;WAIG;;QAOH;;;;WAIG;;;;;;;;;;;;;;;;;;;IA8NH,yBAAyB;;QArNzB,2CAA2C;;QAE3C,yBAAyB;;QAEzB,yBAAyB;;QAEzB,0BAA0B;;QAE1B,6BAA6B;;QAE7B,6BAA6B;;QAE7B,8DAA8D;;QAE9D,gDAAgD;;;;;;;;;;;;;;;;;;;;;IA0MhD,mBAAmB;;IAGnB,oBAAoB;;QApMpB,kCAAkC;;QAElC,mCAAmC;;QAEnC,wCAAwC;;QAExC,mCAAmC;;QAEnC,+BAA+B;;QAE/B,4BAA4B;;;;;;;;;;;;;;;;;IA6L5B,6BAA6B;;QApL7B,gDAAgD;;QAEhD,6CAA6C;;QAE7C,qCAAqC;;QAErC,uCAAuC;;QAEvC,sDAAsD;;;;;;;;;;;;;;;IA+KtD,oBAAoB;;;;;;;;;;;;;;;;;YA9JpB,sDAAsD;;YAEtD,4DAA4D;;YAE5D,4CAA4C;;YAE5C;;;eAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwJH,wBAAwB;;QAzIxB,2BAA2B;;QAE3B,+BAA+B;;QAE/B;;;;;WAKG;;QAEH,6DAA6D;;QAE7D;;;;WAIG;;;;;;;;;;;;;;;IA2HH,+BAA+B;;QAlH/B,4BAA4B;;;;;;;IAqH5B,wDAAwD;;QApFxD,2EAA2E;;YAP3E,sEAAsE;;YAEtE,yEAAyE;;;;;;;;;QAOzE,iEAAiE;;YATjE,sEAAsE;;YAEtE,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4FzE,8DAA8D;;QA5E9D;;;;;;WAMG;;QAEH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEH,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAQjE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAExD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAE5C"}

package/dist/core/config.js

@@ -8,17 +8,34 @@ import { z } from 'zod';
 // =============================================================================
 // URL Configuration
 // =============================================================================
+/**
+ * Accepts a full URL or a bare hostname and normalizes to a full https:// URL.
+ * e.g. "example.com" → "https://example.com"
+ */
+const urlOrHostname = z
+    .string()
+    .transform((val) => {
+    if (!val.includes('://')) {
+        return `https://${val}`;
+    }
+    return val;
+})
+    .pipe(z.string().url());
 export const UrlConfigSchema = z.object({
     /** Custom domain (null = use auto-generated URL) */
-    custom: z.string().url().nullable().optional(),
+    custom: urlOrHostname.nullable().optional(),
     /** Auto-generated URL (workers.dev or pages.dev) */
-    auto: z.string().url().optional(),
+    auto: urlOrHostname.optional(),
+    /** Cloudflare zone ID for custom domain (populated during setup) */
+    zoneId: z.string().nullable().optional(),
+    /** Whether to configure Workers custom domain binding */
+    customDomainBinding: z.boolean().optional(),
 });
 export const UiUrlConfigSchema = z.object({
     /** Custom domain (null = use auto-generated URL) */
-    custom: z.string().url().nullable().optional(),
+    custom: urlOrHostname.nullable().optional(),
     /** Auto-generated URL (workers.dev or pages.dev) */
-    auto: z.string().url().optional(),
+    auto: urlOrHostname.optional(),
     /**
      * Whether to serve this UI from the same domain as the API via proxy
      * - true: UI is proxied through ar-router (e.g., https://api.example.com/admin)
@@ -59,22 +76,52 @@ export const EnvironmentConfigSchema = z.object({
 // =============================================================================
 // Tenant Configuration
 // =============================================================================
+/**
+ * User ID format options
+ * - nanoid: URL-safe 21-character IDs (default, recommended)
+ * - uuid: Standard UUID v4 format
+ */
+export const UserIdFormatSchema = z.enum(['nanoid', 'uuid']).default('nanoid');
 export const TenantConfigSchema = z.object({
-    /** Default tenant identifier (used in single-tenant mode) */
+    /** Default tenant identifier */
     name: z.string().default('default'),
     /** Human-readable tenant/organization name */
     displayName: z.string().default('Default Tenant'),
     /**
-     * Multi-tenant mode with subdomain-based tenant isolation
-     * - true: issuer = https://{tenant}.{baseDomain}
-     * - false: issuer = ISSUER_URL (single-tenant)
+     * @deprecated Multi-tenant mode is always enabled.
+     * Kept for backward compatibility during migration.
      */
     multiTenant: z.boolean().default(false),
     /**
-     * Base domain for multi-tenant mode (e.g., "authrim.com")
-     * Issuer URL will be: https://{tenant}.{baseDomain}
+     * Base domain (root domain only, e.g., "authrim.com", "example.com")
+     * All tenant domains are subdomains of this: {tenant}.{baseDomain}
      */
     baseDomain: z.string().optional(),
+    /**
+     * User ID format for new users
+     * - nanoid: URL-safe 21-character IDs (default, recommended)
+     * - uuid: Standard UUID v4 format (36 characters with hyphens)
+     *
+     * Note: This setting cannot be changed after users are created.
+     */
+    userIdFormat: UserIdFormatSchema,
+    /**
+     * Primary tenant ID for naked domain access.
+     * When set, naked domain (e.g., example.com) routes to this tenant.
+     * When unset, naked domain routes to the default tenant (name field).
+     */
+    primaryTenant: z
+        .string()
+        .min(1)
+        .max(63)
+        .regex(/^[a-z0-9-]+$/)
+        .optional(),
+    /**
+     * Use naked domain as issuer URL.
+     * When true: https://example.com (no tenant subdomain)
+     * When false: https://tenant.example.com (with tenant subdomain)
+     */
+    nakedDomain: z.boolean().default(false).optional(),
 });
 // =============================================================================
 // Components Configuration
@@ -119,13 +166,13 @@ export const OidcConfigSchema = z.object({
 // =============================================================================
 export const ShardingConfigSchema = z.object({
     /** Number of authorization code store shards */
-    authCodeShards: z.number().int().positive().default(64),
+    authCodeShards: z.number().int().positive().default(4),
     /** Number of refresh token rotator shards */
-    refreshTokenShards: z.number().int().positive().default(8),
+    refreshTokenShards: z.number().int().positive().default(4),
     /** Number of session store shards */
-    sessionShards: z.number().int().positive().default(32),
+    sessionShards: z.number().int().positive().default(4),
     /** Number of challenge store shards */
-    challengeShards: z.number().int().positive().default(16),
+    challengeShards: z.number().int().positive().default(4),
     /** Number of flow state store shards (Flow Engine) */
     flowStateShards: z.number().int().positive().default(32),
 });
@@ -136,7 +183,7 @@ export const QueueFeatureSchema = z.object({
     enabled: z.boolean().default(false),
 });
 export const R2FeatureSchema = z.object({
-    enabled: z.boolean().default(false),
+    enabled: z.boolean().default(true),
 });
 export const EmailFeatureSchema = z.object({
     /** Email provider (resend, sendgrid, ses, or none) */
@@ -165,13 +212,20 @@ export const KeysConfigSchema = z.object({
     /** Public key in JWK format */
     publicKeyJwk: z.record(z.unknown()).optional(),
     /**
-     * Path to secrets directory (relative from config file location)
-     * - New structure (.authrim/{env}/): './keys/'
-     * - Legacy structure: './.keys/{env}/'
+     * Path to secrets directory
+     * - External (.authrim-keys/{env}/): absolute path
+     * - Internal (.authrim/{env}/keys/): './keys/'
+     * - Legacy (.keys/{env}/): './.keys/{env}/'
      */
     secretsPath: z.string().default('./keys/'),
     /** Whether to include secrets in config (not recommended) */
     includeSecrets: z.boolean().default(false),
+    /**
+     * Key storage type
+     * - 'external': Keys stored in {cwd}/.authrim-keys/{env}/ (new default)
+     * - 'internal': Keys stored in .authrim/{env}/keys/ (within source)
+     */
+    storageType: z.enum(['internal', 'external']).optional().default('external'),
 });
 // =============================================================================
 // Cloudflare Configuration