@authup/server-core 1.0.0-beta.47 → 1.0.0-beta.49

package/dist/adapters/http/middleware/built-in/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QAuBtE"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QA2BtE"}

package/dist/adapters/http/middleware/built-in/cors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // @routup/cors reflects the matched origin when given an array (and\n        // still honours credentials: true). Callers pass the trusted\n        // appOrigins allowlist; falls back to reflect-all only if unset.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAIZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;EAEJ,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. All authentication is header-based\n        // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n        // origin allowlist would add no security, only break dynamically\n        // registered browser clients. Operators can still pass an explicit\n        // `origin` via the middlewareCors config options.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;EAEJ,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}

package/dist/app/index.mjs

@@ -5,8 +5,8 @@ import { AuthenticationInjectionKey } from "./modules/authentication/constants.m
 import { CacheInjectionKey } from "./modules/cache/constants.mjs";
 import { ModuleName } from "./modules/constants.mjs";
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./modules/config/constants.mjs";
+import { expandToOrigins, getAppOrigins } from "./modules/config/origins.mjs";
 import { ConfigModule } from "./modules/config/module.mjs";
-import { getAppOrigins } from "./modules/config/origins.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
 import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
 import { AuthenticationModule } from "./modules/authentication/module.mjs";
@@ -62,4 +62,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, UserAttributeRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, getAppOrigins };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, UserAttributeRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };

package/dist/app/modules/config/constants.d.ts

@@ -9,7 +9,7 @@ export declare enum ConfigEnvironmentVariableName {
     HOST = "HOST",
     PORT = "PORT",
     PUBLIC_URL = "PUBLIC_URL",
-    ADDITIONAL_DOMAINS = "ADDITIONAL_DOMAINS",
+    TRUSTED_ORIGINS = "TRUSTED_ORIGINS",
     TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
     TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",
     REGISTRATION_ENABLED = "REGISTRATION_ENABLED",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAEvD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAEvD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -12,7 +12,7 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["HOST"] = "HOST";
 	ConfigEnvironmentVariableName["PORT"] = "PORT";
 	ConfigEnvironmentVariableName["PUBLIC_URL"] = "PUBLIC_URL";
-	ConfigEnvironmentVariableName["ADDITIONAL_DOMAINS"] = "ADDITIONAL_DOMAINS";
+	ConfigEnvironmentVariableName["TRUSTED_ORIGINS"] = "TRUSTED_ORIGINS";
 	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
 	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";
 	ConfigEnvironmentVariableName["REGISTRATION_ENABLED"] = "REGISTRATION_ENABLED";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    ADDITIONAL_DOMAINS = 'ADDITIONAL_DOMAINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}

package/dist/app/modules/config/index.mjs

@@ -2,6 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./constants.mjs";
+import { expandToOrigins, getAppOrigins } from "./origins.mjs";
 import { ConfigModule } from "./module.mjs";
-import { getAppOrigins } from "./origins.mjs";
-export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, getAppOrigins };
+export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, expandToOrigins, getAppOrigins };

package/dist/app/modules/config/module.d.ts

@@ -1,11 +1,11 @@
 import type { IModule } from 'orkos';
 import type { IContainer } from 'eldin';
 import type { ConfigRawReadOptions } from './read/index.ts';
-import type { Config } from './types.ts';
+import type { Config, ConfigFactory } from './types.ts';
 export declare class ConfigModule implements IModule {
     readonly name: string;
-    protected instance: Config | undefined;
-    constructor(config?: Config);
+    protected instance: Config | ConfigFactory | undefined;
+    constructor(config?: Config | ConfigFactory);
     setup(container: IContainer): Promise<void>;
     /**
      * Read config from env and fs.

package/dist/app/modules/config/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,QAAQ,EAAG,MAAM,GAAG,SAAS,CAAC;gBAI5B,MAAM,CAAC,EAAE,MAAM;IAOrB,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAajD;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC;CAQnE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,QAAQ,EAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;gBAI5C,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa;IAOrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC;CAQnE"}

package/dist/app/modules/config/module.mjs

@@ -16,7 +16,8 @@ var ConfigModule = class {
 	}
 	async setup(container) {
 		let instance;
-		if (this.instance) instance = this.instance;
+		if (typeof this.instance === "function") instance = await this.instance();
+		else if (this.instance) instance = this.instance;
 		else instance = await this.read();
 		container.register(ConfigInjectionKey, { useValue: instance });
 	}

package/dist/app/modules/config/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ModuleName","ConfigInjectionKey","normalizeConfig","readConfigRaw","ConfigModule","name","instance","config","CONFIG","setup","container","read","register","useValue","options","raw","env"],"sources":["../../../../src/app/modules/config/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config } from './types.ts';\n\nexport class ConfigModule implements IModule {\n    readonly name: string;\n\n    protected instance : Config | undefined;\n\n    // ----------------------------------------------------\n\n    constructor(config?: Config) {\n        this.name = ModuleName.CONFIG;\n        this.instance = config;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        let instance : Config;\n        if (this.instance) {\n            instance = this.instance;\n        } else {\n            instance = await this.read();\n        }\n\n        container.register(ConfigInjectionKey, { useValue: instance });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Read config from env and fs.\n     *\n     * @param options\n     */\n    async read(options: ConfigRawReadOptions = {}) : Promise<Config> {\n        const raw = await readConfigRaw({\n            env: true,\n            ...options,\n        });\n\n        return normalizeConfig(raw);\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,eAAb,MAAaA;CACAC;CAECC;CAIV,YAAYC,QAAiB;EACzB,KAAKF,OAAOL,WAAWQ;EACvB,KAAKF,WAAWC;CACpB;CAIA,MAAME,MAAMC,WAAsC;EAC9C,IAAIJ;EACJ,IAAI,KAAKA,UACLA,WAAW,KAAKA;OAEhBA,WAAW,MAAM,KAAKK,KAAI;EAG9BD,UAAUE,SAASX,oBAAoB,EAAEY,UAAUP,SAAS,CAAA;CAChE;;;;;IASA,MAAMK,KAAKG,UAAgC,CAAC,GAAqB;EAM7D,OAAOZ,gBAAgBa,MALLZ,cAAc;GAC5Ba,KAAK;GACL,GAAGF;EACP,CAAA,CAEuBC;CAC3B;AACJ"}
+{"version":3,"file":"module.mjs","names":["ModuleName","ConfigInjectionKey","normalizeConfig","readConfigRaw","ConfigModule","name","instance","config","CONFIG","setup","container","read","register","useValue","options","raw","env"],"sources":["../../../../src/app/modules/config/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config, ConfigFactory } from './types.ts';\n\nexport class ConfigModule implements IModule {\n    readonly name: string;\n\n    protected instance : Config | ConfigFactory | undefined;\n\n    // ----------------------------------------------------\n\n    constructor(config?: Config | ConfigFactory) {\n        this.name = ModuleName.CONFIG;\n        this.instance = config;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        let instance : Config;\n        if (typeof this.instance === 'function') {\n            instance = await this.instance();\n        } else if (this.instance) {\n            instance = this.instance;\n        } else {\n            instance = await this.read();\n        }\n\n        container.register(ConfigInjectionKey, { useValue: instance });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Read config from env and fs.\n     *\n     * @param options\n     */\n    async read(options: ConfigRawReadOptions = {}) : Promise<Config> {\n        const raw = await readConfigRaw({\n            env: true,\n            ...options,\n        });\n\n        return normalizeConfig(raw);\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,eAAb,MAAaA;CACAC;CAECC;CAIV,YAAYC,QAAiC;EACzC,KAAKF,OAAOL,WAAWQ;EACvB,KAAKF,WAAWC;CACpB;CAIA,MAAME,MAAMC,WAAsC;EAC9C,IAAIJ;EACJ,IAAI,OAAO,KAAKA,aAAa,YACzBA,WAAW,MAAM,KAAKA,SAAQ;OAC3B,IAAI,KAAKA,UACZA,WAAW,KAAKA;OAEhBA,WAAW,MAAM,KAAKK,KAAI;EAG9BD,UAAUE,SAASX,oBAAoB,EAAEY,UAAUP,SAAS,CAAA;CAChE;;;;;IASA,MAAMK,KAAKG,UAAgC,CAAC,GAAqB;EAM7D,OAAOZ,gBAAgBa,MALLZ,cAAc;GAC5Ba,KAAK;GACL,GAAGF;EACP,CAAA,CAEuBC;CAC3B;AACJ"}

package/dist/app/modules/config/normalize.d.ts

@@ -1,3 +1,3 @@
 import type { Config, ConfigInput } from './types.ts';
-export declare function normalizeConfig(input?: ConfigInput): Config;
+export declare function normalizeConfig(input?: ConfigInput): Promise<Config>;
 //# sourceMappingURL=normalize.d.ts.map

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,MAAM,CA0F/D"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqG9E"}

package/dist/app/modules/config/normalize.mjs

@@ -2,16 +2,17 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { toPublicHost } from "../../../utils/host.mjs";
+import { expandToOrigins } from "./origins.mjs";
 import { parseConfig } from "./parse.mjs";
 import { EnvironmentName } from "@authup/kit";
 import { read } from "envix";
 import path from "node:path";
 import process from "node:process";
 //#region src/app/modules/config/normalize.ts
-function normalizeConfig(input = {}) {
-	const parsed = parseConfig(input);
+async function normalizeConfig(input = {}) {
+	const parsed = await parseConfig(input);
 	const writableDirectoryPath = parsed.writableDirectoryPath || path.join(process.cwd(), "writable");
-	const port = parsed.port || 3001;
+	const port = parsed.port ?? 3001;
 	let host = parsed.host || "0.0.0.0";
 	let publicUrl;
 	if (parsed.publicUrl) publicUrl = parsed.publicUrl;
@@ -22,11 +23,12 @@ function normalizeConfig(input = {}) {
 			publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;
 		} else publicUrl = `http://${toPublicHost(host)}:${port}`;
 	}
-	const env = read("NODE_ENV", EnvironmentName.DEVELOPMENT);
-	const additionalDomains = [...parsed.additionalDomains ?? []];
+	const env = parsed.env || read("NODE_ENV", EnvironmentName.DEVELOPMENT);
+	const trustedOrigins = [];
+	for (const value of parsed.trustedOrigins ?? []) for (const origin of expandToOrigins(value)) if (!trustedOrigins.includes(origin)) trustedOrigins.push(origin);
 	if (env !== EnvironmentName.PRODUCTION) {
 		const devOrigin = "http://localhost:3000";
-		if (!additionalDomains.includes(devOrigin)) additionalDomains.push(devOrigin);
+		if (!trustedOrigins.includes(devOrigin)) trustedOrigins.push(devOrigin);
 	}
 	return {
 		env,
@@ -65,7 +67,7 @@ function normalizeConfig(input = {}) {
 		permissions: [],
 		permissionsDefaultPolicyAssignment: true,
 		...parsed,
-		additionalDomains
+		trustedOrigins
 	};
 }
 //#endregion

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","EnvironmentName","toPublicHost","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","additionalDomains","PRODUCTION","devOrigin","includes","push","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport function normalizeConfig(input: ConfigInput = {}): Config {\n    const parsed = parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port || 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    // Copy — never mutate the caller-supplied parsed array in place, or a\n    // repeated normalizeConfig() on the same input accumulates the dev origin\n    // into a security-sensitive allowlist.\n    const additionalDomains = [...(parsed.additionalDomains ?? [])];\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!additionalDomains.includes(devOrigin)) {\n            additionalDomains.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 3_600,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the dev-seeded value wins over the raw\n        // parsed list (parsed.additionalDomains is already merged in above).\n        additionalDomains,\n    };\n}\n"],"mappings":";;;;;;;;;;AAeA,SAAgBM,gBAAgBC,QAAqB,CAAC,GAAC;CACnD,MAAMC,SAASH,YAAYE,KAAAA;CAE3B,MAAME,wBAAwBD,OAAOC,yBACjCR,KAAKS,KAAKR,QAAQS,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMjB,KAAK,YAAYG,gBAAgBe,WAAW;CAUxD,MAAMC,oBAAoB,CAAA,GAAKX,OAAOW,qBAAqB,CAAA,CAAA;CAC3D,IAAIF,QAAQd,gBAAgBiB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACF,kBAAkBG,SAASD,SAAAA,GAC5BF,kBAAkBI,KAAKF,SAAAA;CAE/B;CAEA,OAAO;EACHJ;EACAO,UAAUtB,QAAQS,IAAG;EACrBF;EAEAgB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENf;EACAC;EACAC;EAEAc,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EAEzBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG7C;EAIHW;CACJ;AACJ"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","EnvironmentName","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 3_600,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n}\n"],"mappings":";;;;;;;;;;;AAgBA,eAAsBO,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCT,KAAKU,KAAKT,QAAQU,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOlB,KAAK,YAAYG,gBAAgBgB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQf,gBAAgBsB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,OAAO;EACHR;EACAS,UAAUzB,QAAQU,IAAG;EACrBF;EAEAkB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENjB;EACAC;EACAC;EAEAgB,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EAEzBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/C;EAIHW;CACJ;AACJ"}

package/dist/app/modules/config/origins.d.ts

@@ -1,10 +1,25 @@
 import type { Config } from './types.ts';
+/**
+ * Expand a configured trusted-origin value to its canonical origin(s).
+ *
+ * A value with an explicit scheme contributes exactly that origin —
+ * the way to restrict a host to https only. A bare host[:port]
+ * (e.g. `hub.local`) contributes both the http and https origin.
+ *
+ * Only http(s) is accepted: other schemes either have no usable web
+ * origin (`new URL('myapp://x').origin` is the literal string "null")
+ * or are meaningless as a redirect target for the web client — letting
+ * them through would put garbage into a security-sensitive allowlist.
+ *
+ * Throws on values that don't parse as a URL/host or use another scheme.
+ */
+export declare function expandToOrigins(value: string): string[];
 /**
  * Derive the set of trusted application origins (scheme://host[:port]).
  *
- * publicUrl may carry a path; both the OAuth2 redirect allowlist and the
- * CORS origin allowlist need bare origins, so extract the origin from each
- * configured URL and de-duplicate.
+ * publicUrl may carry a path, so its origin is extracted; trustedOrigins
+ * entries are canonical origins — normalizeConfig owns that invariant
+ * (expansion + dedupe via expandToOrigins) — and are merged verbatim.
  */
-export declare function getAppOrigins(config: Pick<Config, 'publicUrl' | 'additionalDomains'>): string[];
+export declare function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[];
 //# sourceMappingURL=origins.d.ts.map

package/dist/app/modules/config/origins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,mBAAmB,CAAC,GAAG,MAAM,EAAE,CAS/F"}
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAcvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}

package/dist/app/modules/config/origins.mjs

@@ -3,19 +3,42 @@ import "node:url";
 import.meta.url;
 import { URL } from "node:url";
 //#region src/app/modules/config/origins.ts
+const SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\/\//i;
+const ALLOWED_PROTOCOLS = ["http:", "https:"];
+/**
+* Expand a configured trusted-origin value to its canonical origin(s).
+*
+* A value with an explicit scheme contributes exactly that origin —
+* the way to restrict a host to https only. A bare host[:port]
+* (e.g. `hub.local`) contributes both the http and https origin.
+*
+* Only http(s) is accepted: other schemes either have no usable web
+* origin (`new URL('myapp://x').origin` is the literal string "null")
+* or are meaningless as a redirect target for the web client — letting
+* them through would put garbage into a security-sensitive allowlist.
+*
+* Throws on values that don't parse as a URL/host or use another scheme.
+*/ function expandToOrigins(value) {
+	if (SCHEME_REGEX.test(value)) {
+		const url = new URL(value);
+		if (!ALLOWED_PROTOCOLS.includes(url.protocol)) throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);
+		return [url.origin];
+	}
+	return [new URL(`http://${value}`).origin, new URL(`https://${value}`).origin];
+}
 /**
 * Derive the set of trusted application origins (scheme://host[:port]).
 *
-* publicUrl may carry a path; both the OAuth2 redirect allowlist and the
-* CORS origin allowlist need bare origins, so extract the origin from each
-* configured URL and de-duplicate.
+* publicUrl may carry a path, so its origin is extracted; trustedOrigins
+* entries are canonical origins — normalizeConfig owns that invariant
+* (expansion + dedupe via expandToOrigins) — and are merged verbatim.
 */ function getAppOrigins(config) {
-	const urls = [config.publicUrl, ...config.additionalDomains ?? []];
 	const origins = /* @__PURE__ */ new Set();
-	for (const url of urls) origins.add(new URL(url).origin);
+	origins.add(new URL(config.publicUrl).origin);
+	for (const origin of config.trustedOrigins ?? []) origins.add(origin);
 	return Array.from(origins);
 }
 //#endregion
-export { getAppOrigins };
+export { expandToOrigins, getAppOrigins };
 
 //# sourceMappingURL=origins.mjs.map

package/dist/app/modules/config/origins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"origins.mjs","names":["URL","getAppOrigins","config","urls","publicUrl","additionalDomains","origins","Set","url","add","origin","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport type { Config } from './types.ts';\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path; both the OAuth2 redirect allowlist and the\n * CORS origin allowlist need bare origins, so extract the origin from each\n * configured URL and de-duplicate.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'additionalDomains'>): string[] {\n    const urls = [config.publicUrl, ...(config.additionalDomains ?? [])];\n\n    const origins = new Set<string>();\n    for (const url of urls) {\n        origins.add(new URL(url).origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;;;;;;;GAiBA,SAAgBC,cAAcC,QAAuD;CACjF,MAAMC,OAAO,CAACD,OAAOE,WAAAA,GAAeF,OAAOG,qBAAqB,CAAA,CAAA;CAEhE,MAAMC,0BAAU,IAAIC,IAAAA;CACpB,KAAK,MAAMC,OAAOL,MACdG,QAAQG,IAAI,IAAIT,IAAIQ,GAAAA,CAAAA,CAAKE,MAAM;CAGnC,OAAOC,MAAMC,KAAKN,OAAAA;AACtB"}
+{"version":3,"file":"origins.mjs","names":["URL","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","test","url","includes","protocol","Error","origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/**\n * Expand a configured trusted-origin value to its canonical origin(s).\n *\n * A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n *\n * Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n *\n * Throws on values that don't parse as a URL/host or use another scheme.\n */\nexport function expandToOrigins(value: string): string[] {\n    if (SCHEME_REGEX.test(value)) {\n        const url = new URL(value);\n        if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n            throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n        }\n\n        return [url.origin];\n    }\n\n    return [\n        new URL(`http://${value}`).origin,\n        new URL(`https://${value}`).origin,\n    ];\n}\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[] {\n    const origins = new Set<string>();\n    origins.add(new URL(config.publicUrl).origin);\n\n    for (const origin of config.trustedOrigins ?? []) {\n        origins.add(origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;AAUA,MAAMC,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAA;;;;;;;;;;;;;;GAgBpC,SAAgBC,gBAAgBC,OAAa;CACzC,IAAIH,aAAaI,KAAKD,KAAAA,GAAQ;EAC1B,MAAME,MAAM,IAAIN,IAAII,KAAAA;EACpB,IAAI,CAACF,kBAAkBK,SAASD,IAAIE,QAAQ,GACxC,MAAM,IAAIC,MAAM,8DAA8DH,IAAIE,UAAU;EAGhG,OAAO,CAACF,IAAII,MAAAA;CAChB;CAEA,OAAO,CACH,IAAIV,IAAI,UAAUI,OAAO,CAAA,CAAEM,QAC3B,IAAIV,IAAI,WAAWI,OAAO,CAAA,CAAEM,MAAAA;AAEpC;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIf,IAAIY,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}

package/dist/app/modules/config/parse.d.ts

@@ -1,3 +1,3 @@
 import type { ConfigInput } from './types.ts';
-export declare function parseConfig(input?: unknown): ConfigInput;
+export declare function parseConfig(input?: unknown): Promise<ConfigInput>;
 //# sourceMappingURL=parse.d.ts.map

package/dist/app/modules/config/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/parse.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAU,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,GAAE,OAAY,GAAG,WAAW,CA6E5D"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/parse.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,wBAAsB,WAAW,CAAC,KAAK,GAAE,OAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ3E"}

package/dist/app/modules/config/parse.mjs

@@ -1,57 +1,12 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { ConfigValidator } from "./validator.mjs";
 import { isObject } from "@authup/kit";
-import zod from "zod";
 //#region src/app/modules/config/parse.ts
-function parseConfig(input = {}) {
-	return zod.object({
-		env: zod.string().optional(),
-		rootPath: zod.string().optional(),
-		writableDirectoryPath: zod.string().optional(),
-		logger: zod.boolean().optional(),
-		db: zod.custom((value) => isObject(value)).optional(),
-		redis: zod.lazy(() => zod.union([
-			zod.string().optional(),
-			zod.boolean().optional(),
-			zod.any().optional()
-		])).optional(),
-		smtp: zod.lazy(() => zod.union([
-			zod.string().optional(),
-			zod.boolean().optional(),
-			zod.any().optional()
-		])).optional(),
-		port: zod.number().nonnegative().optional(),
-		host: zod.string().optional(),
-		publicUrl: zod.string().url().optional(),
-		additionalDomains: zod.array(zod.string().url()).optional(),
-		middlewareBody: zod.boolean().or(zod.record(zod.string(), zod.any())).optional(),
-		middlewareCors: zod.boolean().or(zod.record(zod.string(), zod.any())).optional(),
-		middlewareCookie: zod.boolean().or(zod.record(zod.string(), zod.any())).optional(),
-		middlewareQuery: zod.boolean().or(zod.record(zod.string(), zod.any())).optional(),
-		middlewarePrometheus: zod.boolean().or(zod.record(zod.string(), zod.any())).optional(),
-		middlewareRateLimit: zod.boolean().or(zod.record(zod.string(), zod.any())).optional(),
-		middlewareSwagger: zod.boolean().optional(),
-		tokenAccessMaxAge: zod.number().nonnegative().optional(),
-		tokenRefreshMaxAge: zod.number().nonnegative().optional(),
-		registrationEnabled: zod.boolean().optional(),
-		emailVerificationEnabled: zod.boolean().optional(),
-		passwordRecoveryEnabled: zod.boolean().optional(),
-		clientAuthBasic: zod.boolean().optional(),
-		clientSystemEnabled: zod.boolean().optional(),
-		clientSystemSecret: zod.string().min(3).max(256).optional(),
-		clientSystemSecretReset: zod.boolean().optional(),
-		userAuthBasic: zod.boolean().optional(),
-		userAdminEnabled: zod.boolean().optional(),
-		userAdminPassword: zod.string().min(3).max(256).optional(),
-		userAdminPasswordReset: zod.boolean().optional(),
-		robotAuthBasic: zod.boolean().optional(),
-		robotAdminEnabled: zod.boolean().optional(),
-		robotAdminSecret: zod.string().min(3).max(256).optional(),
-		robotAdminSecretReset: zod.boolean().optional(),
-		permissions: zod.string().or(zod.array(zod.string())).optional(),
-		permissionsDefaultPolicyAssignment: zod.boolean().optional()
-	}).parse(input);
+async function parseConfig(input = {}) {
+	if (!isObject(input)) throw new Error("The configuration input must be an object.");
+	return new ConfigValidator().run(input);
 }
 //#endregion
 export { parseConfig };

package/dist/app/modules/config/parse.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"parse.mjs","names":["isObject","zod","parseConfig","input","schema","object","env","string","optional","rootPath","writableDirectoryPath","logger","boolean","db","custom","value","redis","lazy","union","any","smtp","port","number","nonnegative","host","publicUrl","url","additionalDomains","array","middlewareBody","or","record","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","min","max","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","parse"],"sources":["../../../../src/app/modules/config/parse.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information.optional(),\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport zod from 'zod';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport function parseConfig(input: unknown = {}): ConfigInput {\n    const schema = zod.object({\n        env: zod.string().optional(),\n        rootPath: zod.string().optional(),\n        writableDirectoryPath: zod.string().optional(),\n\n        logger: zod.boolean().optional(),\n        db: zod.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n            (value) => isObject(value),\n        ).optional(),\n        redis: zod.lazy(() => zod.union([\n            zod.string().optional(),\n            zod.boolean().optional(),\n            zod.any().optional(),\n        ])).optional(),\n        smtp: zod.lazy(() => zod.union([\n            zod.string().optional(),\n            zod.boolean().optional(),\n            zod.any().optional(),\n        ])).optional(),\n        port: zod.number()\n            .nonnegative().optional(),\n        host: zod.string().optional(),\n        publicUrl: zod.string()\n            .url().optional(),\n        additionalDomains: zod.array(zod.string().url()).optional(),\n        middlewareBody: zod.boolean()\n            .or(zod.record(zod.string(), zod.any())).optional(),\n        middlewareCors: zod.boolean()\n            .or(zod.record(zod.string(), zod.any())).optional(),\n        middlewareCookie: zod.boolean()\n            .or(zod.record(zod.string(), zod.any())).optional(),\n        middlewareQuery: zod.boolean()\n            .or(zod.record(zod.string(), zod.any())).optional(),\n        middlewarePrometheus: zod.boolean()\n            .or(zod.record(zod.string(), zod.any())).optional(),\n        middlewareRateLimit: zod.boolean()\n            .or(zod.record(zod.string(), zod.any())).optional(),\n        middlewareSwagger: zod.boolean().optional(),\n\n        tokenAccessMaxAge: zod.number()\n            .nonnegative().optional(),\n        tokenRefreshMaxAge: zod.number()\n            .nonnegative().optional(),\n        registrationEnabled: zod.boolean().optional(),\n        emailVerificationEnabled: zod.boolean().optional(),\n        passwordRecoveryEnabled: zod.boolean().optional(),\n\n        clientAuthBasic: zod.boolean().optional(),\n        clientSystemEnabled: zod.boolean().optional(),\n        clientSystemSecret: zod.string()\n            .min(3)\n            .max(256).optional(),\n        clientSystemSecretReset: zod.boolean().optional(),\n\n        userAuthBasic: zod.boolean().optional(),\n        userAdminEnabled: zod.boolean().optional(),\n        userAdminPassword: zod.string()\n            .min(3)\n            .max(256).optional(),\n        userAdminPasswordReset: zod.boolean().optional(),\n\n        robotAuthBasic: zod.boolean().optional(),\n        robotAdminEnabled: zod.boolean().optional(),\n        robotAdminSecret: zod.string()\n            .min(3)\n            .max(256).optional(),\n        robotAdminSecretReset: zod.boolean().optional(),\n\n        permissions: zod.string()\n            .or(zod.array(zod.string()))\n            .optional(),\n\n        permissionsDefaultPolicyAssignment: zod.boolean().optional(),\n    } satisfies Record<keyof Config, any>);\n\n    return schema.parse(input);\n}\n"],"mappings":";;;;;;AAcA,SAAgBE,YAAYC,QAAiB,CAAC,GAAC;CA4E3C,OA3EeF,IAAII,OAAO;EACtBC,KAAKL,IAAIM,OAAM,CAAA,CAAGC,SAAQ;EAC1BC,UAAUR,IAAIM,OAAM,CAAA,CAAGC,SAAQ;EAC/BE,uBAAuBT,IAAIM,OAAM,CAAA,CAAGC,SAAQ;EAE5CG,QAAQV,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAC9BK,IAAIZ,IAAIa,QACHC,UAAUf,SAASe,KAAAA,CAAAA,CAAAA,CACtBP,SAAQ;EACVQ,OAAOf,IAAIgB,WAAWhB,IAAIiB,MAAM;GAC5BjB,IAAIM,OAAM,CAAA,CAAGC,SAAQ;GACrBP,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;GACtBP,IAAIkB,IAAG,CAAA,CAAGX,SAAQ;GACrB,CAAA,CAAA,CAAGA,SAAQ;EACZY,MAAMnB,IAAIgB,WAAWhB,IAAIiB,MAAM;GAC3BjB,IAAIM,OAAM,CAAA,CAAGC,SAAQ;GACrBP,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;GACtBP,IAAIkB,IAAG,CAAA,CAAGX,SAAQ;GACrB,CAAA,CAAA,CAAGA,SAAQ;EACZa,MAAMpB,IAAIqB,OAAM,CAAA,CACXC,YAAW,CAAA,CAAGf,SAAQ;EAC3BgB,MAAMvB,IAAIM,OAAM,CAAA,CAAGC,SAAQ;EAC3BiB,WAAWxB,IAAIM,OAAM,CAAA,CAChBmB,IAAG,CAAA,CAAGlB,SAAQ;EACnBmB,mBAAmB1B,IAAI2B,MAAM3B,IAAIM,OAAM,CAAA,CAAGmB,IAAG,CAAA,CAAA,CAAIlB,SAAQ;EACzDqB,gBAAgB5B,IAAIW,QAAO,CAAA,CACtBkB,GAAG7B,IAAI8B,OAAO9B,IAAIM,OAAM,GAAIN,IAAIkB,IAAG,CAAA,CAAA,CAAA,CAAKX,SAAQ;EACrDwB,gBAAgB/B,IAAIW,QAAO,CAAA,CACtBkB,GAAG7B,IAAI8B,OAAO9B,IAAIM,OAAM,GAAIN,IAAIkB,IAAG,CAAA,CAAA,CAAA,CAAKX,SAAQ;EACrDyB,kBAAkBhC,IAAIW,QAAO,CAAA,CACxBkB,GAAG7B,IAAI8B,OAAO9B,IAAIM,OAAM,GAAIN,IAAIkB,IAAG,CAAA,CAAA,CAAA,CAAKX,SAAQ;EACrD0B,iBAAiBjC,IAAIW,QAAO,CAAA,CACvBkB,GAAG7B,IAAI8B,OAAO9B,IAAIM,OAAM,GAAIN,IAAIkB,IAAG,CAAA,CAAA,CAAA,CAAKX,SAAQ;EACrD2B,sBAAsBlC,IAAIW,QAAO,CAAA,CAC5BkB,GAAG7B,IAAI8B,OAAO9B,IAAIM,OAAM,GAAIN,IAAIkB,IAAG,CAAA,CAAA,CAAA,CAAKX,SAAQ;EACrD4B,qBAAqBnC,IAAIW,QAAO,CAAA,CAC3BkB,GAAG7B,IAAI8B,OAAO9B,IAAIM,OAAM,GAAIN,IAAIkB,IAAG,CAAA,CAAA,CAAA,CAAKX,SAAQ;EACrD6B,mBAAmBpC,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAEzC8B,mBAAmBrC,IAAIqB,OAAM,CAAA,CACxBC,YAAW,CAAA,CAAGf,SAAQ;EAC3B+B,oBAAoBtC,IAAIqB,OAAM,CAAA,CACzBC,YAAW,CAAA,CAAGf,SAAQ;EAC3BgC,qBAAqBvC,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAC3CiC,0BAA0BxC,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAChDkC,yBAAyBzC,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAE/CmC,iBAAiB1C,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EACvCoC,qBAAqB3C,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAC3CqC,oBAAoB5C,IAAIM,OAAM,CAAA,CACzBuC,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CAAKvC,SAAQ;EACtBwC,yBAAyB/C,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAE/CyC,eAAehD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EACrC0C,kBAAkBjD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EACxC2C,mBAAmBlD,IAAIM,OAAM,CAAA,CACxBuC,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CAAKvC,SAAQ;EACtB4C,wBAAwBnD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAE9C6C,gBAAgBpD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EACtC8C,mBAAmBrD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EACzC+C,kBAAkBtD,IAAIM,OAAM,CAAA,CACvBuC,IAAI,CAAA,CAAA,CACJC,IAAI,GAAA,CAAA,CAAKvC,SAAQ;EACtBgD,uBAAuBvD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;EAE7CiD,aAAaxD,IAAIM,OAAM,CAAA,CAClBuB,GAAG7B,IAAI2B,MAAM3B,IAAIM,OAAM,CAAA,CAAA,CAAA,CACvBC,SAAQ;EAEbkD,oCAAoCzD,IAAIW,QAAO,CAAA,CAAGJ,SAAQ;CAC9D,CAEOJ,CAAAA,CAAOuD,MAAMxD,KAAAA;AACxB"}
+{"version":3,"file":"parse.mjs","names":["isObject","ConfigValidator","parseConfig","input","Error","validator","run"],"sources":["../../../../src/app/modules/config/parse.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { ConfigInput } from './types.ts';\nimport { ConfigValidator } from './validator.ts';\n\nexport async function parseConfig(input: unknown = {}): Promise<ConfigInput> {\n    if (!isObject(input)) {\n        throw new Error('The configuration input must be an object.');\n    }\n\n    const validator = new ConfigValidator();\n\n    return validator.run(input);\n}\n"],"mappings":";;;;;;AAWA,eAAsBE,YAAYC,QAAiB,CAAC,GAAC;CACjD,IAAI,CAACH,SAASG,KAAAA,GACV,MAAM,IAAIC,MAAM,4CAAA;CAKpB,OAAOC,IAFeJ,gBAEfI,CAAAA,CAAUC,IAAIH,KAAAA;AACzB"}

package/dist/app/modules/config/read/env.mjs

@@ -19,11 +19,11 @@ function readConfigRawFromEnv() {
 	const host = read(ConfigEnvironmentVariableName.HOST);
 	if (host) options.host = host;
 	const port = readInt(ConfigEnvironmentVariableName.PORT);
-	if (port) options.port = Number.parseInt(`${port}`, 10);
+	if (typeof port !== "undefined") options.port = port;
 	const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);
 	if (publicURL) options.publicUrl = publicURL;
-	const additionalDomains = readArray(ConfigEnvironmentVariableName.ADDITIONAL_DOMAINS);
-	if (additionalDomains && additionalDomains.length > 0) options.additionalDomains = additionalDomains;
+	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
+	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
 	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);
 	if (typeof tokenAccessMaxAge !== "undefined") options.tokenAccessMaxAge = tokenAccessMaxAge;
 	const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","Number","parseInt","publicURL","PUBLIC_URL","publicUrl","additionalDomains","ADDITIONAL_DOMAINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf, \n    read, \n    readArray, \n    readBool, \n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (port) {\n        options.port = Number.parseInt(`${port}`, 10);\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const additionalDomains = readArray(ConfigEnvironmentVariableName.ADDITIONAL_DOMAINS);\n    if (additionalDomains && additionalDomains.length > 0) {\n        options.additionalDomains = additionalDomains;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAID,MACAZ,QAAQY,OAAOE,OAAOC,SAAS,GAAGH,QAAQ,EAAA;CAG9C,MAAMI,YAAYxB,KAAKM,8BAA8BmB,UAAU;CAC/D,IAAID,WACAhB,QAAQkB,YAAYF;CAGxB,MAAMG,oBAAoB1B,UAAUK,8BAA8BsB,kBAAkB;CACpF,IAAID,qBAAqBA,kBAAkBE,SAAS,GAChDrB,QAAQmB,oBAAoBA;CAGhC,MAAMG,oBAAoB3B,QAAQG,8BAA8ByB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BtB,QAAQsB,oBAAoBA;CAGhC,MAAME,qBAAqB7B,QAAQG,8BAA8B2B,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BxB,QAAQwB,qBAAqBA;CAGjC,MAAME,sBAAsBhC,SAASI,8BAA8B6B,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/B1B,QAAQ0B,sBAAsBA;CAGlC,MAAME,2BAA2BlC,SAASI,8BAA8B+B,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC5B,QAAQ4B,2BAA2BA;CAGvC,MAAME,0BAA0BpC,SAASI,8BAA8BiC,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnC9B,QAAQ8B,0BAA0BA;CAKtC,MAAME,kBAAkBtC,SAASI,8BAA8BmC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BhC,QAAQkC,kBAAkBF;CAG9B,MAAMG,sBAAsBzC,SAASI,8BAA8BsC,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BnC,QAAQmC,sBAAsBA;CAGlC,MAAME,oBAAoB7C,KAAKM,8BAA8BwC,oBAAoB;CACjF,IAAID,mBACArC,QAAQuC,qBAAqBF;CAGjC,MAAMG,yBAAyB9C,SAASI,8BAA8B2C,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCxC,QAAQ0C,0BAA0BF;CAKtC,MAAMG,gBAAgBjD,SAASI,8BAA8B8C,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB3C,QAAQ6C,gBAAgBF;CAG5B,MAAMG,mBAAmBpD,SAASI,8BAA8BiD,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B9C,QAAQ8C,mBAAmBA;CAG/B,MAAME,oBAAoBxD,KAAKM,8BAA8BmD,mBAAmB;CAChF,IAAID,mBACAhD,QAAQgD,oBAAoBA;CAGhC,MAAME,yBAAyBxD,SAASI,8BAA8BqD,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClClD,QAAQkD,yBAAyBA;CAKrC,MAAME,iBAAiB1D,SAASI,8BAA8BuD,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BpD,QAAQsD,iBAAiBF;CAG7B,MAAMG,oBAAoB7D,SAASI,8BAA8B0D,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BvD,QAAQuD,oBAAoBA;CAGhC,MAAME,mBAAmBjE,KAAKM,8BAA8B4D,kBAAkB;CAC9E,IAAID,kBACAzD,QAAQyD,mBAAmBA;CAG/B,MAAME,wBAAwBjE,SAASI,8BAA8B8D,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjC3D,QAAQ2D,wBAAwBA;CAKpC,MAAME,cAAcpE,UAAUK,8BAA8BgE,WAAW;CACvE,IAAID,eAAeA,YAAYxC,SAAS,GACpCrB,QAAQ6D,cAAcA;CAG1B,MAAME,qCAAqCrE,SAASI,8BAA8BkE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C/D,QAAQ+D,qCAAqCA;CAGjD,OAAO/D;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","trustedOrigins","TRUSTED_ORIGINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf, \n    read, \n    readArray, \n    readBool, \n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYtB,KAAKM,8BAA8BiB,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,iBAAiBxB,UAAUK,8BAA8BoB,eAAe;CAC9E,IAAID,kBAAkBA,eAAeE,SAAS,GAC1CnB,QAAQiB,iBAAiBA;CAG7B,MAAMG,oBAAoBzB,QAAQG,8BAA8BuB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BpB,QAAQoB,oBAAoBA;CAGhC,MAAME,qBAAqB3B,QAAQG,8BAA8ByB,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BtB,QAAQsB,qBAAqBA;CAGjC,MAAME,sBAAsB9B,SAASI,8BAA8B2B,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BxB,QAAQwB,sBAAsBA;CAGlC,MAAME,2BAA2BhC,SAASI,8BAA8B6B,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC1B,QAAQ0B,2BAA2BA;CAGvC,MAAME,0BAA0BlC,SAASI,8BAA8B+B,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAKtC,MAAME,kBAAkBpC,SAASI,8BAA8BiC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9B,QAAQgC,kBAAkBF;CAG9B,MAAMG,sBAAsBvC,SAASI,8BAA8BoC,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjC,QAAQiC,sBAAsBA;CAGlC,MAAME,oBAAoB3C,KAAKM,8BAA8BsC,oBAAoB;CACjF,IAAID,mBACAnC,QAAQqC,qBAAqBF;CAGjC,MAAMG,yBAAyB5C,SAASI,8BAA8ByC,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtC,QAAQwC,0BAA0BF;CAKtC,MAAMG,gBAAgB/C,SAASI,8BAA8B4C,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzC,QAAQ2C,gBAAgBF;CAG5B,MAAMG,mBAAmBlD,SAASI,8BAA8B+C,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5C,QAAQ4C,mBAAmBA;CAG/B,MAAME,oBAAoBtD,KAAKM,8BAA8BiD,mBAAmB;CAChF,IAAID,mBACA9C,QAAQ8C,oBAAoBA;CAGhC,MAAME,yBAAyBtD,SAASI,8BAA8BmD,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChD,QAAQgD,yBAAyBA;CAKrC,MAAME,iBAAiBxD,SAASI,8BAA8BqD,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BlD,QAAQoD,iBAAiBF;CAG7B,MAAMG,oBAAoB3D,SAASI,8BAA8BwD,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BrD,QAAQqD,oBAAoBA;CAGhC,MAAME,mBAAmB/D,KAAKM,8BAA8B0D,kBAAkB;CAC9E,IAAID,kBACAvD,QAAQuD,mBAAmBA;CAG/B,MAAME,wBAAwB/D,SAASI,8BAA8B4D,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjCzD,QAAQyD,wBAAwBA;CAKpC,MAAME,cAAclE,UAAUK,8BAA8B8D,WAAW;CACvE,IAAID,eAAeA,YAAYxC,SAAS,GACpCnB,QAAQ2D,cAAcA;CAG1B,MAAME,qCAAqCnE,SAASI,8BAA8BgE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C7D,QAAQ6D,qCAAqCA;CAGjD,OAAO7D;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -57,19 +57,26 @@ export type Config = {
      */
     publicUrl: string;
     /**
-     * Additional origins (besides publicUrl) that are trusted as
-     * redirect targets for the per-realm public `web` client and as
-     * allowed CORS origins. Bare origins (scheme://host[:port]); each is
-     * stored as `<origin>/**` in the web client's redirect_uri set.
+     * Trusted first-party app origins (besides publicUrl) — used as
+     * redirect targets for the per-realm public `web` client. Does NOT
+     * drive CORS (the API reflects any origin by default; an explicit
+     * CORS allowlist goes through middlewareCors), and does not affect
+     * UIs using their own registered OAuth2 client. Input entries may be
+     * full http(s) origins (scheme://host[:port]; other protocols are
+     * rejected) or bare hosts (host[:port]) — a bare host expands to
+     * both its http and https origin during normalization, so the
+     * normalized config always holds full origins (scheme://host[:port],
+     * no path); each is stored as `<origin>/**` in the web client's
+     * redirect_uri set.
      *
      * SECURITY: the `web` client is built_in (auto-consent + `global`
      * scope), so any origin listed here can obtain a full-permission user
-     * token once a user logs in. Adding a domain grants it full login
+     * token once a user logs in. Adding an origin grants it full login
      * capability for every realm.
      *
      * default: []
      */
-    additionalDomains: string[];
+    trustedOrigins: string[];
     /**
      * use body middleware
      *
@@ -201,4 +208,5 @@ export type Config = {
     permissionsDefaultPolicyAssignment: boolean;
 };
 export type ConfigInput = Partial<Config>;
+export type ConfigFactory = () => Promise<Config> | Config;
 //# sourceMappingURL=types.d.ts.map

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;OAYG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAI5B;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts

@@ -0,0 +1,6 @@
+import { Container } from 'validup';
+import type { Config } from './types.ts';
+export declare class ConfigValidator extends Container<Config> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/app/modules/config/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAuFhC"}