npm - @authup/server-core - Versions diffs - 1.0.0-beta.62 → 1.0.0-beta.64 - Mend

@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (769) hide show

package/dist/app/modules/config/types.d.ts CHANGED Viewed

@@ -1,401 +1,34 @@
-import type { RedisClient, RedisClientOptions } from '@authup/server-kit';
-import type { ParseOptions as CookieOptions } from '@routup/basic/cookie';
-import type { Options as CorsOptions } from '@routup/cors';
-import type { OptionsInput as PrometheusOptions } from '@routup/prometheus';
-import type { ParseOptions as QueryOptions } from '@routup/basic/query';
-import type { OptionsInput as RateLimitOptions } from '@routup/rate-limit';
-import type { UIOptions as SwaggerUIOptions } from '@routup/swagger-ui';
-import type { Options as BodyOptions } from '@routup/basic/body';
-import type { DataSourceOptions } from 'typeorm';
-import type { SMTPOptions } from '../mail/adapter/smtp/types.ts';
-import type { CertificateSource } from '../../../adapters/http/request/index.ts';
-export type Config = {
-    /**
-     * Application environment (e.g., 'production').
-     * default: 'development'
-     */
-    env: string;
-    /**
-     * default: process.cwd()
-     */
-    rootPath: string;
-    /**
-     * Relative or absolute path.
-     * If the path is relative, the rootPath will be appended.
-     *
-     * default: writable
-     */
-    writableDirectoryPath: string;
-    /**
-     * EXPERIMENTAL. May change in a minor release: per-realm themes are
-     * likely to reshape the directory into `<root>/<theme name>/`. The
-     * manifest's `version` field makes a breaking change detectable.
-     *
-     * Directory holding the operator theme applied to the served consoles
-     * (the auth console and the account console). Relative paths resolve
-     * against the rootPath.
-     *
-     * The directory is operator trust, exactly like the config file: its
-     * `assets/` sub-directory is served verbatim at `/theme`, and its
-     * `theme.json` injects CSS custom properties into both consoles.
-     * Mount it read-only and never from a source a tenant can write.
-     *
-     * default: '' (theming disabled)
-     */
-    themeDirectoryPath: string;
-    /**
-     * EXPERIMENTAL, alongside themeDirectoryPath.
-     *
-     * Opt in to reading `fragments/head.html` from the theme directory and
-     * splicing it into the `<head>` of both served consoles.
-     *
-     * The fragment is raw, unsanitized markup running on the IdP origin,
-     * so it must be a deliberate operator decision and never a consequence
-     * of a file appearing in the mounted directory.
-     *
-     * default: false
-     */
-    themeFragmentsEnabled: boolean;
-    /**
-     * EXPERIMENTAL. The render contract it verifies is itself versioned
-     * (CONTRACT_VERSION), but this key and the boot-time assert may change.
-     *
-     * Package directory of a substituted `@authup/client-auth-console`
-     * (the directory holding its package.json and dist/). Consulted before
-     * the node_modules resolution walk.
-     *
-     * This replaces the login/consent IMPLEMENTATION, not its styling: the
-     * substituted package owns the prompt ladder, PKCE and state handling,
-     * MFA ordering and redirect gating. Use the theme directory for
-     * branding.
-     *
-     * default: '' (resolve @authup/client-auth-console from node_modules)
-     */
-    authConsolePath: string;
-    /**
-     * Package directory of a substituted
-     * `@authup/client-account-console`. Same contract as authConsolePath.
-     *
-     * default: '' (resolve @authup/client-account-console from node_modules)
-     */
-    accountConsolePath: string;
-    /**
-     * default: true
-     */
-    logger: boolean;
-    /**
-     * default driver: better-sqlite3
-     */
-    db?: DataSourceOptions;
-    /**
-     * default: true
-     */
-    redis: string | boolean | RedisClient | RedisClientOptions;
-    /**
-     * default: false
-     */
-    smtp: string | boolean | SMTPOptions;
-    /**
-     * Application port number.
-     * default: 3001
-     */
-    port: number;
-    /**
-     * Application host.
-     * default: localhost
-     */
-    host: string;
-    /**
-     * API base URL.
-     * default: http://localhost:3001
-     */
-    publicUrl: string;
-    /**
-     * Optional externally reachable base URL dedicated to endpoints that
-     * request TLS client certificates. Published as RFC 8705 mTLS endpoint
-     * aliases. The reverse proxy may route it to the same backend listener.
-     * default: null
-     */
-    mtlsPublicUrl: string | null;
-    /**
-     * Trusted-proxy client-certificate header contract. Enabling a source
-     * asserts that the backend listener is reachable only through a proxy that
-     * removes or overwrites the selected headers.
-     * default: disabled
-     */
-    certificateSource: CertificateSource;
-    /**
-     * Which upstream proxies to trust when deriving the client IP from
-     * `X-Forwarded-For` (routup's `TrustProxyInput` minus the function
-     * form): `true` trusts every hop, `false` trusts none (the socket
-     * peer address is used), a number trusts that many hops, and a
-     * string / string[] is a proxy-addr allowlist (IPs, CIDRs, or the
-     * presets `loopback`, `linklocal`, `uniquelocal`; a comma-separated
-     * string splits into a list).
-     *
-     * SECURITY: with `true`, any DIRECT client can spoof its IP via the
-     * `X-Forwarded-For` header — login-throttle keys, audit-event rows,
-     * and the session inventory all record the forged value. Pin the
-     * actual proxy (`1`, `loopback`, or its address/CIDR) when the
-     * listener is reachable without a proxy or exact attribution
-     * matters.
-     * default: true
-     */
-    trustProxy: boolean | number | string | string[];
-    /**
-     * Trusted first-party app origins (besides publicUrl) — used as
-     * redirect targets for the per-realm public system clients. Does NOT
-     * drive CORS (the API reflects any origin by default; an explicit
-     * CORS allowlist goes through middlewareCors), and does not affect
-     * UIs using their own registered OAuth2 client. Input entries may be
-     * full http(s) origins (scheme://host[:port]; other protocols are
-     * rejected) or bare hosts (host[:port]) — a bare host expands to
-     * both its http and https origin during normalization, so the
-     * normalized config always holds full origins (scheme://host[:port],
-     * no path); each is stored as `<origin>/**` in the system clients'
-     * redirect_uri set.
-     *
-     * SECURITY: the system clients are built_in (auto-consent + `global`
-     * scope), so any origin listed here can obtain a full-permission user
-     * token once a user logs in. Adding an origin grants it full login
-     * capability for every realm.
-     *
-     * default: []
-     */
-    trustedOrigins: string[];
-    /**
-     * use body middleware
-     *
-     * default: true
-     */
-    middlewareBody: boolean | BodyOptions;
-    /**
-     * use cors middleware
-     *
-     * default: true
-     */
-    middlewareCors: boolean | CorsOptions;
-    /**
-     * use cookie middleware
-     *
-     * default: true
-     */
-    middlewareCookie: boolean | CookieOptions;
-    /**
-     * Prometheus middleware (options)
-     */
-    middlewarePrometheus: boolean | PrometheusOptions;
-    /**
-     * Query middleware (options)
-     */
-    middlewareQuery: boolean | QueryOptions;
-    /**
-     * Rate limit middleware (options).
-     */
-    middlewareRateLimit: boolean | RateLimitOptions;
-    /**
-     * Swagger middleware (options)
-     *
-     * default: true
-     */
-    middlewareSwagger: boolean | SwaggerUIOptions;
-    /**
-     * Refresh token validity in seconds (default: 259,200s / 3 days).
-     * default: 259_200s (3days)
-     */
-    tokenRefreshMaxAge: number;
-    /**
-     * Access token validity in seconds (default: 900s / 15 minutes).
-     * default: 900s (15min)
-     */
-    tokenAccessMaxAge: number;
-    /**
-     * Grace period (seconds) during which a just-rotated (consumed) refresh
-     * token is still accepted, minting new chain-linked tokens instead of
-     * triggering replay detection. Absorbs multi-tab / mobile refresh races.
-     * default: 0 (strict — first-use-wins)
-     */
-    tokenRefreshGracePeriod: number;
-    /**
-     * Max age (seconds) of the authentication that a `prompt=login` / `max_age`
-     * authorize request accepts before forcing re-authentication. A stateless
-     * approximation judged against the session's created_at.
-     * default: 60s
-     */
-    promptLoginMaxAge: number;
-    /**
-     * Seconds past its `exp` an (expired) `id_token_hint` presented at the
-     * RP-initiated logout endpoint (`/logout`) is still accepted for a
-     * server-side session revoke. Bounds how long a leaked id_token stays a
-     * replayable remote logout; beyond the window the click-gated confirm
-     * page still works.
-     * default: 0 (unbounded — spec/Keycloak parity)
-     */
-    endSessionHintGracePeriod: number;
-    /**
-     * Enable user registration?
-     * default: false
-     */
-    registrationEnabled: boolean;
-    /**
-     * Require email verification for registration or login?
-     * default: false
-     */
-    emailVerificationEnabled: boolean;
-    /**
-     * Allow password reset via email?
-     * default: false
-     */
-    passwordRecoveryEnabled: boolean;
-    /**
-     * Minimum length for user-chosen passwords (user create/update,
-     * registration, password reset). The maximum is fixed at 512.
-     * default: 10
-     */
-    passwordMinLength: number;
-    /**
-     * Serve the account self-service surface (`/account`: profile, password,
-     * authenticators, sessions, applications). Operators with their own
-     * self-service portal can disable authup's.
-     * default: true
-     */
-    accountConsoleEnabled: boolean;
-    /**
-     * Persist security audit events (login, authorize, replay detection, ...)
-     * to the auth_events table. When disabled only the structured log line
-     * is emitted.
-     * default: true
-     */
-    eventLogEnabled: boolean;
-    /**
-     * Per-row retention for persisted audit events in days (stamped as
-     * expires_at at write time, swept by the event cleaner). Raise it for
-     * longer compliance windows; 0 = keep forever.
-     * default: 90
-     */
-    eventLogRetentionDays: number;
-    /**
-     * Additionally mirror every entity create/update/delete published on the
-     * domain-event bus into the auth_events table (scope: entity). Only
-     * effective while eventLogEnabled is true.
-     * default: true
-     */
-    eventLogEntityEnabled: boolean;
-    /**
-     * Per-row retention for entity-CRUD audit events in days — deliberately
-     * short so entity churn self-prunes. 0 = keep forever.
-     * default: 7
-     */
-    eventLogEntityRetentionDays: number;
-    /**
-     * Throttle failed interactive logins per (identifier, ip) pair by
-     * counting recent loginFailed audit events. Requires eventLogEnabled.
-     * default: false
-     */
-    loginAttemptThrottleEnabled: boolean;
-    /**
-     * Failed attempts per (identifier, ip) pair within the window before
-     * the pair is throttled.
-     * default: 5
-     */
-    loginAttemptThreshold: number;
-    /**
-     * Sliding throttle window in seconds.
-     * default: 900
-     */
-    loginAttemptWindow: number;
-    /**
-     * Optional base64-encoded 32-byte KEK (AES-256-GCM) wrapping the realm
-     * key store's material at rest (auth_keys.decryption_key — realm
-     * signing private keys and the per-realm enc keys the MFA seed cipher
-     * rides). Unset = material persists unwrapped (Keycloak/authentik
-     * parity); setting it later wraps rows lazily on read, removing it
-     * while wrapped rows exist fails loud at first use.
-     * default: '' (unset)
-     */
-    secretsEncryptionKey: string;
-    /**
-     * Org-wide multi-factor authentication feature toggle. When enabled,
-     * users can enroll authenticator devices, and a user holding a
-     * confirmed device must present a second factor on interactive
-     * authorization and the password grant.
-     * default: false
-     */
-    mfaEnabled: boolean;
-    /**
-     * Enforce MFA for every user: a user without a confirmed device is
-     * routed to inline enrollment at next interactive login
-     * (configure-inline). Requires mfaEnabled.
-     * default: false
-     */
-    mfaRequired: boolean;
-    /**
-     * Max age (seconds) of the session's second-factor proof (mfa_at) an
-     * `acr_values=urn:authup:mfa` step-up request accepts before forcing
-     * a fresh challenge. Mirrors promptLoginMaxAge's semantics (the
-     * window absorbs the hosted challenge round-trip).
-     * default: 60
-     */
-    mfaFreshnessMaxAge: number;
-    /**
-     * Lifetime (seconds) of the "MFA-pending" login ticket the password
-     * grant issues when the second factor cannot ride the single POST
-     * (email / WebAuthn) — and of the pending session backing it (extended
-     * to the full session lifetime on completion). Sized to cover the
-     * email-OTP window (code expiry: 10 minutes).
-     * default: 600
-     */
-    mfaTicketMaxAge: number;
-    /**
-     * default: false
-     */
-    clientAuthBasic: boolean;
-    /**
-     * Enable a client account for the default realm.
-     * default: false
-     */
-    clientSystemEnabled: boolean;
-    /**
-     * The secret of the default client.
-     */
-    clientSystemSecret: string;
-    /**
-     * Reset client secret on application startup.
-     * default: undefined
-     */
-    clientSystemSecretReset: boolean;
-    /**
-     * default: false
-     */
-    userAuthBasic: boolean;
-    /**
-     * Enable default admin user.
-     * default: true
-     */
-    userAdminEnabled: boolean;
-    /**
-     * The password of the default admin user.
-     * default: 'start123'
-     */
-    userAdminPassword: string;
-    /**
-     * Reset admin password on application startup.
-     * default: undefined
-     */
-    userAdminPasswordReset: boolean;
-    /**
-     * default: []
-     */
-    permissions: string | string[];
-    /**
-     * Auto-assign system.default policy to new permissions without policies.
-     * Creates an entry in the permission-policy junction table.
-     * default: true
-     *
-     * @deprecated Will be removed in v2.0.0. External systems should assign policies explicitly.
-     */
-    permissionsDefaultPolicyAssignment: boolean;
+import type { AccountConsoleConfig, AdminConsoleConfig, AuthConsoleConfig, CoreConfig, RootConfig, SECTION_KEY } from '@authup/server-config';
+/**
+ * The keys THIS service reads out of `authup.yml`: the deployment-wide
+ * section, its own `core` section, and the four console keys it needs
+ * to answer a request.
+ *
+ * It is a SELECTION, never a declaration. Every key is declared once in
+ * `@authup/server-config`, so this service cannot spell a path, an
+ * environment variable or a reader differently from a console service reading
+ * the same key. It also cannot silently forget one: a key is either named
+ * here or it is not read.
+ *
+ * The theme section is deliberately absent. Theming applies to a served
+ * console, and since plan 101 D2 no console is served from this process.
+ *
+ * Its own two sections are read WHOLE and therefore flat, in the vocabulary
+ * the service itself uses (`port`, not `core.port`). The console keys stay
+ * under the section they belong to: three consoles each declare a `url` and
+ * an `enabled`, which no flat bag can hold at once, and the nesting says
+ * whose is whose.
+ */
+export type Config = RootConfig & CoreConfig & {
+    [SECTION_KEY.AUTH_CONSOLE]: Pick<AuthConsoleConfig, 'url'>;
+    [SECTION_KEY.ADMIN_CONSOLE]: Pick<AdminConsoleConfig, 'url' | 'enabled'>;
+    [SECTION_KEY.ACCOUNT_CONSOLE]: Pick<AccountConsoleConfig, 'url' | 'enabled'>;
 };
 export type ConfigInput = Partial<Config>;
 export type ConfigFactory = () => Promise<Config> | Config;
+/**
+ * Keys without a static default: publicUrl is derived from host and port in
+ * normalizeConfig, db falls back to typeorm-extension's driver default.
+ */
+export type ConfigSchemaDerivedKey = 'publicUrl' | 'internalUrl' | 'db';
 //# sourceMappingURL=types.d.ts.map

package/dist/app/modules/config/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,~~EAAE~~,~~WAAW~~,~~EAAE~~,kBAAkB,~~EAAE~~,~~MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,~~iBAAiB,~~EAAE~~,~~MAAM~~,~~oBAAoB~~,~~CAAC;AAC5E~~,~~OAAO~~,~~KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,~~WAAW,~~EAAE~~,MAAM,~~oBAAoB~~,CAAC;~~AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+~~B~~,CAAC~~;~~AACjE~~,~~OAAO,KAAK,EAAE,iBAAiB,EAAE,~~MAAM,~~yCAAyC,CAAC;AAEjF,~~MAAM,MAAM,~~MAAM,~~GAAG~~;IACjB;;;OAGG;IACH~~,~~GAAG~~,~~EAAE~~,~~MAAM~~,~~CAAC~~;~~IAEZ;;OAEG;IACH~~,~~QAAQ,EAAE,MAAM,~~CAAC~~;IACjB;;;;;OAKG;IACH~~,~~qBAAqB~~,~~EAAE,MAAM,~~CAAC~~;IAE9B;;;;;;;;;;;;;;;OAeG;IACH~~,~~kBAAkB~~,~~EAAE,MAAM,~~CAAC~~;IAE3B;;;;;;;;;;;OAWG;IACH~~,~~qBAAqB,~~EAAE,~~OAAO~~,CAAC~~;IAE/B;;;;;;;;;;;;;;OAcG;IACH~~,~~eAAe~~,EAAE,~~MAAM~~,CAAC~~;IAExB;;;;;OAKG;IACH~~,~~kBAAkB,EAAE,MAAM,~~CAAC;~~IAI3B;;OAEG;IACH~~,~~MAAM,EAAE,OAAO,~~CAAC~~;IAEhB;;OAEG;IACH~~,~~EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,~~WAAW,~~GAAG,kBAAkB,~~CAAC~~;IAE3D;;OAEG;IACH~~,~~IAAI~~,~~EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,~~CAAC~~;IAIrC;;;OAGG;IACH~~,~~IAAI,~~EAAE,~~MAAM,CAAC;IAEb;;;OAGG;IACH,~~IAAI,~~EAAE,MAAM,~~CAAC~~;IAEb;;;OAGG;IACH~~,~~SAAS~~,EAAE,~~MAAM~~,~~CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,~~GAAG,~~IAAI~~,CAAC~~;IAE7B;;;;;OAKG;IACH~~,~~iBAAiB,EAAE,iBAAiB,~~CAAC;~~IAErC;;;;;;;;;;;;;;;;OAgBG;IACH~~,~~UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,~~CAAC~~;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH~~,~~cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,~~WAAW,CAAC~~;IAEtC;;;;OAIG;IACH~~,~~cAAc~~,~~EAAE,OAAO,GAAG,WAAW,~~CAAC~~;IAEtC;;;;OAIG;IACH~~,~~gBAAgB,~~EAAE,~~OAAO~~,~~GAAG,aAAa,~~CAAC~~;IAE1C;;OAEG;IACH~~,oBAAoB,EAAE,~~OAAO~~,GAAG,~~iBAAiB~~,CAAC~~;IAElD;;OAEG;IACH~~,~~eAAe,EAAE,OAAO,GAAG,YAAY,CAAC~~;~~IAExC;;OAEG;IACH~~,~~mBAAmB,EAAE,OAAO,GAAG,gBAAgB,~~CAAC;~~IAEhD;;;;OAIG;IACH~~,~~iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,~~MAAM,~~CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,~~MAAM,~~CAAC;IAE1B;;;;;OAKG;IACH~~,~~uBAAuB~~,~~EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,~~OAAO,CAAC~~;IAE7B;;;OAGG;IACH~~,~~wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,~~MAAM,CAAC~~;IAE1B;;;;;OAKG;IACH~~,~~qBAAqB,EAAE,OAAO,~~CAAC;~~IAI/B;;;;;OAKG;IACH~~,~~eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,~~MAAM,~~CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,~~MAAM,~~CAAC;IAEpC;;;;OAIG;IACH~~,~~2BAA2B~~,~~EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,~~MAAM,~~CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,~~OAAO,CAAC~~;IAEpB;;;;;OAKG;IACH~~,~~WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,~~MAAM,CAAC~~;IAE3B;;;;;;;OAOG;IACH~~,~~eAAe~~,~~EAAE,~~MAAM,CAAC;~~IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB~~;;;~~OAGG~~;~~IACH~~,~~mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,~~MAAM,~~CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,~~MAAM,~~CAAC;IAE1B;;;OAGG;IACH,~~sBAAsB,~~EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,~~GAAG,~~MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,~~WAAW,GAAG,~~OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,~~aAAa,GAAG,~~MAAM~~,~~OAAO,~~CAAC~~,MAAM,CAAC,GAAG,MAAM,CAAC~~"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,WAAW,EACd,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,MAAM,GAAG,UAAU,GAC3B,UAAU,GACV;IACI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;IACzE,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,SAAS,CAAC,CAAA;CAC/E,CAAC;AAEN,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,aAAa,GAAG,IAAI,CAAC"}

package/dist/app/modules/config/validator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"~~AAcA~~,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;~~AAIpC~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;~~CA8HhC~~"}
1	+ {"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAOhC"}

package/dist/app/modules/config/validator.mjs CHANGED Viewed

@@ -1,98 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { expandToOrigins } from "./origins.mjs";
-import { isValidTrustProxyListEntry } from "./trust-proxy.mjs";
-import { CERTIFICATE_SOURCES } from "../../../adapters/http/request/constants.mjs";
-import "../../../adapters/http/request/index.mjs";
-import { isObject } from "@authup/kit";
-import { USER_PASSWORD_MAX_LENGTH } from "@authup/core-kit";
+import { CONFIG_SCHEMA } from "./constants.mjs";
 import { Container } from "validup";
-import { createValidator } from "@validup/zod";
-import { z } from "zod";
+import { mountSchema } from "@authup/server-config-kit";
 //#region src/app/modules/config/validator.ts
 var ConfigValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		const stringValidator = createValidator(z.string());
-		const booleanValidator = createValidator(z.boolean());
-		const nonNegativeNumberValidator = createValidator(z.number().nonnegative());
-		const secretValidator = createValidator(z.string().min(3).max(256));
-		const middlewareValidator = createValidator(z.boolean().or(z.record(z.string(), z.any())));
-		const serviceValidator = createValidator(z.string().or(z.boolean()).or(z.custom((value) => isObject(value))));
-		const validators = {
-			env: stringValidator,
-			rootPath: stringValidator,
-			writableDirectoryPath: stringValidator,
-			themeDirectoryPath: stringValidator,
-			themeFragmentsEnabled: booleanValidator,
-			authConsolePath: stringValidator,
-			accountConsolePath: stringValidator,
-			logger: booleanValidator,
-			db: createValidator(z.custom((value) => isObject(value))),
-			redis: serviceValidator,
-			smtp: serviceValidator,
-			port: nonNegativeNumberValidator,
-			host: stringValidator,
-			publicUrl: createValidator(z.url()),
-			mtlsPublicUrl: createValidator(z.url().nullable()),
-			certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),
-			trustProxy: createValidator(z.union([
-				z.boolean(),
-				z.number().int().nonnegative(),
-				z.string(),
-				z.array(z.string().refine(isValidTrustProxyListEntry, "must be an IP, CIDR, or proxy-addr preset"))
-			])),
-			trustedOrigins: createValidator(z.array(z.string().refine((value) => {
-				try {
-					expandToOrigins(value);
-					return true;
-				} catch {
-					return false;
-				}
-			}, "must be a http(s) origin or a bare host[:port]"))),
-			middlewareBody: middlewareValidator,
-			middlewareCors: middlewareValidator,
-			middlewareCookie: middlewareValidator,
-			middlewareQuery: middlewareValidator,
-			middlewarePrometheus: middlewareValidator,
-			middlewareRateLimit: middlewareValidator,
-			middlewareSwagger: booleanValidator,
-			tokenAccessMaxAge: nonNegativeNumberValidator,
-			tokenRefreshMaxAge: nonNegativeNumberValidator,
-			tokenRefreshGracePeriod: nonNegativeNumberValidator,
-			promptLoginMaxAge: nonNegativeNumberValidator,
-			endSessionHintGracePeriod: nonNegativeNumberValidator,
-			registrationEnabled: booleanValidator,
-			emailVerificationEnabled: booleanValidator,
-			passwordRecoveryEnabled: booleanValidator,
-			passwordMinLength: createValidator(z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH)),
-			accountConsoleEnabled: booleanValidator,
-			eventLogEnabled: booleanValidator,
-			eventLogRetentionDays: nonNegativeNumberValidator,
-			eventLogEntityEnabled: booleanValidator,
-			eventLogEntityRetentionDays: nonNegativeNumberValidator,
-			loginAttemptThrottleEnabled: booleanValidator,
-			loginAttemptThreshold: createValidator(z.number().int().positive()),
-			loginAttemptWindow: createValidator(z.number().int().positive()),
-			secretsEncryptionKey: createValidator(z.union([z.literal(""), z.base64()])),
-			mfaEnabled: booleanValidator,
-			mfaRequired: booleanValidator,
-			mfaFreshnessMaxAge: nonNegativeNumberValidator,
-			mfaTicketMaxAge: createValidator(z.number().int().positive()),
-			clientAuthBasic: booleanValidator,
-			clientSystemEnabled: booleanValidator,
-			clientSystemSecret: secretValidator,
-			clientSystemSecretReset: booleanValidator,
-			userAuthBasic: booleanValidator,
-			userAdminEnabled: booleanValidator,
-			userAdminPassword: secretValidator,
-			userAdminPasswordReset: booleanValidator,
-			permissions: createValidator(z.string().or(z.array(z.string()))),
-			permissionsDefaultPolicyAssignment: booleanValidator
-		};
-		const keys = Object.keys(validators);
-		for (const key of keys) this.mount(key, { optional: true }, validators[key]);
+		mountSchema(this, CONFIG_SCHEMA);
 	}
 };
 //#endregion

package/dist/app/modules/config/validator.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n protected override initialize() {\n super.initialize();\n\n const stringValidator = createValidator(z.string());\n const booleanValidator = createValidator(z.boolean());\n const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n const secretValidator = createValidator(z.string().min(3).max(256));\n const middlewareValidator = createValidator(\n z.boolean().or(z.record(z.string(), z.any())),\n );\n const serviceValidator = createValidator(\n z.string()\n .or(z.boolean())\n .or(z.custom<Record<string, any>>((value) => isObject(value))),\n );\n\n // Record<keyof Config, ...> is the compile-time exhaustiveness\n // guard: a Config key without a validator here fails the build\n // instead of being silently stripped by run().\n const validators: Record<keyof Config, ValidatorDescriptor> = {\n env: stringValidator,\n rootPath: stringValidator,\n writableDirectoryPath: stringValidator,\n themeDirectoryPath: stringValidator,\n themeFragmentsEnabled: booleanValidator,\n authConsolePath: stringValidator,\n accountConsolePath: stringValidator,\n\n logger: booleanValidator,\n db: createValidator(\n z.custom<MysqlDataSourceOptions \| PostgresDataSourceOptions \| BetterSqlite3DataSourceOptions>(\n (value) => isObject(value),\n ),\n ),\n redis: serviceValidator,\n smtp: serviceValidator,\n\n port: nonNegativeNumberValidator,\n host: stringValidator,\n publicUrl: createValidator(z.url()),\n mtlsPublicUrl: createValidator(z.url().nullable()),\n certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n trustProxy: createValidator(z.union([\n z.boolean(),\n z.number().int().nonnegative(),\n // scalar strings are canonicalized in normalizeConfig\n // (integer/boolean words → their semantic type)\n z.string(),\n // the explicit allowlist form: an integer-string or boolean\n // word entry is a mis-typed scalar and must fail loud —\n // proxy-addr would silently compile '1' to 0.0.0.1\n z.array(z.string().refine(\n isValidTrustProxyListEntry,\n 'must be an IP, CIDR, or proxy-addr preset',\n )),\n ])),\n trustedOrigins: createValidator(\n z.array(z.string().refine((value) => {\n try {\n expandToOrigins(value);\n return true;\n } catch {\n return false;\n }\n }, 'must be a http(s) origin or a bare host[:port]')),\n ),\n\n middlewareBody: middlewareValidator,\n middlewareCors: middlewareValidator,\n middlewareCookie: middlewareValidator,\n middlewareQuery: middlewareValidator,\n middlewarePrometheus: middlewareValidator,\n middlewareRateLimit: middlewareValidator,\n middlewareSwagger: booleanValidator,\n\n tokenAccessMaxAge: nonNegativeNumberValidator,\n tokenRefreshMaxAge: nonNegativeNumberValidator,\n tokenRefreshGracePeriod: nonNegativeNumberValidator,\n promptLoginMaxAge: nonNegativeNumberValidator,\n endSessionHintGracePeriod: nonNegativeNumberValidator,\n registrationEnabled: booleanValidator,\n emailVerificationEnabled: booleanValidator,\n passwordRecoveryEnabled: booleanValidator,\n passwordMinLength: createValidator(\n z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n ),\n accountConsoleEnabled: booleanValidator,\n\n eventLogEnabled: booleanValidator,\n eventLogRetentionDays: nonNegativeNumberValidator,\n eventLogEntityEnabled: booleanValidator,\n eventLogEntityRetentionDays: nonNegativeNumberValidator,\n loginAttemptThrottleEnabled: booleanValidator,\n loginAttemptThreshold: createValidator(z.number().int().positive()),\n loginAttemptWindow: createValidator(z.number().int().positive()),\n\n // '' = unset; otherwise a base64 string (normalizeConfig enforces\n // the decoded 32-byte length at boot).\n secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n mfaEnabled: booleanValidator,\n mfaRequired: booleanValidator,\n mfaFreshnessMaxAge: nonNegativeNumberValidator,\n mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n clientAuthBasic: booleanValidator,\n clientSystemEnabled: booleanValidator,\n clientSystemSecret: secretValidator,\n clientSystemSecretReset: booleanValidator,\n\n userAuthBasic: booleanValidator,\n userAdminEnabled: booleanValidator,\n userAdminPassword: secretValidator,\n userAdminPasswordReset: booleanValidator,\n\n permissions: createValidator(\n z.string().or(z.array(z.string())),\n ),\n permissionsDefaultPolicyAssignment: booleanValidator,\n };\n\n const keys = Object.keys(validators) as (keyof Config)[];\n for (const key of keys) {\n this.mount(key, { optional: true }, validators[key]);\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GACvBqB,oBAAoBrB;GACpBsB,uBAAuBpB;GACvBqB,iBAAiBvB;GACjBwB,oBAAoBxB;GAEpByB,QAAQvB;GACRwB,IAAIlC,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BW,OAAOb;GACPc,MAAMd;GAENe,MAAMzB;GACN0B,MAAM9B;GACN+B,WAAWvC,gBAAgBE,EAAEsC,IAAG,CAAA;GAChCC,eAAezC,gBAAgBE,EAAEsC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmB3C,gBAAgBE,EAAE0C,KAAKvC,mBAAAA,CAAAA;GAC1CwC,YAAY7C,gBAAgBE,EAAE4C,MAAM;IAChC5C,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGjC,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAGwC,OACf7C,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD8C,gBAAgBlD,gBACZE,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAGwC,QAAQzB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGP2B,gBAAgBjC;GAChBkC,gBAAgBlC;GAChBmC,kBAAkBnC;GAClBoC,iBAAiBpC;GACjBqC,sBAAsBrC;GACtBsC,qBAAqBtC;GACrBuC,mBAAmB/C;GAEnBgD,mBAAmB9C;GACnB+C,oBAAoB/C;GACpBgD,yBAAyBhD;GACzBiD,mBAAmBjD;GACnBkD,2BAA2BlD;GAC3BmD,qBAAqBrD;GACrBsD,0BAA0BtD;GAC1BuD,yBAAyBvD;GACzBwD,mBAAmBlE,gBACfE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAGlD,IAAInB,wBAAAA,CAAAA;GAEpCsE,uBAAuB1D;GAEvB2D,iBAAiB3D;GACjB4D,uBAAuB1D;GACvB2D,uBAAuB7D;GACvB8D,6BAA6B5D;GAC7B6D,6BAA6B/D;GAC7BgE,uBAAuB1E,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEQ,oBAAoB3E,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DS,sBAAsB5E,gBAAgBE,EAAE4C,MAAM,CAAC5C,EAAE2E,QAAQ,EAAA,GAAK3E,EAAE4E,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYrE;GACZsE,aAAatE;GACbuE,oBAAoBrE;GACpBsE,iBAAiBlF,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1DgB,iBAAiBzE;GACjB0E,qBAAqB1E;GACrB2E,oBAAoBtE;GACpBuE,yBAAyB5E;GAEzB6E,eAAe7E;GACf8E,kBAAkB9E;GAClB+E,mBAAmB1E;GACnB2E,wBAAwBhF;GAExBiF,aAAa3F,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElCmF,oCAAoClF;EACxC;EAEA,MAAMmF,OAAOC,OAAOD,KAAKpE,UAAAA;EACzB,KAAK,MAAMsE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGxE,WAAWsE,IAAI;CAE3D;AACJ"}
1	+ {"version":3,"file":"validator.mjs","names":["mountSchema","Container","CONFIG_SCHEMA","ConfigValidator","initialize"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { mountSchema } from '@authup/server-config-kit';\nimport { Container } from 'validup';\nimport type { Config } from './types.ts';\nimport { CONFIG_SCHEMA } from './constants.ts';\n\nexport class ConfigValidator extends Container<Config> {\n protected override initialize() {\n super.initialize();\n\n // The mapped Schema type is the exhaustiveness guard: a Config\n // key without a registry entry fails the build.\n mountSchema(this, CONFIG_SCHEMA);\n }\n}\n"],"mappings":";;;;;;;AAYA,IAAaG,kBAAb,cAAqCF,UAAAA;CACdG,aAAa;EAC5B,MAAMA,WAAAA;EAINJ,YAAY,MAAME,aAAAA;CACtB;AACJ"}

package/dist/app/modules/database/index.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 export * from './constants.ts';
+export * from './migration.ts';
 export * from './module.ts';
 export * from './repositories/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/database/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC"}

package/dist/app/modules/database/index.mjs CHANGED Viewed

@@ -27,5 +27,6 @@ import { UserRoleRepositoryAdapter } from "./repositories/user-role/repository.m
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./repositories/identity-provider-role-mapping/repository.mjs";
 import "./repositories/index.mjs";
 import { DatabaseInjectionKey } from "./constants.mjs";
+import { assertNoPendingMigrations, verifySchemaOrSynchronize } from "./migration.mjs";
 import { DatabaseModule } from "./module.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, EventRepositoryAdapter, IdentityProviderAccountRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, EventRepositoryAdapter, IdentityProviderAccountRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, assertNoPendingMigrations, verifySchemaOrSynchronize };

package/dist/app/modules/database/migration.d.ts ADDED Viewed

@@ -0,0 +1,33 @@
+import type { Logger } from '@authup/server-kit';
+import type { DataSource } from 'typeorm';
+/**
+ * Verify the database schema is current without running any DDL.
+ *
+ * Resolves `false` when the resolved data-source options carry no
+ * migrations at all. That is the sqlite shape: nothing can be pending, and
+ * the schema still has to be created, so the caller falls through to a
+ * schema synchronize. The predicate is the options, never a dialect
+ * compare.
+ *
+ * Resolves `true` when migrations are configured and none of them are
+ * pending. Throws when any are pending, so a process can never silently
+ * serve against an older schema.
+ */
+export declare function assertNoPendingMigrations(dataSource: DataSource): Promise<boolean>;
+/**
+ * Bring a process up against a schema another process owns: verify it, and
+ * create it only where there is nothing to verify.
+ *
+ * `assertNoPendingMigrations` throws when the chain is behind, so a verified
+ * return is the only way past it. Its `false` return means the data source
+ * carries no migrations at all (the sqlite shape), where nothing can be
+ * pending and the schema still has to be created, so that branch falls
+ * through to a synchronize. Dropping the fall-through would leave a sqlite
+ * process with no schema.
+ *
+ * Both callers that must not migrate share this: `DatabaseModule.migrate`
+ * under `migrationEnabled: false`, and the worker preset, which never
+ * migrates whatever the flag says.
+ */
+export declare function verifySchemaOrSynchronize(logger: Logger, dataSource: DataSource): Promise<void>;
+//# sourceMappingURL=migration.d.ts.map

package/dist/app/modules/database/migration.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/migration.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,CAkBzF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC3C,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}