@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/app/modules/config/app-origins.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { URL } from "node:url";
+//#region src/app/modules/config/app-origins.ts
+/**
+* Derive the set of trusted application origins (scheme://host[:port]).
+*
+* publicUrl may carry a path, so its origin is extracted; trustedOrigins
+* entries are canonical origins already (normalizeConfig owns that
+* invariant, via `expandToOrigins`) and are merged verbatim.
+*/ function getAppOrigins(config) {
+	const origins = /* @__PURE__ */ new Set();
+	origins.add(new URL(config.publicUrl).origin);
+	for (const origin of config.trustedOrigins ?? []) origins.add(origin);
+	return Array.from(origins);
+}
+//#endregion
+export { getAppOrigins };
+
+//# sourceMappingURL=app-origins.mjs.map

package/dist/app/modules/config/app-origins.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-origins.mjs","names":["URL","getAppOrigins","config","origins","Set","add","publicUrl","origin","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/app-origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport type { Config } from './types.ts';\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins already (normalizeConfig owns that\n * invariant, via `expandToOrigins`) and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[] {\n    const origins = new Set<string>();\n    origins.add(new URL(config.publicUrl).origin);\n\n    for (const origin of config.trustedOrigins ?? []) {\n        origins.add(origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;;;;;;;GAiBA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIL,IAAIE,OAAOI,SAAS,CAAA,CAAEC,MAAM;CAE5C,KAAK,MAAMA,UAAUL,OAAOM,kBAAkB,CAAA,GAC1CL,QAAQE,IAAIE,MAAAA;CAGhB,OAAOE,MAAMC,KAAKP,OAAAA;AACtB"}

package/dist/app/modules/config/constants.d.ts

@@ -1,53 +1,26 @@
 import { TypedToken } from 'eldin';
-import type { Config } from './types.ts';
+import type { Config, ConfigSchemaDerivedKey } from './types.ts';
+import type { Schema } from '@authup/server-config-kit';
+import type { EnvironmentVariable } from '@authup/server-config';
 export declare const ConfigInjectionKey: TypedToken<Config>;
-export declare enum ConfigEnvironmentVariableName {
-    NODE_ENV = "NODE_ENV",
-    WRITABLE_DIRECTORY_PATH = "WRITABLE_DIRECTORY_PATH",
-    THEME_DIRECTORY_PATH = "THEME_DIRECTORY_PATH",
-    THEME_FRAGMENTS_ENABLED = "THEME_FRAGMENTS_ENABLED",
-    AUTH_CONSOLE_PATH = "AUTH_CONSOLE_PATH",
-    ACCOUNT_CONSOLE_PATH = "ACCOUNT_CONSOLE_PATH",
-    REDIS = "REDIS",
-    SMTP = "SMTP",
-    HOST = "HOST",
-    PORT = "PORT",
-    PUBLIC_URL = "PUBLIC_URL",
-    MTLS_PUBLIC_URL = "MTLS_PUBLIC_URL",
-    CERTIFICATE_SOURCE = "CERTIFICATE_SOURCE",
-    TRUST_PROXY = "TRUST_PROXY",
-    TRUSTED_ORIGINS = "TRUSTED_ORIGINS",
-    TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
-    TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",
-    TOKEN_REFRESH_GRACE_PERIOD = "TOKEN_REFRESH_GRACE_PERIOD",
-    PROMPT_LOGIN_MAX_AGE = "PROMPT_LOGIN_MAX_AGE",
-    END_SESSION_HINT_GRACE_PERIOD = "END_SESSION_HINT_GRACE_PERIOD",
-    REGISTRATION_ENABLED = "REGISTRATION_ENABLED",
-    EMAIL_VERIFICATION_ENABLED = "EMAIL_VERIFICATION_ENABLED",
-    PASSWORD_RECOVERY_ENABLED = "PASSWORD_RECOVERY_ENABLED",
-    PASSWORD_MIN_LENGTH = "PASSWORD_MIN_LENGTH",
-    ACCOUNT_CONSOLE_ENABLED = "ACCOUNT_CONSOLE_ENABLED",
-    EVENT_LOG_ENABLED = "EVENT_LOG_ENABLED",
-    EVENT_LOG_RETENTION_DAYS = "EVENT_LOG_RETENTION_DAYS",
-    EVENT_LOG_ENTITY_ENABLED = "EVENT_LOG_ENTITY_ENABLED",
-    EVENT_LOG_ENTITY_RETENTION_DAYS = "EVENT_LOG_ENTITY_RETENTION_DAYS",
-    LOGIN_ATTEMPT_THROTTLE_ENABLED = "LOGIN_ATTEMPT_THROTTLE_ENABLED",
-    LOGIN_ATTEMPT_THRESHOLD = "LOGIN_ATTEMPT_THRESHOLD",
-    LOGIN_ATTEMPT_WINDOW = "LOGIN_ATTEMPT_WINDOW",
-    SECRETS_ENCRYPTION_KEY = "SECRETS_ENCRYPTION_KEY",
-    MFA_ENABLED = "MFA_ENABLED",
-    MFA_REQUIRED = "MFA_REQUIRED",
-    MFA_FRESHNESS_MAX_AGE = "MFA_FRESHNESS_MAX_AGE",
-    MFA_TICKET_MAX_AGE = "MFA_TICKET_MAX_AGE",
-    CLIENT_AUTH_BASIC = "CLIENT_AUTH_BASIC",
-    CLIENT_SYSTEM_ENABLED = "CLIENT_SYSTEM_ENABLED",
-    CLIENT_SYSTEM_SECRET = "CLIENT_SYSTEM_SECRET",
-    CLIENT_SYSTEM_SECRET_RESET = "CLIENT_SYSTEM_SECRET_RESET",
-    USER_AUTH_BASIC = "USER_AUTH_BASIC",
-    USER_ADMIN_ENABLED = "USER_ADMIN_ENABLED",
-    USER_ADMIN_PASSWORD = "USER_ADMIN_PASSWORD",
-    USER_ADMIN_PASSWORD_RESET = "USER_ADMIN_PASSWORD_RESET",
-    PERMISSIONS = "PERMISSIONS",
-    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = "PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"
-}
+/**
+ * The keys this service reads, SELECTED out of the document schema by name.
+ *
+ * Nothing is declared here: a key's path, environment variable, default,
+ * reader and zod type all travel with its one declaration in
+ * `@authup/server-config`, so naming a key is the only thing that can go
+ * wrong, and naming a key that does not exist fails the build. The mapped
+ * Schema type is the other half of that guard: a {@link Config} key
+ * with no entry fails the build too.
+ *
+ * The two whole-section spreads are the sections this service reads in full,
+ * so their keys are flat and read in this service's own vocabulary. The five
+ * console keys stay nested under the console they belong to, since three
+ * consoles each declare a `url`. They are picked one by one rather than
+ * spread because a console section is mostly the console service's own
+ * business (where it listens, which package it serves); server-core only
+ * needs where a browser reaches it, and whether a static console is served
+ * at all.
+ */
+export declare const CONFIG_SCHEMA: Schema<Config, ConfigSchemaDerivedKey, EnvironmentVariable>;
 //# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAC7C,uBAAuB,4BAA4B;IACnD,iBAAiB,sBAAsB;IACvC,oBAAoB,yBAAyB;IAE7C,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAC3C,uBAAuB,4BAA4B;IAEnD,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAUjE,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAC9B,MAAM,EACN,sBAAsB,EACtB,mBAAmB,CAkBtB,CAAC"}

package/dist/app/modules/config/constants.mjs

@@ -2,59 +2,42 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { TypedToken } from "eldin";
+import { ACCOUNT_CONSOLE_SCHEMA, ADMIN_CONSOLE_SCHEMA, AUTH_CONSOLE_SCHEMA, CORE_SCHEMA, ROOT_SCHEMA, SECTION_KEY } from "@authup/server-config";
+import { defineSchema } from "@authup/server-config-kit";
 //#region src/app/modules/config/constants.ts
 const ConfigInjectionKey = new TypedToken("Config");
-var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVariableName) {
-	ConfigEnvironmentVariableName["NODE_ENV"] = "NODE_ENV";
-	ConfigEnvironmentVariableName["WRITABLE_DIRECTORY_PATH"] = "WRITABLE_DIRECTORY_PATH";
-	ConfigEnvironmentVariableName["THEME_DIRECTORY_PATH"] = "THEME_DIRECTORY_PATH";
-	ConfigEnvironmentVariableName["THEME_FRAGMENTS_ENABLED"] = "THEME_FRAGMENTS_ENABLED";
-	ConfigEnvironmentVariableName["AUTH_CONSOLE_PATH"] = "AUTH_CONSOLE_PATH";
-	ConfigEnvironmentVariableName["ACCOUNT_CONSOLE_PATH"] = "ACCOUNT_CONSOLE_PATH";
-	ConfigEnvironmentVariableName["REDIS"] = "REDIS";
-	ConfigEnvironmentVariableName["SMTP"] = "SMTP";
-	ConfigEnvironmentVariableName["HOST"] = "HOST";
-	ConfigEnvironmentVariableName["PORT"] = "PORT";
-	ConfigEnvironmentVariableName["PUBLIC_URL"] = "PUBLIC_URL";
-	ConfigEnvironmentVariableName["MTLS_PUBLIC_URL"] = "MTLS_PUBLIC_URL";
-	ConfigEnvironmentVariableName["CERTIFICATE_SOURCE"] = "CERTIFICATE_SOURCE";
-	ConfigEnvironmentVariableName["TRUST_PROXY"] = "TRUST_PROXY";
-	ConfigEnvironmentVariableName["TRUSTED_ORIGINS"] = "TRUSTED_ORIGINS";
-	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
-	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";
-	ConfigEnvironmentVariableName["TOKEN_REFRESH_GRACE_PERIOD"] = "TOKEN_REFRESH_GRACE_PERIOD";
-	ConfigEnvironmentVariableName["PROMPT_LOGIN_MAX_AGE"] = "PROMPT_LOGIN_MAX_AGE";
-	ConfigEnvironmentVariableName["END_SESSION_HINT_GRACE_PERIOD"] = "END_SESSION_HINT_GRACE_PERIOD";
-	ConfigEnvironmentVariableName["REGISTRATION_ENABLED"] = "REGISTRATION_ENABLED";
-	ConfigEnvironmentVariableName["EMAIL_VERIFICATION_ENABLED"] = "EMAIL_VERIFICATION_ENABLED";
-	ConfigEnvironmentVariableName["PASSWORD_RECOVERY_ENABLED"] = "PASSWORD_RECOVERY_ENABLED";
-	ConfigEnvironmentVariableName["PASSWORD_MIN_LENGTH"] = "PASSWORD_MIN_LENGTH";
-	ConfigEnvironmentVariableName["ACCOUNT_CONSOLE_ENABLED"] = "ACCOUNT_CONSOLE_ENABLED";
-	ConfigEnvironmentVariableName["EVENT_LOG_ENABLED"] = "EVENT_LOG_ENABLED";
-	ConfigEnvironmentVariableName["EVENT_LOG_RETENTION_DAYS"] = "EVENT_LOG_RETENTION_DAYS";
-	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_ENABLED"] = "EVENT_LOG_ENTITY_ENABLED";
-	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_RETENTION_DAYS"] = "EVENT_LOG_ENTITY_RETENTION_DAYS";
-	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_THROTTLE_ENABLED"] = "LOGIN_ATTEMPT_THROTTLE_ENABLED";
-	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_THRESHOLD"] = "LOGIN_ATTEMPT_THRESHOLD";
-	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_WINDOW"] = "LOGIN_ATTEMPT_WINDOW";
-	ConfigEnvironmentVariableName["SECRETS_ENCRYPTION_KEY"] = "SECRETS_ENCRYPTION_KEY";
-	ConfigEnvironmentVariableName["MFA_ENABLED"] = "MFA_ENABLED";
-	ConfigEnvironmentVariableName["MFA_REQUIRED"] = "MFA_REQUIRED";
-	ConfigEnvironmentVariableName["MFA_FRESHNESS_MAX_AGE"] = "MFA_FRESHNESS_MAX_AGE";
-	ConfigEnvironmentVariableName["MFA_TICKET_MAX_AGE"] = "MFA_TICKET_MAX_AGE";
-	ConfigEnvironmentVariableName["CLIENT_AUTH_BASIC"] = "CLIENT_AUTH_BASIC";
-	ConfigEnvironmentVariableName["CLIENT_SYSTEM_ENABLED"] = "CLIENT_SYSTEM_ENABLED";
-	ConfigEnvironmentVariableName["CLIENT_SYSTEM_SECRET"] = "CLIENT_SYSTEM_SECRET";
-	ConfigEnvironmentVariableName["CLIENT_SYSTEM_SECRET_RESET"] = "CLIENT_SYSTEM_SECRET_RESET";
-	ConfigEnvironmentVariableName["USER_AUTH_BASIC"] = "USER_AUTH_BASIC";
-	ConfigEnvironmentVariableName["USER_ADMIN_ENABLED"] = "USER_ADMIN_ENABLED";
-	ConfigEnvironmentVariableName["USER_ADMIN_PASSWORD"] = "USER_ADMIN_PASSWORD";
-	ConfigEnvironmentVariableName["USER_ADMIN_PASSWORD_RESET"] = "USER_ADMIN_PASSWORD_RESET";
-	ConfigEnvironmentVariableName["PERMISSIONS"] = "PERMISSIONS";
-	ConfigEnvironmentVariableName["PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"] = "PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT";
-	return ConfigEnvironmentVariableName;
-}({});
+/**
+* The keys this service reads, SELECTED out of the document schema by name.
+*
+* Nothing is declared here: a key's path, environment variable, default,
+* reader and zod type all travel with its one declaration in
+* `@authup/server-config`, so naming a key is the only thing that can go
+* wrong, and naming a key that does not exist fails the build. The mapped
+* Schema type is the other half of that guard: a {@link Config} key
+* with no entry fails the build too.
+*
+* The two whole-section spreads are the sections this service reads in full,
+* so their keys are flat and read in this service's own vocabulary. The five
+* console keys stay nested under the console they belong to, since three
+* consoles each declare a `url`. They are picked one by one rather than
+* spread because a console section is mostly the console service's own
+* business (where it listens, which package it serves); server-core only
+* needs where a browser reaches it, and whether a static console is served
+* at all.
+*/ const CONFIG_SCHEMA = {
+	...ROOT_SCHEMA,
+	...CORE_SCHEMA,
+	[SECTION_KEY.AUTH_CONSOLE]: defineSchema({ url: AUTH_CONSOLE_SCHEMA.url }),
+	[SECTION_KEY.ADMIN_CONSOLE]: defineSchema({
+		url: ADMIN_CONSOLE_SCHEMA.url,
+		enabled: ADMIN_CONSOLE_SCHEMA.enabled
+	}),
+	[SECTION_KEY.ACCOUNT_CONSOLE]: defineSchema({
+		url: ACCOUNT_CONSOLE_SCHEMA.url,
+		enabled: ACCOUNT_CONSOLE_SCHEMA.enabled
+	})
+};
 //#endregion
-export { ConfigEnvironmentVariableName, ConfigInjectionKey };
+export { CONFIG_SCHEMA, ConfigInjectionKey };
 
 //# sourceMappingURL=constants.mjs.map

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n    THEME_DIRECTORY_PATH = 'THEME_DIRECTORY_PATH',\n    THEME_FRAGMENTS_ENABLED = 'THEME_FRAGMENTS_ENABLED',\n    AUTH_CONSOLE_PATH = 'AUTH_CONSOLE_PATH',\n    ACCOUNT_CONSOLE_PATH = 'ACCOUNT_CONSOLE_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUST_PROXY = 'TRUST_PROXY',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n    ACCOUNT_CONSOLE_ENABLED = 'ACCOUNT_CONSOLE_ENABLED',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAwDX,EAAA,CAAA,CAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","defineSchema","ACCOUNT_CONSOLE_SCHEMA","ADMIN_CONSOLE_SCHEMA","AUTH_CONSOLE_SCHEMA","CORE_SCHEMA","ROOT_SCHEMA","SECTION_KEY","ConfigInjectionKey","CONFIG_SCHEMA","AUTH_CONSOLE","url","ADMIN_CONSOLE","enabled","ACCOUNT_CONSOLE"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport { TypedToken } from 'eldin';\nimport type { Config, ConfigSchemaDerivedKey } from './types.ts';\nimport type { Schema } from '@authup/server-config-kit';\nimport { defineSchema } from '@authup/server-config-kit';\nimport type { EnvironmentVariable } from '@authup/server-config';\nimport {\n    ACCOUNT_CONSOLE_SCHEMA,\n    ADMIN_CONSOLE_SCHEMA,\n    AUTH_CONSOLE_SCHEMA,\n    CORE_SCHEMA,\n    ROOT_SCHEMA,\n    SECTION_KEY,\n} from '@authup/server-config';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\n/**\n * The keys this service reads, SELECTED out of the document schema by name.\n *\n * Nothing is declared here: a key's path, environment variable, default,\n * reader and zod type all travel with its one declaration in\n * `@authup/server-config`, so naming a key is the only thing that can go\n * wrong, and naming a key that does not exist fails the build. The mapped\n * Schema type is the other half of that guard: a {@link Config} key\n * with no entry fails the build too.\n *\n * The two whole-section spreads are the sections this service reads in full,\n * so their keys are flat and read in this service's own vocabulary. The five\n * console keys stay nested under the console they belong to, since three\n * consoles each declare a `url`. They are picked one by one rather than\n * spread because a console section is mostly the console service's own\n * business (where it listens, which package it serves); server-core only\n * needs where a browser reaches it, and whether a static console is served\n * at all.\n */\nexport const CONFIG_SCHEMA: Schema<\n    Config,\n    ConfigSchemaDerivedKey,\n    EnvironmentVariable\n> = {\n    ...ROOT_SCHEMA,\n    ...CORE_SCHEMA,\n\n    // where the hosted page GETs redirect to\n    [SECTION_KEY.AUTH_CONSOLE]: defineSchema({ url: AUTH_CONSOLE_SCHEMA.url }),\n\n    // where the server-side console login lands the browser, and whether that\n    // login is minted at all\n    [SECTION_KEY.ADMIN_CONSOLE]: defineSchema({\n        url: ADMIN_CONSOLE_SCHEMA.url,\n        enabled: ADMIN_CONSOLE_SCHEMA.enabled,\n    }),\n    [SECTION_KEY.ACCOUNT_CONSOLE]: defineSchema({\n        url: ACCOUNT_CONSOLE_SCHEMA.url,\n        enabled: ACCOUNT_CONSOLE_SCHEMA.enabled,\n    }),\n};\n"],"mappings":";;;;;;;AAoBA,MAAaQ,qBAAqB,IAAIR,WAAmB,QAAA;;;;;;;;;;;;;;;;;;;GAqBzD,MAAaS,gBAIT;CACA,GAAGH;CACH,GAAGD;EAGFE,YAAYG,eAAeT,aAAa,EAAEU,KAAKP,oBAAoBO,IAAI,CAAA;EAIvEJ,YAAYK,gBAAgBX,aAAa;EACtCU,KAAKR,qBAAqBQ;EAC1BE,SAASV,qBAAqBU;CAClC,CAAA;EACCN,YAAYO,kBAAkBb,aAAa;EACxCU,KAAKT,uBAAuBS;EAC5BE,SAASX,uBAAuBW;CACpC,CAAA;AACJ"}

package/dist/app/modules/config/index.d.ts

@@ -1,7 +1,6 @@
 export * from './constants.ts';
-export * from './helpers.ts';
+export * from './read.ts';
 export * from './module.ts';
-export * from './origins.ts';
-export * from './read/index.ts';
+export * from './app-origins.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}

package/dist/app/modules/config/index.mjs

@@ -1,12 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./constants.mjs";
-import { expandToOrigins, getAppOrigins } from "./origins.mjs";
-import { readConfigRawFromEnv } from "./read/env.mjs";
-import { readConfigRawFromFS } from "./read/fs.mjs";
-import { readConfigRaw } from "./read/module.mjs";
-import "./read/index.mjs";
-import { readConfig } from "./helpers.mjs";
+import { CONFIG_SCHEMA, ConfigInjectionKey } from "./constants.mjs";
+import { normalizeConfig, readConfig } from "./read.mjs";
 import { ConfigModule } from "./module.mjs";
-export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+import { getAppOrigins } from "./app-origins.mjs";
+export { CONFIG_SCHEMA, ConfigInjectionKey, ConfigModule, getAppOrigins, normalizeConfig, readConfig };

package/dist/app/modules/config/module.d.ts

@@ -1,7 +1,7 @@
 import type { IModule } from 'orkos';
 import type { IContainer } from 'eldin';
-import type { ConfigRawReadOptions } from './read/index.ts';
 import type { Config, ConfigFactory } from './types.ts';
+import type { ConfigRawReadOptions } from '@authup/server-config';
 export declare class ConfigModule implements IModule {
     readonly name: string;
     protected instance: Config | ConfigFactory | undefined;
@@ -12,6 +12,6 @@ export declare class ConfigModule implements IModule {
      *
      * @param options
      */
-    read(options?: ConfigRawReadOptions): Promise<Config>;
+    read(options?: ConfigRawReadOptions<Config>): Promise<Config>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/config/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,QAAQ,EAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;gBAI5C,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa;IAOrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC;CAGnE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,QAAQ,EAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;gBAI5C,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa;IAOrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,oBAAoB,CAAC,MAAM,CAAM,GAAI,OAAO,CAAC,MAAM,CAAC;CAG3E"}

package/dist/app/modules/config/module.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "./constants.mjs";
-import { readConfig } from "./helpers.mjs";
+import { readConfig } from "./read.mjs";
 //#region src/app/modules/config/module.ts
 var ConfigModule = class {
 	name;

package/dist/app/modules/config/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ModuleName","ConfigInjectionKey","readConfig","ConfigModule","name","instance","config","CONFIG","setup","container","read","register","useValue","options"],"sources":["../../../../src/app/modules/config/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { readConfig } from './helpers.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport type { Config, ConfigFactory } from './types.ts';\n\nexport class ConfigModule implements IModule {\n    readonly name: string;\n\n    protected instance : Config | ConfigFactory | undefined;\n\n    // ----------------------------------------------------\n\n    constructor(config?: Config | ConfigFactory) {\n        this.name = ModuleName.CONFIG;\n        this.instance = config;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        let instance : Config;\n        if (typeof this.instance === 'function') {\n            instance = await this.instance();\n        } else if (this.instance) {\n            instance = this.instance;\n        } else {\n            instance = await this.read();\n        }\n\n        container.register(ConfigInjectionKey, { useValue: instance });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Read config from env and fs.\n     *\n     * @param options\n     */\n    async read(options: ConfigRawReadOptions = {}) : Promise<Config> {\n        return readConfig(options);\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAaG,eAAb,MAAaA;CACAC;CAECC;CAIV,YAAYC,QAAiC;EACzC,KAAKF,OAAOJ,WAAWO;EACvB,KAAKF,WAAWC;CACpB;CAIA,MAAME,MAAMC,WAAsC;EAC9C,IAAIJ;EACJ,IAAI,OAAO,KAAKA,aAAa,YACzBA,WAAW,MAAM,KAAKA,SAAQ;OAC3B,IAAI,KAAKA,UACZA,WAAW,KAAKA;OAEhBA,WAAW,MAAM,KAAKK,KAAI;EAG9BD,UAAUE,SAASV,oBAAoB,EAAEW,UAAUP,SAAS,CAAA;CAChE;;;;;IASA,MAAMK,KAAKG,UAAgC,CAAC,GAAqB;EAC7D,OAAOX,WAAWW,OAAAA;CACtB;AACJ"}
+{"version":3,"file":"module.mjs","names":["ModuleName","ConfigInjectionKey","readConfig","ConfigModule","name","instance","config","CONFIG","setup","container","read","register","useValue","options"],"sources":["../../../../src/app/modules/config/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { readConfig } from './read.ts';\nimport type { Config, ConfigFactory } from './types.ts';\nimport type { ConfigRawReadOptions } from '@authup/server-config';\n\nexport class ConfigModule implements IModule {\n    readonly name: string;\n\n    protected instance : Config | ConfigFactory | undefined;\n\n    // ----------------------------------------------------\n\n    constructor(config?: Config | ConfigFactory) {\n        this.name = ModuleName.CONFIG;\n        this.instance = config;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        let instance : Config;\n        if (typeof this.instance === 'function') {\n            instance = await this.instance();\n        } else if (this.instance) {\n            instance = this.instance;\n        } else {\n            instance = await this.read();\n        }\n\n        container.register(ConfigInjectionKey, { useValue: instance });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Read config from env and fs.\n     *\n     * @param options\n     */\n    async read(options: ConfigRawReadOptions<Config> = {}) : Promise<Config> {\n        return readConfig(options);\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAaG,eAAb,MAAaA;CACAC;CAECC;CAIV,YAAYC,QAAiC;EACzC,KAAKF,OAAOJ,WAAWO;EACvB,KAAKF,WAAWC;CACpB;CAIA,MAAME,MAAMC,WAAsC;EAC9C,IAAIJ;EACJ,IAAI,OAAO,KAAKA,aAAa,YACzBA,WAAW,MAAM,KAAKA,SAAQ;OAC3B,IAAI,KAAKA,UACZA,WAAW,KAAKA;OAEhBA,WAAW,MAAM,KAAKK,KAAI;EAG9BD,UAAUE,SAASV,oBAAoB,EAAEW,UAAUP,SAAS,CAAA;CAChE;;;;;IASA,MAAMK,KAAKG,UAAwC,CAAC,GAAqB;EACrE,OAAOX,WAAWW,OAAAA;CACtB;AACJ"}

package/dist/app/modules/config/read.d.ts

@@ -0,0 +1,29 @@
+import type { ConfigRawReadOptions } from '@authup/server-config';
+import type { Config, ConfigInput } from './types.ts';
+/**
+ * Read config from env (and optionally fs) and normalize it.
+ *
+ * @param options
+ */
+export declare function readConfig(options?: ConfigRawReadOptions<Config>): Promise<Config>;
+/**
+ * The configuration this service runs on.
+ *
+ * There is nothing server-core-specific left here, and that is the point.
+ * Every derivation, canonicalization and cross-key invariant this function
+ * used to perform imperatively is declared on the key it belongs to, in
+ * `@authup/server-config`, and applied by {@link resolveSchemaData}: the
+ * issuer url derived from the core listener keys, the canonicalized trusted
+ * origins, each console's url and the refusal of a foreign one, every
+ * path made absolute against `rootPath`, the trustProxy shapes, and the
+ * three flag implications.
+ *
+ * So this is the same three passes any other service runs, and a console
+ * reading the same document computes the same answers without asking
+ * server-core for them. That is what the hand-over of `publicUrl`,
+ * `trustedOrigins` and `rootPath` from the CLI to the console services used
+ * to paper over, and why a console started through its own bin used to get a
+ * half-normalized document with no error to show for it.
+ */
+export declare function normalizeConfig(input?: ConfigInput): Promise<Config>;
+//# sourceMappingURL=read.d.ts.map

package/dist/app/modules/config/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/read.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AAE9F,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAWtD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,oBAAoB,CAAC,MAAM,CAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CA6C7F;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9E"}

package/dist/app/modules/config/read.mjs

@@ -0,0 +1,65 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONFIG_SCHEMA } from "./constants.mjs";
+import { parseConfig } from "./parse.mjs";
+import { readConfigRaw } from "@authup/server-config";
+import { isObject } from "smob";
+import { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from "typeorm-extension";
+import { buildSchemaDefaults, mergeSchemaData, resolveSchemaData } from "@authup/server-config-kit";
+//#region src/app/modules/config/read.ts
+/**
+* Read config from env (and optionally fs) and normalize it.
+*
+* @param options
+*/ async function readConfig(options = {}) {
+	let envDataSource;
+	const captureEnvDataSource = () => {
+		if (hasEnvDataSourceOptions()) envDataSource = readDataSourceOptionsFromEnv();
+	};
+	const env = options.env ?? true;
+	const envOptions = isObject(env) ? env : {};
+	const raw = await readConfigRaw(CONFIG_SCHEMA, {
+		...options,
+		fs: options.fs,
+		env: env ? {
+			...envOptions,
+			fn: (config) => {
+				envOptions.fn?.(config);
+				captureEnvDataSource();
+			}
+		} : false
+	});
+	if (envDataSource) {
+		const db = raw.db ?? { type: envDataSource.type };
+		for (const [key, value] of Object.entries(envDataSource)) if (typeof value !== "undefined") db[key] = value;
+		raw.db = db;
+	}
+	return normalizeConfig(raw);
+}
+/**
+* The configuration this service runs on.
+*
+* There is nothing server-core-specific left here, and that is the point.
+* Every derivation, canonicalization and cross-key invariant this function
+* used to perform imperatively is declared on the key it belongs to, in
+* `@authup/server-config`, and applied by {@link resolveSchemaData}: the
+* issuer url derived from the core listener keys, the canonicalized trusted
+* origins, each console's url and the refusal of a foreign one, every
+* path made absolute against `rootPath`, the trustProxy shapes, and the
+* three flag implications.
+*
+* So this is the same three passes any other service runs, and a console
+* reading the same document computes the same answers without asking
+* server-core for them. That is what the hand-over of `publicUrl`,
+* `trustedOrigins` and `rootPath` from the CLI to the console services used
+* to paper over, and why a console started through its own bin used to get a
+* half-normalized document with no error to show for it.
+*/ async function normalizeConfig(input = {}) {
+	const parsed = await parseConfig(input);
+	return resolveSchemaData(CONFIG_SCHEMA, mergeSchemaData(CONFIG_SCHEMA, buildSchemaDefaults(CONFIG_SCHEMA), parsed));
+}
+//#endregion
+export { normalizeConfig, readConfig };
+
+//# sourceMappingURL=read.mjs.map

package/dist/app/modules/config/read.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.mjs","names":["readConfigRaw","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","isObject","CONFIG_SCHEMA","buildSchemaDefaults","mergeSchemaData","resolveSchemaData","parseConfig","readConfig","options","envDataSource","captureEnvDataSource","env","envOptions","raw","fs","fn","config","db","type","key","value","Object","entries","normalizeConfig","input","parsed"],"sources":["../../../../src/app/modules/config/read.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ConfigRawReadOptions, DatabaseConnectionOptions  } from '@authup/server-config';\nimport { readConfigRaw } from '@authup/server-config';\nimport type { Config, ConfigInput } from './types.ts';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport { isObject } from 'smob';\nimport { CONFIG_SCHEMA } from './constants.ts';\nimport {\n    buildSchemaDefaults,\n    mergeSchemaData,\n    resolveSchemaData,\n} from '@authup/server-config-kit';\nimport { parseConfig } from './parse.ts';\n\n/**\n * Read config from env (and optionally fs) and normalize it.\n *\n * @param options\n */\nexport async function readConfig(options: ConfigRawReadOptions<Config> = {}) : Promise<Config> {\n    // The environment is read unless the caller says otherwise, and the `fn`\n    // below is what carries the DB_* block, so neither may be spread away by\n    // the caller's own options: both are applied AFTER `...options`.\n    let envDataSource : DatabaseConnectionOptions | undefined;\n    const captureEnvDataSource = () => {\n        // The DB_* names come from typeorm-extension and stay outside the registry.\n        if (hasEnvDataSourceOptions()) {\n            // the configuration surface is deliberately untyped here: `db` is\n            // authup's own loose shape, and typeorm's driver union carries\n            // dialects (mariadb) this service does not support anyway. The\n            // supported set is asserted at connect time.\n            envDataSource = readDataSourceOptionsFromEnv() as DatabaseConnectionOptions;\n        }\n    };\n    const env = options.env ?? true;\n    const envOptions = isObject(env) ? env : {};\n\n    const raw = await readConfigRaw(\n        CONFIG_SCHEMA,\n        {\n            ...options,\n            fs: options.fs,\n            env: env ?\n                {\n                    ...envOptions,\n                    fn: (config) => {\n                        envOptions.fn?.(config);\n                        captureEnvDataSource();\n                    },\n                } : false,\n        },\n    );\n\n    if (envDataSource) {\n        const db = raw.db ?? { type: envDataSource.type };\n        for (const [key, value] of Object.entries(envDataSource)) {\n            if (typeof value !== 'undefined') {\n                db[key] = value;\n            }\n        }\n        raw.db = db;\n    }\n\n    return normalizeConfig(raw);\n}\n\n/**\n * The configuration this service runs on.\n *\n * There is nothing server-core-specific left here, and that is the point.\n * Every derivation, canonicalization and cross-key invariant this function\n * used to perform imperatively is declared on the key it belongs to, in\n * `@authup/server-config`, and applied by {@link resolveSchemaData}: the\n * issuer url derived from the core listener keys, the canonicalized trusted\n * origins, each console's url and the refusal of a foreign one, every\n * path made absolute against `rootPath`, the trustProxy shapes, and the\n * three flag implications.\n *\n * So this is the same three passes any other service runs, and a console\n * reading the same document computes the same answers without asking\n * server-core for them. That is what the hand-over of `publicUrl`,\n * `trustedOrigins` and `rootPath` from the CLI to the console services used\n * to paper over, and why a console started through its own bin used to get a\n * half-normalized document with no error to show for it.\n */\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    return resolveSchemaData<Config>(\n        CONFIG_SCHEMA,\n        mergeSchemaData<Config>(\n            CONFIG_SCHEMA,\n            buildSchemaDefaults<Config>(CONFIG_SCHEMA),\n            parsed,\n        ),\n    ) as Config;\n}\n"],"mappings":";;;;;;;;;;;;;;GAyBA,eAAsBS,WAAWC,UAAwC,CAAC,GAAC;CAIvE,IAAIC;CACJ,MAAMC,6BAAuB;EAEzB,IAAIX,wBAAAA,GAKAU,gBAAgBT,6BAAAA;CAExB;CACA,MAAMW,MAAMH,QAAQG,OAAO;CAC3B,MAAMC,aAAaX,SAASU,GAAAA,IAAOA,MAAM,CAAC;CAE1C,MAAME,MAAM,MAAMf,cACdI,eACA;EACI,GAAGM;EACHM,IAAIN,QAAQM;EACZH,KAAKA,MACD;GACI,GAAGC;GACHG,KAAKC,WAAAA;IACDJ,WAAWG,KAAKC,MAAAA;IAChBN,qBAAAA;GACJ;EACJ,IAAI;CACZ,CAAA;CAGJ,IAAID,eAAe;EACf,MAAMQ,KAAKJ,IAAII,MAAM,EAAEC,MAAMT,cAAcS,KAAK;EAChD,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQb,aAAAA,GACtC,IAAI,OAAOW,UAAU,aACjBH,GAAGE,OAAOC;EAGlBP,IAAII,KAAKA;CACb;CAEA,OAAOM,gBAAgBV,GAAAA;AAC3B;;;;;;;;;;;;;;;;;;;GAqBA,eAAsBU,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMnB,YAAYkB,KAAAA;CAEjC,OAAOnB,kBACHH,eACAE,gBACIF,eACAC,oBAA4BD,aAAAA,GAC5BuB,MAAAA,CAAAA;AAGZ"}