@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/app/modules/config/origins.mjs

@@ -1,46 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { patternHasGlobstarInAuthority } from "@authup/kit";
-import { URL } from "node:url";
-//#region src/app/modules/config/origins.ts
-const SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\/\//i;
-const ALLOWED_PROTOCOLS = ["http:", "https:"];
-/**
-* Expand a configured trusted-origin value to its canonical origin(s).
-*
-* A value with an explicit scheme contributes exactly that origin —
-* the way to restrict a host to https only. A bare host[:port]
-* (e.g. `hub.local`) contributes both the http and https origin.
-*
-* Only http(s) is accepted: other schemes either have no usable web
-* origin (`new URL('myapp://x').origin` is the literal string "null")
-* or are meaningless as a redirect target for the web client — letting
-* them through would put garbage into a security-sensitive allowlist.
-*
-* Throws on values that don't parse as a URL/host or use another scheme.
-*/ function expandToOrigins(value) {
-	if (patternHasGlobstarInAuthority(value)) throw new Error(`A trusted origin must not use ** in the host, it would match every origin. Use a single * for a host wildcard, got: ${value}`);
-	if (SCHEME_REGEX.test(value)) {
-		const url = new URL(value);
-		if (!ALLOWED_PROTOCOLS.includes(url.protocol)) throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);
-		return [url.origin];
-	}
-	return [new URL(`http://${value}`).origin, new URL(`https://${value}`).origin];
-}
-/**
-* Derive the set of trusted application origins (scheme://host[:port]).
-*
-* publicUrl may carry a path, so its origin is extracted; trustedOrigins
-* entries are canonical origins — normalizeConfig owns that invariant
-* (expansion + dedupe via expandToOrigins) — and are merged verbatim.
-*/ function getAppOrigins(config) {
-	const origins = /* @__PURE__ */ new Set();
-	origins.add(new URL(config.publicUrl).origin);
-	for (const origin of config.trustedOrigins ?? []) origins.add(origin);
-	return Array.from(origins);
-}
-//#endregion
-export { expandToOrigins, getAppOrigins };
-
-//# sourceMappingURL=origins.mjs.map

package/dist/app/modules/config/origins.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"origins.mjs","names":["URL","patternHasGlobstarInAuthority","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","Error","test","url","includes","protocol","origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport { patternHasGlobstarInAuthority } from '@authup/kit';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/**\n * Expand a configured trusted-origin value to its canonical origin(s).\n *\n * A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n *\n * Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n *\n * Throws on values that don't parse as a URL/host or use another scheme.\n */\nexport function expandToOrigins(value: string): string[] {\n    // `new URL()` accepts `*` and `**` as a hostname, and every trusted origin\n    // becomes an `<origin>/**` redirect pattern for the system clients. A `**`\n    // there matches the rest of the value outright, so a single typo would\n    // turn the redirect allowlist of every realm's console clients into\n    // allow-any-origin. A single `*` is a supported host wildcard.\n    if (patternHasGlobstarInAuthority(value)) {\n        throw new Error(`A trusted origin must not use ** in the host, it would match every origin. Use a single * for a host wildcard, got: ${value}`);\n    }\n\n    if (SCHEME_REGEX.test(value)) {\n        const url = new URL(value);\n        if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n            throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n        }\n\n        return [url.origin];\n    }\n\n    return [\n        new URL(`http://${value}`).origin,\n        new URL(`https://${value}`).origin,\n    ];\n}\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[] {\n    const origins = new Set<string>();\n    origins.add(new URL(config.publicUrl).origin);\n\n    for (const origin of config.trustedOrigins ?? []) {\n        origins.add(origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;;AAWA,MAAME,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAS;;;;;;;;;;;;;;GAgB7C,SAAgBC,gBAAgBC,OAAa;CAMzC,IAAIJ,8BAA8BI,KAAAA,GAC9B,MAAM,IAAIC,MAAM,uHAAuHD,OAAO;CAGlJ,IAAIH,aAAaK,KAAKF,KAAAA,GAAQ;EAC1B,MAAMG,MAAM,IAAIR,IAAIK,KAAAA;EACpB,IAAI,CAACF,kBAAkBM,SAASD,IAAIE,QAAQ,GACxC,MAAM,IAAIJ,MAAM,8DAA8DE,IAAIE,UAAU;EAGhG,OAAO,CAACF,IAAIG,MAAO;CACvB;CAEA,OAAO,CACH,IAAIX,IAAI,UAAUK,OAAO,CAAA,CAAEM,QAC3B,IAAIX,IAAI,WAAWK,OAAO,CAAA,CAAEM,MAC/B;AACL;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIhB,IAAIa,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}

package/dist/app/modules/config/read/env.d.ts

@@ -1,3 +0,0 @@
-import type { ConfigInput } from '../types.ts';
-export declare function readConfigRawFromEnv(): ConfigInput;
-//# sourceMappingURL=env.d.ts.map

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CA4QnD"}

package/dist/app/modules/config/read/env.mjs

@@ -1,139 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { ConfigEnvironmentVariableName } from "../constants.mjs";
-import { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from "typeorm-extension";
-import { oneOf, read, readArray, readBool, readInt } from "envix";
-//#region src/app/modules/config/read/env.ts
-const BOOLEAN_TRUE_VALUES = /* @__PURE__ */ new Set([
-	"true",
-	"t",
-	"1",
-	"yes",
-	"y",
-	"on"
-]);
-const BOOLEAN_FALSE_VALUES = /* @__PURE__ */ new Set([
-	"false",
-	"f",
-	"0",
-	"no",
-	"n",
-	"off"
-]);
-/**
-* Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead
-* of silently falling back to the default (envix's `readBool` swallows e.g.
-* `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent
-* default is a weakened posture. Returns `undefined` when the var is unset.
-*/ function readBoolStrict(name) {
-	const raw = read(name);
-	if (typeof raw !== "string" || raw.trim().length === 0) return;
-	const normalized = raw.trim().toLowerCase();
-	if (BOOLEAN_TRUE_VALUES.has(normalized)) return true;
-	if (BOOLEAN_FALSE_VALUES.has(normalized)) return false;
-	throw new Error(`The environment variable ${name} must be a boolean value (received "${raw}").`);
-}
-function readConfigRawFromEnv() {
-	const options = {};
-	const env = read(ConfigEnvironmentVariableName.NODE_ENV);
-	if (env) options.env = env;
-	const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);
-	if (writableDirectoryPath) options.writableDirectoryPath = writableDirectoryPath;
-	const themeDirectoryPath = read(ConfigEnvironmentVariableName.THEME_DIRECTORY_PATH);
-	if (themeDirectoryPath) options.themeDirectoryPath = themeDirectoryPath;
-	const themeFragmentsEnabled = readBool(ConfigEnvironmentVariableName.THEME_FRAGMENTS_ENABLED);
-	if (typeof themeFragmentsEnabled !== "undefined") options.themeFragmentsEnabled = themeFragmentsEnabled;
-	const authConsolePath = read(ConfigEnvironmentVariableName.AUTH_CONSOLE_PATH);
-	if (authConsolePath) options.authConsolePath = authConsolePath;
-	const accountConsolePath = read(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_PATH);
-	if (accountConsolePath) options.accountConsolePath = accountConsolePath;
-	if (hasEnvDataSourceOptions()) options.db = readDataSourceOptionsFromEnv();
-	const redis = oneOf([readBool(ConfigEnvironmentVariableName.REDIS), read(ConfigEnvironmentVariableName.REDIS)]);
-	if (typeof redis !== "undefined") options.redis = redis;
-	const smtp = oneOf([readBool(ConfigEnvironmentVariableName.SMTP), read(ConfigEnvironmentVariableName.SMTP)]);
-	if (typeof smtp !== "undefined") options.smtp = smtp;
-	const host = read(ConfigEnvironmentVariableName.HOST);
-	if (host) options.host = host;
-	const port = readInt(ConfigEnvironmentVariableName.PORT);
-	if (typeof port !== "undefined") options.port = port;
-	const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);
-	if (publicURL) options.publicUrl = publicURL;
-	const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);
-	if (mtlsPublicURL) options.mtlsPublicUrl = mtlsPublicURL;
-	const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);
-	if (certificateSource) options.certificateSource = certificateSource;
-	const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);
-	if (typeof trustProxy === "string" && trustProxy.trim().length > 0) options.trustProxy = trustProxy;
-	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
-	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
-	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);
-	if (typeof tokenAccessMaxAge !== "undefined") options.tokenAccessMaxAge = tokenAccessMaxAge;
-	const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);
-	if (typeof tokenRefreshMaxAge !== "undefined") options.tokenRefreshMaxAge = tokenRefreshMaxAge;
-	const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);
-	if (typeof tokenRefreshGracePeriod !== "undefined") options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;
-	const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);
-	if (typeof promptLoginMaxAge !== "undefined") options.promptLoginMaxAge = promptLoginMaxAge;
-	const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);
-	if (typeof endSessionHintGracePeriod !== "undefined") options.endSessionHintGracePeriod = endSessionHintGracePeriod;
-	const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);
-	if (typeof registrationEnabled !== "undefined") options.registrationEnabled = registrationEnabled;
-	const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);
-	if (typeof emailVerificationEnabled !== "undefined") options.emailVerificationEnabled = emailVerificationEnabled;
-	const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);
-	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
-	const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);
-	if (typeof passwordMinLength !== "undefined") options.passwordMinLength = passwordMinLength;
-	const accountConsoleEnabled = readBool(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_ENABLED);
-	if (typeof accountConsoleEnabled !== "undefined") options.accountConsoleEnabled = accountConsoleEnabled;
-	const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);
-	if (typeof eventLogEnabled !== "undefined") options.eventLogEnabled = eventLogEnabled;
-	const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);
-	if (typeof eventLogRetentionDays !== "undefined") options.eventLogRetentionDays = eventLogRetentionDays;
-	const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);
-	if (typeof eventLogEntityEnabled !== "undefined") options.eventLogEntityEnabled = eventLogEntityEnabled;
-	const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);
-	if (typeof eventLogEntityRetentionDays !== "undefined") options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;
-	const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);
-	if (typeof loginAttemptThrottleEnabled !== "undefined") options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;
-	const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);
-	if (typeof loginAttemptThreshold !== "undefined") options.loginAttemptThreshold = loginAttemptThreshold;
-	const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);
-	if (typeof loginAttemptWindow !== "undefined") options.loginAttemptWindow = loginAttemptWindow;
-	const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);
-	if (typeof mfaEnabled !== "undefined") options.mfaEnabled = mfaEnabled;
-	const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);
-	if (typeof mfaRequired !== "undefined") options.mfaRequired = mfaRequired;
-	const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);
-	if (typeof mfaFreshnessMaxAge !== "undefined") options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;
-	const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);
-	if (typeof mfaTicketMaxAge !== "undefined") options.mfaTicketMaxAge = mfaTicketMaxAge;
-	const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);
-	if (secretsEncryptionKey) options.secretsEncryptionKey = secretsEncryptionKey;
-	const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);
-	if (typeof clientBasicAuth !== "undefined") options.clientAuthBasic = clientBasicAuth;
-	const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);
-	if (typeof clientSystemEnabled !== "undefined") options.clientSystemEnabled = clientSystemEnabled;
-	const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);
-	if (clientAdminSecret) options.clientSystemSecret = clientAdminSecret;
-	const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);
-	if (typeof clientAdminSecretReset !== "undefined") options.clientSystemSecretReset = clientAdminSecretReset;
-	const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);
-	if (typeof userBasicAuth !== "undefined") options.userAuthBasic = userBasicAuth;
-	const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);
-	if (typeof userAdminEnabled !== "undefined") options.userAdminEnabled = userAdminEnabled;
-	const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);
-	if (userAdminPassword) options.userAdminPassword = userAdminPassword;
-	const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);
-	if (typeof userAdminPasswordReset !== "undefined") options.userAdminPasswordReset = userAdminPasswordReset;
-	const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);
-	if (permissions && permissions.length > 0) options.permissions = permissions;
-	const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);
-	if (typeof permissionsDefaultPolicyAssignment !== "undefined") options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;
-	return options;
-}
-//#endregion
-export { readConfigRawFromEnv };
-
-//# sourceMappingURL=env.mjs.map

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","themeDirectoryPath","THEME_DIRECTORY_PATH","themeFragmentsEnabled","THEME_FRAGMENTS_ENABLED","authConsolePath","AUTH_CONSOLE_PATH","accountConsolePath","ACCOUNT_CONSOLE_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","accountConsoleEnabled","ACCOUNT_CONSOLE_ENABLED","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    const themeDirectoryPath = read(ConfigEnvironmentVariableName.THEME_DIRECTORY_PATH);\n    if (themeDirectoryPath) {\n        options.themeDirectoryPath = themeDirectoryPath;\n    }\n\n    const themeFragmentsEnabled = readBool(ConfigEnvironmentVariableName.THEME_FRAGMENTS_ENABLED);\n    if (typeof themeFragmentsEnabled !== 'undefined') {\n        options.themeFragmentsEnabled = themeFragmentsEnabled;\n    }\n\n    const authConsolePath = read(ConfigEnvironmentVariableName.AUTH_CONSOLE_PATH);\n    if (authConsolePath) {\n        options.authConsolePath = authConsolePath;\n    }\n\n    const accountConsolePath = read(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_PATH);\n    if (accountConsolePath) {\n        options.accountConsolePath = accountConsolePath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    // canonicalized again in normalizeConfig for every config surface; the\n    // env read keeps the raw string, the shared canonicalizer decides.\n    const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n    if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n        options.trustProxy = trustProxy;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    const accountConsoleEnabled = readBool(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_ENABLED);\n    if (typeof accountConsoleEnabled !== 'undefined') {\n        options.accountConsoleEnabled = accountConsoleEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAGpC,MAAME,qBAAqB1B,KAAKM,8BAA8BqB,oBAAoB;CAClF,IAAID,oBACAL,QAAQK,qBAAqBA;CAGjC,MAAME,wBAAwB1B,SAASI,8BAA8BuB,uBAAuB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCP,QAAQO,wBAAwBA;CAGpC,MAAME,kBAAkB9B,KAAKM,8BAA8ByB,iBAAiB;CAC5E,IAAID,iBACAT,QAAQS,kBAAkBA;CAG9B,MAAME,qBAAqBhC,KAAKM,8BAA8B2B,oBAAoB;CAClF,IAAID,oBACAX,QAAQW,qBAAqBA;CAKjC,IAAI5B,wBAAAA,GAEAiB,QAAQa,KAAK7B,6BAAAA;CAKjB,MAAM8B,QAAQpC,MAAM,CAChBG,SAASI,8BAA8B8B,KAAK,GAC5CpC,KAAKM,8BAA8B8B,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBd,QAAQc,QAAQA;CAGpB,MAAME,OAAOtC,MAAM,CACfG,SAASI,8BAA8BgC,IAAI,GAC3CtC,KAAKM,8BAA8BgC,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBhB,QAAQgB,OAAOA;CAKnB,MAAME,OAAOvC,KAAKM,8BAA8BkC,IAAI;CACpD,IAAID,MACAlB,QAAQkB,OAAOA;CAGnB,MAAME,OAAOtC,QAAQG,8BAA8BoC,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBpB,QAAQoB,OAAOA;CAGnB,MAAME,YAAY3C,KAAKM,8BAA8BsC,UAAU;CAC/D,IAAID,WACAtB,QAAQwB,YAAYF;CAGxB,MAAMG,gBAAgB9C,KAAKM,8BAA8ByC,eAAe;CACxE,IAAID,eACAzB,QAAQ2B,gBAAgBF;CAG5B,MAAMG,oBAAoBjD,KAAKM,8BAA8B4C,kBAAkB;CAC/E,IAAID,mBACA5B,QAAQ4B,oBAAoBA;CAKhC,MAAME,aAAanD,KAAKM,8BAA8B8C,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAWtC,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQ8B,aAAaA;CAGzB,MAAME,iBAAiBpD,UAAUK,8BAA8BgD,eAAe;CAC9E,IAAID,kBAAkBA,eAAevC,SAAS,GAC1CO,QAAQgC,iBAAiBA;CAG7B,MAAME,oBAAoBpD,QAAQG,8BAA8BkD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BlC,QAAQkC,oBAAoBA;CAGhC,MAAME,qBAAqBtD,QAAQG,8BAA8BoD,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BpC,QAAQoC,qBAAqBA;CAGjC,MAAME,0BAA0BxD,QAAQG,8BAA8BsD,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAGhC,MAAME,4BAA4B5D,QAAQG,8BAA8B0D,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrC1C,QAAQ0C,4BAA4BA;CAGxC,MAAME,sBAAsB/D,SAASI,8BAA8B4D,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/B5C,QAAQ4C,sBAAsBA;CAGlC,MAAME,2BAA2BjE,SAASI,8BAA8B8D,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC9C,QAAQ8C,2BAA2BA;CAGvC,MAAME,0BAA0BnE,SAASI,8BAA8BgE,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnChD,QAAQgD,0BAA0BA;CAGtC,MAAME,oBAAoBpE,QAAQG,8BAA8BkE,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BlD,QAAQkD,oBAAoBA;CAGhC,MAAME,wBAAwBvE,SAASI,8BAA8BoE,uBAAuB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAKpC,MAAME,kBAAkBjE,eAAeJ,8BAA8BsE,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3BtD,QAAQsD,kBAAkBA;CAG9B,MAAME,wBAAwB1E,QAAQG,8BAA8BwE,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCxD,QAAQwD,wBAAwBA;CAGpC,MAAME,wBAAwBrE,eAAeJ,8BAA8B0E,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC1D,QAAQ0D,wBAAwBA;CAGpC,MAAME,8BAA8B9E,QAAQG,8BAA8B4E,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvC5D,QAAQ4D,8BAA8BA;CAG1C,MAAME,8BAA8BzE,eAAeJ,8BAA8B8E,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvC9D,QAAQ8D,8BAA8BA;CAG1C,MAAME,wBAAwBlF,QAAQG,8BAA8BgF,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjChE,QAAQgE,wBAAwBA;CAGpC,MAAME,qBAAqBpF,QAAQG,8BAA8BkF,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BlE,QAAQkE,qBAAqBA;CAKjC,MAAME,aAAa/E,eAAeJ,8BAA8BoF,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBpE,QAAQoE,aAAaA;CAGzB,MAAME,cAAcjF,eAAeJ,8BAA8BsF,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvBtE,QAAQsE,cAAcA;CAG1B,MAAME,qBAAqB1F,QAAQG,8BAA8BwF,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BxE,QAAQwE,qBAAqBA;CAGjC,MAAME,kBAAkB5F,QAAQG,8BAA8B0F,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B1E,QAAQ0E,kBAAkBA;CAG9B,MAAME,uBAAuBjG,KAAKM,8BAA8B4F,sBAAsB;CACtF,IAAID,sBACA5E,QAAQ4E,uBAAuBA;CAKnC,MAAME,kBAAkBjG,SAASI,8BAA8B8F,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9E,QAAQgF,kBAAkBF;CAG9B,MAAMG,sBAAsBpG,SAASI,8BAA8BiG,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjF,QAAQiF,sBAAsBA;CAGlC,MAAME,oBAAoBxG,KAAKM,8BAA8BmG,oBAAoB;CACjF,IAAID,mBACAnF,QAAQqF,qBAAqBF;CAGjC,MAAMG,yBAAyBzG,SAASI,8BAA8BsG,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQwF,0BAA0BF;CAKtC,MAAMG,gBAAgB5G,SAASI,8BAA8ByG,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzF,QAAQ2F,gBAAgBF;CAG5B,MAAMG,mBAAmB/G,SAASI,8BAA8B4G,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5F,QAAQ4F,mBAAmBA;CAG/B,MAAME,oBAAoBnH,KAAKM,8BAA8B8G,mBAAmB;CAChF,IAAID,mBACA9F,QAAQ8F,oBAAoBA;CAGhC,MAAME,yBAAyBnH,SAASI,8BAA8BgH,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChG,QAAQgG,yBAAyBA;CAKrC,MAAME,cAActH,UAAUK,8BAA8BkH,WAAW;CACvE,IAAID,eAAeA,YAAYzG,SAAS,GACpCO,QAAQkG,cAAcA;CAG1B,MAAME,qCAAqCvH,SAASI,8BAA8BoH,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CpG,QAAQoG,qCAAqCA;CAGjD,OAAOpG;AACX"}

package/dist/app/modules/config/read/fs.d.ts

@@ -1,3 +0,0 @@
-import type { ConfigReadFsOptions } from './types.ts';
-export declare function readConfigRawFromFS(options?: ConfigReadFsOptions): Promise<Partial<import("../types.ts").Config>>;
-//# sourceMappingURL=fs.d.ts.map

package/dist/app/modules/config/read/fs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/fs.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiCtD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,kDA6C1E"}

package/dist/app/modules/config/read/fs.mjs

@@ -1,60 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { isObject, merge } from "smob";
-import { FSStore } from "confinity";
-//#region src/app/modules/config/read/fs.ts
-/**
-* Resolve one infrastructure section (`db`, `redis`, `smtp`), which may be
-* declared at the top level (shared), under `server.*` or under `server.core.*`.
-*
-* Keys are ordered **least specific first**. Two objects are merged, so a
-* shared base survives while the more specific declaration wins per key; a
-* scalar (a `redis://…` connection string, say) replaces whatever preceded it.
-* That is what "the most specific declaration wins" means for a section the
-* documentation explicitly describes as shared — `db.type` set once at the top
-* level still applies when only `db.database` is overridden per component.
-*
-* confinity v1 applied exactly this precedence inside `get([...keys])`; v2
-* removed the array form, so it is spelled out here instead.
-*/ function readSection(store, keys) {
-	let output;
-	for (const key of keys) {
-		const value = store.getSync(key);
-		if (typeof value === "undefined") continue;
-		output = isObject(value) && isObject(output) ? merge(value, output) : value;
-	}
-	return output;
-}
-async function readConfigRawFromFS(options = {}) {
-	const store = new FSStore({
-		prefix: "authup",
-		cwd: options.cwd
-	});
-	if (options.file) await store.loadFile(options.file);
-	else await store.load();
-	const raw = store.getSync("server.core") || {};
-	const db = readSection(store, [
-		"db",
-		"server.db",
-		"server.core.db"
-	]);
-	if (db) raw.db = db;
-	const redis = readSection(store, [
-		"redis",
-		"server.redis",
-		"server.core.redis"
-	]);
-	if (redis) raw.redis = redis;
-	const smtp = readSection(store, [
-		"smtp",
-		"server.smtp",
-		"server.core.smtp"
-	]);
-	if (smtp) raw.smtp = smtp;
-	return raw;
-}
-//#endregion
-export { readConfigRawFromFS };
-
-//# sourceMappingURL=fs.mjs.map

package/dist/app/modules/config/read/fs.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"fs.mjs","names":["FSStore","isObject","merge","readSection","store","keys","output","key","value","getSync","readConfigRawFromFS","options","prefix","cwd","file","loadFile","load","raw","db","redis","smtp"],"sources":["../../../../../src/app/modules/config/read/fs.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { FSStore } from 'confinity';\nimport { isObject, merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport type { ConfigReadFsOptions } from './types.ts';\n\n/**\n * Resolve one infrastructure section (`db`, `redis`, `smtp`), which may be\n * declared at the top level (shared), under `server.*` or under `server.core.*`.\n *\n * Keys are ordered **least specific first**. Two objects are merged, so a\n * shared base survives while the more specific declaration wins per key; a\n * scalar (a `redis://…` connection string, say) replaces whatever preceded it.\n * That is what \"the most specific declaration wins\" means for a section the\n * documentation explicitly describes as shared — `db.type` set once at the top\n * level still applies when only `db.database` is overridden per component.\n *\n * confinity v1 applied exactly this precedence inside `get([...keys])`; v2\n * removed the array form, so it is spelled out here instead.\n */\nfunction readSection<T>(store: FSStore, keys: string[]) : T | undefined {\n    let output : unknown;\n\n    for (const key of keys) {\n        const value = store.getSync(key);\n        if (typeof value === 'undefined') {\n            continue;\n        }\n\n        output = isObject(value) && isObject(output) ?\n            merge(value, output) :\n            value;\n    }\n\n    return output as T | undefined;\n}\n\nexport async function readConfigRawFromFS(options: ConfigReadFsOptions = {}) {\n    const store = new FSStore({\n        prefix: 'authup',\n        cwd: options.cwd,\n    });\n\n    if (options.file) {\n        await store.loadFile(options.file);\n    } else {\n        await store.load();\n    }\n\n    // Read synchronously after the explicit load. `get` is asynchronous in\n    // confinity v2, and a missing `await` would hand a Promise to code that\n    // only checks whether it received an object.\n    const raw : ConfigInput = store.getSync<ConfigInput>('server.core') || {};\n\n    const db = readSection<ConfigInput['db']>(store, [\n        'db',\n        'server.db',\n        'server.core.db',\n    ]);\n    if (db) {\n        raw.db = db;\n    }\n\n    const redis = readSection<ConfigInput['redis']>(store, [\n        'redis',\n        'server.redis',\n        'server.core.redis',\n    ]);\n    if (redis) {\n        raw.redis = redis;\n    }\n\n    const smtp = readSection<ConfigInput['smtp']>(store, [\n        'smtp',\n        'server.smtp',\n        'server.core.smtp',\n    ]);\n    if (smtp) {\n        raw.smtp = smtp;\n    }\n\n    return raw;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GA0BA,SAASG,YAAeC,OAAgBC,MAAc;CAClD,IAAIC;CAEJ,KAAK,MAAMC,OAAOF,MAAM;EACpB,MAAMG,QAAQJ,MAAMK,QAAQF,GAAAA;EAC5B,IAAI,OAAOC,UAAU,aACjB;EAGJF,SAASL,SAASO,KAAAA,KAAUP,SAASK,MAAAA,IACjCJ,MAAMM,OAAOF,MAAAA,IACbE;CACR;CAEA,OAAOF;AACX;AAEA,eAAsBI,oBAAoBC,UAA+B,CAAC,GAAC;CACvE,MAAMP,QAAQ,IAAIJ,QAAQ;EACtBY,QAAQ;EACRC,KAAKF,QAAQE;CACjB,CAAA;CAEA,IAAIF,QAAQG,MACR,MAAMV,MAAMW,SAASJ,QAAQG,IAAI;MAEjC,MAAMV,MAAMY,KAAI;CAMpB,MAAMC,MAAoBb,MAAMK,QAAqB,aAAA,KAAkB,CAAC;CAExE,MAAMS,KAAKf,YAA+BC,OAAO;EAC7C;EACA;EACA;CACH,CAAA;CACD,IAAIc,IACAD,IAAIC,KAAKA;CAGb,MAAMC,QAAQhB,YAAkCC,OAAO;EACnD;EACA;EACA;CACH,CAAA;CACD,IAAIe,OACAF,IAAIE,QAAQA;CAGhB,MAAMC,OAAOjB,YAAiCC,OAAO;EACjD;EACA;EACA;CACH,CAAA;CACD,IAAIgB,MACAH,IAAIG,OAAOA;CAGf,OAAOH;AACX"}

package/dist/app/modules/config/read/index.d.ts

@@ -1,5 +0,0 @@
-export * from './module.ts';
-export * from './env.ts';
-export * from './fs.ts';
-export * from './types.ts';
-//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/config/read/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC"}

package/dist/app/modules/config/read/index.mjs

@@ -1,7 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { readConfigRawFromEnv } from "./env.mjs";
-import { readConfigRawFromFS } from "./fs.mjs";
-import { readConfigRaw } from "./module.mjs";
-export { readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/config/read/module.d.ts

@@ -1,4 +0,0 @@
-import type { ConfigInput } from '../types.ts';
-import type { ConfigRawReadOptions } from './types.ts';
-export declare function readConfigRaw(options?: ConfigRawReadOptions): Promise<ConfigInput>;
-//# sourceMappingURL=module.d.ts.map

package/dist/app/modules/config/read/module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,WAAW,CAAC,CAmB7F"}

package/dist/app/modules/config/read/module.mjs

@@ -1,29 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { readConfigRawFromEnv } from "./env.mjs";
-import { readConfigRawFromFS } from "./fs.mjs";
-import { merge } from "smob";
-//#region src/app/modules/config/read/module.ts
-async function readConfigRaw(options = {}) {
-	if (options.fs && options.env) {
-		const fsOptions = boolableToObject(options.fs);
-		const fs = await readConfigRawFromFS(fsOptions);
-		const env = readConfigRawFromEnv();
-		return merge(env, fs);
-	}
-	if (options.fs) {
-		const fsOptions = boolableToObject(options.fs);
-		return readConfigRawFromFS(fsOptions);
-	}
-	if (options.env) return readConfigRawFromEnv();
-	return {};
-}
-function boolableToObject(input) {
-	if (typeof input === "boolean") return {};
-	return input;
-}
-//#endregion
-export { readConfigRaw };
-
-//# sourceMappingURL=module.mjs.map

package/dist/app/modules/config/read/module.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.mjs","names":["merge","readConfigRawFromEnv","readConfigRawFromFS","readConfigRaw","options","fs","env","fsOptions","boolableToObject","input"],"sources":["../../../../../src/app/modules/config/read/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport { readConfigRawFromEnv } from './env.ts';\nimport { readConfigRawFromFS } from './fs.ts';\nimport type { ConfigRawReadOptions } from './types.ts';\n\nexport async function readConfigRaw(options: ConfigRawReadOptions = {}) : Promise<ConfigInput> {\n    if (options.fs && options.env) {\n        const fsOptions = boolableToObject(options.fs);\n        const fs = await readConfigRawFromFS(fsOptions);\n        const env = readConfigRawFromEnv();\n\n        return merge(env, fs);\n    }\n\n    if (options.fs) {\n        const fsOptions = boolableToObject(options.fs);\n        return readConfigRawFromFS(fsOptions);\n    }\n\n    if (options.env) {\n        return readConfigRawFromEnv();\n    }\n\n    return {};\n}\n\nfunction boolableToObject<T>(input: T | boolean) : T {\n    if (typeof input === 'boolean') {\n        return {} as T;\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;AAaA,eAAsBG,cAAcC,UAAgC,CAAC,GAAC;CAClE,IAAIA,QAAQC,MAAMD,QAAQE,KAAK;EAC3B,MAAMC,YAAYC,iBAAiBJ,QAAQC,EAAE;EAC7C,MAAMA,KAAK,MAAMH,oBAAoBK,SAAAA;EACrC,MAAMD,MAAML,qBAAAA;EAEZ,OAAOD,MAAMM,KAAKD,EAAAA;CACtB;CAEA,IAAID,QAAQC,IAAI;EACZ,MAAME,YAAYC,iBAAiBJ,QAAQC,EAAE;EAC7C,OAAOH,oBAAoBK,SAAAA;CAC/B;CAEA,IAAIH,QAAQE,KACR,OAAOL,qBAAAA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASO,iBAAoBC,OAAkB;CAC3C,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;CAGZ,OAAOA;AACX"}

package/dist/app/modules/config/read/types.d.ts

@@ -1,9 +0,0 @@
-export type ConfigReadFsOptions = {
-    cwd?: string;
-    file?: string | string[];
-};
-export type ConfigRawReadOptions = {
-    fs?: boolean | ConfigReadFsOptions;
-    env?: boolean;
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/app/modules/config/read/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mBAAmB,GAAG;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,EAAE,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;IACnC,GAAG,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC"}

package/dist/app/modules/config/trust-proxy.d.ts

@@ -1,28 +0,0 @@
-/**
- * Canonicalize a string-form trustProxy value into its semantic type. This
- * MUST run for every config surface (env, .conf, file, programmatic input) —
- * not just env: proxy-addr accepts single-integer "long value" IPv4 notation,
- * so an un-canonicalized `trustProxy: "1"` (e.g. a stringifying configmap)
- * would silently compile to an allowlist of `0.0.0.1` instead of one trusted
- * hop. The integer form wins over the boolean words (`'1'` means ONE hop,
- * never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr
- * presets are all case-insensitive semantically, but proxy-addr matches the
- * presets case-sensitively) and passes through as the allowlist form.
- */
-export declare function canonicalizeTrustProxy(raw: string): boolean | number | string;
-/**
- * An entry of the explicit array (allowlist) form must be an address, CIDR,
- * or preset — an integer-string or boolean word there is a mis-typed scalar
- * form and must fail loud instead of compiling to a bogus `0.0.0.1`-style
- * allowlist entry.
- */
-export declare function isValidTrustProxyListEntry(value: string): boolean;
-/**
- * The allowlist form needs the same trim + lowercase the scalar form gets:
- * proxy-addr trims a comma-separated scalar string itself and matches its
- * presets case-sensitively, so without this an array entry that PASSES
- * validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or
- * `LOOPBACK` — would still throw `invalid IP address` inside `new App`.
- */
-export declare function canonicalizeTrustProxyListEntry(value: string): string;
-//# sourceMappingURL=trust-proxy.d.ts.map

package/dist/app/modules/config/trust-proxy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-proxy.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/trust-proxy.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAyB7E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE"}

package/dist/app/modules/config/trust-proxy.mjs

@@ -1,64 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { AuthupError } from "@authup/errors";
-//#region src/app/modules/config/trust-proxy.ts
-const BOOLEAN_TRUE_WORDS = /* @__PURE__ */ new Set([
-	"true",
-	"t",
-	"yes",
-	"y",
-	"on"
-]);
-const BOOLEAN_FALSE_WORDS = /* @__PURE__ */ new Set([
-	"false",
-	"f",
-	"no",
-	"n",
-	"off"
-]);
-const INTEGER = /^\d+$/;
-/**
-* Canonicalize a string-form trustProxy value into its semantic type. This
-* MUST run for every config surface (env, .conf, file, programmatic input) —
-* not just env: proxy-addr accepts single-integer "long value" IPv4 notation,
-* so an un-canonicalized `trustProxy: "1"` (e.g. a stringifying configmap)
-* would silently compile to an allowlist of `0.0.0.1` instead of one trusted
-* hop. The integer form wins over the boolean words (`'1'` means ONE hop,
-* never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr
-* presets are all case-insensitive semantically, but proxy-addr matches the
-* presets case-sensitively) and passes through as the allowlist form.
-*/ function canonicalizeTrustProxy(raw) {
-	const normalized = raw.trim();
-	if (INTEGER.test(normalized)) {
-		const hops = Number.parseInt(normalized, 10);
-		if (!Number.isSafeInteger(hops)) throw new AuthupError(`The trustProxy hop count "${normalized}" exceeds the safe integer range.`);
-		return hops;
-	}
-	const lowered = normalized.toLowerCase();
-	if (BOOLEAN_TRUE_WORDS.has(lowered)) return true;
-	if (BOOLEAN_FALSE_WORDS.has(lowered)) return false;
-	return lowered;
-}
-/**
-* An entry of the explicit array (allowlist) form must be an address, CIDR,
-* or preset — an integer-string or boolean word there is a mis-typed scalar
-* form and must fail loud instead of compiling to a bogus `0.0.0.1`-style
-* allowlist entry.
-*/ function isValidTrustProxyListEntry(value) {
-	const normalized = canonicalizeTrustProxyListEntry(value);
-	return normalized.length > 0 && !INTEGER.test(normalized) && !BOOLEAN_TRUE_WORDS.has(normalized) && !BOOLEAN_FALSE_WORDS.has(normalized);
-}
-/**
-* The allowlist form needs the same trim + lowercase the scalar form gets:
-* proxy-addr trims a comma-separated scalar string itself and matches its
-* presets case-sensitively, so without this an array entry that PASSES
-* validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or
-* `LOOPBACK` — would still throw `invalid IP address` inside `new App`.
-*/ function canonicalizeTrustProxyListEntry(value) {
-	return value.trim().toLowerCase();
-}
-//#endregion
-export { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry, isValidTrustProxyListEntry };
-
-//# sourceMappingURL=trust-proxy.mjs.map

package/dist/app/modules/config/trust-proxy.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-proxy.mjs","names":["AuthupError","BOOLEAN_TRUE_WORDS","Set","BOOLEAN_FALSE_WORDS","INTEGER","canonicalizeTrustProxy","raw","normalized","trim","test","hops","Number","parseInt","isSafeInteger","lowered","toLowerCase","has","isValidTrustProxyListEntry","value","canonicalizeTrustProxyListEntry","length"],"sources":["../../../../src/app/modules/config/trust-proxy.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\n\nconst BOOLEAN_TRUE_WORDS = new Set(['true', 't', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_WORDS = new Set(['false', 'f', 'no', 'n', 'off']);\n\nconst INTEGER = /^\\d+$/;\n\n/**\n * Canonicalize a string-form trustProxy value into its semantic type. This\n * MUST run for every config surface (env, .conf, file, programmatic input) —\n * not just env: proxy-addr accepts single-integer \"long value\" IPv4 notation,\n * so an un-canonicalized `trustProxy: \"1\"` (e.g. a stringifying configmap)\n * would silently compile to an allowlist of `0.0.0.1` instead of one trusted\n * hop. The integer form wins over the boolean words (`'1'` means ONE hop,\n * never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr\n * presets are all case-insensitive semantically, but proxy-addr matches the\n * presets case-sensitively) and passes through as the allowlist form.\n */\nexport function canonicalizeTrustProxy(raw: string): boolean | number | string {\n    const normalized = raw.trim();\n    if (INTEGER.test(normalized)) {\n        const hops = Number.parseInt(normalized, 10);\n        // The typed surface rejects an out-of-range hop count (zod's int() is\n        // safe-integer bounded), so the string surface must not smuggle one\n        // past it — canonicalization runs AFTER validation, and parseInt\n        // saturates a huge digit string into an unsafe integer / Infinity,\n        // which routup reads as \"trust every hop\".\n        if (!Number.isSafeInteger(hops)) {\n            throw new AuthupError(`The trustProxy hop count \"${normalized}\" exceeds the safe integer range.`);\n        }\n\n        return hops;\n    }\n\n    const lowered = normalized.toLowerCase();\n    if (BOOLEAN_TRUE_WORDS.has(lowered)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_WORDS.has(lowered)) {\n        return false;\n    }\n\n    return lowered;\n}\n\n/**\n * An entry of the explicit array (allowlist) form must be an address, CIDR,\n * or preset — an integer-string or boolean word there is a mis-typed scalar\n * form and must fail loud instead of compiling to a bogus `0.0.0.1`-style\n * allowlist entry.\n */\nexport function isValidTrustProxyListEntry(value: string): boolean {\n    const normalized = canonicalizeTrustProxyListEntry(value);\n    return normalized.length > 0 &&\n        !INTEGER.test(normalized) &&\n        !BOOLEAN_TRUE_WORDS.has(normalized) &&\n        !BOOLEAN_FALSE_WORDS.has(normalized);\n}\n\n/**\n * The allowlist form needs the same trim + lowercase the scalar form gets:\n * proxy-addr trims a comma-separated scalar string itself and matches its\n * presets case-sensitively, so without this an array entry that PASSES\n * validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or\n * `LOOPBACK` — would still throw `invalid IP address` inside `new App`.\n */\nexport function canonicalizeTrustProxyListEntry(value: string): string {\n    return value.trim().toLowerCase();\n}\n"],"mappings":";;;;;AASA,MAAMC,qCAAqB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAO;CAAK;AAAK,CAAA;AAClE,MAAMC,sCAAsB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAM;CAAK;AAAM,CAAA;AAEpE,MAAME,UAAU;;;;;;;;;;;GAahB,SAAgBC,uBAAuBC,KAAW;CAC9C,MAAMC,aAAaD,IAAIE,KAAI;CAC3B,IAAIJ,QAAQK,KAAKF,UAAAA,GAAa;EAC1B,MAAMG,OAAOC,OAAOC,SAASL,YAAY,EAAA;EAMzC,IAAI,CAACI,OAAOE,cAAcH,IAAAA,GACtB,MAAM,IAAIV,YAAY,6BAA6BO,WAAW,kCAAkC;EAGpG,OAAOG;CACX;CAEA,MAAMI,UAAUP,WAAWQ,YAAW;CACtC,IAAId,mBAAmBe,IAAIF,OAAAA,GACvB,OAAO;CAEX,IAAIX,oBAAoBa,IAAIF,OAAAA,GACxB,OAAO;CAGX,OAAOA;AACX;;;;;;GAQA,SAAgBG,2BAA2BC,OAAa;CACpD,MAAMX,aAAaY,gCAAgCD,KAAAA;CACnD,OAAOX,WAAWa,SAAS,KACvB,CAAChB,QAAQK,KAAKF,UAAAA,KACd,CAACN,mBAAmBe,IAAIT,UAAAA,KACxB,CAACJ,oBAAoBa,IAAIT,UAAAA;AACjC;;;;;;;GASA,SAAgBY,gCAAgCD,OAAa;CACzD,OAAOA,MAAMV,KAAI,CAAA,CAAGO,YAAW;AACnC"}

package/dist/cli/config.d.ts

@@ -1,18 +0,0 @@
-import type { ConfigReadFsOptions } from '../app/index.ts';
-import { ConfigModule } from '../app/index.ts';
-import type { CLIConfigArgs } from './types.ts';
-export declare const CLI_CONFIG_ARGS: {
-    configDirectory: {
-        type: "string";
-        description: string;
-        alias: string;
-    };
-    configFile: {
-        type: "string";
-        description: string;
-        alias: string;
-    };
-};
-export declare function applyCLIConfigArgs(options: ConfigReadFsOptions, args: CLIConfigArgs): ConfigReadFsOptions;
-export declare function createCLIConfigModule(options?: ConfigReadFsOptions): ConfigModule;
-//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAc,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,eAAe;;;;;;;;;;;CAWT,CAAC;AAEpB,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,aAAa,GACnB,mBAAmB,CAUtB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,mBAAwB,GAAI,YAAY,CAKtF"}

package/dist/cli/config.mjs

@@ -1,34 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { readConfig } from "../app/modules/config/helpers.mjs";
-import { ConfigModule } from "../app/modules/config/module.mjs";
-import "../app/index.mjs";
-//#region src/cli/config.ts
-const CLI_CONFIG_ARGS = {
-	configDirectory: {
-		type: "string",
-		description: "Config directory path",
-		alias: "cD"
-	},
-	configFile: {
-		type: "string",
-		description: "Name of one or more configuration files.",
-		alias: "cF"
-	}
-};
-function applyCLIConfigArgs(options, args) {
-	if (args.configDirectory) options.cwd = args.configDirectory;
-	if (args.configFile) options.file = args.configFile;
-	return options;
-}
-function createCLIConfigModule(options = {}) {
-	return new ConfigModule(() => readConfig({
-		env: true,
-		fs: options
-	}));
-}
-//#endregion
-export { CLI_CONFIG_ARGS, applyCLIConfigArgs, createCLIConfigModule };
-
-//# sourceMappingURL=config.mjs.map

package/dist/cli/config.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.mjs","names":["ConfigModule","readConfig","CLI_CONFIG_ARGS","configDirectory","type","description","alias","configFile","applyCLIConfigArgs","options","args","cwd","file","createCLIConfigModule","env","fs"],"sources":["../../src/cli/config.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ArgsDef } from 'citty';\nimport type { ConfigReadFsOptions } from '../app/index.ts';\nimport { ConfigModule, readConfig } from '../app/index.ts';\nimport type { CLIConfigArgs } from './types.ts';\n\nexport const CLI_CONFIG_ARGS = {\n    configDirectory: {\n        type: 'string',\n        description: 'Config directory path',\n        alias: 'cD',\n    },\n    configFile: {\n        type: 'string',\n        description: 'Name of one or more configuration files.',\n        alias: 'cF',\n    },\n} satisfies ArgsDef;\n\nexport function applyCLIConfigArgs(\n    options: ConfigReadFsOptions,\n    args: CLIConfigArgs,\n) : ConfigReadFsOptions {\n    if (args.configDirectory) {\n        options.cwd = args.configDirectory;\n    }\n\n    if (args.configFile) {\n        options.file = args.configFile;\n    }\n\n    return options;\n}\n\nexport function createCLIConfigModule(options: ConfigReadFsOptions = {}) : ConfigModule {\n    return new ConfigModule(() => readConfig({\n        env: true,\n        fs: options,\n    }));\n}\n"],"mappings":";;;;;;;AAYA,MAAaE,kBAAkB;CAC3BC,iBAAiB;EACbC,MAAM;EACNC,aAAa;EACbC,OAAO;CACX;CACAC,YAAY;EACRH,MAAM;EACNC,aAAa;EACbC,OAAO;CACX;AACJ;AAEA,SAAgBE,mBACZC,SACAC,MAAmB;CAEnB,IAAIA,KAAKP,iBACLM,QAAQE,MAAMD,KAAKP;CAGvB,IAAIO,KAAKH,YACLE,QAAQG,OAAOF,KAAKH;CAGxB,OAAOE;AACX;AAEA,SAAgBI,sBAAsBJ,UAA+B,CAAC,GAAC;CACnE,OAAO,IAAIT,mBAAmBC,WAAW;EACrCa,KAAK;EACLC,IAAIN;CACR,CAAA,CAAA;AACJ"}

package/dist/cli/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,aAAa,GAAG;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/utils/host.d.ts

@@ -1,2 +0,0 @@
-export declare function toPublicHost(input: string): string;
-//# sourceMappingURL=host.d.ts.map

package/dist/utils/host.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/utils/host.ts"],"names":[],"mappings":"AAOA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,UAMzC"}

package/dist/utils/host.mjs

@@ -1,12 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-//#region src/utils/host.ts
-function toPublicHost(input) {
-	if (input === "0.0.0.0" || input === "::") return "localhost";
-	return input;
-}
-//#endregion
-export { toPublicHost };
-
-//# sourceMappingURL=host.mjs.map