@crombolo/server 0.16.0 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/server",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "The crombolo HTTP server: routing, configuration, media stores and background jobs.",
   "license": "MIT",
   "author": "Crombolo",
@@ -30,17 +30,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/api-delivery": "0.16.0",
-    "@crombolo/api-management": "0.16.0",
-    "@crombolo/assistant": "0.16.0",
-    "@crombolo/auth": "0.16.0",
-    "@crombolo/backoffice-host": "0.16.0",
-    "@crombolo/contracts": "0.16.0",
-    "@crombolo/core": "0.16.0",
-    "@crombolo/data": "0.16.0",
-    "@crombolo/render": "0.16.0",
-    "@crombolo/schema": "0.16.0",
-    "@crombolo/transfer": "0.16.0",
+    "@crombolo/api-delivery": "0.18.0",
+    "@crombolo/api-management": "0.18.0",
+    "@crombolo/assistant": "0.18.0",
+    "@crombolo/auth": "0.18.0",
+    "@crombolo/backoffice-host": "0.18.0",
+    "@crombolo/contracts": "0.18.0",
+    "@crombolo/core": "0.18.0",
+    "@crombolo/data": "0.18.0",
+    "@crombolo/render": "0.18.0",
+    "@crombolo/schema": "0.18.0",
+    "@crombolo/transfer": "0.18.0",
     "@logtape/logtape": "^2.3.8"
   }
 }

package/src/adapters/documents.ts

@@ -75,6 +75,8 @@ export function createDocumentPort(
   tracker: RedirectTracker = NO_REDIRECT_TRACKING,
   /** The site's own directory: where `domains.toml` is, when the site keeps one. */
   siteDir?: string,
+  /** Whether the site can send the e-mails a subscription asks for (story 045). */
+  notificationsAvailable = true,
 ): DocumentPort {
   const repo = new DocumentRepository(db, options)
   const domains = new DomainRepository(db)
@@ -415,9 +417,14 @@ export function createDocumentPort(
     async setNotifications(key, principal, actionIds) {
       const node = await repo.nodes.byKey(key)
       const userId = await userIdOf(principal)
-      if (!node || node.objectType !== repo.objectType || userId === undefined) return false
+      if (!node || node.objectType !== repo.objectType || userId === undefined) return 'notFound'
+      // Clearing is always allowed; asking for something the site cannot send is not.
+      if (!notificationsAvailable) {
+        const had = new Set(await notifications.subscribed(userId, node.id))
+        if (actionIds.some((id) => !had.has(id))) return 'unavailable'
+      }
       await notifications.set(userId, node.id, actionIds)
-      return true
+      return 'saved'
     },
 
     versions: (key) => repo.versions(key),

package/src/adapters/users.ts

@@ -119,6 +119,8 @@ export interface UserPortOptions {
   nodes: NodeLookup
   /** Signs a user out everywhere, as a password change set by someone else does. */
   endSessions: (userId: number) => Promise<void>
+  /** A group save changed what it may do on these pages (story 045: the "rights" notification). */
+  onPagePermissionsChanged?: (principal: Principal, nodeKeys: string[]) => void | Promise<void>
 }
 
 export function createUserPorts(
@@ -661,7 +663,11 @@ export function createUserPorts(
 
   return {
     users: userPort,
-    groups: createUserGroupPort(db, { adminKey, nodes }),
+    groups: createUserGroupPort(db, {
+      adminKey,
+      nodes,
+      onPagePermissionsChanged: options.onPagePermissionsChanged,
+    }),
     userData: createUserDataPort(db),
   }
 }
@@ -763,7 +769,11 @@ function fromPermissions(permissions: UserGroupInput['permissions']): GranularPe
 
 function createUserGroupPort(
   db: Db,
-  deps: { adminKey: () => Promise<string | undefined>; nodes: NodeLookup },
+  deps: {
+    adminKey: () => Promise<string | undefined>
+    nodes: NodeLookup
+    onPagePermissionsChanged?: UserPortOptions['onPagePermissionsChanged']
+  },
 ): UserGroupPort {
   const groups = new UserGroupRepository(db)
   const users = new UserRepository(db)
@@ -827,6 +837,34 @@ function createUserGroupPort(
     return 'Success'
   }
 
+  /** Each page's verbs for the group, by page key. */
+  const pageVerbs = (group: { granular: GranularPermission[] } | undefined) => {
+    const out = new Map<string, Set<string>>()
+    for (const row of group?.granular ?? [])
+      if (row.context === 'Document' && row.key) {
+        const verbs = out.get(row.key) ?? new Set<string>()
+        verbs.add(row.permission)
+        out.set(row.key, verbs)
+      }
+    return out
+  }
+  /** The pages whose verbs for the group a save changed. */
+  const changedPages = (before: Map<string, Set<string>>, after: Map<string, Set<string>>) =>
+    [...new Set([...before.keys(), ...after.keys()])].filter((key) => {
+      const a = before.get(key) ?? new Set<string>()
+      const b = after.get(key) ?? new Set<string>()
+      return a.size !== b.size || [...a].some((verb) => !b.has(verb))
+    })
+  const announcePermissions = async (
+    principal: Principal,
+    before: Map<string, Set<string>>,
+    key: string,
+  ) => {
+    if (!deps.onPagePermissionsChanged) return
+    const changed = changedPages(before, pageVerbs(await groups.byKey(key)))
+    if (changed.length > 0) await deps.onPagePermissionsChanged(principal, changed)
+  }
+
   const save = async (input: UserGroupInput, key: string): Promise<UserGroupStatus> => {
     const result = await groups.save({
       key,
@@ -906,6 +944,7 @@ function createUserGroupPort(
       if (await groups.byKey(key)) return { status: 'DuplicateAlias' }
       const saved = await save(input, key)
       if (saved !== 'Success') return { status: saved }
+      await announcePermissions(principal, new Map(), key)
       // A non-admin who creates a group joins it, as in Umbraco
       if (!principal.isAdmin) await users.addToGroup(key, [principal.id])
       return { status: 'Success', key }
@@ -917,7 +956,10 @@ function createUserGroupPort(
       if (!isMember(principal, group.key)) return 'Forbidden'
       const valid = await validate(principal, input, group)
       if (valid !== 'Success') return valid
-      return save(input, group.key)
+      const before = pageVerbs(group)
+      const saved = await save(input, group.key)
+      if (saved === 'Success') await announcePermissions(principal, before, group.key)
+      return saved
     },
 
     async delete(principal, keys) {

package/src/approvals.ts

@@ -7,6 +7,7 @@
  * This decides: who may act, what an edit does to a waiting request, when a
  * stage is done, and when the page is published.
  */
+
 import type { Principal } from '@crombolo/api-management'
 import {
   approvalsNeeded,
@@ -36,6 +37,7 @@ import {
   type StoredWorkflow,
   UserGroupRepository,
 } from '@crombolo/data'
+import type { ContentNotifier } from './content-notifications.ts'
 import type { EmailPort } from './email.ts'
 
 /** What publishing and unpublishing go through when approval says yes. */
@@ -57,6 +59,8 @@ export interface ApprovalsOptions {
   email?: EmailPort
   /** Where a link in an e-mail points, e.g. `https://site.example/crombolo`. */
   backOfficeUrl?: string
+  /** Queues the content notifications a publish on approval makes (story 045). */
+  notifier?: ContentNotifier
 }
 
 /** A refusal a person reads: why, and what to do instead. */
@@ -426,6 +430,12 @@ export function createApprovals(options: ApprovalsOptions): Approvals {
       request.action === 'publish' ? 'Published on approval' : 'Unpublished on approval',
       `through "${request.workflow.name}"`,
     )
+    if (request.action === 'publish')
+      await options.notifier?.raise(
+        { actions: ['Umb.Document.Publish'], key: request.nodeKey, keyKind: 'document' },
+        principal ? { key: principal.id, name: principal.name } : null,
+        `approved through "${request.workflow.name}"`,
+      )
     await notify(
       'editor',
       request,

package/src/components.ts

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, statSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { join, relative, resolve, sep } from 'node:path'
 
 /**
@@ -196,6 +196,82 @@ export function componentFileFor(root: string, alias: string): string {
   return join(root, `${alias}.tsx`)
 }
 
+/** What an e-mail template looks like: a default export over `EmailProps`. */
+export function emailScaffold(alias: string): string {
+  const name = componentName(alias)
+  return `import type { EmailProps } from '@crombolo/crombolo'
+
+export default function ${name}({ form, fields, site }: EmailProps) {
+  return (
+    <html lang="en">
+      <body>
+        <h1>{form.name}</h1>
+        <table>
+          {fields.map((field) => (
+            <tr>
+              <th>{field.caption}</th>
+              <td>
+                {field.leftOut
+                  ? 'Not included'
+                  : field.answered
+                    ? field.values.join(', ')
+                    : 'Not answered'}
+              </td>
+            </tr>
+          ))}
+        </table>
+        <p>
+          Sent from <a href={site.url}>{site.name}</a>
+        </p>
+      </body>
+    </html>
+  )
+}
+`
+}
+
+/** The folder e-mail templates live in, as an alias prefix. */
+export const EMAIL_FOLDER = 'emails/'
+
+/**
+ * The components the forms designer offers as e-mail designs: those in
+ * `components/emails/`, and any a form already names, so a picker never loses
+ * the one that is set. A layout there takes `EmailLayoutProps`, so it is not offered.
+ */
+export function listEmailTemplates(
+  root: string,
+  named: Iterable<string> = [],
+): { alias: string; name: string }[] {
+  const components = listComponents(root)
+  const found = new Set<string>()
+  for (const component of components)
+    if (
+      component.alias.startsWith(EMAIL_FOLDER) &&
+      !/\bEmailLayoutProps\b/.test(readFileSync(component.path, 'utf8'))
+    )
+      found.add(component.alias)
+  const present = new Set(components.map((component) => component.alias))
+  for (const alias of named) if (present.has(alias)) found.add(alias)
+  const items = [...found].sort().map((alias) => ({ alias, name: readableName(alias) }))
+  // Two folders with the same file name would read alike, so those keep their path.
+  const counts = new Map<string, number>()
+  for (const item of items) counts.set(item.name, (counts.get(item.name) ?? 0) + 1)
+  return items.map((item) =>
+    (counts.get(item.name) ?? 0) > 1 ? { ...item, name: `${item.name} (${item.alias})` } : item,
+  )
+}
+
+/** `emails/contactReceipt` → "Contact receipt". */
+function readableName(alias: string): string {
+  const base = alias.split('/').pop() ?? alias
+  const words = base
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/[-_]+/g, ' ')
+    .trim()
+    .toLowerCase()
+  return words.charAt(0).toUpperCase() + words.slice(1)
+}
+
 /** What a component looks like: a function, taking whatever imports it hands it. */
 export function componentScaffold(alias: string): string {
   const name = componentName(alias)

package/src/config.ts

@@ -14,6 +14,7 @@ import type { GitConfig } from './git-routes.ts'
 import { checkIdentityProviders, type IdentityProvider } from './identity-providers.ts'
 import type { MediaStore } from './media-store.ts'
 import type { SchemaStore } from './schema-store.ts'
+import { setting } from './settings.ts'
 
 /**
  * Runtime settings for a site. Umbraco's equivalents live in appsettings.json;
@@ -497,11 +498,11 @@ export function loadConfig(
   cwd = process.cwd(),
 ): CromboloConfig {
   const fromEnv: CromboloConfig = {
-    port: Number(Bun.env.PORT ?? DEFAULTS.port),
-    maxRequestBodyBytes: Bun.env.CROMBOLO_MAX_REQUEST_BODY_MB
-      ? Number(Bun.env.CROMBOLO_MAX_REQUEST_BODY_MB) * 1024 * 1024
+    port: Number(setting('PORT') ?? DEFAULTS.port),
+    maxRequestBodyBytes: setting('CROMBOLO_MAX_REQUEST_BODY_MB')
+      ? Number(setting('CROMBOLO_MAX_REQUEST_BODY_MB')) * 1024 * 1024
       : DEFAULTS.maxRequestBodyBytes,
-    backOfficePath: Bun.env.CROMBOLO_BACKOFFICE_PATH ?? DEFAULTS.backOfficePath,
+    backOfficePath: setting('CROMBOLO_BACKOFFICE_PATH') ?? DEFAULTS.backOfficePath,
     defaultUiLanguage: DEFAULTS.defaultUiLanguage,
     keepUserLoggedIn: DEFAULTS.keepUserLoggedIn,
     allowLocalLogin: DEFAULTS.allowLocalLogin,
@@ -509,135 +510,135 @@ export function loadConfig(
     versionCheckPeriod: DEFAULTS.versionCheckPeriod,
     umbracoCssPath: DEFAULTS.umbracoCssPath,
     signalRSkipNegotiation: DEFAULTS.signalRSkipNegotiation,
-    development: Bun.env.NODE_ENV !== 'production',
-    sqliteFile: Bun.env.CROMBOLO_SQLITE_FILE ?? DEFAULTS.sqliteFile,
-    adminLogin: Bun.env.CROMBOLO_ADMIN_LOGIN ?? DEFAULTS.adminLogin,
-    adminPassword: Bun.env.CROMBOLO_ADMIN_PASSWORD,
+    development: setting('NODE_ENV') !== 'production',
+    sqliteFile: setting('CROMBOLO_SQLITE_FILE') ?? DEFAULTS.sqliteFile,
+    adminLogin: setting('CROMBOLO_ADMIN_LOGIN') ?? DEFAULTS.adminLogin,
+    adminPassword: setting('CROMBOLO_ADMIN_PASSWORD'),
     apiClient:
-      Bun.env.CROMBOLO_API_CLIENT_ID || Bun.env.CROMBOLO_API_CLIENT_SECRET
+      setting('CROMBOLO_API_CLIENT_ID') || setting('CROMBOLO_API_CLIENT_SECRET')
         ? {
-            id: Bun.env.CROMBOLO_API_CLIENT_ID ?? '',
-            secret: Bun.env.CROMBOLO_API_CLIENT_SECRET ?? '',
+            id: setting('CROMBOLO_API_CLIENT_ID') ?? '',
+            secret: setting('CROMBOLO_API_CLIENT_SECRET') ?? '',
           }
         : undefined,
-    localAdmin: Bun.env.CROMBOLO_LOCAL_ADMIN === 'true',
-    setupCode: Bun.env.CROMBOLO_SETUP_CODE,
-    secretKey: Bun.env.CROMBOLO_SECRET_KEY,
-    secureCookies: Bun.env.CROMBOLO_INSECURE_COOKIES !== 'true',
-    siteName: Bun.env.CROMBOLO_SITE_NAME ?? DEFAULTS.siteName,
+    localAdmin: setting('CROMBOLO_LOCAL_ADMIN') === 'true',
+    setupCode: setting('CROMBOLO_SETUP_CODE'),
+    secretKey: setting('CROMBOLO_SECRET_KEY'),
+    secureCookies: setting('CROMBOLO_INSECURE_COOKIES') !== 'true',
+    siteName: setting('CROMBOLO_SITE_NAME') ?? DEFAULTS.siteName,
     siteDir: cwd,
-    componentsDir: Bun.env.CROMBOLO_COMPONENTS_DIR ?? DEFAULTS.componentsDir,
-    componentsCacheDir: Bun.env.CROMBOLO_COMPONENTS_CACHE_DIR ?? DEFAULTS.componentsCacheDir,
+    componentsDir: setting('CROMBOLO_COMPONENTS_DIR') ?? DEFAULTS.componentsDir,
+    componentsCacheDir: setting('CROMBOLO_COMPONENTS_CACHE_DIR') ?? DEFAULTS.componentsCacheDir,
     componentsSnapshot: {
-      ...(Bun.env.CROMBOLO_COMPONENTS_GATE_MS
-        ? { gateTtlMs: Number(Bun.env.CROMBOLO_COMPONENTS_GATE_MS) }
+      ...(setting('CROMBOLO_COMPONENTS_GATE_MS')
+        ? { gateTtlMs: Number(setting('CROMBOLO_COMPONENTS_GATE_MS')) }
         : {}),
-      ...(Bun.env.CROMBOLO_COMPONENTS_GENERATION_LIMIT
-        ? { maxGenerations: Number(Bun.env.CROMBOLO_COMPONENTS_GENERATION_LIMIT) }
+      ...(setting('CROMBOLO_COMPONENTS_GENERATION_LIMIT')
+        ? { maxGenerations: Number(setting('CROMBOLO_COMPONENTS_GENERATION_LIMIT')) }
         : {}),
-      ...(Bun.env.CROMBOLO_COMPONENTS_KEEP
-        ? { keep: Number(Bun.env.CROMBOLO_COMPONENTS_KEEP) }
+      ...(setting('CROMBOLO_COMPONENTS_KEEP')
+        ? { keep: Number(setting('CROMBOLO_COMPONENTS_KEEP')) }
         : {}),
-      ...(Bun.env.CROMBOLO_COMPONENTS_SWAP_MS
-        ? { minSwapIntervalMs: Number(Bun.env.CROMBOLO_COMPONENTS_SWAP_MS) }
+      ...(setting('CROMBOLO_COMPONENTS_SWAP_MS')
+        ? { minSwapIntervalMs: Number(setting('CROMBOLO_COMPONENTS_SWAP_MS')) }
         : {}),
     },
-    renderTimeoutMs: Number(Bun.env.CROMBOLO_RENDER_TIMEOUT_MS ?? DEFAULTS.renderTimeoutMs),
-    schemaDir: Bun.env.CROMBOLO_SCHEMA_DIR ?? DEFAULTS.schemaDir,
-    schemaRevision: Bun.env.CROMBOLO_SCHEMA_REVISION ?? DEFAULTS.schemaRevision,
-    nodeId: Bun.env.CROMBOLO_NODE_ID ?? `${hostname()}:${process.pid}`,
-    role: roleFromEnvironment(Bun.env.CROMBOLO_ROLE),
+    renderTimeoutMs: Number(setting('CROMBOLO_RENDER_TIMEOUT_MS') ?? DEFAULTS.renderTimeoutMs),
+    schemaDir: setting('CROMBOLO_SCHEMA_DIR') ?? DEFAULTS.schemaDir,
+    schemaRevision: setting('CROMBOLO_SCHEMA_REVISION') ?? DEFAULTS.schemaRevision,
+    nodeId: setting('CROMBOLO_NODE_ID') ?? `${hostname()}:${process.pid}`,
+    role: roleFromEnvironment(setting('CROMBOLO_ROLE')),
     git: undefined,
     schemaStore: undefined,
-    schemaCacheDir: Bun.env.CROMBOLO_SCHEMA_CACHE_DIR ?? join(tmpdir(), 'crombolo-schema'),
+    schemaCacheDir: setting('CROMBOLO_SCHEMA_CACHE_DIR') ?? join(tmpdir(), 'crombolo-schema'),
     // Resolved again below, once it is known whether a store was configured.
     schemaWritable:
-      Bun.env.CROMBOLO_SCHEMA_WRITABLE !== undefined
-        ? Bun.env.CROMBOLO_SCHEMA_WRITABLE === 'true'
-        : Bun.env.NODE_ENV !== 'production',
-    syncSchemaAtBoot: Bun.env.CROMBOLO_SYNC_SCHEMA_AT_BOOT !== 'false',
-    dialect: Bun.env.CROMBOLO_DB === 'postgres' ? 'postgres' : 'sqlite',
-    pgDump: Bun.env.CROMBOLO_PG_DUMP,
+      setting('CROMBOLO_SCHEMA_WRITABLE') !== undefined
+        ? setting('CROMBOLO_SCHEMA_WRITABLE') === 'true'
+        : setting('NODE_ENV') !== 'production',
+    syncSchemaAtBoot: setting('CROMBOLO_SYNC_SCHEMA_AT_BOOT') !== 'false',
+    dialect: setting('CROMBOLO_DB') === 'postgres' ? 'postgres' : 'sqlite',
+    pgDump: setting('CROMBOLO_PG_DUMP'),
     upgradePolicy:
-      Bun.env.CROMBOLO_UPGRADE_POLICY === 'pending-allowed' ||
-      (Bun.env.CROMBOLO_UPGRADE_POLICY === undefined && Bun.env.NODE_ENV !== 'production')
+      setting('CROMBOLO_UPGRADE_POLICY') === 'pending-allowed' ||
+      (setting('CROMBOLO_UPGRADE_POLICY') === undefined && setting('NODE_ENV') !== 'production')
         ? 'pending-allowed'
         : 'strict',
     versionCleanup: {
-      enabled: Bun.env.CROMBOLO_VERSION_CLEANUP === 'true',
+      enabled: setting('CROMBOLO_VERSION_CLEANUP') === 'true',
       keepAllVersionsNewerThanDays: Number(
-        Bun.env.CROMBOLO_VERSION_CLEANUP_KEEP_ALL_DAYS ?? DEFAULTS.keepAllVersionsNewerThanDays,
+        setting('CROMBOLO_VERSION_CLEANUP_KEEP_ALL_DAYS') ?? DEFAULTS.keepAllVersionsNewerThanDays,
       ),
       keepLatestVersionPerDayForDays: Number(
-        Bun.env.CROMBOLO_VERSION_CLEANUP_KEEP_LATEST_DAYS ??
+        setting('CROMBOLO_VERSION_CLEANUP_KEEP_LATEST_DAYS') ??
           DEFAULTS.keepLatestVersionPerDayForDays,
       ),
     },
     auditRetentionDays: nonNegative(
-      Bun.env.CROMBOLO_AUDIT_RETENTION_DAYS,
+      setting('CROMBOLO_AUDIT_RETENTION_DAYS'),
       DEFAULTS.auditRetentionDays,
     ),
-    mediaDir: Bun.env.CROMBOLO_MEDIA_DIR ?? DEFAULTS.mediaDir,
+    mediaDir: setting('CROMBOLO_MEDIA_DIR') ?? DEFAULTS.mediaDir,
     mediaStore: undefined,
-    logsDir: Bun.env.CROMBOLO_LOGS_DIR ?? DEFAULTS.logsDir,
-    logLevel: parseLogLevel(Bun.env.CROMBOLO_LOG_LEVEL),
-    logToConsole: Bun.env.CROMBOLO_LOG_TO_CONSOLE !== 'false',
+    logsDir: setting('CROMBOLO_LOGS_DIR') ?? DEFAULTS.logsDir,
+    logLevel: parseLogLevel(setting('CROMBOLO_LOG_LEVEL')),
+    logToConsole: setting('CROMBOLO_LOG_TO_CONSOLE') !== 'false',
     diagnostics: {
-      traceRequests: Bun.env.CROMBOLO_TRACE_REQUESTS === 'true',
-      heapIntervalSeconds: Math.max(0, Number(Bun.env.CROMBOLO_HEAP_INTERVAL_SECONDS ?? 0) || 0),
+      traceRequests: setting('CROMBOLO_TRACE_REQUESTS') === 'true',
+      heapIntervalSeconds: Math.max(0, Number(setting('CROMBOLO_HEAP_INTERVAL_SECONDS') ?? 0) || 0),
     },
-    stylesheetsDir: Bun.env.CROMBOLO_CSS_DIR ?? DEFAULTS.stylesheetsDir,
-    scriptsDir: Bun.env.CROMBOLO_SCRIPTS_DIR ?? DEFAULTS.scriptsDir,
-    usernameIsEmail: Bun.env.CROMBOLO_USERNAME_IS_EMAIL !== 'false',
-    applicationUrl: Bun.env.CROMBOLO_APPLICATION_URL ?? '',
+    stylesheetsDir: setting('CROMBOLO_CSS_DIR') ?? DEFAULTS.stylesheetsDir,
+    scriptsDir: setting('CROMBOLO_SCRIPTS_DIR') ?? DEFAULTS.scriptsDir,
+    usernameIsEmail: setting('CROMBOLO_USERNAME_IS_EMAIL') !== 'false',
+    applicationUrl: setting('CROMBOLO_APPLICATION_URL') ?? '',
     sendUserLink: undefined,
     email: undefined,
-    allowMemberRegistration: Bun.env.CROMBOLO_ALLOW_MEMBER_REGISTRATION === 'true',
+    allowMemberRegistration: setting('CROMBOLO_ALLOW_MEMBER_REGISTRATION') === 'true',
     memberRegistrationType:
-      Bun.env.CROMBOLO_MEMBER_REGISTRATION_TYPE ?? DEFAULTS.memberRegistrationType,
-    memberRegistrationGroups: (Bun.env.CROMBOLO_MEMBER_REGISTRATION_GROUPS ?? '')
+      setting('CROMBOLO_MEMBER_REGISTRATION_TYPE') ?? DEFAULTS.memberRegistrationType,
+    memberRegistrationGroups: (setting('CROMBOLO_MEMBER_REGISTRATION_GROUPS') ?? '')
       .split(',')
       .map((name) => name.trim())
       .filter(Boolean),
     memberSessionMinutes: Number(
-      Bun.env.CROMBOLO_MEMBER_SESSION_MINUTES ?? DEFAULTS.memberSessionMinutes,
+      setting('CROMBOLO_MEMBER_SESSION_MINUTES') ?? DEFAULTS.memberSessionMinutes,
     ),
     maxFailedPasswordAttempts: Number(
-      Bun.env.CROMBOLO_MAX_FAILED_PASSWORD_ATTEMPTS ?? DEFAULTS.maxFailedPasswordAttempts,
+      setting('CROMBOLO_MAX_FAILED_PASSWORD_ATTEMPTS') ?? DEFAULTS.maxFailedPasswordAttempts,
     ),
     // No environment variable: a provider is a preset, which is code.
     memberIdentityProviders: [],
     backofficeIdentityProviders: [],
     remote: {
-      enabled: Bun.env.CROMBOLO_REMOTE_ENABLED === 'true',
-      environment: Bun.env.CROMBOLO_REMOTE_ENVIRONMENT || 'production',
-      protected: Bun.env.CROMBOLO_REMOTE_PROTECTED !== 'false',
-      approvals: Bun.env.CROMBOLO_REMOTE_APPROVALS === 'true',
-      maxUploadBytes: Number(Bun.env.CROMBOLO_REMOTE_MAX_UPLOAD_GB ?? 50) * 1024 ** 3,
+      enabled: setting('CROMBOLO_REMOTE_ENABLED') === 'true',
+      environment: setting('CROMBOLO_REMOTE_ENVIRONMENT') || 'production',
+      protected: setting('CROMBOLO_REMOTE_PROTECTED') !== 'false',
+      approvals: setting('CROMBOLO_REMOTE_APPROVALS') === 'true',
+      maxUploadBytes: Number(setting('CROMBOLO_REMOTE_MAX_UPLOAD_GB') ?? 50) * 1024 ** 3,
     },
     redirects: [],
-    trackRedirects: Bun.env.CROMBOLO_TRACK_REDIRECTS !== 'false',
-    applyBundleContentOnInstall: Bun.env.CROMBOLO_APPLY_BUNDLE_CONTENT !== 'false',
+    trackRedirects: setting('CROMBOLO_TRACK_REDIRECTS') !== 'false',
+    applyBundleContentOnInstall: setting('CROMBOLO_APPLY_BUNDLE_CONTENT') !== 'false',
     // Resolved again below, once it is known whether a store was configured.
-    runtimeInstalls: Bun.env.CROMBOLO_RUNTIME_INSTALLS !== 'false',
+    runtimeInstalls: setting('CROMBOLO_RUNTIME_INSTALLS') !== 'false',
     seo: stripUndefined({
-      sitemap: envFlag(Bun.env.CROMBOLO_SITEMAP),
-      indexable: envFlag(Bun.env.CROMBOLO_INDEXABLE),
+      sitemap: envFlag(setting('CROMBOLO_SITEMAP')),
+      indexable: envFlag(setting('CROMBOLO_INDEXABLE')),
     }),
     deliveryApi: stripUndefined({
-      enabled: envFlag(Bun.env.CROMBOLO_DELIVERY_API),
-      apiKey: Bun.env.CROMBOLO_DELIVERY_API_KEY || undefined,
-      publicAccess: envFlag(Bun.env.CROMBOLO_DELIVERY_API_PUBLIC),
+      enabled: envFlag(setting('CROMBOLO_DELIVERY_API')),
+      apiKey: setting('CROMBOLO_DELIVERY_API_KEY') || undefined,
+      publicAccess: envFlag(setting('CROMBOLO_DELIVERY_API_PUBLIC')),
       media:
-        envFlag(Bun.env.CROMBOLO_DELIVERY_API_MEDIA) === undefined
+        envFlag(setting('CROMBOLO_DELIVERY_API_MEDIA')) === undefined
           ? undefined
-          : { enabled: envFlag(Bun.env.CROMBOLO_DELIVERY_API_MEDIA) },
+          : { enabled: envFlag(setting('CROMBOLO_DELIVERY_API_MEDIA')) },
     }),
     // No environment variable: a bundle is an import, which is code.
     bundles: [],
-    marketplaceUrl: Bun.env.CROMBOLO_MARKETPLACE_URL ?? DEFAULTS.marketplaceUrl,
-    packageKeyword: Bun.env.CROMBOLO_PACKAGE_KEYWORD ?? DEFAULTS.packageKeyword,
-    npmRegistry: Bun.env.CROMBOLO_NPM_REGISTRY ?? DEFAULTS.npmRegistry,
+    marketplaceUrl: setting('CROMBOLO_MARKETPLACE_URL') ?? DEFAULTS.marketplaceUrl,
+    packageKeyword: setting('CROMBOLO_PACKAGE_KEYWORD') ?? DEFAULTS.packageKeyword,
+    npmRegistry: setting('CROMBOLO_NPM_REGISTRY') ?? DEFAULTS.npmRegistry,
     // No environment variable: enabling it takes a provider, which is code.
     assistant: undefined,
   }
@@ -661,7 +662,7 @@ export function loadConfig(
   // it — that is the point of configuring one. An explicit setting still wins.
   if (
     merged.schemaStore &&
-    Bun.env.CROMBOLO_SCHEMA_WRITABLE === undefined &&
+    setting('CROMBOLO_SCHEMA_WRITABLE') === undefined &&
     overrides.schemaWritable === undefined
   ) {
     merged.schemaWritable = true
@@ -670,7 +671,7 @@ export function loadConfig(
   // them would not either. An explicit setting still wins.
   if (
     merged.schemaStore &&
-    Bun.env.CROMBOLO_RUNTIME_INSTALLS === undefined &&
+    setting('CROMBOLO_RUNTIME_INSTALLS') === undefined &&
     overrides.runtimeInstalls === undefined
   ) {
     merged.runtimeInstalls = false
@@ -727,7 +728,7 @@ function stripUndefined<T extends object>(value: T): Partial<T> {
  */
 export function describeDatabase(
   config: Pick<CromboloConfig, 'dialect' | 'sqliteFile'>,
-  url: string | undefined = Bun.env.CROMBOLO_POSTGRES_URL ?? Bun.env.DATABASE_URL,
+  url: string | undefined = setting('CROMBOLO_POSTGRES_URL') ?? setting('DATABASE_URL'),
 ): string {
   if (config.dialect !== 'postgres') return config.sqliteFile
   if (!url) return 'postgres'
@@ -739,4 +740,4 @@ export function describeDatabase(
   }
 }
 
-export const VERSION = '0.16.0'
+export const VERSION = '0.18.0'