@digimuza/saas-core 0.0.2

package/dist/config/client.js

@@ -0,0 +1,94 @@
+import { z } from "zod";
+import { ConfigError } from "./errors.js";
+/**
+ * Public configuration safe to ship in a browser bundle.
+ *
+ * This module is deliberately standalone: it does not import `./sections.js` or
+ * any other server configuration code, so nothing that describes or reads a
+ * secret can be pulled into a client bundle through it.
+ *
+ * Every variable is read as a **literal** `process.env.NEXT_PUBLIC_*` access.
+ * Next.js performs a textual substitution of those expressions at build time; a
+ * dynamic lookup such as `process.env[key]` is not substituted and would be
+ * `undefined` in the browser. Do not refactor these into a loop.
+ */
+const clientEnvSchema = z
+    .object({
+    NEXT_PUBLIC_APP_NAME: z.string().min(1),
+    NEXT_PUBLIC_APP_URL: z.url(),
+    NEXT_PUBLIC_APP_ENV: z
+        .enum(["development", "test", "staging", "production"])
+        .default("development"),
+    /** Public WorkOS client identifier. Not a secret. */
+    NEXT_PUBLIC_WORKOS_CLIENT_ID: z.string().min(1),
+    /** Browser-facing realtime endpoint. */
+    NEXT_PUBLIC_REALTIME_URL: z.url().optional(),
+})
+    .transform((env) => ({
+    appName: env.NEXT_PUBLIC_APP_NAME,
+    appUrl: env.NEXT_PUBLIC_APP_URL,
+    environment: env.NEXT_PUBLIC_APP_ENV,
+    isProduction: env.NEXT_PUBLIC_APP_ENV === "production",
+    workosClientId: env.NEXT_PUBLIC_WORKOS_CLIENT_ID,
+    realtimeUrl: env.NEXT_PUBLIC_REALTIME_URL,
+}));
+function readPublicEnv() {
+    if (typeof process === "undefined" || !process.env) {
+        return {};
+    }
+    const raw = {
+        NEXT_PUBLIC_APP_NAME: process.env.NEXT_PUBLIC_APP_NAME,
+        NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
+        NEXT_PUBLIC_APP_ENV: process.env.NEXT_PUBLIC_APP_ENV,
+        NEXT_PUBLIC_WORKOS_CLIENT_ID: process.env.NEXT_PUBLIC_WORKOS_CLIENT_ID,
+        NEXT_PUBLIC_REALTIME_URL: process.env.NEXT_PUBLIC_REALTIME_URL,
+    };
+    const result = {};
+    for (const [key, value] of Object.entries(raw)) {
+        // Empty strings are treated as absent so Zod defaults and optionals apply.
+        if (value !== undefined && value !== "") {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+let cached;
+function load() {
+    if (cached !== undefined) {
+        return cached;
+    }
+    const parsed = clientEnvSchema.safeParse(readPublicEnv());
+    if (!parsed.success) {
+        throw new ConfigError("client", parsed.error);
+    }
+    cached = parsed.data;
+    return cached;
+}
+/** Typed, validated public configuration. Safe for client components. */
+export const clientConfig = {
+    get app() {
+        const value = load();
+        return {
+            name: value.appName,
+            url: value.appUrl,
+            environment: value.environment,
+            isProduction: value.isProduction,
+        };
+    },
+    get auth() {
+        return { workosClientId: load().workosClientId };
+    },
+    get realtime() {
+        return { url: load().realtimeUrl };
+    },
+};
+/** Eagerly validate public configuration. Call from a client entry point. */
+export function assertClientConfig() {
+    load();
+}
+/** Clear memoised public configuration. Test-only. */
+export function resetClientConfigCache() {
+    cached = undefined;
+}
+export { ConfigError } from "./errors.js";
+//# sourceMappingURL=client.js.map

package/dist/config/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;;GAWG;AAEH,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC5B,mBAAmB,EAAE,CAAC;SACnB,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;SACtD,OAAO,CAAC,aAAa,CAAC;IACzB,qDAAqD;IACrD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,wCAAwC;IACxC,wBAAwB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,EAAE,GAAG,CAAC,oBAAoB;IACjC,MAAM,EAAE,GAAG,CAAC,mBAAmB;IAC/B,WAAW,EAAE,GAAG,CAAC,mBAAmB;IACpC,YAAY,EAAE,GAAG,CAAC,mBAAmB,KAAK,YAAY;IACtD,cAAc,EAAE,GAAG,CAAC,4BAA4B;IAChD,WAAW,EAAE,GAAG,CAAC,wBAAwB;CAC1C,CAAC,CAAC,CAAC;AAIN,SAAS,aAAa;IACpB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAuC;QAC9C,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACpD,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACpD,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B;QACtE,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;KAC/D,CAAC;IAEF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,2EAA2E;QAC3E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,MAAgC,CAAC;AAErC,SAAS,IAAI;IACX,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,GAAG;QACL,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI;QACN,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/config/config-loader.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config-loader.d.ts.map

package/dist/config/config-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/config/config-loader.ts"],"names":[],"mappings":""}

package/dist/config/config-loader.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config-loader.js.map

package/dist/config/config-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../../src/config/config-loader.ts"],"names":[],"mappings":""}

package/dist/config/env.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The single point in @digimuza/saas-core that reads `process.env`.
+ *
+ * Nothing else in the package — and no application code — may access
+ * `process.env` directly. Values arrive here from Infisical, which injects
+ * secrets into the process environment at runtime.
+ */
+/** Raw environment source. Indirected so tests can substitute a fixture. */
+export type EnvSource = Record<string, string | undefined>;
+/**
+ * Replace the environment source. Test-only; calling this in production code
+ * defeats the purpose of centralising environment access.
+ */
+export declare function setEnvSource(source: EnvSource | undefined): void;
+/**
+ * Read the given variables from the environment.
+ *
+ * Empty strings are treated as absent. Secret managers and CI systems routinely
+ * inject `FOO=` for unset values; without this, Zod `.default()` and
+ * `.optional()` would never apply and every deployment would need every
+ * variable set to a non-empty placeholder.
+ */
+export declare function readEnv(keys: readonly string[]): Record<string, string>;
+//# sourceMappingURL=env.d.ts.map

package/dist/config/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAI3D;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAEhE;AAOD;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvE"}

package/dist/config/env.js

@@ -0,0 +1,40 @@
+/**
+ * The single point in @digimuza/saas-core that reads `process.env`.
+ *
+ * Nothing else in the package — and no application code — may access
+ * `process.env` directly. Values arrive here from Infisical, which injects
+ * secrets into the process environment at runtime.
+ */
+let override;
+/**
+ * Replace the environment source. Test-only; calling this in production code
+ * defeats the purpose of centralising environment access.
+ */
+export function setEnvSource(source) {
+    override = source;
+}
+function source() {
+    if (override !== undefined)
+        return override;
+    return typeof process !== "undefined" && process.env ? process.env : {};
+}
+/**
+ * Read the given variables from the environment.
+ *
+ * Empty strings are treated as absent. Secret managers and CI systems routinely
+ * inject `FOO=` for unset values; without this, Zod `.default()` and
+ * `.optional()` would never apply and every deployment would need every
+ * variable set to a non-empty placeholder.
+ */
+export function readEnv(keys) {
+    const env = source();
+    const result = {};
+    for (const key of keys) {
+        const value = env[key];
+        if (value !== undefined && value !== "") {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,IAAI,QAA+B,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,QAAQ,GAAG,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,MAAM;IACb,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,IAAuB;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config/errors.d.ts

@@ -0,0 +1,17 @@
+import type { ZodError } from "zod";
+/**
+ * Thrown when a configuration section is missing or invalid.
+ *
+ * Security: the message is built from the failing variable *names* and Zod's
+ * structural messages only. Configuration values are never interpolated, so a
+ * bad secret can never be leaked into logs, stack traces or error trackers.
+ */
+export declare class ConfigError extends Error {
+    readonly name = "ConfigError";
+    /** The configuration section that failed, e.g. `"database"`. */
+    readonly section: string;
+    /** Environment variable names that failed validation. */
+    readonly variables: readonly string[];
+    constructor(section: string, error: ZodError);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/config/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/config/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAEpC;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,iBAAiB;IAEvC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAc3C;CACF"}

package/dist/config/errors.js

@@ -0,0 +1,26 @@
+/**
+ * Thrown when a configuration section is missing or invalid.
+ *
+ * Security: the message is built from the failing variable *names* and Zod's
+ * structural messages only. Configuration values are never interpolated, so a
+ * bad secret can never be leaked into logs, stack traces or error trackers.
+ */
+export class ConfigError extends Error {
+    name = "ConfigError";
+    /** The configuration section that failed, e.g. `"database"`. */
+    section;
+    /** Environment variable names that failed validation. */
+    variables;
+    constructor(section, error) {
+        const problems = error.issues.map((issue) => {
+            const variable = issue.path.join(".") || "(section)";
+            return `  - ${variable}: ${issue.message}`;
+        });
+        super(`Invalid configuration for section "${section}":\n${problems.join("\n")}\n\n` +
+            `These values are injected by Infisical at runtime. Verify the Infisical ` +
+            `project/environment for this deployment.`);
+        this.section = section;
+        this.variables = error.issues.map((issue) => issue.path.join("."));
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/config/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/config/errors.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,aAAa,CAAC;IAEvC,gEAAgE;IACvD,OAAO,CAAS;IAEzB,yDAAyD;IAChD,SAAS,CAAoB;IAEtC,YAAY,OAAe,EAAE,KAAe;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;YACrD,OAAO,OAAO,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,KAAK,CACH,sCAAsC,OAAO,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YAC3E,0EAA0E;YAC1E,0CAA0C,CAC7C,CAAC;QAEF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/config/index.d.ts

@@ -0,0 +1,72 @@
+import { type SectionName } from "./sections.ts";
+export { ConfigError } from "./errors.ts";
+export { setEnvSource, type EnvSource } from "./env.ts";
+export { sectionNames, type SectionName } from "./sections.ts";
+/**
+ * Typed, validated server configuration.
+ *
+ * Values originate from the process environment, which Infisical populates at
+ * runtime. Never read `process.env` outside this module.
+ */
+export declare const config: {
+    readonly app: {
+        name: string;
+        url: string;
+        environment: "development" | "production" | "staging" | "test";
+        logLevel: "debug" | "error" | "info" | "warn";
+        isProduction: boolean;
+    };
+    readonly database: {
+        url: string;
+        maxConnections: number;
+        ssl: boolean;
+        statementTimeoutMs: number;
+        preparedStatements: boolean;
+    };
+    readonly auth: {
+        workosApiKey: string;
+        workosClientId: string;
+        cookiePassword: string;
+        redirectUri: string;
+    };
+    readonly billing: {
+        apiKey: string;
+        webhookSecret: string;
+        apiUrl: string;
+    };
+    readonly email: {
+        apiKey: string;
+        fromAddress: string;
+        fromName: string | undefined;
+    };
+    readonly storage: {
+        bucket: string;
+        region: string;
+        accessKeyId: string;
+        secretAccessKey: string;
+        endpoint: string | undefined;
+        publicUrl: string | undefined;
+    };
+    readonly realtime: {
+        url: string;
+        apiKey: string;
+    };
+    readonly jobs: {
+        secretKey: string;
+        apiUrl: string;
+    };
+};
+/**
+ * Eagerly validate configuration sections and fail fast.
+ *
+ * Call this once during application startup with the sections the application
+ * depends on, so misconfiguration surfaces at boot rather than mid-request.
+ *
+ * @param names Sections to validate. Defaults to every section.
+ * @throws ConfigError when a single section is invalid.
+ * @throws AggregateError of ConfigError when several sections are invalid.
+ */
+export declare function assertConfig(names?: readonly SectionName[]): void;
+/** Clear memoised configuration. Test-only. */
+export declare function resetConfigCache(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAIzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAsC/D;;;;;GAKG;AACH,eAAO,MAAM,MAAM;aACb,GAAG;;;;;;;aAGH,QAAQ;;;;;;;aAGR,IAAI;;;;;;aAGJ,OAAO;;;;;aAGP,KAAK;;;;;aAGL,OAAO;;;;;;;;aAGP,QAAQ;;;;aAGR,IAAI;;;;CAGT,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,GAAE,SAAS,WAAW,EAAiB,GAAG,IAAI,CA0B/E;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/config/index.js

@@ -0,0 +1,106 @@
+import { ConfigError } from "./errors.js";
+import { readEnv } from "./env.js";
+import { assertServerRuntime } from "./runtime.js";
+import { sectionNames, sections } from "./sections.js";
+assertServerRuntime("@digimuza/saas-core/config");
+export { ConfigError } from "./errors.js";
+export { setEnvSource } from "./env.js";
+export { sectionNames } from "./sections.js";
+const cache = new Map();
+/**
+ * Validate and memoise one section.
+ *
+ * Sections are validated on first access rather than at import time. A core
+ * package is consumed by many runtimes — a migration script, a Trigger.dev
+ * task, a Next.js route handler — and few of them need every integration
+ * configured. Eager whole-config validation would force every deployment to set
+ * Revolut and storage credentials just to run a migration. Use `assertConfig()`
+ * at application startup to get fail-fast behaviour for the sections an
+ * application actually depends on.
+ */
+function loadSection(name) {
+    const cached = cache.get(name);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const definition = sections[name];
+    const raw = readEnv(Object.keys(definition.env.shape));
+    const parsed = definition.env.safeParse(raw);
+    if (!parsed.success) {
+        throw new ConfigError(name, parsed.error);
+    }
+    // `definition` is narrowed to a union member per `K`; the parsed output and
+    // the mapper agree by construction in `sections.ts`.
+    const value = definition.map(parsed.data);
+    cache.set(name, value);
+    return value;
+}
+/**
+ * Typed, validated server configuration.
+ *
+ * Values originate from the process environment, which Infisical populates at
+ * runtime. Never read `process.env` outside this module.
+ */
+export const config = {
+    get app() {
+        return loadSection("app");
+    },
+    get database() {
+        return loadSection("database");
+    },
+    get auth() {
+        return loadSection("auth");
+    },
+    get billing() {
+        return loadSection("billing");
+    },
+    get email() {
+        return loadSection("email");
+    },
+    get storage() {
+        return loadSection("storage");
+    },
+    get realtime() {
+        return loadSection("realtime");
+    },
+    get jobs() {
+        return loadSection("jobs");
+    },
+};
+/**
+ * Eagerly validate configuration sections and fail fast.
+ *
+ * Call this once during application startup with the sections the application
+ * depends on, so misconfiguration surfaces at boot rather than mid-request.
+ *
+ * @param names Sections to validate. Defaults to every section.
+ * @throws ConfigError when a single section is invalid.
+ * @throws AggregateError of ConfigError when several sections are invalid.
+ */
+export function assertConfig(names = sectionNames) {
+    const errors = [];
+    for (const name of names) {
+        try {
+            loadSection(name);
+        }
+        catch (error) {
+            if (error instanceof ConfigError) {
+                errors.push(error);
+                continue;
+            }
+            throw error;
+        }
+    }
+    if (errors.length === 1) {
+        throw errors[0];
+    }
+    if (errors.length > 1) {
+        throw new AggregateError(errors, `Invalid configuration in ${errors.length} sections: ` +
+            errors.map((error) => error.section).join(", "));
+    }
+}
+/** Clear memoised configuration. Test-only. */
+export function resetConfigCache() {
+    cache.clear();
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAoB,MAAM,eAAe,CAAC;AAEzE,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAoB,MAAM,eAAe,CAAC;AAI/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAwB,IAAO;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAyB,CAAC;IACnC,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,KAAK,GAAI,UAAU,CAAC,GAA2C,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,GAAG;QACL,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI;QACN,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO;QACT,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK;QACP,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO;QACT,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI;QACN,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAK,GAA2B,YAAY;IACvE,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CACtB,MAAM,EACN,4BAA4B,MAAM,CAAC,MAAM,aAAa;YACpD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,gBAAgB;IAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/config/runtime.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Guards server-only modules against being evaluated in a browser bundle.
+ *
+ * Why not the `server-only` package: it resolves to a module that throws unless
+ * the bundler sets the `react-server` export condition. This core package must
+ * also run in plain Node (migration scripts, Trigger.dev tasks, Vitest), where
+ * that condition is absent — importing it would break every non-Next consumer.
+ *
+ * This is a runtime guard, not a build-time one. It fires on the first import in
+ * a browser, which surfaces immediately in development. The build-time guarantee
+ * comes from the package layout: clients import `@digimuza/saas-core/config/client`,
+ * which never imports server configuration code.
+ */
+export declare function assertServerRuntime(moduleName: string): void;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/config/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/config/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAS5D"}

package/dist/config/runtime.js

@@ -0,0 +1,22 @@
+/**
+ * Guards server-only modules against being evaluated in a browser bundle.
+ *
+ * Why not the `server-only` package: it resolves to a module that throws unless
+ * the bundler sets the `react-server` export condition. This core package must
+ * also run in plain Node (migration scripts, Trigger.dev tasks, Vitest), where
+ * that condition is absent — importing it would break every non-Next consumer.
+ *
+ * This is a runtime guard, not a build-time one. It fires on the first import in
+ * a browser, which surfaces immediately in development. The build-time guarantee
+ * comes from the package layout: clients import `@digimuza/saas-core/config/client`,
+ * which never imports server configuration code.
+ */
+export function assertServerRuntime(moduleName) {
+    // Checked via globalThis so this module needs no DOM lib types.
+    if (typeof globalThis.window !== "undefined") {
+        throw new Error(`${moduleName} is server-only and was loaded in a browser. ` +
+            `Import "@digimuza/saas-core/config/client" from client components; ` +
+            `server configuration contains secrets and must never reach the client bundle.`);
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/config/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/config/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,gEAAgE;IAChE,IAAI,OAAQ,UAAmC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,+CAA+C;YAC1D,qEAAqE;YACrE,+EAA+E,CAClF,CAAC;IACJ,CAAC;AACH,CAAC"}