@happyvertical/smrt-config 0.55.2 → 0.55.4

package/dist/index.js

@@ -1,262 +1,6 @@
+import { A as getDefaultAIKeyEnvName, B as setExplorer, C as getApplicationRuntimePreset, D as DEFAULT_AI_ENV_PREFIXES, E as AI_PROVIDER_KEY_ENV, F as tryResolveAIProviderConfig, I as withAIAliases, L as getCachedConfig, M as redactBaseUrl, N as resolveAIProviderConfig, O as canonicalizeAIConfig, P as toAIClientOptions, R as getExplorer, S as RuntimeProfileValidationError, T as AIProviderNotConfiguredError, V as setLoadedConfig, _ as parseExportedConfig, a as getModuleConfig, b as getRuntimeConfig, c as mergeAIConfigLayers, d as resolveConfiguredApplicationRuntime, f as resolveEffectiveApplicationRuntime, g as mergeExportedConfig, h as exportConfig, i as getConfig, j as mergeAIConfigObjects, k as describeAIProviderConfig, l as resolveCliDatabaseConfig, m as tryResolveConfiguredAIProvider, n as defineConfig, o as getPackageConfig, p as setConfig, r as getAIConfigBlock, s as getSiteConfig, t as clearCache, u as resolveConfiguredAIProvider, v as sanitizeConfig, w as resolveApplicationRuntime, x as mergeConfigs, y as clearRuntimeConfig, z as setCachedConfig } from "./chunks/shared-B81TOCQq.js";
 import { cosmiconfig } from "cosmiconfig";
 import { createJiti } from "jiti";
-//#region src/ai.ts
-var AI_PROVIDER_KEY_ENV = Object.freeze({
-	openai: "OPENAI_API_KEY",
-	anthropic: "ANTHROPIC_API_KEY",
-	gemini: "GEMINI_API_KEY"
-});
-var AUTO_DETECT_ORDER = [
-	"openai",
-	"anthropic",
-	"gemini"
-];
-var DEFAULT_AI_ENV_PREFIXES = Object.freeze(["SMRT_AI", "HAVE_AI"]);
-function getDefaultAIKeyEnvName(provider) {
-	const normalized = nonEmpty(provider)?.toLowerCase();
-	return normalized && Object.hasOwn(AI_PROVIDER_KEY_ENV, normalized) ? AI_PROVIDER_KEY_ENV[normalized] : void 0;
-}
-var AIProviderNotConfiguredError = class extends Error {
-	code = "SMRT_AI_NOT_CONFIGURED";
-	constructor(message) {
-		super(message);
-		this.name = "AIProviderNotConfiguredError";
-	}
-};
-function nonEmpty(value) {
-	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
-function redactBaseUrl(value) {
-	if (!value) return void 0;
-	try {
-		const url = new URL(value);
-		return `${url.protocol}//${url.host}`;
-	} catch {
-		return "[unparseable-url]";
-	}
-}
-function tryResolveAIProviderConfig(options = {}) {
-	const env = options.env ?? process.env;
-	const read = (name) => nonEmpty(env[name]);
-	const prefixes = options.prefixes ?? DEFAULT_AI_ENV_PREFIXES;
-	const explicit = options.explicit ?? {};
-	const block = options.config ?? {};
-	const fromEnv = (suffix) => prefixes.map((prefix) => ({
-		source: `env:${prefix}_${suffix}`,
-		value: read(`${prefix}_${suffix}`)
-	}));
-	const explicitCand = (value) => ({
-		source: "explicit",
-		value: nonEmpty(value)
-	});
-	const configCand = (value) => ({
-		source: "config",
-		value: nonEmpty(value)
-	});
-	const layered = (exp, cfg, envs) => options.envOverridesConfig ? [
-		...exp,
-		...envs,
-		...cfg
-	] : [
-		...exp,
-		...cfg,
-		...envs
-	];
-	const first = (candidates) => {
-		for (const c of candidates) if (c.value) return {
-			value: c.value,
-			source: c.source
-		};
-	};
-	const sources = {};
-	const result = {};
-	const set = (field, hit) => {
-		if (hit) {
-			result[field] = hit.value;
-			sources[field] = hit.source;
-		}
-	};
-	set("provider", first(layered([explicitCand(nonEmpty(explicit.provider) ?? nonEmpty(explicit.type))], [configCand(block.provider)], fromEnv("PROVIDER"))));
-	set("model", first(layered([explicitCand(nonEmpty(explicit.model) ?? nonEmpty(explicit.defaultModel))], [configCand(block.model)], fromEnv("MODEL"))));
-	const autoDetected = result.provider || options.autoDetect === false ? void 0 : AUTO_DETECT_ORDER.find((p) => read(AI_PROVIDER_KEY_ENV[p]));
-	if (autoDetected) {
-		result.provider = autoDetected;
-		sources.provider = "auto-detect";
-	}
-	const selected = result.provider?.toLowerCase();
-	const configKeyEnv = nonEmpty(block.apiKeyEnv);
-	const explicitGroup = {
-		source: "explicit",
-		provider: nonEmpty(explicit.provider) ?? nonEmpty(explicit.type),
-		apiKey: nonEmpty(explicit.apiKey),
-		baseUrl: nonEmpty(explicit.baseUrl)
-	};
-	const configGroup = {
-		source: "config",
-		provider: nonEmpty(block.provider),
-		apiKey: nonEmpty(block.apiKey) ?? (configKeyEnv ? read(configKeyEnv) : void 0),
-		baseUrl: nonEmpty(block.baseUrl)
-	};
-	const envGroups = prefixes.map((prefix) => ({
-		source: `env:${prefix}`,
-		provider: read(`${prefix}_PROVIDER`),
-		apiKey: read(`${prefix}_API_KEY`),
-		baseUrl: read(`${prefix}_BASE_URL`)
-	}));
-	const groups = options.envOverridesConfig ? [
-		explicitGroup,
-		...envGroups,
-		configGroup
-	] : [
-		explicitGroup,
-		configGroup,
-		...envGroups
-	];
-	const usable = (g) => !g.provider || g.provider.toLowerCase() === selected;
-	const sourceName = (g, suffix) => g.source.startsWith("env:") ? `${g.source}_${suffix}` : g.source;
-	for (const g of groups) {
-		if (!usable(g)) continue;
-		if (g.baseUrl && !result.baseUrl) {
-			result.baseUrl = g.baseUrl;
-			sources.baseUrl = sourceName(g, "BASE_URL");
-		}
-		if (g.apiKey && !result.apiKey) {
-			result.apiKey = g.apiKey;
-			sources.apiKey = sourceName(g, "API_KEY");
-		}
-	}
-	const providerKeyEnv = getDefaultAIKeyEnvName(result.provider);
-	if (!result.apiKey && providerKeyEnv && options.providerKeyEnvFallback !== false && read(providerKeyEnv)) {
-		result.apiKey = read(providerKeyEnv);
-		sources.apiKey = "provider-key-env";
-	}
-	if (!result.provider && (options.requireProvider ?? true)) return;
-	if (!result.provider && !result.apiKey) return;
-	const resolved = {
-		...result,
-		sources,
-		toJSON: () => describeAIProviderConfig(resolved)
-	};
-	Object.defineProperty(resolved, "toJSON", { enumerable: false });
-	return resolved;
-}
-function resolveAIProviderConfig(options = {}) {
-	const resolved = tryResolveAIProviderConfig(options);
-	if (resolved) return resolved;
-	const envNames = (options.prefixes ?? DEFAULT_AI_ENV_PREFIXES).map((p) => `${p}_PROVIDER`).join(", ");
-	const keyNames = Object.values(AI_PROVIDER_KEY_ENV).join(", ");
-	throw new AIProviderNotConfiguredError(`No AI provider is configured. Set the \`ai\` block in smrt.config.ts (provider, model, apiKeyEnv), or set ${envNames}` + (options.autoDetect === false ? "." : `, or one of ${keyNames} to auto-detect the provider.`));
-}
-function describeAIProviderConfig(resolved) {
-	return {
-		provider: resolved.provider,
-		model: resolved.model,
-		baseUrl: redactBaseUrl(resolved.baseUrl),
-		apiKey: resolved.apiKey ? "[redacted]" : void 0,
-		sources: { ...resolved.sources }
-	};
-}
-function toAIClientOptions(resolved) {
-	const out = {};
-	if (resolved.provider) {
-		out.type = resolved.provider;
-		out.provider = resolved.provider;
-	}
-	if (resolved.apiKey) out.apiKey = resolved.apiKey;
-	if (resolved.baseUrl) out.baseUrl = resolved.baseUrl;
-	if (resolved.model) out.defaultModel = resolved.model;
-	return out;
-}
-var OWNED_AI_FIELDS = [
-	"apiKey",
-	"apiKeyEnv",
-	"baseUrl",
-	"model"
-];
-function canonicalizeAIConfig(input) {
-	if (!input || typeof input !== "object") return {};
-	const out = {};
-	for (const [key, value] of Object.entries(input)) {
-		if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
-		if (typeof value === "string" && value.trim().length === 0) continue;
-		out[key] = value;
-	}
-	const provider = nonEmpty(out.provider) ?? nonEmpty(out.type);
-	const model = nonEmpty(out.model) ?? nonEmpty(out.defaultModel);
-	delete out.type;
-	delete out.defaultModel;
-	if (provider) out.provider = provider;
-	else delete out.provider;
-	if (model) out.model = model;
-	else delete out.model;
-	return out;
-}
-function mergeAIConfigObjects(lower, higher) {
-	const low = canonicalizeAIConfig(lower);
-	const high = canonicalizeAIConfig(higher);
-	const lowName = nonEmpty(low.provider)?.toLowerCase();
-	const highName = nonEmpty(high.provider)?.toLowerCase();
-	if (lowName && highName && lowName !== highName) {
-		delete low.provider;
-		for (const f of OWNED_AI_FIELDS) delete low[f];
-	}
-	return {
-		...low,
-		...high
-	};
-}
-function withAIAliases(config) {
-	const out = { ...config };
-	const provider = nonEmpty(out.provider) ?? nonEmpty(out.type);
-	const model = nonEmpty(out.model) ?? nonEmpty(out.defaultModel);
-	for (const k of ["provider", "type"]) if (provider) out[k] = provider;
-	else delete out[k];
-	for (const k of ["model", "defaultModel"]) if (model) out[k] = model;
-	else delete out[k];
-	return out;
-}
-//#endregion
-//#region src/database-environment.ts
-var POSTGRES_URL = /^postgres(?:ql)?:\/\//i;
-function environmentType(value) {
-	const normalized = value?.trim().toLowerCase();
-	if (!normalized) return null;
-	if (normalized === "sqlite") return "sqlite";
-	if (normalized === "postgres" || normalized === "postgresql") return "postgres";
-	throw new TypeError("DATABASE_TYPE must be sqlite or postgres.");
-}
-function resolveCliDatabase(declared, env) {
-	if (typeof declared?.url === "string" && declared.url !== "") return {
-		source: "config",
-		database: typeof declared.type === "string" ? {
-			type: declared.type,
-			url: declared.url
-		} : { url: declared.url }
-	};
-	const url = env.DATABASE_URL?.trim();
-	if (!url) return {
-		source: "none",
-		database: null
-	};
-	let type;
-	try {
-		type = declared?.type === "sqlite" || declared?.type === "postgres" ? declared.type : environmentType(env.DATABASE_TYPE) ?? (POSTGRES_URL.test(url) ? "postgres" : "sqlite");
-	} catch (error) {
-		return {
-			source: "invalid-environment",
-			database: null,
-			error: error.message
-		};
-	}
-	return {
-		source: "environment",
-		database: {
-			type,
-			url
-		}
-	};
-}
-//#endregion
 //#region src/loader.ts
 var MODULE_NAME = "smrt";
 var jitiInstance;
@@ -267,18 +11,6 @@ function getJiti() {
 var typeScriptLoader = async (filepath) => {
 	return getJiti().import(filepath, { default: true });
 };
-function getCachedConfig() {
-	return globalThis.__smrtLoaderCachedConfig ?? null;
-}
-function setCachedConfig(config) {
-	globalThis.__smrtLoaderCachedConfig = config;
-}
-function getExplorer() {
-	return globalThis.__smrtLoaderExplorer ?? null;
-}
-function setExplorer(exp) {
-	globalThis.__smrtLoaderExplorer = exp;
-}
 function isFileNotFound(error) {
 	if (!error || typeof error !== "object") return false;
 	if (error.code === "ENOENT") return true;
@@ -324,800 +56,13 @@ async function loadConfig$1(options = {}) {
 	if (cache) setCachedConfig(config);
 	return config;
 }
-function clearConfigCache() {
-	setCachedConfig(null);
-	const explorer = getExplorer();
-	if (explorer) {
-		explorer.clearCaches();
-		setExplorer(null);
-	}
-}
-//#endregion
-//#region src/runtime-profile.ts
-function isApplicationRuntimeProfile(value) {
-	return value === "local" || value === "self-hosted" || value === "cloud";
-}
-function invalidProfileIssue() {
-	return {
-		code: "invalid_config",
-		path: "profile",
-		message: "must be local, self-hosted, or cloud.",
-		recovery: "Select one documented runtime profile."
-	};
-}
-var RuntimeProfileValidationError = class extends Error {
-	issues;
-	constructor(issues) {
-		super(`Invalid application runtime profile:
-${issues.map((issue) => `- ${issue.path}: ${issue.message} Recovery: ${issue.recovery}`).join("\n")}`);
-		this.name = "RuntimeProfileValidationError";
-		this.issues = Object.freeze(issues.map((issue) => Object.freeze({ ...issue })));
-	}
-};
-var PROFILE_DEFAULTS = {
-	local: {
-		database: {
-			engine: "sqlite",
-			connectionOwnership: "user"
-		},
-		authentication: {
-			provider: "owner-bootstrap",
-			ownerBootstrap: "single-use"
-		},
-		tenancy: {
-			mode: "default-tenant",
-			context: "defaulted",
-			isolation: "application"
-		},
-		assets: {
-			provider: "local-files",
-			ownership: "user"
-		},
-		secrets: {
-			provider: "local-file",
-			ownership: "user"
-		},
-		jobs: { topology: "embedded" },
-		network: {
-			exposure: "loopback",
-			tls: false
-		},
-		portability: {
-			backup: "file-snapshot",
-			logicalExport: true,
-			logicalImport: true
-		}
-	},
-	"self-hosted": {
-		database: {
-			engine: "postgres",
-			connectionOwnership: "operator"
-		},
-		authentication: {
-			provider: "oidc",
-			ownerBootstrap: "disabled"
-		},
-		tenancy: {
-			mode: "single-tenant",
-			context: "defaulted",
-			isolation: "application"
-		},
-		assets: {
-			provider: "s3-compatible",
-			ownership: "operator"
-		},
-		secrets: {
-			provider: "environment",
-			ownership: "operator"
-		},
-		jobs: { topology: "external" },
-		network: {
-			exposure: "public",
-			tls: true
-		},
-		portability: {
-			backup: "operator",
-			logicalExport: true,
-			logicalImport: true
-		}
-	},
-	cloud: {
-		database: {
-			engine: "postgres",
-			connectionOwnership: "managed"
-		},
-		authentication: {
-			provider: "hosted-identity",
-			ownerBootstrap: "disabled"
-		},
-		tenancy: {
-			mode: "multi-tenant",
-			context: "required",
-			isolation: "database-rls"
-		},
-		assets: {
-			provider: "managed-object-storage",
-			ownership: "managed"
-		},
-		secrets: {
-			provider: "managed",
-			ownership: "managed"
-		},
-		jobs: { topology: "scalable" },
-		network: {
-			exposure: "public",
-			tls: true
-		},
-		portability: {
-			backup: "managed",
-			logicalExport: true,
-			logicalImport: true
-		}
-	}
-};
-var INVARIANTS = {
-	domainModels: "identical",
-	generatedRest: "identical",
-	generatedCli: "identical",
-	generatedMcp: "identical",
-	generatedWebMcp: "identical",
-	mcpExposurePolicy: "identical",
-	webMcpExposurePolicy: "identical",
-	actionEffects: "identical",
-	approvalPolicy: "identical",
-	authorizationRecords: "required",
-	jobInvocation: "identical",
-	portability: "logical-export-import"
-};
-var PROVIDER_FIELDS = {
-	database: ["engine", "connectionOwnership"],
-	authentication: ["provider", "ownerBootstrap"],
-	tenancy: [
-		"mode",
-		"context",
-		"isolation"
-	],
-	assets: ["provider", "ownership"],
-	secrets: ["provider", "ownership"],
-	jobs: ["topology"],
-	network: ["exposure", "tls"]
-};
-var PROVIDER_VALUE_DOMAINS = {
-	database: {
-		engine: ["sqlite", "postgres"],
-		connectionOwnership: [
-			"user",
-			"operator",
-			"managed"
-		]
-	},
-	authentication: {
-		provider: [
-			"owner-bootstrap",
-			"oidc",
-			"magic-link",
-			"hosted-identity"
-		],
-		ownerBootstrap: ["single-use", "disabled"]
-	},
-	tenancy: {
-		mode: [
-			"default-tenant",
-			"single-tenant",
-			"multi-tenant"
-		],
-		context: ["defaulted", "required"],
-		isolation: ["application", "database-rls"]
-	},
-	assets: {
-		provider: [
-			"local-files",
-			"s3-compatible",
-			"managed-object-storage"
-		],
-		ownership: [
-			"user",
-			"operator",
-			"managed"
-		]
-	},
-	secrets: {
-		provider: [
-			"local-file",
-			"environment",
-			"external",
-			"managed"
-		],
-		ownership: [
-			"user",
-			"operator",
-			"managed"
-		]
-	},
-	jobs: { topology: [
-		"inline",
-		"embedded",
-		"external",
-		"scalable"
-	] },
-	network: {
-		exposure: ["loopback", "public"],
-		tls: [false, true]
-	}
-};
-function isPlainRecord(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
-}
-function cloneDefaults(profile) {
-	const defaults = PROFILE_DEFAULTS[profile];
-	return {
-		database: { ...defaults.database },
-		authentication: { ...defaults.authentication },
-		tenancy: { ...defaults.tenancy },
-		assets: { ...defaults.assets },
-		secrets: { ...defaults.secrets },
-		jobs: { ...defaults.jobs },
-		network: { ...defaults.network },
-		portability: { ...defaults.portability }
-	};
-}
-function rejectUnknownFields(input) {
-	const issues = [];
-	for (const key of Object.keys(input).sort()) if (key !== "profile" && key !== "providers") issues.push({
-		code: "unsupported_field",
-		path: key,
-		message: "is not part of the runtime-profile contract.",
-		recovery: "Move provider selection under providers or remove this field."
-	});
-	if (Object.hasOwn(input, "profile") && !isApplicationRuntimeProfile(input.profile)) issues.push(invalidProfileIssue());
-	const providers = Object.hasOwn(input, "providers") ? input.providers : void 0;
-	if (providers === void 0) return issues;
-	if (!isPlainRecord(providers)) {
-		issues.push({
-			code: "invalid_config",
-			path: "providers",
-			message: "must be an object with Object.prototype or null.",
-			recovery: "Use providers: { database: { ... } } or omit providers."
-		});
-		return issues;
-	}
-	for (const providerName of Object.keys(providers).sort()) {
-		if (!Object.hasOwn(PROVIDER_FIELDS, providerName)) {
-			issues.push({
-				code: "unsupported_field",
-				path: `providers.${providerName}`,
-				message: "is not an overridable infrastructure provider.",
-				recovery: "Use database, authentication, tenancy, assets, secrets, jobs, or network."
-			});
-			continue;
-		}
-		const value = providers[providerName];
-		if (!isPlainRecord(value)) {
-			issues.push({
-				code: "invalid_config",
-				path: `providers.${providerName}`,
-				message: "must be an object with Object.prototype or null.",
-				recovery: `Provide a partial ${providerName} provider object or omit it.`
-			});
-			continue;
-		}
-		const allowed = PROVIDER_FIELDS[providerName];
-		const valueDomains = PROVIDER_VALUE_DOMAINS[providerName];
-		for (const field of Object.keys(value).sort()) {
-			if (!allowed.includes(field)) {
-				issues.push({
-					code: "unsupported_field",
-					path: `providers.${providerName}.${field}`,
-					message: "is not a supported provider override.",
-					recovery: "Remove secret values and application-policy fields; configure only documented provider selectors."
-				});
-				continue;
-			}
-			const suppliedValue = Object.hasOwn(value, field) ? value[field] : void 0;
-			const allowedValues = valueDomains[field];
-			if (suppliedValue !== void 0 && !allowedValues.includes(suppliedValue)) issues.push({
-				code: "invalid_config",
-				path: `providers.${providerName}.${field}`,
-				message: `must be one of ${allowedValues.map(String).join(", ")}.`,
-				recovery: "Choose a documented provider selector value; supplied values are omitted from diagnostics."
-			});
-		}
-	}
-	return issues;
-}
-function validateApplicationRuntimeConfigShape(config) {
-	if (!isPlainRecord(config)) return [{
-		code: "invalid_config",
-		path: "runtime",
-		message: "must be an object with Object.prototype or null.",
-		recovery: "Provide runtime: { profile: \"local\" | \"self-hosted\" | \"cloud\" }."
-	}];
-	return rejectUnknownFields(config);
-}
-function applyOverrides(providers, input) {
-	const overrideRoot = Object.hasOwn(input, "providers") && isPlainRecord(input.providers) ? input.providers : {};
-	const report = [];
-	for (const providerName of Object.keys(PROVIDER_FIELDS)) {
-		if (!Object.hasOwn(overrideRoot, providerName)) continue;
-		const supplied = overrideRoot[providerName];
-		if (!isPlainRecord(supplied)) continue;
-		const target = providers[providerName];
-		for (const field of PROVIDER_FIELDS[providerName]) {
-			if (!Object.hasOwn(supplied, field)) continue;
-			const value = supplied[field];
-			if (value === void 0) continue;
-			const previous = target[field];
-			target[field] = value;
-			if (value !== previous) report.push({
-				path: `providers.${providerName}.${field}`,
-				from: previous,
-				to: value
-			});
-		}
-	}
-	return report;
-}
-function incompatible(issues, path, expected, recovery) {
-	issues.push({
-		code: "incompatible_provider",
-		path,
-		message: `is incompatible; ${expected}.`,
-		recovery
-	});
-}
-function requireAllowed(issues, path, actual, allowed, profile) {
-	if (!allowed.includes(actual)) incompatible(issues, path, `${profile} requires one of ${allowed.map(String).join(", ")}`, `Choose a supported ${profile} provider or select a different profile.`);
-}
-function validateComposition(profile, providers) {
-	const issues = [];
-	const allow = (path, actual, values) => requireAllowed(issues, path, actual, values, profile);
-	if (profile === "local") {
-		allow("providers.database.engine", providers.database.engine, ["sqlite"]);
-		allow("providers.database.connectionOwnership", providers.database.connectionOwnership, ["user"]);
-		allow("providers.authentication.provider", providers.authentication.provider, ["owner-bootstrap"]);
-		allow("providers.authentication.ownerBootstrap", providers.authentication.ownerBootstrap, ["single-use"]);
-		allow("providers.tenancy.mode", providers.tenancy.mode, ["default-tenant"]);
-		allow("providers.tenancy.context", providers.tenancy.context, ["defaulted"]);
-		allow("providers.tenancy.isolation", providers.tenancy.isolation, ["application"]);
-		allow("providers.assets.provider", providers.assets.provider, ["local-files"]);
-		allow("providers.assets.ownership", providers.assets.ownership, ["user"]);
-		allow("providers.secrets.provider", providers.secrets.provider, ["local-file"]);
-		allow("providers.secrets.ownership", providers.secrets.ownership, ["user"]);
-		allow("providers.jobs.topology", providers.jobs.topology, ["inline", "embedded"]);
-		allow("providers.network.exposure", providers.network.exposure, ["loopback"]);
-		allow("providers.network.tls", providers.network.tls, [false, true]);
-	} else if (profile === "self-hosted") {
-		allow("providers.database.engine", providers.database.engine, ["postgres"]);
-		allow("providers.database.connectionOwnership", providers.database.connectionOwnership, ["operator"]);
-		allow("providers.authentication.provider", providers.authentication.provider, ["oidc", "magic-link"]);
-		allow("providers.authentication.ownerBootstrap", providers.authentication.ownerBootstrap, ["disabled"]);
-		allow("providers.tenancy.mode", providers.tenancy.mode, ["single-tenant", "multi-tenant"]);
-		allow("providers.tenancy.context", providers.tenancy.context, providers.tenancy.mode === "multi-tenant" ? ["required"] : ["defaulted"]);
-		allow("providers.tenancy.isolation", providers.tenancy.isolation, ["application", "database-rls"]);
-		allow("providers.assets.provider", providers.assets.provider, ["local-files", "s3-compatible"]);
-		allow("providers.assets.ownership", providers.assets.ownership, ["operator"]);
-		allow("providers.secrets.provider", providers.secrets.provider, [
-			"environment",
-			"local-file",
-			"external"
-		]);
-		allow("providers.secrets.ownership", providers.secrets.ownership, ["operator"]);
-		allow("providers.jobs.topology", providers.jobs.topology, ["external"]);
-		allow("providers.network.exposure", providers.network.exposure, ["public"]);
-		allow("providers.network.tls", providers.network.tls, [true]);
-	} else {
-		allow("providers.database.engine", providers.database.engine, ["postgres"]);
-		allow("providers.database.connectionOwnership", providers.database.connectionOwnership, ["managed"]);
-		allow("providers.authentication.provider", providers.authentication.provider, ["hosted-identity"]);
-		allow("providers.authentication.ownerBootstrap", providers.authentication.ownerBootstrap, ["disabled"]);
-		allow("providers.tenancy.mode", providers.tenancy.mode, ["multi-tenant"]);
-		allow("providers.tenancy.context", providers.tenancy.context, ["required"]);
-		allow("providers.tenancy.isolation", providers.tenancy.isolation, ["application", "database-rls"]);
-		allow("providers.assets.provider", providers.assets.provider, ["managed-object-storage", "s3-compatible"]);
-		allow("providers.assets.ownership", providers.assets.ownership, ["managed"]);
-		allow("providers.secrets.provider", providers.secrets.provider, ["managed", "external"]);
-		allow("providers.secrets.ownership", providers.secrets.ownership, ["managed"]);
-		allow("providers.jobs.topology", providers.jobs.topology, ["scalable"]);
-		allow("providers.network.exposure", providers.network.exposure, ["public"]);
-		allow("providers.network.tls", providers.network.tls, [true]);
-	}
-	return issues;
-}
-function deriveCapabilities(profile, providers) {
-	return {
-		ownerBootstrap: providers.authentication.ownerBootstrap === "single-use",
-		publicAuthentication: providers.authentication.provider !== "owner-bootstrap",
-		defaultTenant: providers.tenancy.context === "defaulted",
-		multiTenant: providers.tenancy.mode === "multi-tenant",
-		localAssets: providers.assets.provider === "local-files",
-		externalWorkers: providers.jobs.topology === "external" || providers.jobs.topology === "scalable",
-		backup: true,
-		logicalExport: true,
-		logicalImport: true,
-		diagnostics: true,
-		orchestrationHealth: profile !== "local"
-	};
-}
-function deepFreeze(value) {
-	if (value && typeof value === "object" && !Object.isFrozen(value)) {
-		Object.freeze(value);
-		for (const child of Object.values(value)) deepFreeze(child);
-	}
-	return value;
-}
-function resolveApplicationRuntime(config) {
-	if (!isPlainRecord(config)) throw new RuntimeProfileValidationError([...validateApplicationRuntimeConfigShape(config)]);
-	const unknownIssues = validateApplicationRuntimeConfigShape(config);
-	const profile = Object.hasOwn(config, "profile") ? config.profile : void 0;
-	if (!isApplicationRuntimeProfile(profile)) throw new RuntimeProfileValidationError([...unknownIssues, ...Object.hasOwn(config, "profile") ? [] : [invalidProfileIssue()]]);
-	const providers = cloneDefaults(profile);
-	const overrides = applyOverrides(providers, config);
-	const issues = [...unknownIssues, ...validateComposition(profile, providers)];
-	if (issues.length > 0) throw new RuntimeProfileValidationError(issues);
-	return deepFreeze({
-		schemaVersion: 1,
-		profile,
-		providers,
-		capabilities: deriveCapabilities(profile, providers),
-		invariants: { ...INVARIANTS },
-		diagnostics: {
-			secretValuesIncluded: false,
-			overrides,
-			unsafeOverrides: []
-		}
-	});
-}
-function getApplicationRuntimePreset(profile) {
-	if (!isApplicationRuntimeProfile(profile)) throw new RuntimeProfileValidationError([invalidProfileIssue()]);
-	return deepFreeze(cloneDefaults(profile));
-}
-//#endregion
-//#region src/merge.ts
-globalThis.__smrtRuntimeConfig ??= {};
-var UNSAFE_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function defineOwn(target, key, value) {
-	Object.defineProperty(target, key, {
-		configurable: true,
-		enumerable: true,
-		value,
-		writable: true
-	});
-}
-function isPlainObject(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === null || proto === Object.prototype;
-}
-function deepClone(value) {
-	if (Array.isArray(value)) return value.map((item) => deepClone(item));
-	if (isPlainObject(value)) {
-		const out = {};
-		for (const key of Object.keys(value)) {
-			if (UNSAFE_KEYS.has(key)) continue;
-			defineOwn(out, key, deepClone(value[key]));
-		}
-		return out;
-	}
-	return value;
-}
-function deepMerge(target, source) {
-	const result = {};
-	const tgt = target;
-	const src = source;
-	for (const key of Object.keys(tgt)) {
-		if (UNSAFE_KEYS.has(key) || Object.hasOwn(src, key)) continue;
-		defineOwn(result, key, deepClone(tgt[key]));
-	}
-	for (const key of Object.keys(src)) {
-		if (UNSAFE_KEYS.has(key)) continue;
-		const sourceValue = src[key];
-		const targetValue = Object.hasOwn(tgt, key) ? tgt[key] : void 0;
-		if (isPlainObject(sourceValue) && isPlainObject(targetValue)) defineOwn(result, key, deepMerge(targetValue, sourceValue));
-		else if (sourceValue !== void 0 && sourceValue !== null) defineOwn(result, key, deepClone(sourceValue));
-		else if (targetValue !== void 0) defineOwn(result, key, deepClone(targetValue));
-	}
-	return result;
-}
-function setConfig$1(config) {
-	const incomingRuntime = Object.hasOwn(config, "runtime") ? config.runtime : void 0;
-	if (incomingRuntime !== void 0 && (incomingRuntime === null || typeof incomingRuntime !== "object" || Array.isArray(incomingRuntime))) throw new RuntimeProfileValidationError([...validateApplicationRuntimeConfigShape(incomingRuntime)]);
-	if (incomingRuntime !== null && (typeof incomingRuntime === "object" || typeof incomingRuntime === "function") && Object.hasOwn(incomingRuntime, "profile")) {
-		const profileIssues = validateApplicationRuntimeConfigShape(incomingRuntime).filter((issue) => issue.path === "runtime" || issue.path === "profile");
-		if (profileIssues.length > 0) throw new RuntimeProfileValidationError([...profileIssues]);
-	}
-	let current = globalThis.__smrtRuntimeConfig || {};
-	const currentRuntime = Object.hasOwn(current, "runtime") && isPlainObject(current.runtime) ? current.runtime : void 0;
-	const incomingRuntimeMap = Object.hasOwn(config, "runtime") && isPlainObject(config.runtime) ? config.runtime : void 0;
-	if (currentRuntime !== void 0 && incomingRuntimeMap !== void 0 && Object.hasOwn(currentRuntime, "profile") && Object.hasOwn(incomingRuntimeMap, "profile") && currentRuntime.profile !== incomingRuntimeMap.profile) {
-		current = deepClone(current);
-		const resetRuntime = current.runtime;
-		delete resetRuntime.providers;
-	}
-	const merged = deepMerge(current, config);
-	const aiOf = (c) => isPlainObject(c) && isPlainObject(c.ai) ? c.ai : void 0;
-	const pkgAiOf = (c) => isPlainObject(c) && isPlainObject(c.packages) && isPlainObject(c.packages.ai) ? c.packages.ai : void 0;
-	if (aiOf(config)) merged.ai = mergeAIConfigObjects(aiOf(current) ?? {}, aiOf(config));
-	if (pkgAiOf(config)) merged.packages.ai = mergeAIConfigObjects(pkgAiOf(current) ?? {}, pkgAiOf(config));
-	globalThis.__smrtRuntimeConfig = merged;
-}
-function getRuntimeConfig() {
-	return globalThis.__smrtRuntimeConfig || {};
-}
-function clearRuntimeConfig() {
-	globalThis.__smrtRuntimeConfig = {};
-}
-function mergeConfigs(defaults, fileConfig, runtime) {
-	let result = { ...defaults };
-	result = deepMerge(result, fileConfig);
-	result = deepMerge(result, runtime);
-	return result;
-}
-//#endregion
-//#region src/export.ts
-var SECRET_PATTERNS = [
-	/secret/i,
-	/password/i,
-	/passwd/i,
-	/(^|[_-])pass([_-]|$)/i,
-	/(^|[_-])pwd([_-]|$)/i,
-	/[a-z0-9]Pass([_-]|$)/,
-	/[a-z0-9]Pwd([_-]|$)/,
-	/^(pass|pwd)$/i,
-	/token/i,
-	/credential/i,
-	/private/i,
-	/oauth/i,
-	/authorization/i,
-	/(^|[_-])auth([_-]|$)/i,
-	/cookie/i,
-	/salt/i,
-	/passphrase/i,
-	/\bcert\b/i,
-	/certificate/i,
-	/api[_-]?key/i,
-	/access[_-]?key/i,
-	/secret[_-]?key/i,
-	/signing[_-]?key/i,
-	/encryption[_-]?key/i,
-	/private[_-]?key/i,
-	/public[_-]?key/i,
-	/[a-z0-9]Key([_-]|Id|$)/,
-	/(^|[_-])key([_-]|id$|$)/i,
-	/connection[_-]?string/i,
-	/conn[_-]?str/i,
-	/(^|[_-])db[_-]?url/i,
-	/database[_-]?url/i,
-	/datasource[_-]?url/i
-];
-function isSecretKey(key) {
-	return SECRET_PATTERNS.some((pattern) => pattern.test(key));
-}
-var CREDENTIAL_URL_RE = /([a-z][a-z0-9+.-]*:\/\/)[^/?#@\s]+@/gi;
-var VALUE_SECRET_PATTERNS = [
-	{
-		re: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g,
-		replace: "***REDACTED PRIVATE KEY***"
-	},
-	{
-		re: /\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{16,}/g,
-		replace: "***"
-	},
-	{
-		re: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
-		replace: "***"
-	},
-	{
-		re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
-		replace: "***"
-	},
-	{
-		re: /\bgithub_pat_[A-Za-z0-9_]{22,}/g,
-		replace: "***"
-	},
-	{
-		re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
-		replace: "***"
-	},
-	{
-		re: /\bAIza[A-Za-z0-9_-]{35}/g,
-		replace: "***"
-	},
-	{
-		re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
-		replace: "***"
-	},
-	{
-		re: /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi,
-		replace: "Bearer ***"
-	}
-];
-function redactValueSecrets(value) {
-	let out = value.replace(CREDENTIAL_URL_RE, "$1***@");
-	for (const { re, replace } of VALUE_SECRET_PATTERNS) out = out.replace(re, replace);
-	return out;
-}
-function sanitizeConfig(config) {
-	if (config === null || config === void 0) return config;
-	if (Array.isArray(config)) return config.map((item) => sanitizeConfig(item));
-	if (typeof config === "object") {
-		const result = {};
-		for (const [key, value] of Object.entries(config)) {
-			if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
-			if (isSecretKey(key)) continue;
-			result[key] = sanitizeConfig(value);
-		}
-		return result;
-	}
-	if (typeof config === "string") return redactValueSecrets(config);
-	return config;
-}
-function exportConfig(config, options = {}) {
-	const { includeSecrets = false, format = "json", indent = 2 } = options;
-	const exportData = includeSecrets ? config : sanitizeConfig(config);
-	const jsonString = JSON.stringify(exportData, null, indent);
-	if (format === "js") return `export default ${jsonString};
-`;
-	return jsonString;
-}
-function parseExportedConfig(content) {
-	const trimmed = content.trim();
-	if (trimmed.startsWith("export default")) {
-		const jsonPart = trimmed.replace(/^export default\s*/, "").replace(/;\s*$/, "");
-		return JSON.parse(jsonPart);
-	}
-	return JSON.parse(content);
-}
-function mergeExportedConfig(baseConfig, exportedConfig) {
-	const result = { ...baseConfig };
-	for (const [key, value] of Object.entries(exportedConfig)) {
-		if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
-		if (key === "ai" && value !== null && typeof value === "object" && !Array.isArray(value) && result[key] !== null && typeof result[key] === "object" && !Array.isArray(result[key])) result[key] = mergeAIConfigObjects(result[key], value);
-		else if (value !== null && typeof value === "object" && !Array.isArray(value) && result[key] !== null && typeof result[key] === "object" && !Array.isArray(result[key])) result[key] = mergeExportedConfig(result[key], value);
-		else result[key] = value;
-	}
-	return result;
-}
 //#endregion
 //#region src/index.ts
-globalThis.__smrtConfigCache ??= null;
-function getLoadedConfig() {
-	return globalThis.__smrtConfigCache ?? null;
-}
-function setLoadedConfig(config) {
-	globalThis.__smrtConfigCache = config;
-}
 async function loadConfig(options) {
 	const config = await loadConfig$1(options);
 	setLoadedConfig(config);
 	return config;
 }
-function getConfig() {
-	return getLoadedConfig();
-}
-function resolveConfiguredApplicationRuntime() {
-	return resolveRuntimeLayers(getLoadedConfig());
-}
-function resolveEffectiveApplicationRuntime(config) {
-	if (!declaresRuntime(config ?? null) && !declaresRuntime(getRuntimeConfig())) return resolveApplicationRuntime({ profile: "local" });
-	return resolveRuntimeLayers(config ?? null);
-}
-function declaresRuntime(layer) {
-	return layer !== null && Object.hasOwn(layer, "runtime") && layer.runtime !== void 0;
-}
-function resolveRuntimeLayers(loadedConfig) {
-	const runtimeConfig = getRuntimeConfig();
-	const fileRuntime = loadedConfig && Object.hasOwn(loadedConfig, "runtime") ? loadedConfig.runtime : void 0;
-	const runtimeOverride = Object.hasOwn(runtimeConfig, "runtime") ? runtimeConfig.runtime : void 0;
-	for (const layer of [fileRuntime, runtimeOverride]) {
-		if (layer === void 0) continue;
-		const shapeIssues = validateApplicationRuntimeConfigShape(layer);
-		if (shapeIssues.length > 0) throw new RuntimeProfileValidationError([...shapeIssues]);
-	}
-	const fileHasProfile = fileRuntime !== void 0 && Object.hasOwn(fileRuntime, "profile");
-	const profileChanged = runtimeOverride !== void 0 && Object.hasOwn(runtimeOverride, "profile") && runtimeOverride.profile !== (fileHasProfile ? fileRuntime.profile : void 0);
-	if (profileChanged && fileHasProfile) resolveApplicationRuntime(fileRuntime);
-	const fileRuntimeWithoutProviders = { ...fileRuntime ?? {} };
-	delete fileRuntimeWithoutProviders.providers;
-	return resolveApplicationRuntime(mergeConfigs({}, profileChanged ? fileRuntimeWithoutProviders : fileRuntime ?? {}, runtimeOverride ?? {}));
-}
-function getSiteConfig() {
-	return (getLoadedConfig() || {}).site || null;
-}
-function getModuleConfig(moduleName, defaults) {
-	const fileConfig = getLoadedConfig() || {};
-	const runtime = getRuntimeConfig();
-	const globalConfig = fileConfig.smrt || {};
-	const moduleConfig = fileConfig.modules?.[moduleName] || {};
-	const runtimeModuleConfig = runtime.modules?.[moduleName] || {};
-	return mergeConfigs(mergeConfigs(mergeConfigs(defaults || {}, globalConfig, {}), moduleConfig, {}), runtimeModuleConfig, {});
-}
-function resolveCliDatabaseConfig(env = process.env) {
-	const declared = getPackageConfig("cli").database;
-	return resolveCliDatabase(declared, env);
-}
-function getPackageConfig(packageName, defaults) {
-	const fileConfig = getLoadedConfig() || {};
-	const runtime = getRuntimeConfig();
-	const globalConfig = fileConfig.smrt || {};
-	const packageConfig = fileConfig.packages?.[packageName] || {};
-	const runtimePackageConfig = runtime.packages?.[packageName] || {};
-	return mergeConfigs(mergeConfigs(mergeConfigs(defaults || {}, globalConfig, {}), packageConfig, {}), runtimePackageConfig, {});
-}
-function setConfig(config) {
-	setConfig$1(config);
-}
-function clearCache() {
-	setLoadedConfig(null);
-	clearConfigCache();
-	clearRuntimeConfig();
-}
-function defineConfig(config) {
-	return config;
-}
-function getAIConfigBlock() {
-	const file = getLoadedConfig();
-	const runtime = getRuntimeConfig();
-	return mergeAIConfigLayers([
-		file?.packages?.ai,
-		file?.ai,
-		runtime.packages?.ai,
-		runtime.ai
-	]);
-}
-function mergeAIConfigLayers(layers) {
-	const FIELDS = [
-		"model",
-		"baseUrl",
-		"apiKeyEnv",
-		"apiKey"
-	];
-	let provider;
-	const values = {};
-	const owners = {};
-	const text = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
-	for (const layer of layers) {
-		if (!layer || typeof layer !== "object") continue;
-		const rec = layer;
-		const named = text(rec.provider) ?? text(rec.type);
-		if (named && provider && named.toLowerCase() !== provider.toLowerCase()) for (const f of FIELDS) {
-			const owner = owners[f];
-			if (owner && owner.toLowerCase() !== named.toLowerCase()) {
-				delete values[f];
-				delete owners[f];
-			}
-		}
-		if (named) provider = named;
-		for (const f of FIELDS) {
-			const v = f === "model" ? text(rec.model) ?? text(rec.defaultModel) : text(rec[f]);
-			if (v) {
-				values[f] = v;
-				owners[f] = provider;
-			}
-		}
-	}
-	if (!provider && FIELDS.every((f) => !values[f])) return null;
-	const merged = { ...values };
-	if (provider) merged.provider = provider;
-	return merged;
-}
-function resolveConfiguredAIProvider(options = {}) {
-	return resolveAIProviderConfig({
-		...options,
-		config: options.config === void 0 ? getAIConfigBlock() : options.config
-	});
-}
-function tryResolveConfiguredAIProvider(options = {}) {
-	return tryResolveAIProviderConfig({
-		...options,
-		config: options.config === void 0 ? getAIConfigBlock() : options.config
-	});
-}
 //#endregion
 export { AIProviderNotConfiguredError, AI_PROVIDER_KEY_ENV, DEFAULT_AI_ENV_PREFIXES, RuntimeProfileValidationError, canonicalizeAIConfig, clearCache, clearRuntimeConfig, defineConfig, describeAIProviderConfig, exportConfig, getAIConfigBlock, getApplicationRuntimePreset, getConfig, getDefaultAIKeyEnvName, getModuleConfig, getPackageConfig, getRuntimeConfig, getSiteConfig, loadConfig, mergeAIConfigLayers, mergeAIConfigObjects, mergeConfigs, mergeExportedConfig, parseExportedConfig, redactBaseUrl, resolveAIProviderConfig, resolveApplicationRuntime, resolveCliDatabaseConfig, resolveConfiguredAIProvider, resolveConfiguredApplicationRuntime, resolveEffectiveApplicationRuntime, sanitizeConfig, setConfig, toAIClientOptions, tryResolveAIProviderConfig, tryResolveConfiguredAIProvider, withAIAliases };