@happyvertical/smrt-config 0.55.3 → 0.55.5

package/dist/chunks/shared-B81TOCQq.js

@@ -0,0 +1,1065 @@
+//#region src/loaded-config.ts
+globalThis.__smrtConfigCache ??= null;
+function getLoadedConfig() {
+	return globalThis.__smrtConfigCache ?? null;
+}
+function setLoadedConfig(config) {
+	globalThis.__smrtConfigCache = config;
+}
+//#endregion
+//#region src/loader-state.ts
+function getCachedConfig() {
+	return globalThis.__smrtLoaderCachedConfig ?? null;
+}
+function setCachedConfig(config) {
+	globalThis.__smrtLoaderCachedConfig = config;
+}
+function getExplorer() {
+	return globalThis.__smrtLoaderExplorer ?? null;
+}
+function setExplorer(exp) {
+	globalThis.__smrtLoaderExplorer = exp;
+}
+function clearConfigCache() {
+	setCachedConfig(null);
+	const explorer = getExplorer();
+	if (explorer) {
+		explorer.clearCaches();
+		setExplorer(null);
+	}
+}
+//#endregion
+//#region src/ai.ts
+var AI_PROVIDER_KEY_ENV = Object.freeze({
+	openai: "OPENAI_API_KEY",
+	anthropic: "ANTHROPIC_API_KEY",
+	gemini: "GEMINI_API_KEY"
+});
+var AUTO_DETECT_ORDER = [
+	"openai",
+	"anthropic",
+	"gemini"
+];
+var DEFAULT_AI_ENV_PREFIXES = Object.freeze(["SMRT_AI", "HAVE_AI"]);
+function getDefaultAIKeyEnvName(provider) {
+	const normalized = nonEmpty(provider)?.toLowerCase();
+	return normalized && Object.hasOwn(AI_PROVIDER_KEY_ENV, normalized) ? AI_PROVIDER_KEY_ENV[normalized] : void 0;
+}
+var AIProviderNotConfiguredError = class extends Error {
+	code = "SMRT_AI_NOT_CONFIGURED";
+	constructor(message) {
+		super(message);
+		this.name = "AIProviderNotConfiguredError";
+	}
+};
+function nonEmpty(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function redactBaseUrl(value) {
+	if (!value) return void 0;
+	try {
+		const url = new URL(value);
+		return `${url.protocol}//${url.host}`;
+	} catch {
+		return "[unparseable-url]";
+	}
+}
+function tryResolveAIProviderConfig(options = {}) {
+	const env = options.env ?? process.env;
+	const read = (name) => nonEmpty(env[name]);
+	const prefixes = options.prefixes ?? DEFAULT_AI_ENV_PREFIXES;
+	const explicit = options.explicit ?? {};
+	const block = options.config ?? {};
+	const fromEnv = (suffix) => prefixes.map((prefix) => ({
+		source: `env:${prefix}_${suffix}`,
+		value: read(`${prefix}_${suffix}`)
+	}));
+	const explicitCand = (value) => ({
+		source: "explicit",
+		value: nonEmpty(value)
+	});
+	const configCand = (value) => ({
+		source: "config",
+		value: nonEmpty(value)
+	});
+	const layered = (exp, cfg, envs) => options.envOverridesConfig ? [
+		...exp,
+		...envs,
+		...cfg
+	] : [
+		...exp,
+		...cfg,
+		...envs
+	];
+	const first = (candidates) => {
+		for (const c of candidates) if (c.value) return {
+			value: c.value,
+			source: c.source
+		};
+	};
+	const sources = {};
+	const result = {};
+	const set = (field, hit) => {
+		if (hit) {
+			result[field] = hit.value;
+			sources[field] = hit.source;
+		}
+	};
+	set("provider", first(layered([explicitCand(nonEmpty(explicit.provider) ?? nonEmpty(explicit.type))], [configCand(block.provider)], fromEnv("PROVIDER"))));
+	set("model", first(layered([explicitCand(nonEmpty(explicit.model) ?? nonEmpty(explicit.defaultModel))], [configCand(block.model)], fromEnv("MODEL"))));
+	const autoDetected = result.provider || options.autoDetect === false ? void 0 : AUTO_DETECT_ORDER.find((p) => read(AI_PROVIDER_KEY_ENV[p]));
+	if (autoDetected) {
+		result.provider = autoDetected;
+		sources.provider = "auto-detect";
+	}
+	const selected = result.provider?.toLowerCase();
+	const configKeyEnv = nonEmpty(block.apiKeyEnv);
+	const explicitGroup = {
+		source: "explicit",
+		provider: nonEmpty(explicit.provider) ?? nonEmpty(explicit.type),
+		apiKey: nonEmpty(explicit.apiKey),
+		baseUrl: nonEmpty(explicit.baseUrl)
+	};
+	const configGroup = {
+		source: "config",
+		provider: nonEmpty(block.provider),
+		apiKey: nonEmpty(block.apiKey) ?? (configKeyEnv ? read(configKeyEnv) : void 0),
+		baseUrl: nonEmpty(block.baseUrl)
+	};
+	const envGroups = prefixes.map((prefix) => ({
+		source: `env:${prefix}`,
+		provider: read(`${prefix}_PROVIDER`),
+		apiKey: read(`${prefix}_API_KEY`),
+		baseUrl: read(`${prefix}_BASE_URL`)
+	}));
+	const groups = options.envOverridesConfig ? [
+		explicitGroup,
+		...envGroups,
+		configGroup
+	] : [
+		explicitGroup,
+		configGroup,
+		...envGroups
+	];
+	const usable = (g) => !g.provider || g.provider.toLowerCase() === selected;
+	const sourceName = (g, suffix) => g.source.startsWith("env:") ? `${g.source}_${suffix}` : g.source;
+	for (const g of groups) {
+		if (!usable(g)) continue;
+		if (g.baseUrl && !result.baseUrl) {
+			result.baseUrl = g.baseUrl;
+			sources.baseUrl = sourceName(g, "BASE_URL");
+		}
+		if (g.apiKey && !result.apiKey) {
+			result.apiKey = g.apiKey;
+			sources.apiKey = sourceName(g, "API_KEY");
+		}
+	}
+	const providerKeyEnv = getDefaultAIKeyEnvName(result.provider);
+	if (!result.apiKey && providerKeyEnv && options.providerKeyEnvFallback !== false && read(providerKeyEnv)) {
+		result.apiKey = read(providerKeyEnv);
+		sources.apiKey = "provider-key-env";
+	}
+	if (!result.provider && (options.requireProvider ?? true)) return;
+	if (!result.provider && !result.apiKey) return;
+	const resolved = {
+		...result,
+		sources,
+		toJSON: () => describeAIProviderConfig(resolved)
+	};
+	Object.defineProperty(resolved, "toJSON", { enumerable: false });
+	return resolved;
+}
+function resolveAIProviderConfig(options = {}) {
+	const resolved = tryResolveAIProviderConfig(options);
+	if (resolved) return resolved;
+	const envNames = (options.prefixes ?? DEFAULT_AI_ENV_PREFIXES).map((p) => `${p}_PROVIDER`).join(", ");
+	const keyNames = Object.values(AI_PROVIDER_KEY_ENV).join(", ");
+	throw new AIProviderNotConfiguredError(`No AI provider is configured. Set the \`ai\` block in smrt.config.ts (provider, model, apiKeyEnv), or set ${envNames}` + (options.autoDetect === false ? "." : `, or one of ${keyNames} to auto-detect the provider.`));
+}
+function describeAIProviderConfig(resolved) {
+	return {
+		provider: resolved.provider,
+		model: resolved.model,
+		baseUrl: redactBaseUrl(resolved.baseUrl),
+		apiKey: resolved.apiKey ? "[redacted]" : void 0,
+		sources: { ...resolved.sources }
+	};
+}
+function toAIClientOptions(resolved) {
+	const out = {};
+	if (resolved.provider) {
+		out.type = resolved.provider;
+		out.provider = resolved.provider;
+	}
+	if (resolved.apiKey) out.apiKey = resolved.apiKey;
+	if (resolved.baseUrl) out.baseUrl = resolved.baseUrl;
+	if (resolved.model) out.defaultModel = resolved.model;
+	return out;
+}
+var OWNED_AI_FIELDS = [
+	"apiKey",
+	"apiKeyEnv",
+	"baseUrl",
+	"model"
+];
+function canonicalizeAIConfig(input) {
+	if (!input || typeof input !== "object") return {};
+	const out = {};
+	for (const [key, value] of Object.entries(input)) {
+		if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+		if (typeof value === "string" && value.trim().length === 0) continue;
+		out[key] = value;
+	}
+	const provider = nonEmpty(out.provider) ?? nonEmpty(out.type);
+	const model = nonEmpty(out.model) ?? nonEmpty(out.defaultModel);
+	delete out.type;
+	delete out.defaultModel;
+	if (provider) out.provider = provider;
+	else delete out.provider;
+	if (model) out.model = model;
+	else delete out.model;
+	return out;
+}
+function mergeAIConfigObjects(lower, higher) {
+	const low = canonicalizeAIConfig(lower);
+	const high = canonicalizeAIConfig(higher);
+	const lowName = nonEmpty(low.provider)?.toLowerCase();
+	const highName = nonEmpty(high.provider)?.toLowerCase();
+	if (lowName && highName && lowName !== highName) {
+		delete low.provider;
+		for (const f of OWNED_AI_FIELDS) delete low[f];
+	}
+	return {
+		...low,
+		...high
+	};
+}
+function withAIAliases(config) {
+	const out = { ...config };
+	const provider = nonEmpty(out.provider) ?? nonEmpty(out.type);
+	const model = nonEmpty(out.model) ?? nonEmpty(out.defaultModel);
+	for (const k of ["provider", "type"]) if (provider) out[k] = provider;
+	else delete out[k];
+	for (const k of ["model", "defaultModel"]) if (model) out[k] = model;
+	else delete out[k];
+	return out;
+}
+//#endregion
+//#region src/database-environment.ts
+var POSTGRES_URL = /^postgres(?:ql)?:\/\//i;
+function environmentType(value) {
+	const normalized = value?.trim().toLowerCase();
+	if (!normalized) return null;
+	if (normalized === "sqlite") return "sqlite";
+	if (normalized === "postgres" || normalized === "postgresql") return "postgres";
+	throw new TypeError("DATABASE_TYPE must be sqlite or postgres.");
+}
+function resolveCliDatabase(declared, env) {
+	if (typeof declared?.url === "string" && declared.url !== "") return {
+		source: "config",
+		database: typeof declared.type === "string" ? {
+			type: declared.type,
+			url: declared.url
+		} : { url: declared.url }
+	};
+	const url = env.DATABASE_URL?.trim();
+	if (!url) return {
+		source: "none",
+		database: null
+	};
+	let type;
+	try {
+		type = declared?.type === "sqlite" || declared?.type === "postgres" ? declared.type : environmentType(env.DATABASE_TYPE) ?? (POSTGRES_URL.test(url) ? "postgres" : "sqlite");
+	} catch (error) {
+		return {
+			source: "invalid-environment",
+			database: null,
+			error: error.message
+		};
+	}
+	return {
+		source: "environment",
+		database: {
+			type,
+			url
+		}
+	};
+}
+//#endregion
+//#region src/runtime-profile.ts
+function isApplicationRuntimeProfile(value) {
+	return value === "local" || value === "self-hosted" || value === "cloud";
+}
+function invalidProfileIssue() {
+	return {
+		code: "invalid_config",
+		path: "profile",
+		message: "must be local, self-hosted, or cloud.",
+		recovery: "Select one documented runtime profile."
+	};
+}
+var RuntimeProfileValidationError = class extends Error {
+	issues;
+	constructor(issues) {
+		super(`Invalid application runtime profile:
+${issues.map((issue) => `- ${issue.path}: ${issue.message} Recovery: ${issue.recovery}`).join("\n")}`);
+		this.name = "RuntimeProfileValidationError";
+		this.issues = Object.freeze(issues.map((issue) => Object.freeze({ ...issue })));
+	}
+};
+var PROFILE_DEFAULTS = {
+	local: {
+		database: {
+			engine: "sqlite",
+			connectionOwnership: "user"
+		},
+		authentication: {
+			provider: "owner-bootstrap",
+			ownerBootstrap: "single-use"
+		},
+		tenancy: {
+			mode: "default-tenant",
+			context: "defaulted",
+			isolation: "application"
+		},
+		assets: {
+			provider: "local-files",
+			ownership: "user"
+		},
+		secrets: {
+			provider: "local-file",
+			ownership: "user"
+		},
+		jobs: { topology: "embedded" },
+		network: {
+			exposure: "loopback",
+			tls: false
+		},
+		portability: {
+			backup: "file-snapshot",
+			logicalExport: true,
+			logicalImport: true
+		}
+	},
+	"self-hosted": {
+		database: {
+			engine: "postgres",
+			connectionOwnership: "operator"
+		},
+		authentication: {
+			provider: "oidc",
+			ownerBootstrap: "disabled"
+		},
+		tenancy: {
+			mode: "single-tenant",
+			context: "defaulted",
+			isolation: "application"
+		},
+		assets: {
+			provider: "s3-compatible",
+			ownership: "operator"
+		},
+		secrets: {
+			provider: "environment",
+			ownership: "operator"
+		},
+		jobs: { topology: "external" },
+		network: {
+			exposure: "public",
+			tls: true
+		},
+		portability: {
+			backup: "operator",
+			logicalExport: true,
+			logicalImport: true
+		}
+	},
+	cloud: {
+		database: {
+			engine: "postgres",
+			connectionOwnership: "managed"
+		},
+		authentication: {
+			provider: "hosted-identity",
+			ownerBootstrap: "disabled"
+		},
+		tenancy: {
+			mode: "multi-tenant",
+			context: "required",
+			isolation: "database-rls"
+		},
+		assets: {
+			provider: "managed-object-storage",
+			ownership: "managed"
+		},
+		secrets: {
+			provider: "managed",
+			ownership: "managed"
+		},
+		jobs: { topology: "scalable" },
+		network: {
+			exposure: "public",
+			tls: true
+		},
+		portability: {
+			backup: "managed",
+			logicalExport: true,
+			logicalImport: true
+		}
+	}
+};
+var INVARIANTS = {
+	domainModels: "identical",
+	generatedRest: "identical",
+	generatedCli: "identical",
+	generatedMcp: "identical",
+	generatedWebMcp: "identical",
+	mcpExposurePolicy: "identical",
+	webMcpExposurePolicy: "identical",
+	actionEffects: "identical",
+	approvalPolicy: "identical",
+	authorizationRecords: "required",
+	jobInvocation: "identical",
+	portability: "logical-export-import"
+};
+var PROVIDER_FIELDS = {
+	database: ["engine", "connectionOwnership"],
+	authentication: ["provider", "ownerBootstrap"],
+	tenancy: [
+		"mode",
+		"context",
+		"isolation"
+	],
+	assets: ["provider", "ownership"],
+	secrets: ["provider", "ownership"],
+	jobs: ["topology"],
+	network: ["exposure", "tls"]
+};
+var PROVIDER_VALUE_DOMAINS = {
+	database: {
+		engine: ["sqlite", "postgres"],
+		connectionOwnership: [
+			"user",
+			"operator",
+			"managed"
+		]
+	},
+	authentication: {
+		provider: [
+			"owner-bootstrap",
+			"oidc",
+			"magic-link",
+			"hosted-identity"
+		],
+		ownerBootstrap: ["single-use", "disabled"]
+	},
+	tenancy: {
+		mode: [
+			"default-tenant",
+			"single-tenant",
+			"multi-tenant"
+		],
+		context: ["defaulted", "required"],
+		isolation: ["application", "database-rls"]
+	},
+	assets: {
+		provider: [
+			"local-files",
+			"s3-compatible",
+			"managed-object-storage"
+		],
+		ownership: [
+			"user",
+			"operator",
+			"managed"
+		]
+	},
+	secrets: {
+		provider: [
+			"local-file",
+			"environment",
+			"external",
+			"managed"
+		],
+		ownership: [
+			"user",
+			"operator",
+			"managed"
+		]
+	},
+	jobs: { topology: [
+		"inline",
+		"embedded",
+		"external",
+		"scalable"
+	] },
+	network: {
+		exposure: ["loopback", "public"],
+		tls: [false, true]
+	}
+};
+function isPlainRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function cloneDefaults(profile) {
+	const defaults = PROFILE_DEFAULTS[profile];
+	return {
+		database: { ...defaults.database },
+		authentication: { ...defaults.authentication },
+		tenancy: { ...defaults.tenancy },
+		assets: { ...defaults.assets },
+		secrets: { ...defaults.secrets },
+		jobs: { ...defaults.jobs },
+		network: { ...defaults.network },
+		portability: { ...defaults.portability }
+	};
+}
+function rejectUnknownFields(input) {
+	const issues = [];
+	for (const key of Object.keys(input).sort()) if (key !== "profile" && key !== "providers") issues.push({
+		code: "unsupported_field",
+		path: key,
+		message: "is not part of the runtime-profile contract.",
+		recovery: "Move provider selection under providers or remove this field."
+	});
+	if (Object.hasOwn(input, "profile") && !isApplicationRuntimeProfile(input.profile)) issues.push(invalidProfileIssue());
+	const providers = Object.hasOwn(input, "providers") ? input.providers : void 0;
+	if (providers === void 0) return issues;
+	if (!isPlainRecord(providers)) {
+		issues.push({
+			code: "invalid_config",
+			path: "providers",
+			message: "must be an object with Object.prototype or null.",
+			recovery: "Use providers: { database: { ... } } or omit providers."
+		});
+		return issues;
+	}
+	for (const providerName of Object.keys(providers).sort()) {
+		if (!Object.hasOwn(PROVIDER_FIELDS, providerName)) {
+			issues.push({
+				code: "unsupported_field",
+				path: `providers.${providerName}`,
+				message: "is not an overridable infrastructure provider.",
+				recovery: "Use database, authentication, tenancy, assets, secrets, jobs, or network."
+			});
+			continue;
+		}
+		const value = providers[providerName];
+		if (!isPlainRecord(value)) {
+			issues.push({
+				code: "invalid_config",
+				path: `providers.${providerName}`,
+				message: "must be an object with Object.prototype or null.",
+				recovery: `Provide a partial ${providerName} provider object or omit it.`
+			});
+			continue;
+		}
+		const allowed = PROVIDER_FIELDS[providerName];
+		const valueDomains = PROVIDER_VALUE_DOMAINS[providerName];
+		for (const field of Object.keys(value).sort()) {
+			if (!allowed.includes(field)) {
+				issues.push({
+					code: "unsupported_field",
+					path: `providers.${providerName}.${field}`,
+					message: "is not a supported provider override.",
+					recovery: "Remove secret values and application-policy fields; configure only documented provider selectors."
+				});
+				continue;
+			}
+			const suppliedValue = Object.hasOwn(value, field) ? value[field] : void 0;
+			const allowedValues = valueDomains[field];
+			if (suppliedValue !== void 0 && !allowedValues.includes(suppliedValue)) issues.push({
+				code: "invalid_config",
+				path: `providers.${providerName}.${field}`,
+				message: `must be one of ${allowedValues.map(String).join(", ")}.`,
+				recovery: "Choose a documented provider selector value; supplied values are omitted from diagnostics."
+			});
+		}
+	}
+	return issues;
+}
+function validateApplicationRuntimeConfigShape(config) {
+	if (!isPlainRecord(config)) return [{
+		code: "invalid_config",
+		path: "runtime",
+		message: "must be an object with Object.prototype or null.",
+		recovery: "Provide runtime: { profile: \"local\" | \"self-hosted\" | \"cloud\" }."
+	}];
+	return rejectUnknownFields(config);
+}
+function applyOverrides(providers, input) {
+	const overrideRoot = Object.hasOwn(input, "providers") && isPlainRecord(input.providers) ? input.providers : {};
+	const report = [];
+	for (const providerName of Object.keys(PROVIDER_FIELDS)) {
+		if (!Object.hasOwn(overrideRoot, providerName)) continue;
+		const supplied = overrideRoot[providerName];
+		if (!isPlainRecord(supplied)) continue;
+		const target = providers[providerName];
+		for (const field of PROVIDER_FIELDS[providerName]) {
+			if (!Object.hasOwn(supplied, field)) continue;
+			const value = supplied[field];
+			if (value === void 0) continue;
+			const previous = target[field];
+			target[field] = value;
+			if (value !== previous) report.push({
+				path: `providers.${providerName}.${field}`,
+				from: previous,
+				to: value
+			});
+		}
+	}
+	return report;
+}
+function incompatible(issues, path, expected, recovery) {
+	issues.push({
+		code: "incompatible_provider",
+		path,
+		message: `is incompatible; ${expected}.`,
+		recovery
+	});
+}
+function requireAllowed(issues, path, actual, allowed, profile) {
+	if (!allowed.includes(actual)) incompatible(issues, path, `${profile} requires one of ${allowed.map(String).join(", ")}`, `Choose a supported ${profile} provider or select a different profile.`);
+}
+function validateComposition(profile, providers) {
+	const issues = [];
+	const allow = (path, actual, values) => requireAllowed(issues, path, actual, values, profile);
+	if (profile === "local") {
+		allow("providers.database.engine", providers.database.engine, ["sqlite"]);
+		allow("providers.database.connectionOwnership", providers.database.connectionOwnership, ["user"]);
+		allow("providers.authentication.provider", providers.authentication.provider, ["owner-bootstrap"]);
+		allow("providers.authentication.ownerBootstrap", providers.authentication.ownerBootstrap, ["single-use"]);
+		allow("providers.tenancy.mode", providers.tenancy.mode, ["default-tenant"]);
+		allow("providers.tenancy.context", providers.tenancy.context, ["defaulted"]);
+		allow("providers.tenancy.isolation", providers.tenancy.isolation, ["application"]);
+		allow("providers.assets.provider", providers.assets.provider, ["local-files"]);
+		allow("providers.assets.ownership", providers.assets.ownership, ["user"]);
+		allow("providers.secrets.provider", providers.secrets.provider, ["local-file"]);
+		allow("providers.secrets.ownership", providers.secrets.ownership, ["user"]);
+		allow("providers.jobs.topology", providers.jobs.topology, ["inline", "embedded"]);
+		allow("providers.network.exposure", providers.network.exposure, ["loopback"]);
+		allow("providers.network.tls", providers.network.tls, [false, true]);
+	} else if (profile === "self-hosted") {
+		allow("providers.database.engine", providers.database.engine, ["postgres"]);
+		allow("providers.database.connectionOwnership", providers.database.connectionOwnership, ["operator"]);
+		allow("providers.authentication.provider", providers.authentication.provider, ["oidc", "magic-link"]);
+		allow("providers.authentication.ownerBootstrap", providers.authentication.ownerBootstrap, ["disabled"]);
+		allow("providers.tenancy.mode", providers.tenancy.mode, ["single-tenant", "multi-tenant"]);
+		allow("providers.tenancy.context", providers.tenancy.context, providers.tenancy.mode === "multi-tenant" ? ["required"] : ["defaulted"]);
+		allow("providers.tenancy.isolation", providers.tenancy.isolation, ["application", "database-rls"]);
+		allow("providers.assets.provider", providers.assets.provider, ["local-files", "s3-compatible"]);
+		allow("providers.assets.ownership", providers.assets.ownership, ["operator"]);
+		allow("providers.secrets.provider", providers.secrets.provider, [
+			"environment",
+			"local-file",
+			"external"
+		]);
+		allow("providers.secrets.ownership", providers.secrets.ownership, ["operator"]);
+		allow("providers.jobs.topology", providers.jobs.topology, ["external"]);
+		allow("providers.network.exposure", providers.network.exposure, ["public"]);
+		allow("providers.network.tls", providers.network.tls, [true]);
+	} else {
+		allow("providers.database.engine", providers.database.engine, ["postgres"]);
+		allow("providers.database.connectionOwnership", providers.database.connectionOwnership, ["managed"]);
+		allow("providers.authentication.provider", providers.authentication.provider, ["hosted-identity"]);
+		allow("providers.authentication.ownerBootstrap", providers.authentication.ownerBootstrap, ["disabled"]);
+		allow("providers.tenancy.mode", providers.tenancy.mode, ["multi-tenant"]);
+		allow("providers.tenancy.context", providers.tenancy.context, ["required"]);
+		allow("providers.tenancy.isolation", providers.tenancy.isolation, ["application", "database-rls"]);
+		allow("providers.assets.provider", providers.assets.provider, ["managed-object-storage", "s3-compatible"]);
+		allow("providers.assets.ownership", providers.assets.ownership, ["managed"]);
+		allow("providers.secrets.provider", providers.secrets.provider, ["managed", "external"]);
+		allow("providers.secrets.ownership", providers.secrets.ownership, ["managed"]);
+		allow("providers.jobs.topology", providers.jobs.topology, ["scalable"]);
+		allow("providers.network.exposure", providers.network.exposure, ["public"]);
+		allow("providers.network.tls", providers.network.tls, [true]);
+	}
+	return issues;
+}
+function deriveCapabilities(profile, providers) {
+	return {
+		ownerBootstrap: providers.authentication.ownerBootstrap === "single-use",
+		publicAuthentication: providers.authentication.provider !== "owner-bootstrap",
+		defaultTenant: providers.tenancy.context === "defaulted",
+		multiTenant: providers.tenancy.mode === "multi-tenant",
+		localAssets: providers.assets.provider === "local-files",
+		externalWorkers: providers.jobs.topology === "external" || providers.jobs.topology === "scalable",
+		backup: true,
+		logicalExport: true,
+		logicalImport: true,
+		diagnostics: true,
+		orchestrationHealth: profile !== "local"
+	};
+}
+function deepFreeze(value) {
+	if (value && typeof value === "object" && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
+function resolveApplicationRuntime(config) {
+	if (!isPlainRecord(config)) throw new RuntimeProfileValidationError([...validateApplicationRuntimeConfigShape(config)]);
+	const unknownIssues = validateApplicationRuntimeConfigShape(config);
+	const profile = Object.hasOwn(config, "profile") ? config.profile : void 0;
+	if (!isApplicationRuntimeProfile(profile)) throw new RuntimeProfileValidationError([...unknownIssues, ...Object.hasOwn(config, "profile") ? [] : [invalidProfileIssue()]]);
+	const providers = cloneDefaults(profile);
+	const overrides = applyOverrides(providers, config);
+	const issues = [...unknownIssues, ...validateComposition(profile, providers)];
+	if (issues.length > 0) throw new RuntimeProfileValidationError(issues);
+	return deepFreeze({
+		schemaVersion: 1,
+		profile,
+		providers,
+		capabilities: deriveCapabilities(profile, providers),
+		invariants: { ...INVARIANTS },
+		diagnostics: {
+			secretValuesIncluded: false,
+			overrides,
+			unsafeOverrides: []
+		}
+	});
+}
+function getApplicationRuntimePreset(profile) {
+	if (!isApplicationRuntimeProfile(profile)) throw new RuntimeProfileValidationError([invalidProfileIssue()]);
+	return deepFreeze(cloneDefaults(profile));
+}
+//#endregion
+//#region src/merge.ts
+globalThis.__smrtRuntimeConfig ??= {};
+var UNSAFE_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function defineOwn(target, key, value) {
+	Object.defineProperty(target, key, {
+		configurable: true,
+		enumerable: true,
+		value,
+		writable: true
+	});
+}
+function isPlainObject(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === null || proto === Object.prototype;
+}
+function deepClone(value) {
+	if (Array.isArray(value)) return value.map((item) => deepClone(item));
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const key of Object.keys(value)) {
+			if (UNSAFE_KEYS.has(key)) continue;
+			defineOwn(out, key, deepClone(value[key]));
+		}
+		return out;
+	}
+	return value;
+}
+function deepMerge(target, source) {
+	const result = {};
+	const tgt = target;
+	const src = source;
+	for (const key of Object.keys(tgt)) {
+		if (UNSAFE_KEYS.has(key) || Object.hasOwn(src, key)) continue;
+		defineOwn(result, key, deepClone(tgt[key]));
+	}
+	for (const key of Object.keys(src)) {
+		if (UNSAFE_KEYS.has(key)) continue;
+		const sourceValue = src[key];
+		const targetValue = Object.hasOwn(tgt, key) ? tgt[key] : void 0;
+		if (isPlainObject(sourceValue) && isPlainObject(targetValue)) defineOwn(result, key, deepMerge(targetValue, sourceValue));
+		else if (sourceValue !== void 0 && sourceValue !== null) defineOwn(result, key, deepClone(sourceValue));
+		else if (targetValue !== void 0) defineOwn(result, key, deepClone(targetValue));
+	}
+	return result;
+}
+function setConfig$1(config) {
+	const incomingRuntime = Object.hasOwn(config, "runtime") ? config.runtime : void 0;
+	if (incomingRuntime !== void 0 && (incomingRuntime === null || typeof incomingRuntime !== "object" || Array.isArray(incomingRuntime))) throw new RuntimeProfileValidationError([...validateApplicationRuntimeConfigShape(incomingRuntime)]);
+	if (incomingRuntime !== null && (typeof incomingRuntime === "object" || typeof incomingRuntime === "function") && Object.hasOwn(incomingRuntime, "profile")) {
+		const profileIssues = validateApplicationRuntimeConfigShape(incomingRuntime).filter((issue) => issue.path === "runtime" || issue.path === "profile");
+		if (profileIssues.length > 0) throw new RuntimeProfileValidationError([...profileIssues]);
+	}
+	let current = globalThis.__smrtRuntimeConfig || {};
+	const currentRuntime = Object.hasOwn(current, "runtime") && isPlainObject(current.runtime) ? current.runtime : void 0;
+	const incomingRuntimeMap = Object.hasOwn(config, "runtime") && isPlainObject(config.runtime) ? config.runtime : void 0;
+	if (currentRuntime !== void 0 && incomingRuntimeMap !== void 0 && Object.hasOwn(currentRuntime, "profile") && Object.hasOwn(incomingRuntimeMap, "profile") && currentRuntime.profile !== incomingRuntimeMap.profile) {
+		current = deepClone(current);
+		const resetRuntime = current.runtime;
+		delete resetRuntime.providers;
+	}
+	const merged = deepMerge(current, config);
+	const aiOf = (c) => isPlainObject(c) && isPlainObject(c.ai) ? c.ai : void 0;
+	const pkgAiOf = (c) => isPlainObject(c) && isPlainObject(c.packages) && isPlainObject(c.packages.ai) ? c.packages.ai : void 0;
+	if (aiOf(config)) merged.ai = mergeAIConfigObjects(aiOf(current) ?? {}, aiOf(config));
+	if (pkgAiOf(config)) merged.packages.ai = mergeAIConfigObjects(pkgAiOf(current) ?? {}, pkgAiOf(config));
+	globalThis.__smrtRuntimeConfig = merged;
+}
+function getRuntimeConfig() {
+	return globalThis.__smrtRuntimeConfig || {};
+}
+function clearRuntimeConfig() {
+	globalThis.__smrtRuntimeConfig = {};
+}
+function mergeConfigs(defaults, fileConfig, runtime) {
+	let result = { ...defaults };
+	result = deepMerge(result, fileConfig);
+	result = deepMerge(result, runtime);
+	return result;
+}
+//#endregion
+//#region src/export.ts
+var SECRET_PATTERNS = [
+	/secret/i,
+	/password/i,
+	/passwd/i,
+	/(^|[_-])pass([_-]|$)/i,
+	/(^|[_-])pwd([_-]|$)/i,
+	/[a-z0-9]Pass([_-]|$)/,
+	/[a-z0-9]Pwd([_-]|$)/,
+	/^(pass|pwd)$/i,
+	/token/i,
+	/credential/i,
+	/private/i,
+	/oauth/i,
+	/authorization/i,
+	/(^|[_-])auth([_-]|$)/i,
+	/cookie/i,
+	/salt/i,
+	/passphrase/i,
+	/\bcert\b/i,
+	/certificate/i,
+	/api[_-]?key/i,
+	/access[_-]?key/i,
+	/secret[_-]?key/i,
+	/signing[_-]?key/i,
+	/encryption[_-]?key/i,
+	/private[_-]?key/i,
+	/public[_-]?key/i,
+	/[a-z0-9]Key([_-]|Id|$)/,
+	/(^|[_-])key([_-]|id$|$)/i,
+	/connection[_-]?string/i,
+	/conn[_-]?str/i,
+	/(^|[_-])db[_-]?url/i,
+	/database[_-]?url/i,
+	/datasource[_-]?url/i
+];
+function isSecretKey(key) {
+	return SECRET_PATTERNS.some((pattern) => pattern.test(key));
+}
+var CREDENTIAL_URL_RE = /([a-z][a-z0-9+.-]*:\/\/)[^/?#@\s]+@/gi;
+var VALUE_SECRET_PATTERNS = [
+	{
+		re: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g,
+		replace: "***REDACTED PRIVATE KEY***"
+	},
+	{
+		re: /\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{16,}/g,
+		replace: "***"
+	},
+	{
+		re: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+		replace: "***"
+	},
+	{
+		re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+		replace: "***"
+	},
+	{
+		re: /\bgithub_pat_[A-Za-z0-9_]{22,}/g,
+		replace: "***"
+	},
+	{
+		re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+		replace: "***"
+	},
+	{
+		re: /\bAIza[A-Za-z0-9_-]{35}/g,
+		replace: "***"
+	},
+	{
+		re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+		replace: "***"
+	},
+	{
+		re: /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi,
+		replace: "Bearer ***"
+	}
+];
+function redactValueSecrets(value) {
+	let out = value.replace(CREDENTIAL_URL_RE, "$1***@");
+	for (const { re, replace } of VALUE_SECRET_PATTERNS) out = out.replace(re, replace);
+	return out;
+}
+function sanitizeConfig(config) {
+	if (config === null || config === void 0) return config;
+	if (Array.isArray(config)) return config.map((item) => sanitizeConfig(item));
+	if (typeof config === "object") {
+		const result = {};
+		for (const [key, value] of Object.entries(config)) {
+			if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+			if (isSecretKey(key)) continue;
+			result[key] = sanitizeConfig(value);
+		}
+		return result;
+	}
+	if (typeof config === "string") return redactValueSecrets(config);
+	return config;
+}
+function exportConfig(config, options = {}) {
+	const { includeSecrets = false, format = "json", indent = 2 } = options;
+	const exportData = includeSecrets ? config : sanitizeConfig(config);
+	const jsonString = JSON.stringify(exportData, null, indent);
+	if (format === "js") return `export default ${jsonString};
+`;
+	return jsonString;
+}
+function parseExportedConfig(content) {
+	const trimmed = content.trim();
+	if (trimmed.startsWith("export default")) {
+		const jsonPart = trimmed.replace(/^export default\s*/, "").replace(/;\s*$/, "");
+		return JSON.parse(jsonPart);
+	}
+	return JSON.parse(content);
+}
+function mergeExportedConfig(baseConfig, exportedConfig) {
+	const result = { ...baseConfig };
+	for (const [key, value] of Object.entries(exportedConfig)) {
+		if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
+		if (key === "ai" && value !== null && typeof value === "object" && !Array.isArray(value) && result[key] !== null && typeof result[key] === "object" && !Array.isArray(result[key])) result[key] = mergeAIConfigObjects(result[key], value);
+		else if (value !== null && typeof value === "object" && !Array.isArray(value) && result[key] !== null && typeof result[key] === "object" && !Array.isArray(result[key])) result[key] = mergeExportedConfig(result[key], value);
+		else result[key] = value;
+	}
+	return result;
+}
+//#endregion
+//#region src/shared.ts
+function getConfig() {
+	return getLoadedConfig();
+}
+function resolveConfiguredApplicationRuntime() {
+	return resolveRuntimeLayers(getLoadedConfig());
+}
+function resolveEffectiveApplicationRuntime(config) {
+	if (!declaresRuntime(config ?? null) && !declaresRuntime(getRuntimeConfig())) return resolveApplicationRuntime({ profile: "local" });
+	return resolveRuntimeLayers(config ?? null);
+}
+function declaresRuntime(layer) {
+	return layer !== null && Object.hasOwn(layer, "runtime") && layer.runtime !== void 0;
+}
+function resolveRuntimeLayers(loadedConfig) {
+	const runtimeConfig = getRuntimeConfig();
+	const fileRuntime = loadedConfig && Object.hasOwn(loadedConfig, "runtime") ? loadedConfig.runtime : void 0;
+	const runtimeOverride = Object.hasOwn(runtimeConfig, "runtime") ? runtimeConfig.runtime : void 0;
+	for (const layer of [fileRuntime, runtimeOverride]) {
+		if (layer === void 0) continue;
+		const shapeIssues = validateApplicationRuntimeConfigShape(layer);
+		if (shapeIssues.length > 0) throw new RuntimeProfileValidationError([...shapeIssues]);
+	}
+	const fileHasProfile = fileRuntime !== void 0 && Object.hasOwn(fileRuntime, "profile");
+	const profileChanged = runtimeOverride !== void 0 && Object.hasOwn(runtimeOverride, "profile") && runtimeOverride.profile !== (fileHasProfile ? fileRuntime.profile : void 0);
+	if (profileChanged && fileHasProfile) resolveApplicationRuntime(fileRuntime);
+	const fileRuntimeWithoutProviders = { ...fileRuntime ?? {} };
+	delete fileRuntimeWithoutProviders.providers;
+	return resolveApplicationRuntime(mergeConfigs({}, profileChanged ? fileRuntimeWithoutProviders : fileRuntime ?? {}, runtimeOverride ?? {}));
+}
+function getSiteConfig() {
+	return (getLoadedConfig() || {}).site || null;
+}
+function getModuleConfig(moduleName, defaults) {
+	const fileConfig = getLoadedConfig() || {};
+	const runtime = getRuntimeConfig();
+	const globalConfig = fileConfig.smrt || {};
+	const moduleConfig = fileConfig.modules?.[moduleName] || {};
+	const runtimeModuleConfig = runtime.modules?.[moduleName] || {};
+	return mergeConfigs(mergeConfigs(mergeConfigs(defaults || {}, globalConfig, {}), moduleConfig, {}), runtimeModuleConfig, {});
+}
+function resolveCliDatabaseConfig(env = process.env) {
+	const declared = getPackageConfig("cli").database;
+	return resolveCliDatabase(declared, env);
+}
+function getPackageConfig(packageName, defaults) {
+	const fileConfig = getLoadedConfig() || {};
+	const runtime = getRuntimeConfig();
+	const globalConfig = fileConfig.smrt || {};
+	const packageConfig = fileConfig.packages?.[packageName] || {};
+	const runtimePackageConfig = runtime.packages?.[packageName] || {};
+	return mergeConfigs(mergeConfigs(mergeConfigs(defaults || {}, globalConfig, {}), packageConfig, {}), runtimePackageConfig, {});
+}
+function setConfig(config) {
+	setConfig$1(config);
+}
+function clearCache() {
+	setLoadedConfig(null);
+	clearConfigCache();
+	clearRuntimeConfig();
+}
+function defineConfig(config) {
+	return config;
+}
+function getAIConfigBlock() {
+	const file = getLoadedConfig();
+	const runtime = getRuntimeConfig();
+	return mergeAIConfigLayers([
+		file?.packages?.ai,
+		file?.ai,
+		runtime.packages?.ai,
+		runtime.ai
+	]);
+}
+function mergeAIConfigLayers(layers) {
+	const FIELDS = [
+		"model",
+		"baseUrl",
+		"apiKeyEnv",
+		"apiKey"
+	];
+	let provider;
+	const values = {};
+	const owners = {};
+	const text = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
+	for (const layer of layers) {
+		if (!layer || typeof layer !== "object") continue;
+		const rec = layer;
+		const named = text(rec.provider) ?? text(rec.type);
+		if (named && provider && named.toLowerCase() !== provider.toLowerCase()) for (const f of FIELDS) {
+			const owner = owners[f];
+			if (owner && owner.toLowerCase() !== named.toLowerCase()) {
+				delete values[f];
+				delete owners[f];
+			}
+		}
+		if (named) provider = named;
+		for (const f of FIELDS) {
+			const v = f === "model" ? text(rec.model) ?? text(rec.defaultModel) : text(rec[f]);
+			if (v) {
+				values[f] = v;
+				owners[f] = provider;
+			}
+		}
+	}
+	if (!provider && FIELDS.every((f) => !values[f])) return null;
+	const merged = { ...values };
+	if (provider) merged.provider = provider;
+	return merged;
+}
+function resolveConfiguredAIProvider(options = {}) {
+	return resolveAIProviderConfig({
+		...options,
+		config: options.config === void 0 ? getAIConfigBlock() : options.config
+	});
+}
+function tryResolveConfiguredAIProvider(options = {}) {
+	return tryResolveAIProviderConfig({
+		...options,
+		config: options.config === void 0 ? getAIConfigBlock() : options.config
+	});
+}
+//#endregion
+export { getDefaultAIKeyEnvName as A, setExplorer as B, getApplicationRuntimePreset as C, DEFAULT_AI_ENV_PREFIXES as D, AI_PROVIDER_KEY_ENV as E, tryResolveAIProviderConfig as F, withAIAliases as I, getCachedConfig as L, redactBaseUrl as M, resolveAIProviderConfig as N, canonicalizeAIConfig as O, toAIClientOptions as P, getExplorer as R, RuntimeProfileValidationError as S, AIProviderNotConfiguredError as T, setLoadedConfig as V, parseExportedConfig as _, getModuleConfig as a, getRuntimeConfig as b, mergeAIConfigLayers as c, resolveConfiguredApplicationRuntime as d, resolveEffectiveApplicationRuntime as f, mergeExportedConfig as g, exportConfig as h, getConfig as i, mergeAIConfigObjects as j, describeAIProviderConfig as k, resolveCliDatabaseConfig as l, tryResolveConfiguredAIProvider as m, defineConfig as n, getPackageConfig as o, setConfig as p, getAIConfigBlock as r, getSiteConfig as s, clearCache as t, resolveConfiguredAIProvider as u, sanitizeConfig as v, resolveApplicationRuntime as w, mergeConfigs as x, clearRuntimeConfig as y, setCachedConfig as z };
+
+//# sourceMappingURL=shared-B81TOCQq.js.map