@hexclave/shared 1.0.0

package/dist/config/schema.js

@@ -0,0 +1,1085 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BE-pF4vm.js');
+let yup = require("yup");
+yup = require_chunk.__toESM(yup);
+let ___utils_errors_js = require("../utils/errors.js");
+let ___utils_objects_js = require("../utils/objects.js");
+let ___apps_apps_config_js = require("../apps/apps-config.js");
+let ___utils_currency_constants_js = require("../utils/currency-constants.js");
+let ___utils_strings_js = require("../utils/strings.js");
+let __format_js = require("./format.js");
+let ___helpers_emails_js = require("../helpers/emails.js");
+let ___schema_fields_js = require("../schema-fields.js");
+___schema_fields_js = require_chunk.__toESM(___schema_fields_js);
+let ___utils_oauth_js = require("../utils/oauth.js");
+let ___utils_results_js = require("../utils/results.js");
+let ___utils_types_js = require("../utils/types.js");
+let __migrate_catalogs_to_product_lines_js = require("./migrate-catalogs-to-product-lines.js");
+
+//#region src/config/schema.ts
+const configLevels = [
+	"project",
+	"branch",
+	"environment",
+	"organization"
+];
+const permissionRegex = /^\$?[a-z0-9_:]+$/;
+const customPermissionRegex = /^[a-z0-9_:]+$/;
+function canNoLongerBeOverridden(schema, keys) {
+	return schema.concat((0, ___schema_fields_js.yupObject)(Object.fromEntries(keys.map((key) => [key, schema.getNested(key).meta({ stackConfigCanNoLongerBeOverridden: true })]))));
+}
+/**
+* All fields that can be overridden at this level.
+*/
+const projectConfigSchema = (0, ___schema_fields_js.yupObject)({
+	sourceOfTruth: (0, ___schema_fields_js.yupUnion)((0, ___schema_fields_js.yupObject)({ type: (0, ___schema_fields_js.yupString)().oneOf(["hosted"]).defined() })),
+	project: (0, ___schema_fields_js.yupObject)({ requirePublishableClientKey: (0, ___schema_fields_js.yupBoolean)() })
+});
+const branchRbacDefaultPermissions = (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.yupString)().matches(permissionRegex), (0, ___schema_fields_js.yupBoolean)().isTrue().optional());
+const branchRbacSchema = (0, ___schema_fields_js.yupObject)({
+	permissions: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.yupString)().matches(customPermissionRegex), (0, ___schema_fields_js.yupObject)({
+		description: (0, ___schema_fields_js.yupString)().optional(),
+		scope: (0, ___schema_fields_js.yupString)().oneOf(["team", "project"]).optional(),
+		containedPermissionIds: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.yupString)().matches(permissionRegex), (0, ___schema_fields_js.yupBoolean)().isTrue().optional()).optional()
+	}).optional()),
+	defaultPermissions: (0, ___schema_fields_js.yupObject)({
+		teamCreator: branchRbacDefaultPermissions,
+		teamMember: branchRbacDefaultPermissions,
+		signUp: branchRbacDefaultPermissions
+	})
+});
+const branchApiKeysSchema = (0, ___schema_fields_js.yupObject)({ enabled: (0, ___schema_fields_js.yupObject)({
+	team: (0, ___schema_fields_js.yupBoolean)(),
+	user: (0, ___schema_fields_js.yupBoolean)()
+}) });
+const appIds = Object.keys(___apps_apps_config_js.ALL_APPS);
+const branchAppsSchema = (0, ___schema_fields_js.yupObject)({ installed: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.yupString)().oneOf(appIds), (0, ___schema_fields_js.yupObject)({ enabled: (0, ___schema_fields_js.yupBoolean)() })) });
+const branchAuthSchema = (0, ___schema_fields_js.yupObject)({
+	allowSignUp: (0, ___schema_fields_js.yupBoolean)(),
+	password: (0, ___schema_fields_js.yupObject)({ allowSignIn: (0, ___schema_fields_js.yupBoolean)() }),
+	otp: (0, ___schema_fields_js.yupObject)({ allowSignIn: (0, ___schema_fields_js.yupBoolean)() }),
+	passkey: (0, ___schema_fields_js.yupObject)({ allowSignIn: (0, ___schema_fields_js.yupBoolean)() }),
+	oauth: (0, ___schema_fields_js.yupObject)({
+		accountMergeStrategy: (0, ___schema_fields_js.yupString)().oneOf([
+			"link_method",
+			"raise_error",
+			"allow_duplicates"
+		]).optional(),
+		providers: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.yupString)().matches(permissionRegex), (0, ___schema_fields_js.yupObject)({
+			type: (0, ___schema_fields_js.yupString)().oneOf(___utils_oauth_js.allProviders).optional(),
+			allowSignIn: (0, ___schema_fields_js.yupBoolean)(),
+			allowConnectedAccounts: (0, ___schema_fields_js.yupBoolean)()
+		}))
+	}),
+	signUpRules: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("signUpRuleId"), (0, ___schema_fields_js.yupObject)({
+		enabled: (0, ___schema_fields_js.yupBoolean)(),
+		displayName: (0, ___schema_fields_js.yupString)(),
+		priority: (0, ___schema_fields_js.yupNumber)().integer().min(0),
+		condition: (0, ___schema_fields_js.yupString)(),
+		action: (0, ___schema_fields_js.yupObject)({
+			type: (0, ___schema_fields_js.yupString)().oneOf([
+				"allow",
+				"reject",
+				"restrict",
+				"log"
+			]).defined(),
+			message: (0, ___schema_fields_js.yupString)().optional()
+		})
+	})),
+	signUpRulesDefaultAction: (0, ___schema_fields_js.yupString)().oneOf(["allow", "reject"])
+});
+const branchPaymentsSchema = (0, ___schema_fields_js.yupObject)({
+	blockNewPurchases: (0, ___schema_fields_js.yupBoolean)(),
+	autoPay: (0, ___schema_fields_js.yupObject)({ interval: ___schema_fields_js.dayIntervalSchema }).optional(),
+	productLines: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("productLineId"), (0, ___schema_fields_js.yupObject)({
+		displayName: (0, ___schema_fields_js.yupString)().optional(),
+		customerType: ___schema_fields_js.customerTypeSchema
+	})).meta({ openapiField: {
+		description: "The product lines that products can be in. All products in a product line (besides add-ons) are mutually exclusive.",
+		exampleValue: { "product-line-id": {
+			displayName: "My Product Line",
+			customerType: "user"
+		} }
+	} }),
+	products: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("productId"), ___schema_fields_js.productSchema),
+	items: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("itemId"), (0, ___schema_fields_js.yupObject)({
+		displayName: (0, ___schema_fields_js.yupString)().optional(),
+		customerType: ___schema_fields_js.customerTypeSchema
+	}))
+}).optional().test("product-customer-type-matches-product-line", "Product customer type must match its product line customer type", function(value) {
+	if (!value) return true;
+	const products = value.products;
+	if (!(0, ___utils_objects_js.isObjectLike)(products)) return true;
+	const productLines = value.productLines;
+	for (const [productId, product] of Object.entries(products)) {
+		if (!(0, ___utils_objects_js.isObjectLike)(product)) continue;
+		const productLineId = product.productLineId;
+		if (typeof productLineId !== "string" || productLineId.length === 0) continue;
+		const productLine = (0, ___utils_objects_js.isObjectLike)(productLines) ? (0, ___utils_objects_js.getOrUndefined)(productLines, productLineId) : void 0;
+		if (productLine === void 0) return this.createError({
+			message: `Product "${productId}" specifies product line ID "${productLineId}", but that product line does not exist`,
+			path: `${this.path}.products.${productId}.productLineId`
+		});
+		if (!(0, ___utils_objects_js.isObjectLike)(productLine)) continue;
+		if (product.customerType !== productLine.customerType) return this.createError({
+			message: `Product "${productId}" has customer type "${product.customerType}" but its product line "${productLineId}" has customer type "${productLine.customerType}"`,
+			path: `${this.path}.products.${productId}.customerType`
+		});
+	}
+	return true;
+});
+(void 0)?.test("branchPaymentsSchema accepts partial payments config without products", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ blockNewPurchases: true }, { abortEarly: false })).resolves.toMatchObject({ blockNewPurchases: true });
+});
+(void 0)?.test("branchPaymentsSchema accepts product lines without products", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ productLines: { pro: {
+		displayName: "Pro",
+		customerType: "user"
+	} } }, { abortEarly: false })).resolves.toMatchObject({ productLines: { pro: {
+		displayName: "Pro",
+		customerType: "user"
+	} } });
+});
+(void 0)?.test("branchPaymentsSchema rejects a product that references a missing product line", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ products: { pro: {
+		customerType: "user",
+		productLineId: "missing-line",
+		prices: {}
+	} } }, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: Product "pro" specifies product line ID "missing-line", but that product line does not exist]`);
+});
+(void 0)?.test("branchPaymentsSchema rejects null product entries without throwing a raw TypeError", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ products: { pro: null } }, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: products cannot be null]`);
+});
+(void 0)?.test("branchPaymentsSchema rejects null product line entries without throwing a raw TypeError", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({
+		productLines: { teamLine: null },
+		products: { pro: {
+			customerType: "user",
+			productLineId: "teamLine",
+			prices: {}
+		} }
+	}, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: productLines cannot be null]`);
+});
+(void 0)?.test("branchPaymentsSchema rejects a product whose customer type differs from its product line", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({
+		productLines: { teamLine: { customerType: "team" } },
+		products: { pro: {
+			customerType: "user",
+			productLineId: "teamLine",
+			prices: {}
+		} }
+	}, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: Product "pro" has customer type "user" but its product line "teamLine" has customer type "team"]`);
+});
+(void 0)?.test("branchPaymentsSchema lets productLineId schema reject empty IDs", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ products: { pro: {
+		customerType: "user",
+		productLineId: "",
+		prices: {}
+	} } }, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: productLineId must contain only letters, numbers, underscores, and hyphens, and not start with a hyphen]`);
+});
+const branchDomain = (0, ___schema_fields_js.yupObject)({});
+const branchOnboardingSchema = (0, ___schema_fields_js.yupObject)({ requireEmailVerification: (0, ___schema_fields_js.yupBoolean)() });
+const branchConfigSchema = canNoLongerBeOverridden(projectConfigSchema, ["sourceOfTruth", "project"]).concat((0, ___schema_fields_js.yupObject)({
+	rbac: branchRbacSchema,
+	teams: (0, ___schema_fields_js.yupObject)({
+		createPersonalTeamOnSignUp: (0, ___schema_fields_js.yupBoolean)(),
+		allowClientTeamCreation: (0, ___schema_fields_js.yupBoolean)()
+	}),
+	users: (0, ___schema_fields_js.yupObject)({ allowClientUserDeletion: (0, ___schema_fields_js.yupBoolean)() }),
+	onboarding: branchOnboardingSchema,
+	apiKeys: branchApiKeysSchema,
+	apps: branchAppsSchema,
+	domains: branchDomain,
+	auth: branchAuthSchema,
+	emails: (0, ___schema_fields_js.yupObject)({
+		selectedThemeId: ___schema_fields_js.emailThemeSchema,
+		themes: ___schema_fields_js.emailThemeListSchema,
+		templates: ___schema_fields_js.emailTemplateListSchema
+	}),
+	payments: branchPaymentsSchema,
+	dbSync: (0, ___schema_fields_js.yupObject)({ externalDatabases: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("externalDatabaseId"), (0, ___schema_fields_js.yupObject)({
+		type: (0, ___schema_fields_js.yupString)().oneOf(["postgres"]).defined(),
+		connectionString: (0, ___schema_fields_js.yupString)().when("type", {
+			is: "postgres",
+			then: (schema) => schema.defined(),
+			otherwise: (schema) => schema.optional()
+		})
+	})) }),
+	dataVault: (0, ___schema_fields_js.yupObject)({ stores: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("storeId"), (0, ___schema_fields_js.yupObject)({ displayName: (0, ___schema_fields_js.yupString)() })) })
+}));
+const environmentAnalyticsSchema = (0, ___schema_fields_js.yupObject)({ queryFolders: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("folderId"), (0, ___schema_fields_js.yupObject)({
+	displayName: (0, ___schema_fields_js.yupString)(),
+	sortOrder: (0, ___schema_fields_js.yupNumber)().optional(),
+	queries: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("queryId"), (0, ___schema_fields_js.yupObject)({
+		displayName: (0, ___schema_fields_js.yupString)(),
+		sqlQuery: (0, ___schema_fields_js.yupString)(),
+		description: (0, ___schema_fields_js.yupString)().optional()
+	}))
+})) });
+const environmentConfigSchema = branchConfigSchema.concat((0, ___schema_fields_js.yupObject)({
+	auth: branchConfigSchema.getNested("auth").concat((0, ___schema_fields_js.yupObject)({ oauth: branchConfigSchema.getNested("auth").getNested("oauth").concat((0, ___schema_fields_js.yupObject)({ providers: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.yupString)().matches(permissionRegex), (0, ___schema_fields_js.yupObject)({
+		type: (0, ___schema_fields_js.yupString)().oneOf(___utils_oauth_js.allProviders).optional(),
+		isShared: (0, ___schema_fields_js.yupBoolean)(),
+		clientId: ___schema_fields_js.oauthClientIdSchema.optional(),
+		clientSecret: ___schema_fields_js.oauthClientSecretSchema.optional(),
+		facebookConfigId: ___schema_fields_js.oauthFacebookConfigIdSchema.optional(),
+		microsoftTenantId: ___schema_fields_js.oauthMicrosoftTenantIdSchema.optional(),
+		appleBundles: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("appleBundleId"), (0, ___schema_fields_js.yupObject)({ bundleId: ___schema_fields_js.oauthAppleBundleIdSchema })).optional(),
+		allowSignIn: (0, ___schema_fields_js.yupBoolean)().optional(),
+		allowConnectedAccounts: (0, ___schema_fields_js.yupBoolean)().optional()
+	})) })) })),
+	emails: branchConfigSchema.getNested("emails").concat((0, ___schema_fields_js.yupObject)({ server: (0, ___schema_fields_js.yupObject)({
+		isShared: (0, ___schema_fields_js.yupBoolean)(),
+		provider: (0, ___schema_fields_js.yupString)().oneOf([
+			"resend",
+			"smtp",
+			"managed"
+		]).optional(),
+		host: ___schema_fields_js.emailHostSchema.optional().nonEmpty(),
+		port: ___schema_fields_js.emailPortSchema.optional(),
+		username: ___schema_fields_js.emailUsernameSchema.optional().nonEmpty(),
+		password: ___schema_fields_js.emailPasswordSchema.optional().nonEmpty().when(["provider", "isShared"], {
+			is: (provider, isShared) => provider === "managed" && isShared === false,
+			then: (schema) => schema.defined("Password is required when using managed email provider"),
+			otherwise: (schema) => schema.optional()
+		}),
+		senderName: ___schema_fields_js.emailSenderNameSchema.optional().nonEmpty(),
+		senderEmail: ___schema_fields_js.emailSenderEmailSchema.optional().nonEmpty(),
+		managedSubdomain: (0, ___schema_fields_js.yupString)().optional().nonEmpty().when(["provider", "isShared"], {
+			is: (provider, isShared) => provider === "managed" && isShared === false,
+			then: (schema) => schema.defined("Managed subdomain is required when using managed email provider"),
+			otherwise: (schema) => schema.optional()
+		}),
+		managedSenderLocalPart: (0, ___schema_fields_js.yupString)().optional().nonEmpty().when(["provider", "isShared"], {
+			is: (provider, isShared) => provider === "managed" && isShared === false,
+			then: (schema) => schema.defined("Managed sender local part is required when using managed email provider"),
+			otherwise: (schema) => schema.optional()
+		})
+	}) })),
+	domains: branchConfigSchema.getNested("domains").concat((0, ___schema_fields_js.yupObject)({
+		allowLocalhost: (0, ___schema_fields_js.yupBoolean)(),
+		trustedDomains: (0, ___schema_fields_js.yupRecord)((0, ___schema_fields_js.userSpecifiedIdSchema)("trustedDomainId"), (0, ___schema_fields_js.yupObject)({
+			baseUrl: ___schema_fields_js.wildcardUrlSchema.max(300),
+			handlerPath: ___schema_fields_js.handlerPathSchema.max(300)
+		}))
+	})),
+	payments: branchConfigSchema.getNested("payments").concat((0, ___schema_fields_js.yupObject)({ testMode: (0, ___schema_fields_js.yupBoolean)() })),
+	analytics: environmentAnalyticsSchema,
+	customDashboards: ___schema_fields_js.customDashboardsSchema
+}));
+const organizationConfigSchema = environmentConfigSchema.concat((0, ___schema_fields_js.yupObject)({}));
+function migrateConfigOverride(type, oldUnmigratedConfigOverride) {
+	const isBranchOrHigher = [
+		"branch",
+		"environment",
+		"organization"
+	].includes(type);
+	const isEnvironmentOrHigher = ["environment", "organization"].includes(type);
+	let res = oldUnmigratedConfigOverride;
+	if (isBranchOrHigher) res = renameProperty(res, "emails.theme", "selectedThemeId");
+	if (isEnvironmentOrHigher) res = mapProperty(res, (p) => p.join(".") === "domains.trustedDomains", (value) => {
+		if (Array.isArray(value)) return (0, ___utils_objects_js.typedFromEntries)(value.map((v, i) => [`${i}`, v]));
+		return value;
+	});
+	if (isBranchOrHigher) {
+		res = removeProperty(res, (p) => p.join(".") === "emails.themeList");
+		res = removeProperty(res, (p) => p.join(".") === "emails.templateList");
+	}
+	if (isBranchOrHigher) res = removeProperty(res, (p) => p.join(".") === "sourceOfTruth");
+	if (isBranchOrHigher) {
+		res = removeProperty(res, (p) => p.join(".") === "payments.stripeAccountId");
+		res = removeProperty(res, (p) => p.join(".") === "payments.stripeAccountSetupComplete");
+	}
+	if (isBranchOrHigher) res = removeProperty(res, (p) => p.length === 4 && p[0] === "payments" && p[1] === "items" && p[3] === "default");
+	if (isBranchOrHigher) res = renameProperty(res, "payments.offers", "products");
+	if (isBranchOrHigher) res = renameProperty(res, "payments.groups", "catalogs");
+	if (isBranchOrHigher) res = renameProperty(res, (p) => p.length === 4 && p[0] === "payments" && p[1] === "products" && p[3] === "groupId", (p) => "catalogId");
+	if (isBranchOrHigher) {
+		res = removeProperty(res, (p) => p[0] === "workflows");
+		res = removeProperty(res, (p) => p[0] === "apps" && p[1] === "installed" && p[2] === "workflows");
+	}
+	if (isBranchOrHigher) res = (0, __migrate_catalogs_to_product_lines_js.migrateCatalogsToProductLines)(res);
+	if (isBranchOrHigher) res = mapProperty(res, (p) => p.length >= 4 && p[0] === "payments" && p[1] === "products" && p[p.length - 1] === "prices", (value) => {
+		if (value === "include-by-default") return {};
+		return value;
+	});
+	if (type === "project") res = removeProperty(res, (p) => p[0] === "sourceOfTruth");
+	return res;
+}
+(void 0)?.test("migrateConfigOverride removes legacy sourceOfTruth overrides", ({ expect }) => {
+	expect(migrateConfigOverride("project", { sourceOfTruth: {
+		type: "neon",
+		connectionStrings: { main: "postgres://user:password@neon.example.com/database" }
+	} })).toEqual({});
+	expect(migrateConfigOverride("project", {
+		"sourceOfTruth.type": "postgres",
+		"sourceOfTruth.connectionString": "postgres://user:password@host:5432/database"
+	})).toEqual({});
+});
+function removeProperty(obj, pathCond) {
+	return mapProperty(obj, pathCond, () => void 0);
+}
+function mapProperty(obj, pathCond, mapper) {
+	const res = Array.isArray(obj) ? [] : {};
+	for (const [key, value] of (0, ___utils_objects_js.typedEntries)(obj)) {
+		const path = key.split(".");
+		if (pathCond(path)) {
+			const newValue = mapper(value);
+			if (newValue !== void 0) (0, ___utils_objects_js.set)(res, key, newValue);
+		} else if ((0, ___utils_objects_js.isObjectLike)(value)) (0, ___utils_objects_js.set)(res, key, mapProperty(value, (p) => pathCond([...path, ...p]), mapper));
+		else (0, ___utils_objects_js.set)(res, key, value);
+	}
+	return res;
+}
+(void 0)?.test("mapProperty - basic property mapping", ({ expect }) => {
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.join(".") === "a.b.c", (value) => value + 1)).toEqual({ a: { b: { c: 2 } } });
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.join(".") === "a.b.d", (value) => value + 1)).toEqual({ a: { b: { c: 1 } } });
+	expect(mapProperty({ x: 5 }, (p) => p.join(".") === "x", (value) => value * 2)).toEqual({ x: 10 });
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.join(".") === "b.c", (value) => value * 10)).toEqual({ a: { b: { c: 1 } } });
+	expect(mapProperty({ a: 1 }, (p) => p.join(".") === "b.c", (value) => value)).toEqual({ a: 1 });
+	expect(mapProperty({ "a.b": { c: 1 } }, (p) => p.join(".") === "a.b.c", (value) => value + 1)).toEqual({ "a.b": { c: 2 } });
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.length === 3 && p[0] === "a" && p[1] === "b", (value) => value + 1)).toEqual({ a: { b: { c: 2 } } });
+	const sentinelToEmpty = (v) => v === "include-by-default" ? {} : v;
+	const sentinelPred = (p) => p.length >= 4 && p[0] === "payments" && p[1] === "products" && p[p.length - 1] === "prices";
+	expect(mapProperty({ "payments.products.x.prices": "include-by-default" }, sentinelPred, sentinelToEmpty)).toEqual({ "payments.products.x.prices": {} });
+	expect(mapProperty({ payments: { products: { x: { prices: "include-by-default" } } } }, sentinelPred, sentinelToEmpty)).toEqual({ payments: { products: { x: { prices: {} } } } });
+	expect(mapProperty({ "payments.products": { x: { prices: "include-by-default" } } }, sentinelPred, sentinelToEmpty)).toEqual({ "payments.products": { x: { prices: {} } } });
+	expect(mapProperty({ "payments.products.my.product.prices": "include-by-default" }, sentinelPred, sentinelToEmpty)).toEqual({ "payments.products.my.product.prices": {} });
+});
+function renameProperty(obj, oldPath, newName) {
+	const pathCond = typeof oldPath === "function" ? oldPath : (p) => p.join(".") === oldPath;
+	const pathMapper = typeof newName === "function" ? newName : (p) => newName;
+	const res = Array.isArray(obj) ? [] : {};
+	for (const [key, originalValue] of (0, ___utils_objects_js.typedEntries)(obj)) {
+		const path = key.split(".");
+		for (let i = 0; i < path.length; i++) {
+			const pathPrefix = path.slice(0, i + 1);
+			if (pathCond(pathPrefix)) {
+				const name = pathMapper(pathPrefix);
+				if (name.includes(".")) throw new ___utils_errors_js.HexclaveAssertionError(`newName must not contain a dot. Provided: ${name}`);
+				path[i] = name;
+			}
+		}
+		const value = (0, ___utils_objects_js.isObjectLike)(originalValue) ? renameProperty(originalValue, (p) => pathCond([...path, ...p]), (p) => pathMapper([...path, ...p])) : originalValue;
+		(0, ___utils_objects_js.set)(res, path.join("."), value);
+	}
+	return res;
+}
+(void 0)?.test("renameProperty", ({ expect }) => {
+	expect(renameProperty({ a: 1 }, "a", "b")).toEqual({ b: 1 });
+	expect(renameProperty({ b: { c: 1 } }, "b.c", "d")).toEqual({ b: { d: 1 } });
+	expect(renameProperty({ a: { b: { c: 1 } } }, "a.b.c", "d")).toEqual({ a: { b: { d: 1 } } });
+	expect(renameProperty({ a: { b: { c: 1 } } }, "a.b.c.d", "e")).toEqual({ a: { b: { c: 1 } } });
+	expect(renameProperty({ a: {
+		b: { c: 1 },
+		"b.c": 2
+	} }, "b.c", "d")).toEqual({ a: {
+		b: { c: 1 },
+		"b.c": 2
+	} });
+	expect(renameProperty({ a: { "b.c.d": 2 } }, "a.b.c", "e")).toEqual({ a: { "b.e.d": 2 } });
+	expect(renameProperty({ a: {
+		b: { c: 1 },
+		"b.c": 2
+	} }, "a.b.c", "d")).toEqual({ a: {
+		b: { d: 1 },
+		"b.d": 2
+	} });
+	expect(renameProperty({ a: { b: {
+		c: 1,
+		d: 2
+	} } }, "a.b.c", "d")).toEqual({ a: { b: { d: 2 } } });
+	expect(renameProperty({ a: { b: {
+		d: 2,
+		c: 1
+	} } }, "a.b.c", "d")).toEqual({ a: { b: { d: 1 } } });
+	expect(renameProperty({ a: 1 }, (p) => p.length === 1 && p[0] === "a", (p) => "b")).toEqual({ b: 1 });
+	expect(renameProperty({ a: { b: { c: 1 } } }, (p) => p.length === 3 && p[0] === "a" && p[1] === "b" && p[2] === "c", (p) => "d")).toEqual({ a: { b: { d: 1 } } });
+	expect(renameProperty({ a: { b: { c: 1 } } }, (p) => false, (p) => "e")).toEqual({ a: { b: { c: 1 } } });
+	expect(renameProperty({ a: { b: { a: 1 } } }, (p) => p[p.length - 1] === "a", (p) => "c")).toEqual({ c: { b: { c: 1 } } });
+	expect(() => renameProperty({ a: 1 }, "a", "b.c")).toThrow();
+});
+const projectConfigDefaults = {
+	sourceOfTruth: { type: "hosted" },
+	project: { requirePublishableClientKey: false }
+};
+const branchConfigDefaults = {};
+const environmentConfigDefaults = {};
+const organizationConfigDefaults = {
+	rbac: {
+		permissions: (key) => ({
+			containedPermissionIds: (key) => void 0,
+			description: void 0,
+			scope: void 0
+		}),
+		defaultPermissions: {
+			teamCreator: (key) => void 0,
+			teamMember: (key) => void 0,
+			signUp: (key) => void 0
+		}
+	},
+	apiKeys: { enabled: {
+		team: false,
+		user: false
+	} },
+	apps: { installed: (0, ___utils_objects_js.typedFromEntries)(appIds.map((appId) => [appId, { enabled: false }])) },
+	teams: {
+		createPersonalTeamOnSignUp: false,
+		allowClientTeamCreation: false
+	},
+	users: { allowClientUserDeletion: false },
+	onboarding: { requireEmailVerification: false },
+	domains: {
+		allowLocalhost: false,
+		trustedDomains: (key) => ({
+			baseUrl: void 0,
+			handlerPath: "/handler"
+		})
+	},
+	auth: {
+		allowSignUp: true,
+		password: { allowSignIn: false },
+		otp: { allowSignIn: false },
+		passkey: { allowSignIn: false },
+		oauth: {
+			accountMergeStrategy: "link_method",
+			providers: (key) => ({
+				type: void 0,
+				isShared: true,
+				allowSignIn: false,
+				allowConnectedAccounts: false,
+				clientId: void 0,
+				clientSecret: void 0,
+				facebookConfigId: void 0,
+				microsoftTenantId: void 0,
+				appleBundles: void 0
+			})
+		},
+		signUpRules: (key) => ({
+			enabled: false,
+			displayName: void 0,
+			priority: 0,
+			condition: void 0,
+			action: {
+				type: "allow",
+				message: void 0
+			}
+		}),
+		signUpRulesDefaultAction: "allow"
+	},
+	emails: {
+		server: {
+			isShared: true,
+			provider: "smtp",
+			host: void 0,
+			port: void 0,
+			username: void 0,
+			password: void 0,
+			senderName: void 0,
+			senderEmail: void 0,
+			managedSubdomain: void 0,
+			managedSenderLocalPart: void 0
+		},
+		selectedThemeId: ___helpers_emails_js.DEFAULT_EMAIL_THEME_ID,
+		themes: (0, ___utils_objects_js.typedAssign)((key) => ({
+			displayName: "Unnamed Theme",
+			tsxSource: "Error: Theme config is missing TypeScript source code."
+		}), ___helpers_emails_js.DEFAULT_EMAIL_THEMES),
+		templates: (0, ___utils_objects_js.typedAssign)((key) => ({
+			displayName: "Unnamed Template",
+			tsxSource: "Error: Template config is missing TypeScript source code.",
+			themeId: void 0
+		}), ___helpers_emails_js.DEFAULT_EMAIL_TEMPLATES)
+	},
+	payments: {
+		blockNewPurchases: false,
+		testMode: true,
+		autoPay: void 0,
+		productLines: (key) => ({
+			displayName: void 0,
+			customerType: void 0
+		}),
+		products: (key) => ({
+			displayName: key,
+			productLineId: void 0,
+			customerType: "user",
+			freeTrial: void 0,
+			serverOnly: false,
+			stackable: void 0,
+			isAddOnTo: false,
+			prices: (key) => ({
+				...(0, ___utils_objects_js.typedFromEntries)(___utils_currency_constants_js.SUPPORTED_CURRENCIES.map((currency) => [currency.code, void 0])),
+				interval: void 0,
+				serverOnly: false,
+				freeTrial: void 0
+			}),
+			includedItems: (key) => ({
+				quantity: 0,
+				repeat: "never",
+				expires: "when-repeated"
+			})
+		}),
+		items: (key) => ({
+			displayName: key,
+			customerType: "user"
+		})
+	},
+	dbSync: { externalDatabases: (key) => ({
+		type: void 0,
+		connectionString: void 0
+	}) },
+	dataVault: { stores: (key) => ({ displayName: "Unnamed Vault" }) },
+	analytics: { queryFolders: (key) => ({
+		displayName: "Unnamed Folder",
+		sortOrder: 0,
+		queries: (queryKey) => ({
+			displayName: "Unnamed Query",
+			sqlQuery: "",
+			description: void 0
+		})
+	}) },
+	customDashboards: (key) => ({
+		displayName: "Unnamed Dashboard",
+		tsxSource: "Error: Dashboard config is missing source code."
+	})
+};
+(0, ___utils_types_js.typeAssertIs)()();
+(0, ___utils_types_js.typeAssertIs)()();
+function deepReplaceFunctionsWithObjects(obj, paths = []) {
+	const subPaths = (key) => {
+		return paths.filter((p) => p.split(".").length > 1 && p.split(".")[0] === key).map((p) => p.split(".").slice(1).join("."));
+	};
+	const currentPaths = [...new Set(paths.map((p) => p.split(".")[0]))];
+	return (0, ___utils_objects_js.mapValues)({
+		...typeof obj === "function" ? (0, ___utils_objects_js.filterUndefined)(Object.fromEntries(currentPaths.map((k) => [k, obj(k)]))) : {},
+		...obj
+	}, (v, k) => (0, ___utils_objects_js.isObjectLike)(v) ? deepReplaceFunctionsWithObjects(v, subPaths(k)) : v);
+}
+(void 0)?.test("deepReplaceFunctionsWithObjects", ({ expect }) => {
+	expect(deepReplaceFunctionsWithObjects(() => {})).toEqual({});
+	expect(deepReplaceFunctionsWithObjects({ a: 3 })).toEqual({ a: 3 });
+	expect(deepReplaceFunctionsWithObjects({ a: () => ({ b: 1 }) })).toEqual({ a: {} });
+	expect(deepReplaceFunctionsWithObjects({ a: () => ({ b: 1 }) }, ["a.c.d"])).toEqual({ a: { c: { b: 1 } } });
+	expect(deepReplaceFunctionsWithObjects(() => ({ b: 1 }), ["a"])).toEqual({ a: { b: 1 } });
+	expect(deepReplaceFunctionsWithObjects({ a: (0, ___utils_objects_js.typedAssign)(() => ({}), { b: { c: 1 } }) })).toEqual({ a: { b: { c: 1 } } });
+});
+function applyDefaults(defaults, config) {
+	const res = deepReplaceFunctionsWithObjects(defaults);
+	outer: for (const [key, mergeValue] of Object.entries(config)) if (!(0, ___utils_objects_js.isObjectLike)(mergeValue) && mergeValue !== null) (0, ___utils_objects_js.set)(res, key, mergeValue);
+	else {
+		const keyParts = key.split(".");
+		let baseValue = defaults;
+		let lastWasFunction = false;
+		for (const [index, part] of keyParts.entries()) {
+			if (!(0, ___utils_objects_js.isObjectLike)(baseValue)) {
+				(0, ___utils_objects_js.set)(res, key, mergeValue ?? null);
+				continue outer;
+			}
+			lastWasFunction = false;
+			baseValue = (0, ___utils_objects_js.has)(baseValue, part) ? (0, ___utils_objects_js.get)(baseValue, part) : typeof baseValue === "function" ? (lastWasFunction = true, baseValue)(part) : void 0;
+		}
+		if (lastWasFunction && mergeValue == null) (0, ___utils_objects_js.set)(res, key, null);
+		else if (!(0, ___utils_objects_js.isObjectLike)(baseValue)) (0, ___utils_objects_js.set)(res, key, mergeValue ?? baseValue ?? null);
+		else (0, ___utils_objects_js.set)(res, key, applyDefaults(baseValue, mergeValue ?? {}));
+	}
+	return res;
+}
+(void 0)?.test("applyDefaults", ({ expect }) => {
+	expect(applyDefaults({ a: 1 }, { a: 2 })).toEqual({ a: 2 });
+	expect(applyDefaults({ a: 1 }, { a: null })).toEqual({ a: 1 });
+	expect(applyDefaults({}, { a: 1 })).toEqual({ a: 1 });
+	expect(applyDefaults({ a: { b: 1 } }, { a: { b: 2 } })).toEqual({ a: { b: 2 } });
+	expect(applyDefaults({ a: { b: 1 } }, { a: { c: 2 } })).toEqual({ a: {
+		b: 1,
+		c: 2
+	} });
+	expect(applyDefaults({ a: { b: {
+		c: 1,
+		d: 2
+	} } }, { a: { b: {
+		d: 3,
+		e: 4
+	} } })).toEqual({ a: { b: {
+		c: 1,
+		d: 3,
+		e: 4
+	} } });
+	expect(applyDefaults((key) => ({ b: key }), { a: {} })).toEqual({ a: { b: "a" } });
+	expect(applyDefaults((key) => ({ b: key }), { a: null })).toEqual({ a: null });
+	expect(applyDefaults((key1) => (key2) => ({
+		a: key1,
+		b: key2
+	}), { c: { d: {} } })).toEqual({ c: { d: {
+		a: "c",
+		b: "d"
+	} } });
+	expect(applyDefaults({ a: (key) => ({ b: key }) }, { a: { c: { d: 1 } } })).toEqual({ a: { c: {
+		b: "c",
+		d: 1
+	} } });
+	expect(applyDefaults({ a: (key) => ({ b: key }) }, {})).toEqual({ a: {} });
+	expect(applyDefaults({ a: (key) => ({ b: key }) }, { a: null })).toEqual({ a: {} });
+	expect(applyDefaults({ a: (key) => ({ c: key }) }, { a: { b: null } })).toEqual({ a: { b: null } });
+	expect(applyDefaults({ a: { b: (key) => ({ b: key }) } }, {})).toEqual({ a: { b: {} } });
+	expect(applyDefaults((0, ___utils_objects_js.typedAssign)(() => ({ b: 1 }), { a: {
+		b: 1,
+		c: 2
+	} }), { a: {} })).toEqual({ a: {
+		b: 1,
+		c: 2
+	} });
+	expect(applyDefaults((0, ___utils_objects_js.typedAssign)(() => ({ b: 1 }), { a: {
+		b: 1,
+		c: 2
+	} }), { d: {} })).toEqual({
+		a: {
+			b: 1,
+			c: 2
+		},
+		d: { b: 1 }
+	});
+	expect(applyDefaults({ a: { b: 1 } }, { "a.c": 2 })).toEqual({
+		a: { b: 1 },
+		"a.c": 2
+	});
+	expect(applyDefaults({ a: { b: 1 } }, { "a.c": null })).toEqual({
+		a: { b: 1 },
+		"a.c": null
+	});
+	expect(applyDefaults({ a: { b: 1 } }, {
+		a: { b: 2 },
+		"a.b": null
+	})).toEqual({
+		a: { b: 2 },
+		"a.b": 1
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, {
+		a: { b: { c: 2 } },
+		"a.b.c": null
+	})).toEqual({
+		a: { b: { c: 2 } },
+		"a.b.c": 1
+	});
+	expect(applyDefaults({}, {
+		a: { b: 2 },
+		"a.b": null
+	})).toEqual({
+		a: { b: 2 },
+		"a.b": null
+	});
+	expect(applyDefaults({ a: {
+		b: 1,
+		c: 2
+	} }, { "a.c": null })).toEqual({
+		a: {
+			b: 1,
+			c: 2
+		},
+		"a.c": 2
+	});
+	expect(applyDefaults({ a: {
+		b: 1,
+		c: () => {}
+	} }, { "a.c": null })).toEqual({
+		a: {
+			b: 1,
+			c: {}
+		},
+		"a.c": {}
+	});
+	expect(applyDefaults({ a: {
+		b: 1,
+		c: () => {}
+	} }, { "a.c.d": null })).toEqual({
+		a: {
+			b: 1,
+			c: {}
+		},
+		"a.c.d": null
+	});
+	expect(applyDefaults({ a: { b: 1 } }, { "a.b": null })).toEqual({
+		a: { b: 1 },
+		"a.b": 1
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, { "a.b": null })).toEqual({
+		a: { b: { c: 1 } },
+		"a.b": { c: 1 }
+	});
+	expect(applyDefaults({ a: {} }, { "a.b": null })).toEqual({
+		a: {},
+		"a.b": null
+	});
+	expect(applyDefaults({ a: {} }, {
+		"a": { b: 1 },
+		"a.b": null
+	})).toEqual({
+		a: { b: 1 },
+		"a.b": null
+	});
+	expect(applyDefaults({ a: 1 }, { "a.b": null })).toEqual({
+		a: 1,
+		"a.b": null
+	});
+	expect(applyDefaults({ a: 1 }, { "a.b": 2 })).toEqual({
+		a: 1,
+		"a.b": 2
+	});
+	expect(applyDefaults({ a: null }, { "a.b": 2 })).toEqual({
+		a: null,
+		"a.b": 2
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, { "a.b": { d: 2 } })).toEqual({
+		a: { b: { c: 1 } },
+		"a.b": {
+			c: 1,
+			d: 2
+		}
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, { "a.b": null })).toEqual({
+		a: { b: { c: 1 } },
+		"a.b": { c: 1 }
+	});
+	expect(applyDefaults({ a: { b: { c: { d: 1 } } } }, { "a.b.c": {} })).toEqual({
+		a: { b: { c: { d: 1 } } },
+		"a.b.c": { d: 1 }
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, { "a.b": { d: 2 } })).toEqual({
+		a: {},
+		"a.b": {
+			c: 1,
+			d: 2
+		}
+	});
+	expect(applyDefaults({ a: () => () => ({ d: 1 }) }, { "a.b": null })).toEqual({
+		a: {},
+		"a.b": null
+	});
+	expect(applyDefaults({ a: () => () => ({ d: 1 }) }, { "a.b.c": {} })).toEqual({
+		a: {},
+		"a.b.c": { d: 1 }
+	});
+	expect(applyDefaults({ a: { b: () => ({
+		c: 1,
+		d: 2
+	}) } }, { "a.b.x-y.c": 3 })).toEqual({
+		a: { b: {} },
+		"a.b.x-y.c": 3
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, { "a.b.d": 2 })).toEqual({
+		a: {},
+		"a.b.d": 2
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b.d": 2,
+		"a.e.d": 3
+	})).toEqual({
+		a: {},
+		"a.b.d": 2,
+		"a.e.d": 3
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b.d": 2,
+		a: { b: { d: 3 } }
+	})).toEqual({
+		a: { b: {
+			c: 1,
+			d: 3
+		} },
+		"a.b.d": 2
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b.d": 2,
+		a: { e: { d: 3 } }
+	})).toEqual({
+		a: { e: {
+			c: 1,
+			d: 3
+		} },
+		"a.b.d": 2
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b": { d: { e: 2 } },
+		"a.b.d": null
+	})).toEqual({
+		a: {},
+		"a.b": {
+			c: 1,
+			d: { e: 2 }
+		},
+		"a.b.d": null
+	});
+});
+function applyProjectDefaults(config) {
+	return applyDefaults(projectConfigDefaults, config);
+}
+function applyBranchDefaults(config) {
+	return applyDefaults(branchConfigDefaults, applyDefaults(projectConfigDefaults, config));
+}
+function applyEnvironmentDefaults(config) {
+	return applyDefaults(environmentConfigDefaults, applyDefaults(branchConfigDefaults, applyDefaults(projectConfigDefaults, config)));
+}
+function applyOrganizationDefaults(config) {
+	return applyDefaults(organizationConfigDefaults, applyDefaults(environmentConfigDefaults, applyDefaults(branchConfigDefaults, applyDefaults(projectConfigDefaults, config))));
+}
+async function sanitizeProjectConfig(config) {
+	(0, __format_js.assertNormalized)(config);
+	return {
+		...config,
+		sourceOfTruth: { type: "hosted" }
+	};
+}
+async function sanitizeBranchConfig(config) {
+	(0, __format_js.assertNormalized)(config);
+	return { ...await sanitizeProjectConfig(config) };
+}
+async function sanitizeEnvironmentConfig(config) {
+	(0, __format_js.assertNormalized)(config);
+	return { ...await sanitizeBranchConfig(config) };
+}
+async function sanitizeOrganizationConfig(config) {
+	(0, __format_js.assertNormalized)(config);
+	const prepared = await sanitizeEnvironmentConfig(config);
+	const themes = prepared.emails.themes;
+	const templates = config.emails.server.isShared ? ___helpers_emails_js.DEFAULT_EMAIL_TEMPLATES : prepared.emails.templates;
+	const products = (0, ___utils_objects_js.typedFromEntries)((0, ___utils_objects_js.typedEntries)(prepared.payments.products).map(([key, product]) => {
+		const isAddOnTo = product.isAddOnTo === false ? false : (0, ___utils_objects_js.typedFromEntries)(Object.keys(product.isAddOnTo).map((key) => [key, true]));
+		const prices = (0, ___utils_objects_js.typedFromEntries)((0, ___utils_objects_js.typedEntries)(product.prices).map(([key, value]) => {
+			return [key, { ...value }];
+		}));
+		return [key, {
+			...product,
+			isAddOnTo,
+			prices
+		}];
+	}));
+	const appSortIndices = new Map(Object.keys(___apps_apps_config_js.ALL_APPS).map((appId, index) => [appId, index]));
+	const sortedRuleEntries = (0, ___utils_objects_js.typedEntries)(prepared.auth.signUpRules).sort((a, b) => {
+		const priorityA = a[1].priority;
+		const priorityB = b[1].priority;
+		if (priorityA !== priorityB) return priorityB - priorityA;
+		return (0, ___utils_strings_js.stringCompare)(a[0], b[0]);
+	});
+	return {
+		...prepared,
+		auth: {
+			...prepared.auth,
+			oauth: {
+				...prepared.auth.oauth,
+				providers: (0, ___utils_objects_js.typedFromEntries)((0, ___utils_objects_js.typedEntries)(prepared.auth.oauth.providers).filter(([key, value]) => value.type !== void 0))
+			},
+			signUpRules: (0, ___utils_objects_js.typedFromEntries)(sortedRuleEntries)
+		},
+		emails: {
+			...prepared.emails,
+			selectedThemeId: (0, ___utils_objects_js.has)(themes, prepared.emails.selectedThemeId) ? prepared.emails.selectedThemeId : ___helpers_emails_js.DEFAULT_EMAIL_THEME_ID,
+			themes,
+			templates
+		},
+		payments: {
+			...prepared.payments,
+			products
+		},
+		apps: { installed: (0, ___utils_objects_js.typedFromEntries)((0, ___utils_objects_js.typedEntries)(prepared.apps.installed).sort(([a], [b]) => appSortIndices.get(a) - appSortIndices.get(b))) }
+	};
+}
+/**
+* Does not require a base config, and hence solely relies on the override itself to validate the config. If it returns
+* no error, you know that the
+*
+* It's crucial that our DB never contains any configs that are not valid according to this function, as this would mean
+* that the config object does not satisfy the ValidatedToHaveNoConfigOverrideErrors type (which is used as an assumption
+* in a whole bunch of places in the code).
+*/
+async function getConfigOverrideErrors(schema, configOverride, options = {}) {
+	if (typeof configOverride !== "object" || configOverride === null) return ___utils_results_js.Result.error("Config override must be a non-null object.");
+	if (Object.getPrototypeOf(configOverride) !== Object.getPrototypeOf({})) return ___utils_results_js.Result.error("Config override must be plain old JavaScript object.");
+	const ensureNoDotsInKeys = (obj) => {
+		if (typeof obj !== "object" || obj === null) return;
+		for (const entry of Object.entries(obj)) {
+			if (entry[0].includes(".")) return ___utils_results_js.Result.error(`Key ${entry[0]} contains a dot, which is not allowed in config override.`);
+			const result = ensureNoDotsInKeys(entry[1]);
+			if (result) return result;
+		}
+	};
+	for (const key of Object.keys(configOverride)) {
+		const result = ensureNoDotsInKeys(configOverride[key]);
+		if (result) return result;
+	}
+	const reason = (0, __format_js.getInvalidConfigReason)(configOverride, { configName: "override" });
+	if (reason) return ___utils_results_js.Result.error("Invalid config format: " + reason);
+	const getSubSchema = (schema, key) => {
+		const keyParts = key.split(".");
+		if (!schema.hasNested(keyParts[0])) return;
+		const nestedSchema = schema.getNested(keyParts[0]);
+		if (nestedSchema.meta()?.stackConfigCanNoLongerBeOverridden && !options.allowPropertiesThatCanNoLongerBeOverridden) return;
+		if (keyParts.length === 1) return nestedSchema;
+		else return getSubSchema(nestedSchema, keyParts.slice(1).join("."));
+	};
+	const getRestrictedSchemaBase = (path, schema) => {
+		const schemaInfo = schema.meta()?.stackSchemaInfo;
+		switch (schemaInfo?.type) {
+			case "string": {
+				const description = schema.describe();
+				let res = (0, ___schema_fields_js.yupString)();
+				if (description.tests.some((t) => t.name === "uuid")) res = res.uuid();
+				return res;
+			}
+			case "number": return (0, ___schema_fields_js.yupNumber)();
+			case "boolean": return (0, ___schema_fields_js.yupBoolean)();
+			case "date": return (0, ___schema_fields_js.yupDate)();
+			case "mixed": return (0, ___schema_fields_js.yupMixed)();
+			case "array": throw new ___utils_errors_js.HexclaveAssertionError(`Arrays are not supported in config JSON files (besides tuples). Use a record instead.`, {
+				schemaInfo,
+				schema
+			});
+			case "tuple": return (0, ___schema_fields_js.yupTuple)(schemaInfo.items.map((s, index) => getRestrictedSchema(path + `[${index}]`, s)));
+			case "union": {
+				const schemas = schemaInfo.items;
+				const nonObjectSchemas = [...schemas.entries()].filter(([index, s]) => s.meta()?.stackSchemaInfo?.type !== "object");
+				const objectSchemas = schemas.filter((s) => s.meta()?.stackSchemaInfo?.type === "object");
+				const allObjectSchemaKeys = [...new Set(objectSchemas.flatMap((s) => Object.keys(s.fields)))];
+				const mergedObjectSchema = (0, ___schema_fields_js.yupObject)(Object.fromEntries(allObjectSchemaKeys.map((key) => [key, (0, ___schema_fields_js.yupUnion)(...objectSchemas.flatMap((s, index) => s.hasNested(key) ? [s.getNested(key)] : []))])));
+				return (0, ___schema_fields_js.yupUnion)(...nonObjectSchemas.map(([index, s]) => getRestrictedSchema(path + `|variant-${index}|`, s)), ...objectSchemas.length > 0 ? [getRestrictedSchema(path + (nonObjectSchemas.length > 0 ? `|variant|` : ""), mergedObjectSchema)] : []);
+			}
+			case "record": return (0, ___schema_fields_js.yupRecord)(getRestrictedSchema(path + ".key", schemaInfo.keySchema), getRestrictedSchema(path + ".value", schemaInfo.valueSchema));
+			case "object": {
+				const objectSchema = schema;
+				return (0, ___schema_fields_js.yupObject)(Object.fromEntries(Object.entries(objectSchema.fields).map(([key, value]) => [key, getRestrictedSchema(path + "." + key, value)])));
+			}
+			case "never": return (0, ___schema_fields_js.yupNever)();
+			default: throw new ___utils_errors_js.HexclaveAssertionError(`Unknown schema info at path ${path}: ${JSON.stringify(schemaInfo)}`, {
+				schemaInfo,
+				schema
+			});
+		}
+	};
+	const getRestrictedSchema = (path, schema) => {
+		let restricted = getRestrictedSchemaBase(path, schema);
+		restricted = restricted.nullable();
+		const description = schema.describe();
+		if (description.oneOf.length > 0) restricted = restricted.oneOf(description.oneOf);
+		if (description.notOneOf.length > 0) restricted = restricted.notOneOf(description.notOneOf);
+		return restricted;
+	};
+	for (const [key, value] of Object.entries(configOverride)) {
+		if (value === void 0) continue;
+		if (/^payments\.products\.[^.]+\.prices$/.test(key) && value === "include-by-default") return ___utils_results_js.Result.error(`${key} must not be one of the following values: include-by-default`);
+		const subSchema = getSubSchema(schema, key);
+		if (!subSchema) {
+			const keySplit = key.split(".");
+			for (let i = 0; i < keySplit.length; i++) {
+				const prefix = keySplit.slice(0, i + 1).join(".");
+				if (!getSubSchema(schema, prefix)) return ___utils_results_js.Result.error(`The key ${JSON.stringify(key)} is not valid (nested object not found in schema: ${JSON.stringify(prefix)}).`);
+			}
+			throw new ___utils_errors_js.HexclaveAssertionError("Something weird happened? Sub-schema for key is invalid but no prefix is invalid??", {
+				key,
+				subSchema
+			});
+		}
+		let restrictedSchema = getRestrictedSchema(key, subSchema);
+		try {
+			await restrictedSchema.validate(value, {
+				strict: true,
+				path: key,
+				context: { noUnknownPathPrefixes: [""] }
+			});
+		} catch (error) {
+			if (error instanceof yup.ValidationError) return ___utils_results_js.Result.error(error.message);
+			throw error;
+		}
+	}
+	return ___utils_results_js.Result.ok(null);
+}
+async function assertNoConfigOverrideErrors(schema, config, options = {}) {
+	const res = await getConfigOverrideErrors(schema, config, options);
+	if (res.status === "error") throw new ___utils_errors_js.HexclaveAssertionError(`Config override is invalid — at a place where it should have already been validated! ${res.error}`, {
+		options,
+		config
+	});
+}
+(0, ___utils_types_js.typeAssertIs)()();
+(0, ___utils_types_js.typeAssertExtends)()();
+(0, ___utils_types_js.typeAssertExtends)()();
+/**
+* Checks whether there are any warnings in the incomplete config. A warning doesn't stop the config from being valid,
+* but may require action regardless.
+*
+* The DB can contain configs that are not valid according to this function, as long as they are valid according to
+* the getConfigOverrideErrors function. (This is necessary, because a changing base config may make an override invalid
+* that was previously valid.)
+*/
+async function getIncompleteConfigWarnings(schema, incompleteConfig) {
+	const overrideErrors = await getConfigOverrideErrors(schema, incompleteConfig, { allowPropertiesThatCanNoLongerBeOverridden: true });
+	if (overrideErrors.status === "error") return overrideErrors;
+	const withDefaults = applyDefaults(organizationConfigDefaults, applyDefaults(projectConfigDefaults, incompleteConfig));
+	const droppedKeys = [];
+	const normalizedWithDefaults = (0, __format_js.normalize)(withDefaults, {
+		onDotIntoNonObject: "ignore",
+		droppedKeys
+	});
+	const incompleteConfigDotKeys = new Set(Object.keys(incompleteConfig).filter((k) => k.includes(".") && incompleteConfig[k] !== void 0));
+	const relevantDroppedKeys = droppedKeys.filter((k) => incompleteConfigDotKeys.has(k));
+	if (relevantDroppedKeys.length > 0) {
+		const messages = relevantDroppedKeys.map((key) => {
+			const segments = key.split(".");
+			let current = normalizedWithDefaults;
+			let lastExistingIdx = -1;
+			for (let i = 0; i < segments.length - 1; i++) if (current != null && typeof current === "object" && !Array.isArray(current) && segments[i] in current) {
+				current = current[segments[i]];
+				lastExistingIdx = i;
+			} else break;
+			const nonExistentParent = segments.slice(0, lastExistingIdx + 2).join(".");
+			const remainingSegments = segments.slice(lastExistingIdx + 2);
+			let suggestion = "...";
+			for (let i = remainingSegments.length - 1; i >= 0; i--) suggestion = `{ ${JSON.stringify(remainingSegments[i])}: ${suggestion} }`;
+			suggestion = `{ ${JSON.stringify(nonExistentParent)}: ${suggestion} }`;
+			return `Dot-notation key ${JSON.stringify(key)} will be silently ignored because it references non-existent parent ${JSON.stringify(nonExistentParent)}. Instead of dot notation, use nested object notation like this: ${suggestion}`;
+		});
+		return ___utils_results_js.Result.error(messages.join("\n"));
+	}
+	let normalized;
+	try {
+		normalized = (0, __format_js.normalize)(incompleteConfig, { onDotIntoNull: "empty-object" });
+	} catch (error) {
+		if (error instanceof __format_js.NormalizationError) return ___utils_results_js.Result.error(`Config is not normalizable. ` + error.message);
+		throw error;
+	}
+	try {
+		await schema.validate(normalized, {
+			strict: true,
+			context: { noUnknownPathPrefixes: [""] }
+		});
+		return ___utils_results_js.Result.ok(null);
+	} catch (error) {
+		if (error instanceof yup.ValidationError) return ___utils_results_js.Result.error(error.message);
+		throw error;
+	}
+}
+(0, ___utils_types_js.typeAssertExtends)()();
+(0, ___utils_types_js.typeAssertExtends)()();
+(0, ___utils_types_js.typeAssertExtends)()();
+(0, ___utils_types_js.typeAssertExtends)()();
+(0, ___utils_types_js.typeAssert)()();
+(0, ___utils_types_js.typeAssert)()();
+(0, ___utils_types_js.typeAssertExtends)()();
+
+//#endregion
+exports.applyBranchDefaults = applyBranchDefaults;
+exports.applyEnvironmentDefaults = applyEnvironmentDefaults;
+exports.applyOrganizationDefaults = applyOrganizationDefaults;
+exports.applyProjectDefaults = applyProjectDefaults;
+exports.assertNoConfigOverrideErrors = assertNoConfigOverrideErrors;
+exports.branchConfigSchema = branchConfigSchema;
+exports.branchPaymentsSchema = branchPaymentsSchema;
+exports.configLevels = configLevels;
+exports.environmentConfigSchema = environmentConfigSchema;
+exports.getConfigOverrideErrors = getConfigOverrideErrors;
+exports.getIncompleteConfigWarnings = getIncompleteConfigWarnings;
+exports.migrateConfigOverride = migrateConfigOverride;
+exports.organizationConfigSchema = organizationConfigSchema;
+exports.projectConfigSchema = projectConfigSchema;
+exports.sanitizeBranchConfig = sanitizeBranchConfig;
+exports.sanitizeEnvironmentConfig = sanitizeEnvironmentConfig;
+exports.sanitizeOrganizationConfig = sanitizeOrganizationConfig;
+exports.sanitizeProjectConfig = sanitizeProjectConfig;
+//# sourceMappingURL=schema.js.map