@hexclave/shared 1.0.0

package/dist/esm/config/schema.js

@@ -0,0 +1,1065 @@
+import * as yup$1 from "yup";
+import { HexclaveAssertionError } from "../utils/errors.js";
+import { filterUndefined, get, getOrUndefined, has, isObjectLike, mapValues, set, typedAssign, typedEntries, typedFromEntries } from "../utils/objects.js";
+import { ALL_APPS } from "../apps/apps-config.js";
+import { SUPPORTED_CURRENCIES } from "../utils/currency-constants.js";
+import { stringCompare } from "../utils/strings.js";
+import { NormalizationError, assertNormalized, getInvalidConfigReason, normalize } from "./format.js";
+import { DEFAULT_EMAIL_TEMPLATES, DEFAULT_EMAIL_THEMES, DEFAULT_EMAIL_THEME_ID } from "../helpers/emails.js";
+import * as schemaFields from "../schema-fields.js";
+import { productSchema, userSpecifiedIdSchema, yupBoolean, yupDate, yupMixed, yupNever, yupNumber, yupObject, yupRecord, yupString, yupTuple, yupUnion } from "../schema-fields.js";
+import { allProviders } from "../utils/oauth.js";
+import { Result } from "../utils/results.js";
+import { typeAssert, typeAssertExtends, typeAssertIs } from "../utils/types.js";
+import { migrateCatalogsToProductLines } from "./migrate-catalogs-to-product-lines.js";
+
+//#region src/config/schema.ts
+const configLevels = [
+	"project",
+	"branch",
+	"environment",
+	"organization"
+];
+const permissionRegex = /^\$?[a-z0-9_:]+$/;
+const customPermissionRegex = /^[a-z0-9_:]+$/;
+function canNoLongerBeOverridden(schema, keys) {
+	return schema.concat(yupObject(Object.fromEntries(keys.map((key) => [key, schema.getNested(key).meta({ stackConfigCanNoLongerBeOverridden: true })]))));
+}
+/**
+* All fields that can be overridden at this level.
+*/
+const projectConfigSchema = yupObject({
+	sourceOfTruth: yupUnion(yupObject({ type: yupString().oneOf(["hosted"]).defined() })),
+	project: yupObject({ requirePublishableClientKey: yupBoolean() })
+});
+const branchRbacDefaultPermissions = yupRecord(yupString().matches(permissionRegex), yupBoolean().isTrue().optional());
+const branchRbacSchema = yupObject({
+	permissions: yupRecord(yupString().matches(customPermissionRegex), yupObject({
+		description: yupString().optional(),
+		scope: yupString().oneOf(["team", "project"]).optional(),
+		containedPermissionIds: yupRecord(yupString().matches(permissionRegex), yupBoolean().isTrue().optional()).optional()
+	}).optional()),
+	defaultPermissions: yupObject({
+		teamCreator: branchRbacDefaultPermissions,
+		teamMember: branchRbacDefaultPermissions,
+		signUp: branchRbacDefaultPermissions
+	})
+});
+const branchApiKeysSchema = yupObject({ enabled: yupObject({
+	team: yupBoolean(),
+	user: yupBoolean()
+}) });
+const appIds = Object.keys(ALL_APPS);
+const branchAppsSchema = yupObject({ installed: yupRecord(yupString().oneOf(appIds), yupObject({ enabled: yupBoolean() })) });
+const branchAuthSchema = yupObject({
+	allowSignUp: yupBoolean(),
+	password: yupObject({ allowSignIn: yupBoolean() }),
+	otp: yupObject({ allowSignIn: yupBoolean() }),
+	passkey: yupObject({ allowSignIn: yupBoolean() }),
+	oauth: yupObject({
+		accountMergeStrategy: yupString().oneOf([
+			"link_method",
+			"raise_error",
+			"allow_duplicates"
+		]).optional(),
+		providers: yupRecord(yupString().matches(permissionRegex), yupObject({
+			type: yupString().oneOf(allProviders).optional(),
+			allowSignIn: yupBoolean(),
+			allowConnectedAccounts: yupBoolean()
+		}))
+	}),
+	signUpRules: yupRecord(userSpecifiedIdSchema("signUpRuleId"), yupObject({
+		enabled: yupBoolean(),
+		displayName: yupString(),
+		priority: yupNumber().integer().min(0),
+		condition: yupString(),
+		action: yupObject({
+			type: yupString().oneOf([
+				"allow",
+				"reject",
+				"restrict",
+				"log"
+			]).defined(),
+			message: yupString().optional()
+		})
+	})),
+	signUpRulesDefaultAction: yupString().oneOf(["allow", "reject"])
+});
+const branchPaymentsSchema = yupObject({
+	blockNewPurchases: yupBoolean(),
+	autoPay: yupObject({ interval: schemaFields.dayIntervalSchema }).optional(),
+	productLines: yupRecord(userSpecifiedIdSchema("productLineId"), yupObject({
+		displayName: yupString().optional(),
+		customerType: schemaFields.customerTypeSchema
+	})).meta({ openapiField: {
+		description: "The product lines that products can be in. All products in a product line (besides add-ons) are mutually exclusive.",
+		exampleValue: { "product-line-id": {
+			displayName: "My Product Line",
+			customerType: "user"
+		} }
+	} }),
+	products: yupRecord(userSpecifiedIdSchema("productId"), productSchema),
+	items: yupRecord(userSpecifiedIdSchema("itemId"), yupObject({
+		displayName: yupString().optional(),
+		customerType: schemaFields.customerTypeSchema
+	}))
+}).optional().test("product-customer-type-matches-product-line", "Product customer type must match its product line customer type", function(value) {
+	if (!value) return true;
+	const products = value.products;
+	if (!isObjectLike(products)) return true;
+	const productLines = value.productLines;
+	for (const [productId, product] of Object.entries(products)) {
+		if (!isObjectLike(product)) continue;
+		const productLineId = product.productLineId;
+		if (typeof productLineId !== "string" || productLineId.length === 0) continue;
+		const productLine = isObjectLike(productLines) ? getOrUndefined(productLines, productLineId) : void 0;
+		if (productLine === void 0) return this.createError({
+			message: `Product "${productId}" specifies product line ID "${productLineId}", but that product line does not exist`,
+			path: `${this.path}.products.${productId}.productLineId`
+		});
+		if (!isObjectLike(productLine)) continue;
+		if (product.customerType !== productLine.customerType) return this.createError({
+			message: `Product "${productId}" has customer type "${product.customerType}" but its product line "${productLineId}" has customer type "${productLine.customerType}"`,
+			path: `${this.path}.products.${productId}.customerType`
+		});
+	}
+	return true;
+});
+(void 0)?.test("branchPaymentsSchema accepts partial payments config without products", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ blockNewPurchases: true }, { abortEarly: false })).resolves.toMatchObject({ blockNewPurchases: true });
+});
+(void 0)?.test("branchPaymentsSchema accepts product lines without products", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ productLines: { pro: {
+		displayName: "Pro",
+		customerType: "user"
+	} } }, { abortEarly: false })).resolves.toMatchObject({ productLines: { pro: {
+		displayName: "Pro",
+		customerType: "user"
+	} } });
+});
+(void 0)?.test("branchPaymentsSchema rejects a product that references a missing product line", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ products: { pro: {
+		customerType: "user",
+		productLineId: "missing-line",
+		prices: {}
+	} } }, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: Product "pro" specifies product line ID "missing-line", but that product line does not exist]`);
+});
+(void 0)?.test("branchPaymentsSchema rejects null product entries without throwing a raw TypeError", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ products: { pro: null } }, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: products cannot be null]`);
+});
+(void 0)?.test("branchPaymentsSchema rejects null product line entries without throwing a raw TypeError", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({
+		productLines: { teamLine: null },
+		products: { pro: {
+			customerType: "user",
+			productLineId: "teamLine",
+			prices: {}
+		} }
+	}, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: productLines cannot be null]`);
+});
+(void 0)?.test("branchPaymentsSchema rejects a product whose customer type differs from its product line", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({
+		productLines: { teamLine: { customerType: "team" } },
+		products: { pro: {
+			customerType: "user",
+			productLineId: "teamLine",
+			prices: {}
+		} }
+	}, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: Product "pro" has customer type "user" but its product line "teamLine" has customer type "team"]`);
+});
+(void 0)?.test("branchPaymentsSchema lets productLineId schema reject empty IDs", async ({ expect }) => {
+	await expect(branchPaymentsSchema.validate({ products: { pro: {
+		customerType: "user",
+		productLineId: "",
+		prices: {}
+	} } }, { abortEarly: false })).rejects.toThrowErrorMatchingInlineSnapshot(`[ValidationError: productLineId must contain only letters, numbers, underscores, and hyphens, and not start with a hyphen]`);
+});
+const branchDomain = yupObject({});
+const branchOnboardingSchema = yupObject({ requireEmailVerification: yupBoolean() });
+const branchConfigSchema = canNoLongerBeOverridden(projectConfigSchema, ["sourceOfTruth", "project"]).concat(yupObject({
+	rbac: branchRbacSchema,
+	teams: yupObject({
+		createPersonalTeamOnSignUp: yupBoolean(),
+		allowClientTeamCreation: yupBoolean()
+	}),
+	users: yupObject({ allowClientUserDeletion: yupBoolean() }),
+	onboarding: branchOnboardingSchema,
+	apiKeys: branchApiKeysSchema,
+	apps: branchAppsSchema,
+	domains: branchDomain,
+	auth: branchAuthSchema,
+	emails: yupObject({
+		selectedThemeId: schemaFields.emailThemeSchema,
+		themes: schemaFields.emailThemeListSchema,
+		templates: schemaFields.emailTemplateListSchema
+	}),
+	payments: branchPaymentsSchema,
+	dbSync: yupObject({ externalDatabases: yupRecord(userSpecifiedIdSchema("externalDatabaseId"), yupObject({
+		type: yupString().oneOf(["postgres"]).defined(),
+		connectionString: yupString().when("type", {
+			is: "postgres",
+			then: (schema) => schema.defined(),
+			otherwise: (schema) => schema.optional()
+		})
+	})) }),
+	dataVault: yupObject({ stores: yupRecord(userSpecifiedIdSchema("storeId"), yupObject({ displayName: yupString() })) })
+}));
+const environmentAnalyticsSchema = yupObject({ queryFolders: yupRecord(userSpecifiedIdSchema("folderId"), yupObject({
+	displayName: yupString(),
+	sortOrder: yupNumber().optional(),
+	queries: yupRecord(userSpecifiedIdSchema("queryId"), yupObject({
+		displayName: yupString(),
+		sqlQuery: yupString(),
+		description: yupString().optional()
+	}))
+})) });
+const environmentConfigSchema = branchConfigSchema.concat(yupObject({
+	auth: branchConfigSchema.getNested("auth").concat(yupObject({ oauth: branchConfigSchema.getNested("auth").getNested("oauth").concat(yupObject({ providers: yupRecord(yupString().matches(permissionRegex), yupObject({
+		type: yupString().oneOf(allProviders).optional(),
+		isShared: yupBoolean(),
+		clientId: schemaFields.oauthClientIdSchema.optional(),
+		clientSecret: schemaFields.oauthClientSecretSchema.optional(),
+		facebookConfigId: schemaFields.oauthFacebookConfigIdSchema.optional(),
+		microsoftTenantId: schemaFields.oauthMicrosoftTenantIdSchema.optional(),
+		appleBundles: yupRecord(userSpecifiedIdSchema("appleBundleId"), yupObject({ bundleId: schemaFields.oauthAppleBundleIdSchema })).optional(),
+		allowSignIn: yupBoolean().optional(),
+		allowConnectedAccounts: yupBoolean().optional()
+	})) })) })),
+	emails: branchConfigSchema.getNested("emails").concat(yupObject({ server: yupObject({
+		isShared: yupBoolean(),
+		provider: yupString().oneOf([
+			"resend",
+			"smtp",
+			"managed"
+		]).optional(),
+		host: schemaFields.emailHostSchema.optional().nonEmpty(),
+		port: schemaFields.emailPortSchema.optional(),
+		username: schemaFields.emailUsernameSchema.optional().nonEmpty(),
+		password: schemaFields.emailPasswordSchema.optional().nonEmpty().when(["provider", "isShared"], {
+			is: (provider, isShared) => provider === "managed" && isShared === false,
+			then: (schema) => schema.defined("Password is required when using managed email provider"),
+			otherwise: (schema) => schema.optional()
+		}),
+		senderName: schemaFields.emailSenderNameSchema.optional().nonEmpty(),
+		senderEmail: schemaFields.emailSenderEmailSchema.optional().nonEmpty(),
+		managedSubdomain: yupString().optional().nonEmpty().when(["provider", "isShared"], {
+			is: (provider, isShared) => provider === "managed" && isShared === false,
+			then: (schema) => schema.defined("Managed subdomain is required when using managed email provider"),
+			otherwise: (schema) => schema.optional()
+		}),
+		managedSenderLocalPart: yupString().optional().nonEmpty().when(["provider", "isShared"], {
+			is: (provider, isShared) => provider === "managed" && isShared === false,
+			then: (schema) => schema.defined("Managed sender local part is required when using managed email provider"),
+			otherwise: (schema) => schema.optional()
+		})
+	}) })),
+	domains: branchConfigSchema.getNested("domains").concat(yupObject({
+		allowLocalhost: yupBoolean(),
+		trustedDomains: yupRecord(userSpecifiedIdSchema("trustedDomainId"), yupObject({
+			baseUrl: schemaFields.wildcardUrlSchema.max(300),
+			handlerPath: schemaFields.handlerPathSchema.max(300)
+		}))
+	})),
+	payments: branchConfigSchema.getNested("payments").concat(yupObject({ testMode: yupBoolean() })),
+	analytics: environmentAnalyticsSchema,
+	customDashboards: schemaFields.customDashboardsSchema
+}));
+const organizationConfigSchema = environmentConfigSchema.concat(yupObject({}));
+function migrateConfigOverride(type, oldUnmigratedConfigOverride) {
+	const isBranchOrHigher = [
+		"branch",
+		"environment",
+		"organization"
+	].includes(type);
+	const isEnvironmentOrHigher = ["environment", "organization"].includes(type);
+	let res = oldUnmigratedConfigOverride;
+	if (isBranchOrHigher) res = renameProperty(res, "emails.theme", "selectedThemeId");
+	if (isEnvironmentOrHigher) res = mapProperty(res, (p) => p.join(".") === "domains.trustedDomains", (value) => {
+		if (Array.isArray(value)) return typedFromEntries(value.map((v, i) => [`${i}`, v]));
+		return value;
+	});
+	if (isBranchOrHigher) {
+		res = removeProperty(res, (p) => p.join(".") === "emails.themeList");
+		res = removeProperty(res, (p) => p.join(".") === "emails.templateList");
+	}
+	if (isBranchOrHigher) res = removeProperty(res, (p) => p.join(".") === "sourceOfTruth");
+	if (isBranchOrHigher) {
+		res = removeProperty(res, (p) => p.join(".") === "payments.stripeAccountId");
+		res = removeProperty(res, (p) => p.join(".") === "payments.stripeAccountSetupComplete");
+	}
+	if (isBranchOrHigher) res = removeProperty(res, (p) => p.length === 4 && p[0] === "payments" && p[1] === "items" && p[3] === "default");
+	if (isBranchOrHigher) res = renameProperty(res, "payments.offers", "products");
+	if (isBranchOrHigher) res = renameProperty(res, "payments.groups", "catalogs");
+	if (isBranchOrHigher) res = renameProperty(res, (p) => p.length === 4 && p[0] === "payments" && p[1] === "products" && p[3] === "groupId", (p) => "catalogId");
+	if (isBranchOrHigher) {
+		res = removeProperty(res, (p) => p[0] === "workflows");
+		res = removeProperty(res, (p) => p[0] === "apps" && p[1] === "installed" && p[2] === "workflows");
+	}
+	if (isBranchOrHigher) res = migrateCatalogsToProductLines(res);
+	if (isBranchOrHigher) res = mapProperty(res, (p) => p.length >= 4 && p[0] === "payments" && p[1] === "products" && p[p.length - 1] === "prices", (value) => {
+		if (value === "include-by-default") return {};
+		return value;
+	});
+	if (type === "project") res = removeProperty(res, (p) => p[0] === "sourceOfTruth");
+	return res;
+}
+(void 0)?.test("migrateConfigOverride removes legacy sourceOfTruth overrides", ({ expect }) => {
+	expect(migrateConfigOverride("project", { sourceOfTruth: {
+		type: "neon",
+		connectionStrings: { main: "postgres://user:password@neon.example.com/database" }
+	} })).toEqual({});
+	expect(migrateConfigOverride("project", {
+		"sourceOfTruth.type": "postgres",
+		"sourceOfTruth.connectionString": "postgres://user:password@host:5432/database"
+	})).toEqual({});
+});
+function removeProperty(obj, pathCond) {
+	return mapProperty(obj, pathCond, () => void 0);
+}
+function mapProperty(obj, pathCond, mapper) {
+	const res = Array.isArray(obj) ? [] : {};
+	for (const [key, value] of typedEntries(obj)) {
+		const path = key.split(".");
+		if (pathCond(path)) {
+			const newValue = mapper(value);
+			if (newValue !== void 0) set(res, key, newValue);
+		} else if (isObjectLike(value)) set(res, key, mapProperty(value, (p) => pathCond([...path, ...p]), mapper));
+		else set(res, key, value);
+	}
+	return res;
+}
+(void 0)?.test("mapProperty - basic property mapping", ({ expect }) => {
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.join(".") === "a.b.c", (value) => value + 1)).toEqual({ a: { b: { c: 2 } } });
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.join(".") === "a.b.d", (value) => value + 1)).toEqual({ a: { b: { c: 1 } } });
+	expect(mapProperty({ x: 5 }, (p) => p.join(".") === "x", (value) => value * 2)).toEqual({ x: 10 });
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.join(".") === "b.c", (value) => value * 10)).toEqual({ a: { b: { c: 1 } } });
+	expect(mapProperty({ a: 1 }, (p) => p.join(".") === "b.c", (value) => value)).toEqual({ a: 1 });
+	expect(mapProperty({ "a.b": { c: 1 } }, (p) => p.join(".") === "a.b.c", (value) => value + 1)).toEqual({ "a.b": { c: 2 } });
+	expect(mapProperty({ a: { b: { c: 1 } } }, (p) => p.length === 3 && p[0] === "a" && p[1] === "b", (value) => value + 1)).toEqual({ a: { b: { c: 2 } } });
+	const sentinelToEmpty = (v) => v === "include-by-default" ? {} : v;
+	const sentinelPred = (p) => p.length >= 4 && p[0] === "payments" && p[1] === "products" && p[p.length - 1] === "prices";
+	expect(mapProperty({ "payments.products.x.prices": "include-by-default" }, sentinelPred, sentinelToEmpty)).toEqual({ "payments.products.x.prices": {} });
+	expect(mapProperty({ payments: { products: { x: { prices: "include-by-default" } } } }, sentinelPred, sentinelToEmpty)).toEqual({ payments: { products: { x: { prices: {} } } } });
+	expect(mapProperty({ "payments.products": { x: { prices: "include-by-default" } } }, sentinelPred, sentinelToEmpty)).toEqual({ "payments.products": { x: { prices: {} } } });
+	expect(mapProperty({ "payments.products.my.product.prices": "include-by-default" }, sentinelPred, sentinelToEmpty)).toEqual({ "payments.products.my.product.prices": {} });
+});
+function renameProperty(obj, oldPath, newName) {
+	const pathCond = typeof oldPath === "function" ? oldPath : (p) => p.join(".") === oldPath;
+	const pathMapper = typeof newName === "function" ? newName : (p) => newName;
+	const res = Array.isArray(obj) ? [] : {};
+	for (const [key, originalValue] of typedEntries(obj)) {
+		const path = key.split(".");
+		for (let i = 0; i < path.length; i++) {
+			const pathPrefix = path.slice(0, i + 1);
+			if (pathCond(pathPrefix)) {
+				const name = pathMapper(pathPrefix);
+				if (name.includes(".")) throw new HexclaveAssertionError(`newName must not contain a dot. Provided: ${name}`);
+				path[i] = name;
+			}
+		}
+		const value = isObjectLike(originalValue) ? renameProperty(originalValue, (p) => pathCond([...path, ...p]), (p) => pathMapper([...path, ...p])) : originalValue;
+		set(res, path.join("."), value);
+	}
+	return res;
+}
+(void 0)?.test("renameProperty", ({ expect }) => {
+	expect(renameProperty({ a: 1 }, "a", "b")).toEqual({ b: 1 });
+	expect(renameProperty({ b: { c: 1 } }, "b.c", "d")).toEqual({ b: { d: 1 } });
+	expect(renameProperty({ a: { b: { c: 1 } } }, "a.b.c", "d")).toEqual({ a: { b: { d: 1 } } });
+	expect(renameProperty({ a: { b: { c: 1 } } }, "a.b.c.d", "e")).toEqual({ a: { b: { c: 1 } } });
+	expect(renameProperty({ a: {
+		b: { c: 1 },
+		"b.c": 2
+	} }, "b.c", "d")).toEqual({ a: {
+		b: { c: 1 },
+		"b.c": 2
+	} });
+	expect(renameProperty({ a: { "b.c.d": 2 } }, "a.b.c", "e")).toEqual({ a: { "b.e.d": 2 } });
+	expect(renameProperty({ a: {
+		b: { c: 1 },
+		"b.c": 2
+	} }, "a.b.c", "d")).toEqual({ a: {
+		b: { d: 1 },
+		"b.d": 2
+	} });
+	expect(renameProperty({ a: { b: {
+		c: 1,
+		d: 2
+	} } }, "a.b.c", "d")).toEqual({ a: { b: { d: 2 } } });
+	expect(renameProperty({ a: { b: {
+		d: 2,
+		c: 1
+	} } }, "a.b.c", "d")).toEqual({ a: { b: { d: 1 } } });
+	expect(renameProperty({ a: 1 }, (p) => p.length === 1 && p[0] === "a", (p) => "b")).toEqual({ b: 1 });
+	expect(renameProperty({ a: { b: { c: 1 } } }, (p) => p.length === 3 && p[0] === "a" && p[1] === "b" && p[2] === "c", (p) => "d")).toEqual({ a: { b: { d: 1 } } });
+	expect(renameProperty({ a: { b: { c: 1 } } }, (p) => false, (p) => "e")).toEqual({ a: { b: { c: 1 } } });
+	expect(renameProperty({ a: { b: { a: 1 } } }, (p) => p[p.length - 1] === "a", (p) => "c")).toEqual({ c: { b: { c: 1 } } });
+	expect(() => renameProperty({ a: 1 }, "a", "b.c")).toThrow();
+});
+const projectConfigDefaults = {
+	sourceOfTruth: { type: "hosted" },
+	project: { requirePublishableClientKey: false }
+};
+const branchConfigDefaults = {};
+const environmentConfigDefaults = {};
+const organizationConfigDefaults = {
+	rbac: {
+		permissions: (key) => ({
+			containedPermissionIds: (key) => void 0,
+			description: void 0,
+			scope: void 0
+		}),
+		defaultPermissions: {
+			teamCreator: (key) => void 0,
+			teamMember: (key) => void 0,
+			signUp: (key) => void 0
+		}
+	},
+	apiKeys: { enabled: {
+		team: false,
+		user: false
+	} },
+	apps: { installed: typedFromEntries(appIds.map((appId) => [appId, { enabled: false }])) },
+	teams: {
+		createPersonalTeamOnSignUp: false,
+		allowClientTeamCreation: false
+	},
+	users: { allowClientUserDeletion: false },
+	onboarding: { requireEmailVerification: false },
+	domains: {
+		allowLocalhost: false,
+		trustedDomains: (key) => ({
+			baseUrl: void 0,
+			handlerPath: "/handler"
+		})
+	},
+	auth: {
+		allowSignUp: true,
+		password: { allowSignIn: false },
+		otp: { allowSignIn: false },
+		passkey: { allowSignIn: false },
+		oauth: {
+			accountMergeStrategy: "link_method",
+			providers: (key) => ({
+				type: void 0,
+				isShared: true,
+				allowSignIn: false,
+				allowConnectedAccounts: false,
+				clientId: void 0,
+				clientSecret: void 0,
+				facebookConfigId: void 0,
+				microsoftTenantId: void 0,
+				appleBundles: void 0
+			})
+		},
+		signUpRules: (key) => ({
+			enabled: false,
+			displayName: void 0,
+			priority: 0,
+			condition: void 0,
+			action: {
+				type: "allow",
+				message: void 0
+			}
+		}),
+		signUpRulesDefaultAction: "allow"
+	},
+	emails: {
+		server: {
+			isShared: true,
+			provider: "smtp",
+			host: void 0,
+			port: void 0,
+			username: void 0,
+			password: void 0,
+			senderName: void 0,
+			senderEmail: void 0,
+			managedSubdomain: void 0,
+			managedSenderLocalPart: void 0
+		},
+		selectedThemeId: DEFAULT_EMAIL_THEME_ID,
+		themes: typedAssign((key) => ({
+			displayName: "Unnamed Theme",
+			tsxSource: "Error: Theme config is missing TypeScript source code."
+		}), DEFAULT_EMAIL_THEMES),
+		templates: typedAssign((key) => ({
+			displayName: "Unnamed Template",
+			tsxSource: "Error: Template config is missing TypeScript source code.",
+			themeId: void 0
+		}), DEFAULT_EMAIL_TEMPLATES)
+	},
+	payments: {
+		blockNewPurchases: false,
+		testMode: true,
+		autoPay: void 0,
+		productLines: (key) => ({
+			displayName: void 0,
+			customerType: void 0
+		}),
+		products: (key) => ({
+			displayName: key,
+			productLineId: void 0,
+			customerType: "user",
+			freeTrial: void 0,
+			serverOnly: false,
+			stackable: void 0,
+			isAddOnTo: false,
+			prices: (key) => ({
+				...typedFromEntries(SUPPORTED_CURRENCIES.map((currency) => [currency.code, void 0])),
+				interval: void 0,
+				serverOnly: false,
+				freeTrial: void 0
+			}),
+			includedItems: (key) => ({
+				quantity: 0,
+				repeat: "never",
+				expires: "when-repeated"
+			})
+		}),
+		items: (key) => ({
+			displayName: key,
+			customerType: "user"
+		})
+	},
+	dbSync: { externalDatabases: (key) => ({
+		type: void 0,
+		connectionString: void 0
+	}) },
+	dataVault: { stores: (key) => ({ displayName: "Unnamed Vault" }) },
+	analytics: { queryFolders: (key) => ({
+		displayName: "Unnamed Folder",
+		sortOrder: 0,
+		queries: (queryKey) => ({
+			displayName: "Unnamed Query",
+			sqlQuery: "",
+			description: void 0
+		})
+	}) },
+	customDashboards: (key) => ({
+		displayName: "Unnamed Dashboard",
+		tsxSource: "Error: Dashboard config is missing source code."
+	})
+};
+typeAssertIs()();
+typeAssertIs()();
+function deepReplaceFunctionsWithObjects(obj, paths = []) {
+	const subPaths = (key) => {
+		return paths.filter((p) => p.split(".").length > 1 && p.split(".")[0] === key).map((p) => p.split(".").slice(1).join("."));
+	};
+	const currentPaths = [...new Set(paths.map((p) => p.split(".")[0]))];
+	return mapValues({
+		...typeof obj === "function" ? filterUndefined(Object.fromEntries(currentPaths.map((k) => [k, obj(k)]))) : {},
+		...obj
+	}, (v, k) => isObjectLike(v) ? deepReplaceFunctionsWithObjects(v, subPaths(k)) : v);
+}
+(void 0)?.test("deepReplaceFunctionsWithObjects", ({ expect }) => {
+	expect(deepReplaceFunctionsWithObjects(() => {})).toEqual({});
+	expect(deepReplaceFunctionsWithObjects({ a: 3 })).toEqual({ a: 3 });
+	expect(deepReplaceFunctionsWithObjects({ a: () => ({ b: 1 }) })).toEqual({ a: {} });
+	expect(deepReplaceFunctionsWithObjects({ a: () => ({ b: 1 }) }, ["a.c.d"])).toEqual({ a: { c: { b: 1 } } });
+	expect(deepReplaceFunctionsWithObjects(() => ({ b: 1 }), ["a"])).toEqual({ a: { b: 1 } });
+	expect(deepReplaceFunctionsWithObjects({ a: typedAssign(() => ({}), { b: { c: 1 } }) })).toEqual({ a: { b: { c: 1 } } });
+});
+function applyDefaults(defaults, config) {
+	const res = deepReplaceFunctionsWithObjects(defaults);
+	outer: for (const [key, mergeValue] of Object.entries(config)) if (!isObjectLike(mergeValue) && mergeValue !== null) set(res, key, mergeValue);
+	else {
+		const keyParts = key.split(".");
+		let baseValue = defaults;
+		let lastWasFunction = false;
+		for (const [index, part] of keyParts.entries()) {
+			if (!isObjectLike(baseValue)) {
+				set(res, key, mergeValue ?? null);
+				continue outer;
+			}
+			lastWasFunction = false;
+			baseValue = has(baseValue, part) ? get(baseValue, part) : typeof baseValue === "function" ? (lastWasFunction = true, baseValue)(part) : void 0;
+		}
+		if (lastWasFunction && mergeValue == null) set(res, key, null);
+		else if (!isObjectLike(baseValue)) set(res, key, mergeValue ?? baseValue ?? null);
+		else set(res, key, applyDefaults(baseValue, mergeValue ?? {}));
+	}
+	return res;
+}
+(void 0)?.test("applyDefaults", ({ expect }) => {
+	expect(applyDefaults({ a: 1 }, { a: 2 })).toEqual({ a: 2 });
+	expect(applyDefaults({ a: 1 }, { a: null })).toEqual({ a: 1 });
+	expect(applyDefaults({}, { a: 1 })).toEqual({ a: 1 });
+	expect(applyDefaults({ a: { b: 1 } }, { a: { b: 2 } })).toEqual({ a: { b: 2 } });
+	expect(applyDefaults({ a: { b: 1 } }, { a: { c: 2 } })).toEqual({ a: {
+		b: 1,
+		c: 2
+	} });
+	expect(applyDefaults({ a: { b: {
+		c: 1,
+		d: 2
+	} } }, { a: { b: {
+		d: 3,
+		e: 4
+	} } })).toEqual({ a: { b: {
+		c: 1,
+		d: 3,
+		e: 4
+	} } });
+	expect(applyDefaults((key) => ({ b: key }), { a: {} })).toEqual({ a: { b: "a" } });
+	expect(applyDefaults((key) => ({ b: key }), { a: null })).toEqual({ a: null });
+	expect(applyDefaults((key1) => (key2) => ({
+		a: key1,
+		b: key2
+	}), { c: { d: {} } })).toEqual({ c: { d: {
+		a: "c",
+		b: "d"
+	} } });
+	expect(applyDefaults({ a: (key) => ({ b: key }) }, { a: { c: { d: 1 } } })).toEqual({ a: { c: {
+		b: "c",
+		d: 1
+	} } });
+	expect(applyDefaults({ a: (key) => ({ b: key }) }, {})).toEqual({ a: {} });
+	expect(applyDefaults({ a: (key) => ({ b: key }) }, { a: null })).toEqual({ a: {} });
+	expect(applyDefaults({ a: (key) => ({ c: key }) }, { a: { b: null } })).toEqual({ a: { b: null } });
+	expect(applyDefaults({ a: { b: (key) => ({ b: key }) } }, {})).toEqual({ a: { b: {} } });
+	expect(applyDefaults(typedAssign(() => ({ b: 1 }), { a: {
+		b: 1,
+		c: 2
+	} }), { a: {} })).toEqual({ a: {
+		b: 1,
+		c: 2
+	} });
+	expect(applyDefaults(typedAssign(() => ({ b: 1 }), { a: {
+		b: 1,
+		c: 2
+	} }), { d: {} })).toEqual({
+		a: {
+			b: 1,
+			c: 2
+		},
+		d: { b: 1 }
+	});
+	expect(applyDefaults({ a: { b: 1 } }, { "a.c": 2 })).toEqual({
+		a: { b: 1 },
+		"a.c": 2
+	});
+	expect(applyDefaults({ a: { b: 1 } }, { "a.c": null })).toEqual({
+		a: { b: 1 },
+		"a.c": null
+	});
+	expect(applyDefaults({ a: { b: 1 } }, {
+		a: { b: 2 },
+		"a.b": null
+	})).toEqual({
+		a: { b: 2 },
+		"a.b": 1
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, {
+		a: { b: { c: 2 } },
+		"a.b.c": null
+	})).toEqual({
+		a: { b: { c: 2 } },
+		"a.b.c": 1
+	});
+	expect(applyDefaults({}, {
+		a: { b: 2 },
+		"a.b": null
+	})).toEqual({
+		a: { b: 2 },
+		"a.b": null
+	});
+	expect(applyDefaults({ a: {
+		b: 1,
+		c: 2
+	} }, { "a.c": null })).toEqual({
+		a: {
+			b: 1,
+			c: 2
+		},
+		"a.c": 2
+	});
+	expect(applyDefaults({ a: {
+		b: 1,
+		c: () => {}
+	} }, { "a.c": null })).toEqual({
+		a: {
+			b: 1,
+			c: {}
+		},
+		"a.c": {}
+	});
+	expect(applyDefaults({ a: {
+		b: 1,
+		c: () => {}
+	} }, { "a.c.d": null })).toEqual({
+		a: {
+			b: 1,
+			c: {}
+		},
+		"a.c.d": null
+	});
+	expect(applyDefaults({ a: { b: 1 } }, { "a.b": null })).toEqual({
+		a: { b: 1 },
+		"a.b": 1
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, { "a.b": null })).toEqual({
+		a: { b: { c: 1 } },
+		"a.b": { c: 1 }
+	});
+	expect(applyDefaults({ a: {} }, { "a.b": null })).toEqual({
+		a: {},
+		"a.b": null
+	});
+	expect(applyDefaults({ a: {} }, {
+		"a": { b: 1 },
+		"a.b": null
+	})).toEqual({
+		a: { b: 1 },
+		"a.b": null
+	});
+	expect(applyDefaults({ a: 1 }, { "a.b": null })).toEqual({
+		a: 1,
+		"a.b": null
+	});
+	expect(applyDefaults({ a: 1 }, { "a.b": 2 })).toEqual({
+		a: 1,
+		"a.b": 2
+	});
+	expect(applyDefaults({ a: null }, { "a.b": 2 })).toEqual({
+		a: null,
+		"a.b": 2
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, { "a.b": { d: 2 } })).toEqual({
+		a: { b: { c: 1 } },
+		"a.b": {
+			c: 1,
+			d: 2
+		}
+	});
+	expect(applyDefaults({ a: { b: { c: 1 } } }, { "a.b": null })).toEqual({
+		a: { b: { c: 1 } },
+		"a.b": { c: 1 }
+	});
+	expect(applyDefaults({ a: { b: { c: { d: 1 } } } }, { "a.b.c": {} })).toEqual({
+		a: { b: { c: { d: 1 } } },
+		"a.b.c": { d: 1 }
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, { "a.b": { d: 2 } })).toEqual({
+		a: {},
+		"a.b": {
+			c: 1,
+			d: 2
+		}
+	});
+	expect(applyDefaults({ a: () => () => ({ d: 1 }) }, { "a.b": null })).toEqual({
+		a: {},
+		"a.b": null
+	});
+	expect(applyDefaults({ a: () => () => ({ d: 1 }) }, { "a.b.c": {} })).toEqual({
+		a: {},
+		"a.b.c": { d: 1 }
+	});
+	expect(applyDefaults({ a: { b: () => ({
+		c: 1,
+		d: 2
+	}) } }, { "a.b.x-y.c": 3 })).toEqual({
+		a: { b: {} },
+		"a.b.x-y.c": 3
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, { "a.b.d": 2 })).toEqual({
+		a: {},
+		"a.b.d": 2
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b.d": 2,
+		"a.e.d": 3
+	})).toEqual({
+		a: {},
+		"a.b.d": 2,
+		"a.e.d": 3
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b.d": 2,
+		a: { b: { d: 3 } }
+	})).toEqual({
+		a: { b: {
+			c: 1,
+			d: 3
+		} },
+		"a.b.d": 2
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b.d": 2,
+		a: { e: { d: 3 } }
+	})).toEqual({
+		a: { e: {
+			c: 1,
+			d: 3
+		} },
+		"a.b.d": 2
+	});
+	expect(applyDefaults({ a: () => ({ c: 1 }) }, {
+		"a.b": { d: { e: 2 } },
+		"a.b.d": null
+	})).toEqual({
+		a: {},
+		"a.b": {
+			c: 1,
+			d: { e: 2 }
+		},
+		"a.b.d": null
+	});
+});
+function applyProjectDefaults(config) {
+	return applyDefaults(projectConfigDefaults, config);
+}
+function applyBranchDefaults(config) {
+	return applyDefaults(branchConfigDefaults, applyDefaults(projectConfigDefaults, config));
+}
+function applyEnvironmentDefaults(config) {
+	return applyDefaults(environmentConfigDefaults, applyDefaults(branchConfigDefaults, applyDefaults(projectConfigDefaults, config)));
+}
+function applyOrganizationDefaults(config) {
+	return applyDefaults(organizationConfigDefaults, applyDefaults(environmentConfigDefaults, applyDefaults(branchConfigDefaults, applyDefaults(projectConfigDefaults, config))));
+}
+async function sanitizeProjectConfig(config) {
+	assertNormalized(config);
+	return {
+		...config,
+		sourceOfTruth: { type: "hosted" }
+	};
+}
+async function sanitizeBranchConfig(config) {
+	assertNormalized(config);
+	return { ...await sanitizeProjectConfig(config) };
+}
+async function sanitizeEnvironmentConfig(config) {
+	assertNormalized(config);
+	return { ...await sanitizeBranchConfig(config) };
+}
+async function sanitizeOrganizationConfig(config) {
+	assertNormalized(config);
+	const prepared = await sanitizeEnvironmentConfig(config);
+	const themes = prepared.emails.themes;
+	const templates = config.emails.server.isShared ? DEFAULT_EMAIL_TEMPLATES : prepared.emails.templates;
+	const products = typedFromEntries(typedEntries(prepared.payments.products).map(([key, product]) => {
+		const isAddOnTo = product.isAddOnTo === false ? false : typedFromEntries(Object.keys(product.isAddOnTo).map((key) => [key, true]));
+		const prices = typedFromEntries(typedEntries(product.prices).map(([key, value]) => {
+			return [key, { ...value }];
+		}));
+		return [key, {
+			...product,
+			isAddOnTo,
+			prices
+		}];
+	}));
+	const appSortIndices = new Map(Object.keys(ALL_APPS).map((appId, index) => [appId, index]));
+	const sortedRuleEntries = typedEntries(prepared.auth.signUpRules).sort((a, b) => {
+		const priorityA = a[1].priority;
+		const priorityB = b[1].priority;
+		if (priorityA !== priorityB) return priorityB - priorityA;
+		return stringCompare(a[0], b[0]);
+	});
+	return {
+		...prepared,
+		auth: {
+			...prepared.auth,
+			oauth: {
+				...prepared.auth.oauth,
+				providers: typedFromEntries(typedEntries(prepared.auth.oauth.providers).filter(([key, value]) => value.type !== void 0))
+			},
+			signUpRules: typedFromEntries(sortedRuleEntries)
+		},
+		emails: {
+			...prepared.emails,
+			selectedThemeId: has(themes, prepared.emails.selectedThemeId) ? prepared.emails.selectedThemeId : DEFAULT_EMAIL_THEME_ID,
+			themes,
+			templates
+		},
+		payments: {
+			...prepared.payments,
+			products
+		},
+		apps: { installed: typedFromEntries(typedEntries(prepared.apps.installed).sort(([a], [b]) => appSortIndices.get(a) - appSortIndices.get(b))) }
+	};
+}
+/**
+* Does not require a base config, and hence solely relies on the override itself to validate the config. If it returns
+* no error, you know that the
+*
+* It's crucial that our DB never contains any configs that are not valid according to this function, as this would mean
+* that the config object does not satisfy the ValidatedToHaveNoConfigOverrideErrors type (which is used as an assumption
+* in a whole bunch of places in the code).
+*/
+async function getConfigOverrideErrors(schema, configOverride, options = {}) {
+	if (typeof configOverride !== "object" || configOverride === null) return Result.error("Config override must be a non-null object.");
+	if (Object.getPrototypeOf(configOverride) !== Object.getPrototypeOf({})) return Result.error("Config override must be plain old JavaScript object.");
+	const ensureNoDotsInKeys = (obj) => {
+		if (typeof obj !== "object" || obj === null) return;
+		for (const entry of Object.entries(obj)) {
+			if (entry[0].includes(".")) return Result.error(`Key ${entry[0]} contains a dot, which is not allowed in config override.`);
+			const result = ensureNoDotsInKeys(entry[1]);
+			if (result) return result;
+		}
+	};
+	for (const key of Object.keys(configOverride)) {
+		const result = ensureNoDotsInKeys(configOverride[key]);
+		if (result) return result;
+	}
+	const reason = getInvalidConfigReason(configOverride, { configName: "override" });
+	if (reason) return Result.error("Invalid config format: " + reason);
+	const getSubSchema = (schema, key) => {
+		const keyParts = key.split(".");
+		if (!schema.hasNested(keyParts[0])) return;
+		const nestedSchema = schema.getNested(keyParts[0]);
+		if (nestedSchema.meta()?.stackConfigCanNoLongerBeOverridden && !options.allowPropertiesThatCanNoLongerBeOverridden) return;
+		if (keyParts.length === 1) return nestedSchema;
+		else return getSubSchema(nestedSchema, keyParts.slice(1).join("."));
+	};
+	const getRestrictedSchemaBase = (path, schema) => {
+		const schemaInfo = schema.meta()?.stackSchemaInfo;
+		switch (schemaInfo?.type) {
+			case "string": {
+				const description = schema.describe();
+				let res = yupString();
+				if (description.tests.some((t) => t.name === "uuid")) res = res.uuid();
+				return res;
+			}
+			case "number": return yupNumber();
+			case "boolean": return yupBoolean();
+			case "date": return yupDate();
+			case "mixed": return yupMixed();
+			case "array": throw new HexclaveAssertionError(`Arrays are not supported in config JSON files (besides tuples). Use a record instead.`, {
+				schemaInfo,
+				schema
+			});
+			case "tuple": return yupTuple(schemaInfo.items.map((s, index) => getRestrictedSchema(path + `[${index}]`, s)));
+			case "union": {
+				const schemas = schemaInfo.items;
+				const nonObjectSchemas = [...schemas.entries()].filter(([index, s]) => s.meta()?.stackSchemaInfo?.type !== "object");
+				const objectSchemas = schemas.filter((s) => s.meta()?.stackSchemaInfo?.type === "object");
+				const allObjectSchemaKeys = [...new Set(objectSchemas.flatMap((s) => Object.keys(s.fields)))];
+				const mergedObjectSchema = yupObject(Object.fromEntries(allObjectSchemaKeys.map((key) => [key, yupUnion(...objectSchemas.flatMap((s, index) => s.hasNested(key) ? [s.getNested(key)] : []))])));
+				return yupUnion(...nonObjectSchemas.map(([index, s]) => getRestrictedSchema(path + `|variant-${index}|`, s)), ...objectSchemas.length > 0 ? [getRestrictedSchema(path + (nonObjectSchemas.length > 0 ? `|variant|` : ""), mergedObjectSchema)] : []);
+			}
+			case "record": return yupRecord(getRestrictedSchema(path + ".key", schemaInfo.keySchema), getRestrictedSchema(path + ".value", schemaInfo.valueSchema));
+			case "object": {
+				const objectSchema = schema;
+				return yupObject(Object.fromEntries(Object.entries(objectSchema.fields).map(([key, value]) => [key, getRestrictedSchema(path + "." + key, value)])));
+			}
+			case "never": return yupNever();
+			default: throw new HexclaveAssertionError(`Unknown schema info at path ${path}: ${JSON.stringify(schemaInfo)}`, {
+				schemaInfo,
+				schema
+			});
+		}
+	};
+	const getRestrictedSchema = (path, schema) => {
+		let restricted = getRestrictedSchemaBase(path, schema);
+		restricted = restricted.nullable();
+		const description = schema.describe();
+		if (description.oneOf.length > 0) restricted = restricted.oneOf(description.oneOf);
+		if (description.notOneOf.length > 0) restricted = restricted.notOneOf(description.notOneOf);
+		return restricted;
+	};
+	for (const [key, value] of Object.entries(configOverride)) {
+		if (value === void 0) continue;
+		if (/^payments\.products\.[^.]+\.prices$/.test(key) && value === "include-by-default") return Result.error(`${key} must not be one of the following values: include-by-default`);
+		const subSchema = getSubSchema(schema, key);
+		if (!subSchema) {
+			const keySplit = key.split(".");
+			for (let i = 0; i < keySplit.length; i++) {
+				const prefix = keySplit.slice(0, i + 1).join(".");
+				if (!getSubSchema(schema, prefix)) return Result.error(`The key ${JSON.stringify(key)} is not valid (nested object not found in schema: ${JSON.stringify(prefix)}).`);
+			}
+			throw new HexclaveAssertionError("Something weird happened? Sub-schema for key is invalid but no prefix is invalid??", {
+				key,
+				subSchema
+			});
+		}
+		let restrictedSchema = getRestrictedSchema(key, subSchema);
+		try {
+			await restrictedSchema.validate(value, {
+				strict: true,
+				path: key,
+				context: { noUnknownPathPrefixes: [""] }
+			});
+		} catch (error) {
+			if (error instanceof yup$1.ValidationError) return Result.error(error.message);
+			throw error;
+		}
+	}
+	return Result.ok(null);
+}
+async function assertNoConfigOverrideErrors(schema, config, options = {}) {
+	const res = await getConfigOverrideErrors(schema, config, options);
+	if (res.status === "error") throw new HexclaveAssertionError(`Config override is invalid — at a place where it should have already been validated! ${res.error}`, {
+		options,
+		config
+	});
+}
+typeAssertIs()();
+typeAssertExtends()();
+typeAssertExtends()();
+/**
+* Checks whether there are any warnings in the incomplete config. A warning doesn't stop the config from being valid,
+* but may require action regardless.
+*
+* The DB can contain configs that are not valid according to this function, as long as they are valid according to
+* the getConfigOverrideErrors function. (This is necessary, because a changing base config may make an override invalid
+* that was previously valid.)
+*/
+async function getIncompleteConfigWarnings(schema, incompleteConfig) {
+	const overrideErrors = await getConfigOverrideErrors(schema, incompleteConfig, { allowPropertiesThatCanNoLongerBeOverridden: true });
+	if (overrideErrors.status === "error") return overrideErrors;
+	const withDefaults = applyDefaults(organizationConfigDefaults, applyDefaults(projectConfigDefaults, incompleteConfig));
+	const droppedKeys = [];
+	const normalizedWithDefaults = normalize(withDefaults, {
+		onDotIntoNonObject: "ignore",
+		droppedKeys
+	});
+	const incompleteConfigDotKeys = new Set(Object.keys(incompleteConfig).filter((k) => k.includes(".") && incompleteConfig[k] !== void 0));
+	const relevantDroppedKeys = droppedKeys.filter((k) => incompleteConfigDotKeys.has(k));
+	if (relevantDroppedKeys.length > 0) {
+		const messages = relevantDroppedKeys.map((key) => {
+			const segments = key.split(".");
+			let current = normalizedWithDefaults;
+			let lastExistingIdx = -1;
+			for (let i = 0; i < segments.length - 1; i++) if (current != null && typeof current === "object" && !Array.isArray(current) && segments[i] in current) {
+				current = current[segments[i]];
+				lastExistingIdx = i;
+			} else break;
+			const nonExistentParent = segments.slice(0, lastExistingIdx + 2).join(".");
+			const remainingSegments = segments.slice(lastExistingIdx + 2);
+			let suggestion = "...";
+			for (let i = remainingSegments.length - 1; i >= 0; i--) suggestion = `{ ${JSON.stringify(remainingSegments[i])}: ${suggestion} }`;
+			suggestion = `{ ${JSON.stringify(nonExistentParent)}: ${suggestion} }`;
+			return `Dot-notation key ${JSON.stringify(key)} will be silently ignored because it references non-existent parent ${JSON.stringify(nonExistentParent)}. Instead of dot notation, use nested object notation like this: ${suggestion}`;
+		});
+		return Result.error(messages.join("\n"));
+	}
+	let normalized;
+	try {
+		normalized = normalize(incompleteConfig, { onDotIntoNull: "empty-object" });
+	} catch (error) {
+		if (error instanceof NormalizationError) return Result.error(`Config is not normalizable. ` + error.message);
+		throw error;
+	}
+	try {
+		await schema.validate(normalized, {
+			strict: true,
+			context: { noUnknownPathPrefixes: [""] }
+		});
+		return Result.ok(null);
+	} catch (error) {
+		if (error instanceof yup$1.ValidationError) return Result.error(error.message);
+		throw error;
+	}
+}
+typeAssertExtends()();
+typeAssertExtends()();
+typeAssertExtends()();
+typeAssertExtends()();
+typeAssert()();
+typeAssert()();
+typeAssertExtends()();
+
+//#endregion
+export { applyBranchDefaults, applyEnvironmentDefaults, applyOrganizationDefaults, applyProjectDefaults, assertNoConfigOverrideErrors, branchConfigSchema, branchPaymentsSchema, configLevels, environmentConfigSchema, getConfigOverrideErrors, getIncompleteConfigWarnings, migrateConfigOverride, organizationConfigSchema, projectConfigSchema, sanitizeBranchConfig, sanitizeEnvironmentConfig, sanitizeOrganizationConfig, sanitizeProjectConfig };
+//# sourceMappingURL=schema.js.map