@hexclave/shared 1.0.35 → 1.0.37

package/dist/config/schema.d.ts

@@ -84,7 +84,7 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
   sourceOfTruth: {
     type: "hosted";
   };
-}, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+}, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
   payments?: {
     blockNewPurchases?: boolean | undefined;
     autoPay?: {
@@ -125,6 +125,13 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
       }>;
     }>;
   } | undefined;
+  users: {
+    allowClientUserDeletion?: boolean | undefined;
+  };
+  teams: {
+    createPersonalTeamOnSignUp?: boolean | undefined;
+    allowClientTeamCreation?: boolean | undefined;
+  };
   auth: {
     allowSignUp?: boolean | undefined;
     signUpRulesDefaultAction?: string | undefined;
@@ -147,8 +154,8 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
     };
     signUpRules: Record<string, {
       displayName?: string | undefined;
-      priority?: number | undefined;
       enabled?: boolean | undefined;
+      priority?: number | undefined;
       condition?: string | undefined;
       action: {
         message?: string | undefined;
@@ -159,10 +166,6 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
   onboarding: {
     requireEmailVerification?: boolean | undefined;
   };
-  teams: {
-    createPersonalTeamOnSignUp?: boolean | undefined;
-    allowClientTeamCreation?: boolean | undefined;
-  };
   rbac: {
     permissions: Record<string, {
       description?: string | undefined;
@@ -187,9 +190,6 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
       tsxSource: string;
     }>;
   };
-  users: {
-    allowClientUserDeletion?: boolean | undefined;
-  };
   apiKeys: {
     enabled: {
       team?: boolean | undefined;
@@ -197,7 +197,7 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
     };
   };
   apps: {
-    installed: Record<"authentication" | "fraud-protection" | "analytics" | "onboarding" | "teams" | "rbac" | "api-keys" | "payments" | "emails" | "support" | "email-api" | "data-vault" | "webhooks" | "tv-mode" | "launch-checklist" | "catalyst" | "neon" | "convex" | "vercel" | "tanstack-start" | "clickmaps" | "session-replays", {
+    installed: Record<"teams" | "authentication" | "fraud-protection" | "analytics" | "onboarding" | "rbac" | "api-keys" | "payments" | "emails" | "support" | "email-api" | "data-vault" | "webhooks" | "tv-mode" | "launch-checklist" | "catalyst" | "neon" | "convex" | "vercel" | "tanstack-start" | "clickmaps" | "session-replays", {
       enabled?: boolean | undefined;
     }>;
   };
@@ -218,7 +218,7 @@ declare const branchConfigSchema: yup$1.Schema<Omit<Omit<{
   project: {
     requirePublishableClientKey: undefined;
   };
-}, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+}, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
   rbac: {
     permissions: undefined;
     defaultPermissions: {
@@ -293,7 +293,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
   sourceOfTruth: {
     type: "hosted";
   };
-}, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+}, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
   payments?: {
     blockNewPurchases?: boolean | undefined;
     autoPay?: {
@@ -334,6 +334,13 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
       }>;
     }>;
   } | undefined;
+  users: {
+    allowClientUserDeletion?: boolean | undefined;
+  };
+  teams: {
+    createPersonalTeamOnSignUp?: boolean | undefined;
+    allowClientTeamCreation?: boolean | undefined;
+  };
   auth: {
     allowSignUp?: boolean | undefined;
     signUpRulesDefaultAction?: string | undefined;
@@ -356,8 +363,8 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     };
     signUpRules: Record<string, {
       displayName?: string | undefined;
-      priority?: number | undefined;
       enabled?: boolean | undefined;
+      priority?: number | undefined;
       condition?: string | undefined;
       action: {
         message?: string | undefined;
@@ -368,10 +375,6 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
   onboarding: {
     requireEmailVerification?: boolean | undefined;
   };
-  teams: {
-    createPersonalTeamOnSignUp?: boolean | undefined;
-    allowClientTeamCreation?: boolean | undefined;
-  };
   rbac: {
     permissions: Record<string, {
       description?: string | undefined;
@@ -396,9 +399,6 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
       tsxSource: string;
     }>;
   };
-  users: {
-    allowClientUserDeletion?: boolean | undefined;
-  };
   apiKeys: {
     enabled: {
       team?: boolean | undefined;
@@ -406,7 +406,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     };
   };
   apps: {
-    installed: Record<"authentication" | "fraud-protection" | "analytics" | "onboarding" | "teams" | "rbac" | "api-keys" | "payments" | "emails" | "support" | "email-api" | "data-vault" | "webhooks" | "tv-mode" | "launch-checklist" | "catalyst" | "neon" | "convex" | "vercel" | "tanstack-start" | "clickmaps" | "session-replays", {
+    installed: Record<"teams" | "authentication" | "fraud-protection" | "analytics" | "onboarding" | "rbac" | "api-keys" | "payments" | "emails" | "support" | "email-api" | "data-vault" | "webhooks" | "tv-mode" | "launch-checklist" | "catalyst" | "neon" | "convex" | "vercel" | "tanstack-start" | "clickmaps" | "session-replays", {
       enabled?: boolean | undefined;
     }>;
   };
@@ -487,8 +487,8 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     };
     signUpRules: Record<string, {
       displayName?: string | undefined;
-      priority?: number | undefined;
       enabled?: boolean | undefined;
+      priority?: number | undefined;
       condition?: string | undefined;
       action: {
         message?: string | undefined;
@@ -575,7 +575,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
   project: {
     requirePublishableClientKey: undefined;
   };
-}, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+}, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
   rbac: {
     permissions: undefined;
     defaultPermissions: {
@@ -648,7 +648,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -721,7 +721,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
       project: {
         requirePublishableClientKey: undefined;
       };
-    }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+    }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
       rbac: {
         permissions: undefined;
         defaultPermissions: {
@@ -797,7 +797,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -883,7 +883,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -959,7 +959,7 @@ declare const environmentConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<Omit<{
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -1041,7 +1041,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
   sourceOfTruth: {
     type: "hosted";
   };
-}, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+}, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
   payments?: {
     blockNewPurchases?: boolean | undefined;
     autoPay?: {
@@ -1082,6 +1082,13 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
       }>;
     }>;
   } | undefined;
+  users: {
+    allowClientUserDeletion?: boolean | undefined;
+  };
+  teams: {
+    createPersonalTeamOnSignUp?: boolean | undefined;
+    allowClientTeamCreation?: boolean | undefined;
+  };
   auth: {
     allowSignUp?: boolean | undefined;
     signUpRulesDefaultAction?: string | undefined;
@@ -1104,8 +1111,8 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     };
     signUpRules: Record<string, {
       displayName?: string | undefined;
-      priority?: number | undefined;
       enabled?: boolean | undefined;
+      priority?: number | undefined;
       condition?: string | undefined;
       action: {
         message?: string | undefined;
@@ -1116,10 +1123,6 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
   onboarding: {
     requireEmailVerification?: boolean | undefined;
   };
-  teams: {
-    createPersonalTeamOnSignUp?: boolean | undefined;
-    allowClientTeamCreation?: boolean | undefined;
-  };
   rbac: {
     permissions: Record<string, {
       description?: string | undefined;
@@ -1144,9 +1147,6 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
       tsxSource: string;
     }>;
   };
-  users: {
-    allowClientUserDeletion?: boolean | undefined;
-  };
   apiKeys: {
     enabled: {
       team?: boolean | undefined;
@@ -1154,7 +1154,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     };
   };
   apps: {
-    installed: Record<"authentication" | "fraud-protection" | "analytics" | "onboarding" | "teams" | "rbac" | "api-keys" | "payments" | "emails" | "support" | "email-api" | "data-vault" | "webhooks" | "tv-mode" | "launch-checklist" | "catalyst" | "neon" | "convex" | "vercel" | "tanstack-start" | "clickmaps" | "session-replays", {
+    installed: Record<"teams" | "authentication" | "fraud-protection" | "analytics" | "onboarding" | "rbac" | "api-keys" | "payments" | "emails" | "support" | "email-api" | "data-vault" | "webhooks" | "tv-mode" | "launch-checklist" | "catalyst" | "neon" | "convex" | "vercel" | "tanstack-start" | "clickmaps" | "session-replays", {
       enabled?: boolean | undefined;
     }>;
   };
@@ -1235,8 +1235,8 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     };
     signUpRules: Record<string, {
       displayName?: string | undefined;
-      priority?: number | undefined;
       enabled?: boolean | undefined;
+      priority?: number | undefined;
       condition?: string | undefined;
       action: {
         message?: string | undefined;
@@ -1323,7 +1323,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
   project: {
     requirePublishableClientKey: undefined;
   };
-}, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+}, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
   rbac: {
     permissions: undefined;
     defaultPermissions: {
@@ -1396,7 +1396,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -1469,7 +1469,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
       project: {
         requirePublishableClientKey: undefined;
       };
-    }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+    }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
       rbac: {
         permissions: undefined;
         defaultPermissions: {
@@ -1545,7 +1545,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -1631,7 +1631,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -1707,7 +1707,7 @@ declare const organizationConfigSchema: yup$1.Schema<Omit<NonNullable<Omit<NonNu
     project: {
       requirePublishableClientKey: undefined;
     };
-  }, string>, "auth" | "onboarding" | "teams" | "rbac" | "payments" | "emails" | "users" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
+  }, string>, "users" | "teams" | "auth" | "onboarding" | "rbac" | "payments" | "emails" | "apiKeys" | "apps" | "domains" | "dbSync" | "dataVault"> & {
     rbac: {
       permissions: undefined;
       defaultPermissions: {
@@ -2073,18 +2073,18 @@ declare function sanitizeOrganizationConfig(config: OrganizationRenderedConfigBe
     };
     signUpRules: Record<string, {
       displayName: string | undefined;
-      priority: number;
       enabled: boolean;
+      priority: number;
       condition: string | undefined;
       action: {
         message: string | undefined;
         type: "allow" | "reject" | "restrict" | "log";
       };
     }>;
-    allowSignUp: boolean;
     password: {
       allowSignIn: boolean;
     };
+    allowSignUp: boolean;
     otp: {
       allowSignIn: boolean;
     };
@@ -2183,6 +2183,13 @@ declare function sanitizeOrganizationConfig(config: OrganizationRenderedConfigBe
   } & {
     readonly type: "hosted";
   };
+  users: {
+    allowClientUserDeletion: boolean;
+  };
+  teams: {
+    createPersonalTeamOnSignUp: boolean;
+    allowClientTeamCreation: boolean;
+  };
   analytics: {
     queryFolders: {
       [x: string]: {
@@ -2201,10 +2208,6 @@ declare function sanitizeOrganizationConfig(config: OrganizationRenderedConfigBe
   onboarding: {
     requireEmailVerification: boolean;
   };
-  teams: {
-    createPersonalTeamOnSignUp: boolean;
-    allowClientTeamCreation: boolean;
-  };
   rbac: {
     permissions: {
       [x: string]: {
@@ -2227,9 +2230,6 @@ declare function sanitizeOrganizationConfig(config: OrganizationRenderedConfigBe
       };
     };
   };
-  users: {
-    allowClientUserDeletion: boolean;
-  };
   apiKeys: {
     enabled: {
       team: boolean;

package/dist/config-eval.d.ts

@@ -0,0 +1,31 @@
+import { showOnboardingHexclaveConfigValue } from "./config-authoring.js";
+
+//#region src/config-eval.d.ts
+/**
+ * Thrown when a config file evaluates successfully but its exported `config`
+ * isn't a usable shape (missing, or not an object / "show-onboarding" string).
+ * Distinct from the underlying loader errors jiti throws, so callers can tell a
+ * malformed config apart from a file that simply failed to load.
+ */
+declare class ConfigFileEvalError extends Error {
+  constructor(message: string);
+}
+/**
+ * Walks up from `dir` to find the nearest `package.json` and returns the
+ * best SDK package to use for the `HexclaveConfig` type import.
+ */
+declare function detectImportPackageFromDir(dir: string): string | undefined;
+/** A config object, or the `"show-onboarding"` sentinel that stands in for one. */
+type ParsedConfigValue = Record<string, unknown> | typeof showOnboardingHexclaveConfigValue;
+/**
+ * Evaluates config file content using jiti and returns the exported `config`
+ * value.
+ *
+ * WARNING: This executes arbitrary code via `jiti.evalModule` — only use on
+ * content that is fully operator-controlled (local filesystem). Never call
+ * this on untrusted input (e.g. content fetched from a remote repository).
+ */
+declare function evalConfigFileContent(content: string, filePath: string): ParsedConfigValue;
+//#endregion
+export { ConfigFileEvalError, ParsedConfigValue, detectImportPackageFromDir, evalConfigFileContent };
+//# sourceMappingURL=config-eval.d.ts.map

package/dist/config-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-eval.d.ts","names":[],"sources":["../src/config-eval.ts"],"mappings":";;;;;AAcA;;;;cAAa,mBAAA,SAA4B,KAAA;cAC3B,OAAA;AAAA;;;AAUd;;iBAAgB,0BAAA,CAA2B,GAAA;;KA4B/B,iBAAA,GAAoB,MAAA,2BAAiC,iCAAA;AAAjE;;;;;AAcA;;;AAdA,iBAcgB,qBAAA,CAAsB,OAAA,UAAiB,QAAA,WAAmB,iBAAA"}

package/dist/config-eval.js

@@ -0,0 +1,117 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('./chunk-BE-pF4vm.js');
+let __config_authoring_js = require("./config-authoring.js");
+let fs = require("fs");
+let jiti = require("jiti");
+let path = require("path");
+path = require_chunk.__toESM(path);
+let __config_rendering_js = require("./config-rendering.js");
+
+//#region src/config-eval.ts
+const jiti$1 = (0, jiti.createJiti)(require("url").pathToFileURL(__filename).href, { moduleCache: false });
+/**
+* Thrown when a config file evaluates successfully but its exported `config`
+* isn't a usable shape (missing, or not an object / "show-onboarding" string).
+* Distinct from the underlying loader errors jiti throws, so callers can tell a
+* malformed config apart from a file that simply failed to load.
+*/
+var ConfigFileEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ConfigFileEvalError";
+	}
+};
+/**
+* Walks up from `dir` to find the nearest `package.json` and returns the
+* best SDK package to use for the `HexclaveConfig` type import.
+*/
+function detectImportPackageFromDir(dir) {
+	let current = dir;
+	while (true) {
+		const pkgPath = path.default.join(current, "package.json");
+		if ((0, fs.existsSync)(pkgPath)) try {
+			const pkg = JSON.parse((0, fs.readFileSync)(pkgPath, "utf-8"));
+			return (0, __config_rendering_js.detectConfigImportPackage)([...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})]);
+		} catch {
+			return;
+		}
+		const parent = path.default.dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+}
+function isRecord(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function invalidConfigShape(filePath) {
+	return new ConfigFileEvalError(`Invalid config in ${filePath}. The file must export a plain \`config\` object or "${__config_authoring_js.showOnboardingHexclaveConfigValue}".`);
+}
+/**
+* Evaluates config file content using jiti and returns the exported `config`
+* value.
+*
+* WARNING: This executes arbitrary code via `jiti.evalModule` — only use on
+* content that is fully operator-controlled (local filesystem). Never call
+* this on untrusted input (e.g. content fetched from a remote repository).
+*/
+function evalConfigFileContent(content, filePath) {
+	if (content.trim() === "") return {};
+	const resolvedPath = path.default.isAbsolute(filePath) ? filePath : path.default.resolve(filePath);
+	const mod = jiti$1.evalModule(content, { filename: resolvedPath });
+	if (!isRecord(mod)) throw invalidConfigShape(filePath);
+	const config = mod.config;
+	if (config === void 0) throw invalidConfigShape(filePath);
+	if (typeof config === "string") {
+		if (config !== __config_authoring_js.showOnboardingHexclaveConfigValue) throw new ConfigFileEvalError(`Invalid config in ${filePath}. String config values must be "${__config_authoring_js.showOnboardingHexclaveConfigValue}", got "${config}".`);
+		return config;
+	}
+	if (isRecord(config)) return config;
+	throw invalidConfigShape(filePath);
+}
+(void 0)?.test("evalConfigFileContent parses static config exports", ({ expect }) => {
+	expect(evalConfigFileContent(`
+    import type { StackConfig } from "@hexclave/js";
+    export const config: StackConfig = {
+      auth: { allowSignUp: true },
+      payments: { testMode: false },
+    };
+  `, "stack.config.ts")).toMatchInlineSnapshot(`
+    {
+      "auth": {
+        "allowSignUp": true,
+      },
+      "payments": {
+        "testMode": false,
+      },
+    }
+  `);
+});
+(void 0)?.test("evalConfigFileContent parses show-onboarding", ({ expect }) => {
+	expect(evalConfigFileContent("export const config = \"show-onboarding\";", "stack.config.ts")).toBe("show-onboarding");
+});
+(void 0)?.test("evalConfigFileContent rejects content without config export", ({ expect }) => {
+	expect(() => evalConfigFileContent("export const other = {};", "stack.config.ts")).toThrow(/must export/);
+});
+(void 0)?.test("evalConfigFileContent rejects arbitrary string config values", ({ expect }) => {
+	expect(() => evalConfigFileContent("export const config = \"arbitrary-string\";", "stack.config.ts")).toThrow(/must be "show-onboarding"/);
+});
+(void 0)?.test("evalConfigFileContent rejects unresolvable config factories", ({ expect }) => {
+	expect(() => evalConfigFileContent("export const config = makeConfig();", "stack.config.ts")).toThrow();
+});
+(void 0)?.test("evalConfigFileContent rejects missing config import targets", ({ expect }) => {
+	expect(() => evalConfigFileContent(`
+    import missingConfigPart from "./missing-config-part";
+    export const config = { auth: missingConfigPart };
+  `, "/tmp/hexclave-missing-import-config.ts")).toThrow();
+});
+(void 0)?.test("evalConfigFileContent surfaces invalid syntax as a loader error, not ConfigFileEvalError", ({ expect }) => {
+	const evalInvalid = () => evalConfigFileContent("export const config = {", "stack.config.ts");
+	expect(evalInvalid).toThrow();
+	expect(evalInvalid).not.toThrow(ConfigFileEvalError);
+});
+
+//#endregion
+exports.ConfigFileEvalError = ConfigFileEvalError;
+exports.detectImportPackageFromDir = detectImportPackageFromDir;
+exports.evalConfigFileContent = evalConfigFileContent;
+//# sourceMappingURL=config-eval.js.map

package/dist/config-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-eval.js","names":[],"sources":["../src/config-eval.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { showOnboardingHexclaveConfigValue } from \"./config-authoring\";\nimport { detectConfigImportPackage } from \"./config-rendering\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\n/**\n * Thrown when a config file evaluates successfully but its exported `config`\n * isn't a usable shape (missing, or not an object / \"show-onboarding\" string).\n * Distinct from the underlying loader errors jiti throws, so callers can tell a\n * malformed config apart from a file that simply failed to load.\n */\nexport class ConfigFileEvalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConfigFileEvalError\";\n  }\n}\n\n/**\n * Walks up from `dir` to find the nearest `package.json` and returns the\n * best SDK package to use for the `HexclaveConfig` type import.\n */\nexport function detectImportPackageFromDir(dir: string): string | undefined {\n  let current = dir;\n  while (true) {\n    const pkgPath = path.join(current, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf-8\"));\n        const deps = [\n          ...Object.keys(pkg.dependencies ?? {}),\n          ...Object.keys(pkg.devDependencies ?? {}),\n        ];\n        return detectConfigImportPackage(deps);\n      } catch {\n        return undefined;\n      }\n    }\n    const parent = path.dirname(current);\n    if (parent === current) break;\n    current = parent;\n  }\n  return undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value != null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n/** A config object, or the `\"show-onboarding\"` sentinel that stands in for one. */\nexport type ParsedConfigValue = Record<string, unknown> | typeof showOnboardingHexclaveConfigValue;\n\nfunction invalidConfigShape(filePath: string): ConfigFileEvalError {\n  return new ConfigFileEvalError(`Invalid config in ${filePath}. The file must export a plain \\`config\\` object or \"${showOnboardingHexclaveConfigValue}\".`);\n}\n\n/**\n * Evaluates config file content using jiti and returns the exported `config`\n * value.\n *\n * WARNING: This executes arbitrary code via `jiti.evalModule` — only use on\n * content that is fully operator-controlled (local filesystem). Never call\n * this on untrusted input (e.g. content fetched from a remote repository).\n */\nexport function evalConfigFileContent(content: string, filePath: string): ParsedConfigValue {\n  if (content.trim() === \"\") return {};\n  const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(filePath);\n  const mod: unknown = jiti.evalModule(content, { filename: resolvedPath });\n  if (!isRecord(mod)) {\n    throw invalidConfigShape(filePath);\n  }\n  const config = mod.config;\n  if (config === undefined) {\n    throw invalidConfigShape(filePath);\n  }\n  if (typeof config === \"string\") {\n    if (config !== showOnboardingHexclaveConfigValue) {\n      throw new ConfigFileEvalError(`Invalid config in ${filePath}. String config values must be \"${showOnboardingHexclaveConfigValue}\", got \"${config}\".`);\n    }\n    return config;\n  }\n  if (isRecord(config)) return config;\n  throw invalidConfigShape(filePath);\n}\n\n// --- inline vitest tests ---\n\nimport.meta.vitest?.test(\"evalConfigFileContent parses static config exports\", ({ expect }) => {\n  expect(evalConfigFileContent(`\n    import type { StackConfig } from \"@hexclave/js\";\n    export const config: StackConfig = {\n      auth: { allowSignUp: true },\n      payments: { testMode: false },\n    };\n  `, \"stack.config.ts\")).toMatchInlineSnapshot(`\n    {\n      \"auth\": {\n        \"allowSignUp\": true,\n      },\n      \"payments\": {\n        \"testMode\": false,\n      },\n    }\n  `);\n});\n\nimport.meta.vitest?.test(\"evalConfigFileContent parses show-onboarding\", ({ expect }) => {\n  expect(evalConfigFileContent('export const config = \"show-onboarding\";', \"stack.config.ts\")).toBe(\"show-onboarding\");\n});\n\nimport.meta.vitest?.test(\"evalConfigFileContent rejects content without config export\", ({ expect }) => {\n  expect(() => evalConfigFileContent(\"export const other = {};\", \"stack.config.ts\")).toThrow(/must export/);\n});\n\nimport.meta.vitest?.test(\"evalConfigFileContent rejects arbitrary string config values\", ({ expect }) => {\n  expect(() => evalConfigFileContent('export const config = \"arbitrary-string\";', \"stack.config.ts\")).toThrow(/must be \"show-onboarding\"/);\n});\n\nimport.meta.vitest?.test(\"evalConfigFileContent rejects unresolvable config factories\", ({ expect }) => {\n  expect(() => evalConfigFileContent(\"export const config = makeConfig();\", \"stack.config.ts\")).toThrow();\n});\n\nimport.meta.vitest?.test(\"evalConfigFileContent rejects missing config import targets\", ({ expect }) => {\n  expect(() => evalConfigFileContent(`\n    import missingConfigPart from \"./missing-config-part\";\n    export const config = { auth: missingConfigPart };\n  `, \"/tmp/hexclave-missing-import-config.ts\")).toThrow();\n});\n\nimport.meta.vitest?.test(\"evalConfigFileContent surfaces invalid syntax as a loader error, not ConfigFileEvalError\", ({ expect }) => {\n  // A malformed file fails inside jiti's parser, so the thrown error is a loader\n  // error — NOT a ConfigFileEvalError. Callers depend on that distinction to route\n  // it to \"Failed to load config file\" rather than \"Invalid config\".\n  const evalInvalid = () => evalConfigFileContent(\"export const config = {\", \"stack.config.ts\");\n  expect(evalInvalid).toThrow();\n  expect(evalInvalid).not.toThrow(ConfigFileEvalError);\n});\n"],"mappings":";;;;;;;;;;AAMA,MAAM,6EAAmC,EAAE,aAAa,OAAO,CAAC;;;;;;;AAQhE,IAAa,sBAAb,cAAyC,MAAM;CAC7C,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;;AAQhB,SAAgB,2BAA2B,KAAiC;CAC1E,IAAI,UAAU;AACd,QAAO,MAAM;EACX,MAAM,UAAU,aAAK,KAAK,SAAS,eAAe;AAClD,yBAAe,QAAQ,CACrB,KAAI;GACF,MAAM,MAAM,KAAK,2BAAmB,SAAS,QAAQ,CAAC;AAKtD,+DAJa,CACX,GAAG,OAAO,KAAK,IAAI,gBAAgB,EAAE,CAAC,EACtC,GAAG,OAAO,KAAK,IAAI,mBAAmB,EAAE,CAAC,CAC1C,CACqC;UAChC;AACN;;EAGJ,MAAM,SAAS,aAAK,QAAQ,QAAQ;AACpC,MAAI,WAAW,QAAS;AACxB,YAAU;;;AAKd,SAAS,SAAS,OAAkD;AAClE,QAAO,SAAS,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAM5E,SAAS,mBAAmB,UAAuC;AACjE,QAAO,IAAI,oBAAoB,qBAAqB,SAAS,uDAAuD,wDAAkC,IAAI;;;;;;;;;;AAW5J,SAAgB,sBAAsB,SAAiB,UAAqC;AAC1F,KAAI,QAAQ,MAAM,KAAK,GAAI,QAAO,EAAE;CACpC,MAAM,eAAe,aAAK,WAAW,SAAS,GAAG,WAAW,aAAK,QAAQ,SAAS;CAClF,MAAM,MAAe,OAAK,WAAW,SAAS,EAAE,UAAU,cAAc,CAAC;AACzE,KAAI,CAAC,SAAS,IAAI,CAChB,OAAM,mBAAmB,SAAS;CAEpC,MAAM,SAAS,IAAI;AACnB,KAAI,WAAW,OACb,OAAM,mBAAmB,SAAS;AAEpC,KAAI,OAAO,WAAW,UAAU;AAC9B,MAAI,WAAW,wDACb,OAAM,IAAI,oBAAoB,qBAAqB,SAAS,kCAAkC,wDAAkC,UAAU,OAAO,IAAI;AAEvJ,SAAO;;AAET,KAAI,SAAS,OAAO,CAAE,QAAO;AAC7B,OAAM,mBAAmB,SAAS;;CAKpC,SAAW,KAAC,uDAAyD,EAAA,aAAa;AAChF,QAAO,sBAAsB;;;;;;KAM1B,kBAAkB,CAAC,CAAC,sBAAsB;;;;;;;;;IAS3C;EACF;CAEF,SAAW,KAAC,iDAAgD,EAAA,aAAgB;AAC1E,QAAO,sBAAsB,8CAA4C,kBAAkB,CAAC,CAAC,KAAK,kBAAkB;EACpH;CAEF,SAAW,KAAC,gEAAmE,EAAA,aAAY;AACzF,cAAa,sBAAsB,4BAA4B,kBAAkB,CAAC,CAAC,QAAQ,cAAc;EACzG;CAEF,SAAW,KAAC,iEAAoE,EAAA,aAAY;AAC1F,cAAa,sBAAsB,+CAA6C,kBAAkB,CAAC,CAAC,QAAQ,4BAA4B;EACxI;CAEF,SAAW,KAAC,gEAAgE,EAAA,aAAe;AACzF,cAAa,sBAAsB,uCAAuC,kBAAkB,CAAC,CAAC,SAAS;EACvG;CAEF,SAAW,KAAC,gEAAkE,EAAA,aAAa;AACzF,cAAa,sBAAsB;;;KAGhC,yCAAyC,CAAC,CAAC,SAAS;EACvD;CAEF,SAAW,KAAC,6FAAmF,EAAA,aAAyB;CAItH,MAAM,oBAAoB,sBAAsB,2BAA2B,kBAAkB;AAC7F,QAAO,YAAY,CAAC,SAAS;AAC7B,QAAO,YAAY,CAAC,IAAI,QAAQ,oBAAoB;EACpD"}

package/dist/config-rendering.d.ts

@@ -1,5 +1,3 @@
-import { hexclaveConfigFileExportsConfig, parseHexclaveConfigFileContent, renderConfigFileContent, tryParseHexclaveConfigFileContent } from "./hexclave-config-file.js";
-
 //#region src/config-rendering.d.ts
 /**
  * Given a list of dependency names (from package.json), returns the SDK
@@ -8,10 +6,9 @@ import { hexclaveConfigFileExportsConfig, parseHexclaveConfigFileContent, render
  */
 declare function detectConfigImportPackage(dependencies: string[]): string | undefined;
 /**
- * Walks up from `dir` to find the nearest `package.json` and returns the
- * best SDK package to use for the `HexclaveConfig` type import.
+ * Renders a config object into the source text of a `stack.config.ts` file.
  */
-declare function detectImportPackageFromDir(dir: string): string | undefined;
+declare function renderConfigFileContent(config: unknown, importPackage?: string): string;
 //#endregion
-export { detectConfigImportPackage, detectImportPackageFromDir, hexclaveConfigFileExportsConfig, parseHexclaveConfigFileContent, renderConfigFileContent, tryParseHexclaveConfigFileContent };
+export { detectConfigImportPackage, renderConfigFileContent };
 //# sourceMappingURL=config-rendering.d.ts.map

package/dist/config-rendering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-rendering.d.ts","names":[],"sources":["../src/config-rendering.ts"],"mappings":";;;;AA6BA;;;;iBAAgB,yBAAA,CAA0B,YAAA;AAa1C;;;;AAAA,iBAAgB,0BAAA,CAA2B,GAAA"}
+{"version":3,"file":"config-rendering.d.ts","names":[],"sources":["../src/config-rendering.ts"],"mappings":";;AA4BA;;;;iBAAgB,yBAAA,CAA0B,YAAA;AAY1C;;;AAAA,iBAAgB,uBAAA,CAAwB,MAAA,WAAiB,aAAA"}