@holo-js/config 0.1.1 → 0.1.3

package/dist/index.mjs

@@ -3,10 +3,6 @@ import {
   DEFAULT_HOLO_PROJECT_PATHS,
   normalizeHoloProjectConfig
 } from "@holo-js/db";
-import {
-  normalizeQueueConfig,
-  holoQueueDefaults
-} from "@holo-js/queue";
 var DEFAULT_APP_NAME = "Holo";
 var holoAppDefaults = Object.freeze({
   name: DEFAULT_APP_NAME,
@@ -30,6 +26,23 @@ var holoDatabaseDefaults = Object.freeze({
     })
   })
 });
+var DEFAULT_REDIS_CONNECTION = "default";
+var DEFAULT_REDIS_HOST = "127.0.0.1";
+var DEFAULT_REDIS_PORT = 6379;
+var DEFAULT_REDIS_DB = 0;
+var holoRedisDefaults = Object.freeze({
+  default: DEFAULT_REDIS_CONNECTION,
+  connections: Object.freeze({
+    [DEFAULT_REDIS_CONNECTION]: Object.freeze({
+      name: DEFAULT_REDIS_CONNECTION,
+      host: DEFAULT_REDIS_HOST,
+      port: DEFAULT_REDIS_PORT,
+      username: void 0,
+      password: void 0,
+      db: DEFAULT_REDIS_DB
+    })
+  })
+});
 var holoStorageDefaults = Object.freeze({
   defaultDisk: "local",
   routePrefix: "/storage",
@@ -45,7 +58,715 @@ var holoStorageDefaults = Object.freeze({
     })
   })
 });
-var holoQueueDefaultsNormalized = holoQueueDefaults;
+var DEFAULT_NOTIFICATIONS_TABLE = "notifications";
+var DEFAULT_BROADCAST_CONNECTION = "null";
+var DEFAULT_BROADCAST_HOST = "127.0.0.1";
+var DEFAULT_BROADCAST_HTTP_PORT = 80;
+var DEFAULT_BROADCAST_HTTPS_PORT = 443;
+var DEFAULT_BROADCAST_WORKER_HOST = "0.0.0.0";
+var DEFAULT_BROADCAST_WORKER_PORT = 8080;
+var DEFAULT_BROADCAST_WORKER_PATH = "/app";
+var DEFAULT_BROADCAST_HEALTH_PATH = "/health";
+var DEFAULT_BROADCAST_STATS_PATH = "/stats";
+var holoNotificationsDefaults = Object.freeze({
+  table: DEFAULT_NOTIFICATIONS_TABLE,
+  queue: Object.freeze({
+    connection: void 0,
+    queue: void 0,
+    afterCommit: false
+  })
+});
+var holoBroadcastDefaults = Object.freeze({
+  default: DEFAULT_BROADCAST_CONNECTION,
+  connections: Object.freeze({
+    log: Object.freeze({
+      name: "log",
+      driver: "log",
+      clientOptions: Object.freeze({})
+    }),
+    null: Object.freeze({
+      name: "null",
+      driver: "null",
+      clientOptions: Object.freeze({})
+    })
+  }),
+  worker: Object.freeze({
+    host: DEFAULT_BROADCAST_WORKER_HOST,
+    port: DEFAULT_BROADCAST_WORKER_PORT,
+    path: DEFAULT_BROADCAST_WORKER_PATH,
+    publicHost: void 0,
+    publicPort: void 0,
+    publicScheme: "https",
+    healthPath: DEFAULT_BROADCAST_HEALTH_PATH,
+    statsPath: DEFAULT_BROADCAST_STATS_PATH,
+    scaling: false
+  })
+});
+var DEFAULT_CACHE_DRIVER = "file";
+var DEFAULT_CACHE_PREFIX = "";
+var DEFAULT_CACHE_FILE_PATH = "./storage/framework/cache/data";
+var DEFAULT_CACHE_REDIS_CONNECTION = "default";
+var DEFAULT_CACHE_DATABASE_CONNECTION = "default";
+var DEFAULT_CACHE_DATABASE_TABLE = "cache";
+var DEFAULT_CACHE_DATABASE_LOCK_TABLE = "cache_locks";
+var holoCacheDefaults = Object.freeze({
+  default: DEFAULT_CACHE_DRIVER,
+  prefix: DEFAULT_CACHE_PREFIX,
+  drivers: Object.freeze({
+    file: Object.freeze({
+      name: "file",
+      driver: "file",
+      path: DEFAULT_CACHE_FILE_PATH,
+      prefix: DEFAULT_CACHE_PREFIX
+    }),
+    memory: Object.freeze({
+      name: "memory",
+      driver: "memory",
+      maxEntries: void 0,
+      prefix: DEFAULT_CACHE_PREFIX
+    })
+  })
+});
+var DEFAULT_MAILER_NAME = "preview";
+var DEFAULT_MAIL_PREVIEW_PATH = ".holo-js/runtime/mail-preview";
+var DEFAULT_SMTP_HOST = "127.0.0.1";
+var DEFAULT_SMTP_PORT = 1025;
+var DEFAULT_MAIL_QUEUE_CONFIG = Object.freeze({
+  queued: false,
+  connection: void 0,
+  queue: void 0,
+  afterCommit: false
+});
+var holoMailDefaults = Object.freeze({
+  default: DEFAULT_MAILER_NAME,
+  from: void 0,
+  replyTo: void 0,
+  queue: DEFAULT_MAIL_QUEUE_CONFIG,
+  preview: Object.freeze({
+    allowedEnvironments: Object.freeze(["development"])
+  }),
+  markdown: Object.freeze({
+    wrapper: void 0
+  }),
+  mailers: Object.freeze({
+    preview: Object.freeze({
+      name: "preview",
+      driver: "preview",
+      from: void 0,
+      replyTo: void 0,
+      queue: DEFAULT_MAIL_QUEUE_CONFIG,
+      path: DEFAULT_MAIL_PREVIEW_PATH
+    }),
+    log: Object.freeze({
+      name: "log",
+      driver: "log",
+      from: void 0,
+      replyTo: void 0,
+      queue: DEFAULT_MAIL_QUEUE_CONFIG,
+      logBodies: false
+    }),
+    fake: Object.freeze({
+      name: "fake",
+      driver: "fake",
+      from: void 0,
+      replyTo: void 0,
+      queue: DEFAULT_MAIL_QUEUE_CONFIG
+    }),
+    smtp: Object.freeze({
+      name: "smtp",
+      driver: "smtp",
+      from: void 0,
+      replyTo: void 0,
+      queue: DEFAULT_MAIL_QUEUE_CONFIG,
+      host: DEFAULT_SMTP_HOST,
+      port: DEFAULT_SMTP_PORT,
+      secure: false
+    })
+  })
+});
+var DEFAULT_SESSION_DRIVER = "file";
+var DEFAULT_SESSION_IDLE_TIMEOUT = 120;
+var DEFAULT_SESSION_ABSOLUTE_LIFETIME = 120;
+var DEFAULT_SESSION_REMEMBER_ME_LIFETIME = 43200;
+var DEFAULT_SESSION_COOKIE_NAME = "holo_session";
+var DEFAULT_SESSION_COOKIE_PATH = "/";
+var DEFAULT_SESSION_COOKIE_SAME_SITE = "lax";
+var DEFAULT_SESSION_DATABASE_CONNECTION = "default";
+var DEFAULT_SESSION_DATABASE_TABLE = "sessions";
+var DEFAULT_SESSION_FILE_PATH = "./storage/framework/sessions";
+var holoSessionDefaults = Object.freeze({
+  driver: DEFAULT_SESSION_DRIVER,
+  stores: Object.freeze({
+    database: Object.freeze({
+      name: "database",
+      driver: "database",
+      connection: DEFAULT_SESSION_DATABASE_CONNECTION,
+      table: DEFAULT_SESSION_DATABASE_TABLE
+    }),
+    file: Object.freeze({
+      name: "file",
+      driver: "file",
+      path: DEFAULT_SESSION_FILE_PATH
+    })
+  }),
+  cookie: Object.freeze({
+    name: DEFAULT_SESSION_COOKIE_NAME,
+    path: DEFAULT_SESSION_COOKIE_PATH,
+    secure: false,
+    httpOnly: true,
+    sameSite: DEFAULT_SESSION_COOKIE_SAME_SITE,
+    partitioned: false,
+    maxAge: DEFAULT_SESSION_ABSOLUTE_LIFETIME
+  }),
+  idleTimeout: DEFAULT_SESSION_IDLE_TIMEOUT,
+  absoluteLifetime: DEFAULT_SESSION_ABSOLUTE_LIFETIME,
+  rememberMeLifetime: DEFAULT_SESSION_REMEMBER_ME_LIFETIME
+});
+var DEFAULT_SECURITY_CSRF_FIELD = "_token";
+var DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
+var DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
+var DEFAULT_SECURITY_RATE_LIMIT_DRIVER = "memory";
+var DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
+var DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
+var DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
+var DEFAULT_SECURITY_CSRF_CONFIG = Object.freeze({
+  enabled: false,
+  field: DEFAULT_SECURITY_CSRF_FIELD,
+  header: DEFAULT_SECURITY_CSRF_HEADER,
+  cookie: DEFAULT_SECURITY_CSRF_COOKIE,
+  except: Object.freeze([])
+});
+var DEFAULT_SECURITY_RATE_LIMIT_CONFIG = Object.freeze({
+  driver: DEFAULT_SECURITY_RATE_LIMIT_DRIVER,
+  memory: Object.freeze({
+    driver: "memory"
+  }),
+  file: Object.freeze({
+    path: DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH
+  }),
+  redis: Object.freeze({
+    host: DEFAULT_REDIS_HOST,
+    port: DEFAULT_REDIS_PORT,
+    password: void 0,
+    username: void 0,
+    db: DEFAULT_REDIS_DB,
+    connection: DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION,
+    prefix: DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX
+  }),
+  limiters: Object.freeze({})
+});
+var holoSecurityDefaults = Object.freeze({
+  csrf: DEFAULT_SECURITY_CSRF_CONFIG,
+  rateLimit: DEFAULT_SECURITY_RATE_LIMIT_CONFIG
+});
+var DEFAULT_AUTH_GUARD = "web";
+var DEFAULT_AUTH_PROVIDER = "users";
+var DEFAULT_AUTH_IDENTIFIERS = Object.freeze(["email"]);
+var DEFAULT_AUTH_PASSWORD_BROKER = "users";
+var DEFAULT_AUTH_PASSWORD_RESET_TABLE = "password_reset_tokens";
+var DEFAULT_AUTH_PASSWORD_EXPIRE = 60;
+var DEFAULT_AUTH_PASSWORD_THROTTLE = 60;
+var DEFAULT_WORKOS_SESSION_COOKIE = "wos-session";
+var DEFAULT_CLERK_SESSION_COOKIE = "__session";
+var holoAuthDefaults = Object.freeze({
+  defaults: Object.freeze({
+    guard: DEFAULT_AUTH_GUARD,
+    passwords: DEFAULT_AUTH_PASSWORD_BROKER
+  }),
+  guards: Object.freeze({
+    web: Object.freeze({
+      name: "web",
+      driver: "session",
+      provider: DEFAULT_AUTH_PROVIDER
+    })
+  }),
+  providers: Object.freeze({
+    users: Object.freeze({
+      name: "users",
+      model: "User",
+      identifiers: DEFAULT_AUTH_IDENTIFIERS
+    })
+  }),
+  passwords: Object.freeze({
+    users: Object.freeze({
+      name: "users",
+      provider: DEFAULT_AUTH_PROVIDER,
+      table: DEFAULT_AUTH_PASSWORD_RESET_TABLE,
+      expire: DEFAULT_AUTH_PASSWORD_EXPIRE,
+      throttle: DEFAULT_AUTH_PASSWORD_THROTTLE
+    })
+  }),
+  emailVerification: Object.freeze({
+    required: false
+  }),
+  personalAccessTokens: Object.freeze({
+    defaultAbilities: Object.freeze([])
+  }),
+  socialEncryptionKey: void 0,
+  social: Object.freeze({}),
+  workos: Object.freeze({}),
+  clerk: Object.freeze({})
+});
+var DEFAULT_QUEUE_CONNECTION = "sync";
+var DEFAULT_QUEUE_NAME = "default";
+var DEFAULT_QUEUE_RETRY_AFTER = 90;
+var DEFAULT_QUEUE_BLOCK_FOR = 5;
+var DEFAULT_QUEUE_SLEEP = 1;
+var DEFAULT_FAILED_JOBS_CONNECTION = "default";
+var DEFAULT_FAILED_JOBS_TABLE = "failed_jobs";
+var DEFAULT_DATABASE_QUEUE_TABLE = "jobs";
+var DEFAULT_QUEUE_CONFIG = Object.freeze({
+  default: DEFAULT_QUEUE_CONNECTION,
+  failed: Object.freeze({
+    driver: "database",
+    connection: DEFAULT_FAILED_JOBS_CONNECTION,
+    table: DEFAULT_FAILED_JOBS_TABLE
+  }),
+  connections: Object.freeze({
+    [DEFAULT_QUEUE_CONNECTION]: Object.freeze({
+      name: DEFAULT_QUEUE_CONNECTION,
+      driver: "sync",
+      queue: DEFAULT_QUEUE_NAME
+    })
+  })
+});
+function parseInteger(value, fallback, label, options = {}) {
+  if (typeof value === "undefined") {
+    return fallback;
+  }
+  const normalized = typeof value === "number" ? value : Number.parseInt(value, 10);
+  if (!Number.isInteger(normalized)) {
+    throw new Error(`[Holo Queue] ${label} must be an integer.`);
+  }
+  if (typeof options.minimum === "number" && normalized < options.minimum) {
+    throw new Error(`[Holo Queue] ${label} must be greater than or equal to ${options.minimum}.`);
+  }
+  return normalized;
+}
+function normalizeNonEmptyString(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(label);
+  }
+  return normalized;
+}
+function normalizeConnectionName(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(`[Holo Queue] ${label} must be a non-empty string.`);
+  }
+  return normalized;
+}
+function normalizeCacheName(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(`[Holo Cache] ${label} must be a non-empty string.`);
+  }
+  return normalized;
+}
+function normalizeCacheOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+function parseCacheInteger(value, label, options = {}) {
+  if (typeof value === "undefined") {
+    return void 0;
+  }
+  const normalized = typeof value === "number" ? value : (() => {
+    const trimmed = value.trim();
+    if (!trimmed) {
+      return Number.NaN;
+    }
+    return Number(trimmed);
+  })();
+  if (!Number.isFinite(normalized) || !Number.isInteger(normalized)) {
+    throw new Error(`[Holo Cache] ${label} must be an integer.`);
+  }
+  if (typeof options.minimum === "number" && normalized < options.minimum) {
+    throw new Error(`[Holo Cache] ${label} must be greater than or equal to ${options.minimum}.`);
+  }
+  return normalized;
+}
+function resolveCachePrefix(globalPrefix, localPrefix) {
+  return normalizeCacheOptionalString(localPrefix) ?? globalPrefix;
+}
+function normalizeCacheDriverConfig(name, config2, globalPrefix) {
+  switch (config2.driver) {
+    case "memory": {
+      const memoryConfig = config2;
+      return Object.freeze({
+        name,
+        driver: "memory",
+        prefix: resolveCachePrefix(globalPrefix, memoryConfig.prefix),
+        maxEntries: parseCacheInteger(memoryConfig.maxEntries, `cache driver "${name}" maxEntries`, {
+          minimum: 1
+        })
+      });
+    }
+    case "file": {
+      const fileConfig = config2;
+      return Object.freeze({
+        name,
+        driver: "file",
+        path: normalizeCacheOptionalString(fileConfig.path) || DEFAULT_CACHE_FILE_PATH,
+        prefix: resolveCachePrefix(globalPrefix, fileConfig.prefix)
+      });
+    }
+    case "redis": {
+      const redisConfig = config2;
+      return Object.freeze({
+        name,
+        driver: "redis",
+        connection: redisConfig.connection,
+        prefix: resolveCachePrefix(globalPrefix, redisConfig.prefix)
+      });
+    }
+    case "database": {
+      const databaseConfig = config2;
+      return Object.freeze({
+        name,
+        driver: "database",
+        connection: databaseConfig.connection,
+        table: normalizeCacheOptionalString(databaseConfig.table) || DEFAULT_CACHE_DATABASE_TABLE,
+        lockTable: normalizeCacheOptionalString(databaseConfig.lockTable) || DEFAULT_CACHE_DATABASE_LOCK_TABLE,
+        prefix: resolveCachePrefix(globalPrefix, databaseConfig.prefix)
+      });
+    }
+    default:
+      throw new Error(`[Holo Cache] Unsupported cache driver "${String(config2.driver)}" on driver "${name}".`);
+  }
+}
+function normalizeCacheConfig(config2 = {}, options = {}) {
+  const prefix = normalizeCacheOptionalString(config2.prefix) ?? DEFAULT_CACHE_PREFIX;
+  const defaultRedisConnection = options.redis?.default ?? DEFAULT_CACHE_REDIS_CONNECTION;
+  const defaultDatabaseConnection = options.database?.defaultConnection ?? DEFAULT_CACHE_DATABASE_CONNECTION;
+  const driverEntries = !config2.drivers || Object.keys(config2.drivers).length === 0 ? Object.entries(holoCacheDefaults.drivers) : Object.entries(config2.drivers);
+  const normalizedDriverEntries = driverEntries.map(([name, driver]) => {
+    const normalizedName = normalizeCacheName(name, "Cache driver name");
+    const driverConfig = (() => {
+      switch (driver.driver) {
+        case "redis":
+          return {
+            ...driver,
+            connection: normalizeCacheOptionalString(driver.connection) ?? defaultRedisConnection
+          };
+        case "database":
+          return {
+            ...driver,
+            connection: normalizeCacheOptionalString(driver.connection) ?? defaultDatabaseConnection
+          };
+        default:
+          return driver;
+      }
+    })();
+    return [normalizedName, normalizeCacheDriverConfig(normalizedName, driverConfig, prefix)];
+  });
+  const drivers = Object.freeze(Object.fromEntries(normalizedDriverEntries));
+  const configuredDefault = normalizeCacheOptionalString(config2.default);
+  if (configuredDefault && !Object.hasOwn(drivers, configuredDefault)) {
+    throw new Error(`[Holo Cache] default cache driver "${configuredDefault}" is not configured.`);
+  }
+  const fallbackDefaultDriver = normalizedDriverEntries.find(([name]) => name === DEFAULT_CACHE_DRIVER)?.[0] ?? normalizedDriverEntries[0][0];
+  const defaultDriver = configuredDefault ?? fallbackDefaultDriver;
+  return Object.freeze({
+    default: defaultDriver,
+    prefix,
+    drivers
+  });
+}
+function normalizeQueueName(value) {
+  return value?.trim() || DEFAULT_QUEUE_NAME;
+}
+function parseRedisInteger(value, fallback, label, options = {}) {
+  if (typeof value === "undefined") {
+    return fallback;
+  }
+  const normalized = typeof value === "number" ? value : (() => {
+    const trimmed = value.trim();
+    if (!trimmed || !/^\d+$/.test(trimmed)) {
+      return Number.NaN;
+    }
+    return Number.parseInt(trimmed, 10);
+  })();
+  if (!Number.isInteger(normalized)) {
+    throw new Error(`[Holo Redis] ${label} must be an integer.`);
+  }
+  if (typeof options.minimum === "number" && normalized < options.minimum) {
+    throw new Error(`[Holo Redis] ${label} must be greater than or equal to ${options.minimum}.`);
+  }
+  return normalized;
+}
+function normalizeRedisConnectionName(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(`[Holo Redis] ${label} must be a non-empty string.`);
+  }
+  return normalized;
+}
+function normalizeOptionalRedisString(value, label) {
+  if (typeof value === "undefined") {
+    return void 0;
+  }
+  const normalized = normalizeRedisConnectionName(value, label);
+  try {
+    const parsed = new URL(normalized);
+    if (parsed.protocol !== "redis:" && parsed.protocol !== "rediss:") {
+      throw new Error(`[Holo Redis] ${label} must use the redis:// or rediss:// scheme.`);
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("[Holo Redis]")) {
+      throw error;
+    }
+    throw new Error(`[Holo Redis] ${label} must be a valid redis:// or rediss:// URL.`);
+  }
+  return normalized;
+}
+function normalizeOptionalRedisSocketPath(value, label) {
+  if (typeof value === "undefined") {
+    return void 0;
+  }
+  return normalizeRedisConnectionName(value, label);
+}
+function deriveNormalizedRedisSocketPath(socketPath, host) {
+  if (socketPath) {
+    return socketPath;
+  }
+  if (typeof host === "string" && (host.startsWith("unix://") || host.startsWith("/"))) {
+    return host.startsWith("unix://") ? host.slice("unix://".length) : host;
+  }
+  return void 0;
+}
+function normalizeRedisClusterNodeConfig(connectionName, index, config2) {
+  const label = `redis connection "${connectionName}" cluster node ${index + 1}`;
+  const url = normalizeOptionalRedisString(config2.url, `${label} url`);
+  const socketPath = normalizeOptionalRedisSocketPath(config2.socketPath, `${label} socketPath`);
+  const normalizedSocketPath = deriveNormalizedRedisSocketPath(socketPath, config2.host?.trim());
+  if (typeof normalizedSocketPath !== "undefined") {
+    throw new Error(`[Holo Redis] ${label} cannot use socketPath in cluster mode.`);
+  }
+  parseRedisDatabaseFromUrl(url, {
+    allowPath: false,
+    label: `${label} url`
+  });
+  const host = config2.host?.trim() || DEFAULT_REDIS_HOST;
+  return Object.freeze({
+    ...typeof url === "undefined" ? {} : { url },
+    host,
+    port: parseRedisInteger(config2.port, DEFAULT_REDIS_PORT, `${label} port`, {
+      minimum: 1
+    })
+  });
+}
+function normalizeRedisClusterNodes(connectionName, nodes) {
+  if (!nodes || nodes.length === 0) {
+    return void 0;
+  }
+  return Object.freeze(nodes.map((node, index) => normalizeRedisClusterNodeConfig(connectionName, index, node)));
+}
+function parseRedisDatabaseFromUrl(url, options) {
+  if (typeof url === "undefined") {
+    return void 0;
+  }
+  try {
+    const parsed = new URL(url);
+    const pathname = parsed.pathname.replace(/^\/+/, "");
+    if (!pathname) {
+      return void 0;
+    }
+    const [databaseSegment] = pathname.split("/");
+    const { label } = options;
+    if (options.allowPath === false) {
+      throw new Error(`[Holo Redis] ${label} cannot include a database path in cluster mode.`);
+    }
+    if (!databaseSegment || !/^\d+$/.test(databaseSegment) || pathname !== databaseSegment) {
+      throw new Error(`[Holo Redis] ${label} database path must be a single integer segment.`);
+    }
+    return Number.parseInt(databaseSegment, 10);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("[Holo Redis]")) {
+      throw error;
+    }
+    return void 0;
+  }
+}
+function normalizeRedisConnectionConfig(name, config2) {
+  const url = normalizeOptionalRedisString(config2.url, `redis connection "${name}" url`);
+  const clusters = normalizeRedisClusterNodes(name, config2.clusters);
+  const socketPath = normalizeOptionalRedisSocketPath(config2.socketPath, `redis connection "${name}" socketPath`);
+  const normalizedSocketPath = deriveNormalizedRedisSocketPath(socketPath, config2.host?.trim());
+  const targetModeCount = [url, clusters, normalizedSocketPath].filter((value) => typeof value !== "undefined").length;
+  if (targetModeCount > 1) {
+    throw new Error(`[Holo Redis] redis connection "${name}" must configure exactly one target mode: url, clusters, or socketPath.`);
+  }
+  const host = config2.host?.trim() || normalizedSocketPath || DEFAULT_REDIS_HOST;
+  const databaseFromUrl = parseRedisDatabaseFromUrl(url, {
+    label: `redis connection "${name}" url`
+  });
+  const database = parseRedisInteger(config2.db ?? databaseFromUrl, DEFAULT_REDIS_DB, `redis connection "${name}" db`, {
+    minimum: 0
+  });
+  if (typeof clusters !== "undefined" && database !== 0) {
+    throw new Error(`[Holo Redis] redis connection "${name}" cannot select redis.db=${database} in cluster mode; Redis Cluster only supports database 0.`);
+  }
+  return Object.freeze({
+    name,
+    ...typeof url === "undefined" ? {} : { url },
+    ...typeof clusters === "undefined" ? {} : { clusters },
+    ...typeof normalizedSocketPath === "undefined" ? {} : { socketPath: normalizedSocketPath },
+    host,
+    port: parseRedisInteger(config2.port, DEFAULT_REDIS_PORT, `redis connection "${name}" port`, {
+      minimum: 1
+    }),
+    username: config2.username?.trim() || void 0,
+    password: config2.password?.trim() || void 0,
+    db: database
+  });
+}
+function normalizeRedisConnections(connections) {
+  if (!connections || Object.keys(connections).length === 0) {
+    return holoRedisDefaults.connections;
+  }
+  return Object.freeze(Object.fromEntries(
+    Object.entries(connections).map(([name, config2]) => {
+      const normalizedName = normalizeRedisConnectionName(name, "Redis connection name");
+      return [normalizedName, normalizeRedisConnectionConfig(normalizedName, config2)];
+    })
+  ));
+}
+function resolveNormalizedRedisConnection(redisConfig, connectionName, label) {
+  const { connections } = redisConfig;
+  const resolved = connections[connectionName];
+  if (!resolved) {
+    throw new Error(`[Holo Redis] ${label} "${connectionName}" is not configured.`);
+  }
+  return resolved;
+}
+function parseSecurityInteger(value, fallback, label, options = {}) {
+  const normalized = typeof value === "undefined" ? fallback : typeof value === "number" ? value : (() => {
+    const trimmed = value.trim();
+    if (!trimmed) {
+      return Number.NaN;
+    }
+    return Number(trimmed);
+  })();
+  if (!Number.isFinite(normalized) || !Number.isInteger(normalized)) {
+    throw new Error(`[Holo Security] ${label} must be an integer.`);
+  }
+  if (typeof options.minimum === "number" && normalized < options.minimum) {
+    throw new Error(`[Holo Security] ${label} must be greater than or equal to ${options.minimum}.`);
+  }
+  return normalized;
+}
+function normalizeSecurityName(value, label) {
+  const normalized = value?.trim();
+  if (!normalized) {
+    throw new Error(`[Holo Security] ${label} must be a non-empty string.`);
+  }
+  return normalized;
+}
+function normalizeSecurityOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+function normalizeSyncConnection(name, config2) {
+  return Object.freeze({
+    name,
+    driver: "sync",
+    queue: normalizeQueueName(config2.queue)
+  });
+}
+function normalizeRedisConnection(name, config2, redisConfig) {
+  const explicitConnectionName = config2.connection?.trim();
+  const connectionName = explicitConnectionName || redisConfig?.default;
+  if (!connectionName) {
+    throw new Error(
+      `[@holo-js/config] Queue Redis connection "${name}" requires a top-level redis config with a default connection or an explicit connection name.`
+    );
+  }
+  if (!redisConfig) {
+    throw new Error(
+      `[@holo-js/config] Queue Redis connection "${name}" references shared Redis connection "${connectionName}" but no top-level redis config is loaded.`
+    );
+  }
+  const resolvedRedisConnection = resolveNormalizedRedisConnection(
+    redisConfig,
+    connectionName,
+    "Queue Redis connection"
+  );
+  return Object.freeze({
+    name,
+    driver: "redis",
+    connection: resolvedRedisConnection.name,
+    queue: normalizeQueueName(config2.queue),
+    retryAfter: parseInteger(config2.retryAfter, DEFAULT_QUEUE_RETRY_AFTER, `queue connection "${name}" retryAfter`, {
+      minimum: 0
+    }),
+    blockFor: parseInteger(config2.blockFor, DEFAULT_QUEUE_BLOCK_FOR, `queue connection "${name}" blockFor`, {
+      minimum: 0
+    }),
+    redis: Object.freeze({
+      ...typeof resolvedRedisConnection.url === "undefined" ? {} : { url: resolvedRedisConnection.url },
+      ...typeof resolvedRedisConnection.clusters === "undefined" ? {} : { clusters: resolvedRedisConnection.clusters },
+      host: resolvedRedisConnection.host,
+      port: resolvedRedisConnection.port,
+      password: resolvedRedisConnection.password,
+      username: resolvedRedisConnection.username,
+      db: resolvedRedisConnection.db
+    })
+  });
+}
+function normalizeDatabaseConnection(name, config2) {
+  return Object.freeze({
+    name,
+    driver: "database",
+    queue: normalizeQueueName(config2.queue),
+    retryAfter: parseInteger(config2.retryAfter, DEFAULT_QUEUE_RETRY_AFTER, `queue connection "${name}" retryAfter`, {
+      minimum: 0
+    }),
+    sleep: parseInteger(config2.sleep, DEFAULT_QUEUE_SLEEP, `queue connection "${name}" sleep`, {
+      minimum: 0
+    }),
+    connection: config2.connection?.trim() || DEFAULT_FAILED_JOBS_CONNECTION,
+    table: config2.table?.trim() || DEFAULT_DATABASE_QUEUE_TABLE
+  });
+}
+function normalizeConnectionConfig(name, config2, redisConfig) {
+  switch (config2.driver) {
+    case "sync":
+      return normalizeSyncConnection(name, config2);
+    case "redis":
+      return normalizeRedisConnection(name, config2, redisConfig);
+    case "database":
+      return normalizeDatabaseConnection(name, config2);
+    default:
+      throw new Error(`[Holo Queue] Unsupported queue driver "${String(config2.driver)}" on connection "${name}".`);
+  }
+}
+function normalizeConnections(connections, redisConfig) {
+  if (!connections || Object.keys(connections).length === 0) {
+    return DEFAULT_QUEUE_CONFIG.connections;
+  }
+  const normalizedEntries = Object.entries(connections).map(([name, config2]) => {
+    const normalizedName = normalizeConnectionName(name, "Queue connection name");
+    return [normalizedName, normalizeConnectionConfig(normalizedName, config2, redisConfig)];
+  });
+  return Object.freeze(Object.fromEntries(normalizedEntries));
+}
+function normalizeFailedStore(config2) {
+  if (config2 === false) {
+    return false;
+  }
+  const normalized = config2 ?? DEFAULT_QUEUE_CONFIG.failed;
+  if (normalized.driver && normalized.driver !== "database") {
+    throw new Error(`[Holo Queue] Unsupported failed job store driver "${normalized.driver}".`);
+  }
+  return Object.freeze({
+    driver: "database",
+    connection: normalized.connection?.trim() || DEFAULT_FAILED_JOBS_CONNECTION,
+    table: normalized.table?.trim() || DEFAULT_FAILED_JOBS_TABLE
+  });
+}
+var holoQueueDefaultsNormalized = DEFAULT_QUEUE_CONFIG;
 function normalizeAppEnv(value, fallback = "development") {
   if (!value) {
     return fallback;
@@ -71,6 +792,376 @@ function normalizeAppConfig(config2 = {}) {
     seeders: project.seeders
   });
 }
+function normalizeSessionStoreConfig(name, config2, redisConfig) {
+  switch (config2.driver) {
+    case "database": {
+      const databaseConfig = config2;
+      return Object.freeze({
+        name,
+        driver: "database",
+        connection: databaseConfig.connection?.trim() || DEFAULT_SESSION_DATABASE_CONNECTION,
+        table: databaseConfig.table?.trim() || DEFAULT_SESSION_DATABASE_TABLE
+      });
+    }
+    case "file": {
+      const fileConfig = config2;
+      return Object.freeze({
+        name,
+        driver: "file",
+        path: fileConfig.path?.trim() || DEFAULT_SESSION_FILE_PATH
+      });
+    }
+    case "redis": {
+      const redisStoreConfig = config2;
+      const configuredConnection = redisStoreConfig.connection?.trim();
+      const connectionName = configuredConnection || redisConfig?.default;
+      if (!connectionName) {
+        throw new Error(
+          `[@holo-js/config] Session Redis store "${name}" requires a top-level redis config with a default connection or an explicit connection name.`
+        );
+      }
+      if (!redisConfig) {
+        throw new Error(
+          `[@holo-js/config] Session Redis store "${name}" references shared Redis connection "${connectionName}" but no top-level redis config is loaded.`
+        );
+      }
+      const resolvedConnection = resolveNormalizedRedisConnection(
+        redisConfig,
+        connectionName,
+        "Session Redis store"
+      );
+      return Object.freeze({
+        name,
+        driver: "redis",
+        connection: resolvedConnection.name,
+        ...typeof resolvedConnection.url === "undefined" ? {} : { url: resolvedConnection.url },
+        ...typeof resolvedConnection.clusters === "undefined" ? {} : { clusters: resolvedConnection.clusters },
+        host: resolvedConnection.host,
+        port: resolvedConnection.port,
+        username: resolvedConnection.username,
+        password: resolvedConnection.password,
+        db: resolvedConnection.db,
+        prefix: redisStoreConfig.prefix?.trim() || ""
+      });
+    }
+    default:
+      throw new Error(`[Holo Session] Unsupported session store driver "${String(config2.driver)}" on store "${name}".`);
+  }
+}
+function normalizeSessionConfig(config2 = {}, redisConfig) {
+  const stores = !config2.stores || Object.keys(config2.stores).length === 0 ? holoSessionDefaults.stores : Object.freeze(Object.fromEntries(Object.entries(config2.stores).map(([name, store]) => {
+    const normalizedName = normalizeConnectionName(name, "Session store name");
+    return [normalizedName, normalizeSessionStoreConfig(normalizedName, store, redisConfig)];
+  })));
+  const configuredDriver = config2.driver?.trim();
+  const driver = configuredDriver || (DEFAULT_SESSION_DRIVER in stores ? DEFAULT_SESSION_DRIVER : void 0) || Object.keys(stores)[0] || DEFAULT_SESSION_DRIVER;
+  if (!(driver in stores)) {
+    throw new Error(`[Holo Session] default session driver "${driver}" is not configured.`);
+  }
+  const cookie = config2.cookie ?? {};
+  const sameSite = cookie.sameSite ?? DEFAULT_SESSION_COOKIE_SAME_SITE;
+  if (sameSite !== "lax" && sameSite !== "strict" && sameSite !== "none") {
+    throw new Error(`[Holo Session] cookie sameSite must be "lax", "strict", or "none".`);
+  }
+  const idleTimeout = parseInteger(config2.idleTimeout, DEFAULT_SESSION_IDLE_TIMEOUT, "session idleTimeout", {
+    minimum: 0
+  });
+  const absoluteLifetime = parseInteger(
+    config2.absoluteLifetime,
+    DEFAULT_SESSION_ABSOLUTE_LIFETIME,
+    "session absoluteLifetime",
+    {
+      minimum: 0
+    }
+  );
+  const rememberMeLifetime = parseInteger(
+    config2.rememberMeLifetime,
+    DEFAULT_SESSION_REMEMBER_ME_LIFETIME,
+    "session rememberMeLifetime",
+    {
+      minimum: 0
+    }
+  );
+  return Object.freeze({
+    driver,
+    stores,
+    cookie: Object.freeze({
+      name: cookie.name?.trim() || DEFAULT_SESSION_COOKIE_NAME,
+      path: cookie.path?.trim() || DEFAULT_SESSION_COOKIE_PATH,
+      domain: cookie.domain?.trim() || void 0,
+      secure: cookie.secure ?? false,
+      httpOnly: cookie.httpOnly ?? true,
+      sameSite,
+      partitioned: cookie.partitioned ?? false,
+      maxAge: parseInteger(cookie.maxAge, absoluteLifetime, "session cookie maxAge", {
+        minimum: 0
+      })
+    }),
+    idleTimeout,
+    absoluteLifetime,
+    rememberMeLifetime
+  });
+}
+function normalizeSecurityLimiter(name, config2) {
+  const key = typeof config2.key === "function" ? config2.key : void 0;
+  if (typeof config2.key !== "undefined" && typeof config2.key !== "function") {
+    throw new Error(`[Holo Security] rate limiter "${name}" key resolver must be a function when provided.`);
+  }
+  return Object.freeze({
+    name,
+    maxAttempts: parseSecurityInteger(config2.maxAttempts, 0, `rate limiter "${name}" maxAttempts`, {
+      minimum: 1
+    }),
+    decaySeconds: parseSecurityInteger(config2.decaySeconds, 0, `rate limiter "${name}" decaySeconds`, {
+      minimum: 1
+    }),
+    ...key ? { key } : {}
+  });
+}
+function normalizeSecurityRateLimitConfig(config2, redisConfig) {
+  const driver = normalizeSecurityOptionalString(config2?.driver) || DEFAULT_SECURITY_RATE_LIMIT_DRIVER;
+  if (driver !== "memory" && driver !== "file" && driver !== "redis") {
+    throw new Error(`[Holo Security] Unsupported rate limit driver "${driver}".`);
+  }
+  const file = config2?.file ?? {};
+  const redis = config2?.redis ?? {};
+  const limiters = !config2?.limiters || Object.keys(config2.limiters).length === 0 ? holoSecurityDefaults.rateLimit.limiters : Object.freeze(Object.fromEntries(Object.entries(config2.limiters).map(([name, limiter]) => {
+    const normalizedName = normalizeSecurityName(name, "Rate limiter name");
+    return [normalizedName, normalizeSecurityLimiter(normalizedName, limiter)];
+  })));
+  return Object.freeze({
+    driver,
+    memory: Object.freeze({
+      driver: "memory"
+    }),
+    file: Object.freeze({
+      path: normalizeSecurityOptionalString(file.path) || DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH
+    }),
+    redis: Object.freeze((() => {
+      const connectionName = normalizeSecurityOptionalString(redis.connection) || redisConfig?.default || DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION;
+      const resolvedConnection = redisConfig ? resolveNormalizedRedisConnection(
+        redisConfig,
+        connectionName,
+        "Security rate-limit Redis connection"
+      ) : driver === "redis" ? (() => {
+        throw new Error(
+          `[@holo-js/config] Security rate-limit Redis config references shared Redis connection "${connectionName}" but no top-level redis config is loaded.`
+        );
+      })() : {
+        name: connectionName,
+        host: DEFAULT_REDIS_HOST,
+        port: DEFAULT_REDIS_PORT,
+        password: void 0,
+        username: void 0,
+        db: DEFAULT_REDIS_DB
+      };
+      return {
+        ...typeof resolvedConnection.url === "undefined" ? {} : { url: resolvedConnection.url },
+        ...typeof resolvedConnection.clusters === "undefined" ? {} : { clusters: resolvedConnection.clusters },
+        host: resolvedConnection.host,
+        port: resolvedConnection.port,
+        password: resolvedConnection.password,
+        username: resolvedConnection.username,
+        db: resolvedConnection.db,
+        connection: resolvedConnection.name,
+        prefix: normalizeSecurityOptionalString(redis.prefix) || DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX
+      };
+    })()),
+    limiters
+  });
+}
+function normalizeSecurityConfig(config2 = {}, redisConfig) {
+  const csrf = typeof config2.csrf === "boolean" ? { enabled: config2.csrf } : config2.csrf ?? {};
+  const except = csrf.except ? Object.freeze(csrf.except.map((value, index) => {
+    const normalized = value.trim();
+    if (!normalized) {
+      throw new Error(`[Holo Security] csrf except entry at index ${index} must be a non-empty string.`);
+    }
+    return normalized;
+  })) : DEFAULT_SECURITY_CSRF_CONFIG.except;
+  return Object.freeze({
+    csrf: Object.freeze({
+      enabled: csrf.enabled ?? DEFAULT_SECURITY_CSRF_CONFIG.enabled,
+      field: normalizeSecurityOptionalString(csrf.field) || DEFAULT_SECURITY_CSRF_FIELD,
+      header: normalizeSecurityOptionalString(csrf.header) || DEFAULT_SECURITY_CSRF_HEADER,
+      cookie: normalizeSecurityOptionalString(csrf.cookie) || DEFAULT_SECURITY_CSRF_COOKIE,
+      except
+    }),
+    rateLimit: normalizeSecurityRateLimitConfig(config2.rateLimit, redisConfig)
+  });
+}
+function normalizeAuthProvider(name, config2) {
+  const identifiers = Object.freeze(
+    Array.from(new Set((config2.identifiers ?? DEFAULT_AUTH_IDENTIFIERS).map((value) => normalizeNonEmptyString(value, `[Holo Auth] provider "${name}" identifier entries must be non-empty strings.`))))
+  );
+  if (identifiers.length === 0) {
+    throw new Error(`[Holo Auth] provider "${name}" must declare at least one identifier.`);
+  }
+  return Object.freeze({
+    name,
+    model: normalizeNonEmptyString(config2.model, `[Holo Auth] provider "${name}" model must be a non-empty string.`),
+    identifiers
+  });
+}
+function normalizeAuthGuard(name, config2, providers) {
+  const provider = config2.provider?.trim() || DEFAULT_AUTH_PROVIDER;
+  if (!(provider in providers)) {
+    throw new Error(`[Holo Auth] guard "${name}" references unknown provider "${provider}".`);
+  }
+  if (config2.driver !== "session" && config2.driver !== "token") {
+    throw new Error(`[Holo Auth] Unsupported auth guard driver "${String(config2.driver)}" on guard "${name}".`);
+  }
+  return Object.freeze({
+    name,
+    driver: config2.driver,
+    provider
+  });
+}
+function normalizePasswordBroker(name, config2, providers) {
+  const provider = config2.provider?.trim() || DEFAULT_AUTH_PROVIDER;
+  if (!(provider in providers)) {
+    throw new Error(`[Holo Auth] password broker "${name}" references unknown provider "${provider}".`);
+  }
+  return Object.freeze({
+    name,
+    provider,
+    table: config2.table?.trim() || DEFAULT_AUTH_PASSWORD_RESET_TABLE,
+    expire: parseInteger(config2.expire, DEFAULT_AUTH_PASSWORD_EXPIRE, `auth password broker "${name}" expire`, {
+      minimum: 0
+    }),
+    throttle: parseInteger(config2.throttle, DEFAULT_AUTH_PASSWORD_THROTTLE, `auth password broker "${name}" throttle`, {
+      minimum: 0
+    })
+  });
+}
+function normalizeSocialProvider(name, config2, guards, providers) {
+  const guard = config2.guard?.trim();
+  if (guard && !(guard in guards)) {
+    throw new Error(`[Holo Auth] social provider "${name}" references unknown guard "${guard}".`);
+  }
+  const mapToProvider = config2.mapToProvider?.trim();
+  if (mapToProvider && !(mapToProvider in providers)) {
+    throw new Error(`[Holo Auth] social provider "${name}" references unknown provider "${mapToProvider}".`);
+  }
+  return Object.freeze({
+    name,
+    runtime: config2.runtime?.trim() || void 0,
+    clientId: config2.clientId?.trim() || void 0,
+    clientSecret: config2.clientSecret?.trim() || void 0,
+    redirectUri: config2.redirectUri?.trim() || void 0,
+    scopes: Object.freeze([...config2.scopes ?? []]),
+    guard,
+    mapToProvider,
+    encryptTokens: config2.encryptTokens === true
+  });
+}
+function normalizeWorkosProvider(name, config2, guards, providers) {
+  const guard = config2.guard?.trim();
+  if (guard && !(guard in guards)) {
+    throw new Error(`[Holo Auth] WorkOS provider "${name}" references unknown guard "${guard}".`);
+  }
+  const mapToProvider = config2.mapToProvider?.trim();
+  if (mapToProvider && !(mapToProvider in providers)) {
+    throw new Error(`[Holo Auth] WorkOS provider "${name}" references unknown provider "${mapToProvider}".`);
+  }
+  return Object.freeze({
+    name,
+    clientId: config2.clientId?.trim() || void 0,
+    apiKey: config2.apiKey?.trim() || void 0,
+    cookiePassword: config2.cookiePassword?.trim() || void 0,
+    redirectUri: config2.redirectUri?.trim() || void 0,
+    sessionCookie: config2.sessionCookie?.trim() || DEFAULT_WORKOS_SESSION_COOKIE,
+    guard,
+    mapToProvider
+  });
+}
+function normalizeClerkProvider(name, config2, guards, providers) {
+  const guard = config2.guard?.trim();
+  if (guard && !(guard in guards)) {
+    throw new Error(`[Holo Auth] Clerk provider "${name}" references unknown guard "${guard}".`);
+  }
+  const mapToProvider = config2.mapToProvider?.trim();
+  if (mapToProvider && !(mapToProvider in providers)) {
+    throw new Error(`[Holo Auth] Clerk provider "${name}" references unknown provider "${mapToProvider}".`);
+  }
+  return Object.freeze({
+    name,
+    publishableKey: config2.publishableKey?.trim() || void 0,
+    secretKey: config2.secretKey?.trim() || void 0,
+    jwtKey: config2.jwtKey?.trim() || void 0,
+    apiUrl: config2.apiUrl?.trim() || void 0,
+    frontendApi: config2.frontendApi?.trim() || void 0,
+    sessionCookie: config2.sessionCookie?.trim() || DEFAULT_CLERK_SESSION_COOKIE,
+    authorizedParties: Object.freeze((config2.authorizedParties ?? []).map((value) => value.trim()).filter(Boolean)),
+    guard,
+    mapToProvider
+  });
+}
+function normalizeAuthConfig(config2 = {}) {
+  const providers = !config2.providers || Object.keys(config2.providers).length === 0 ? holoAuthDefaults.providers : Object.freeze(Object.fromEntries(Object.entries(config2.providers).map(([name, provider]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth provider name");
+    return [normalizedName, normalizeAuthProvider(normalizedName, provider)];
+  })));
+  const guards = !config2.guards || Object.keys(config2.guards).length === 0 ? Object.freeze({
+    [DEFAULT_AUTH_GUARD]: normalizeAuthGuard(
+      DEFAULT_AUTH_GUARD,
+      holoAuthDefaults.guards[DEFAULT_AUTH_GUARD],
+      providers
+    )
+  }) : Object.freeze(Object.fromEntries(Object.entries(config2.guards).map(([name, guard]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth guard name");
+    return [normalizedName, normalizeAuthGuard(normalizedName, guard, providers)];
+  })));
+  const passwords = !config2.passwords || Object.keys(config2.passwords).length === 0 ? Object.freeze({
+    [DEFAULT_AUTH_PASSWORD_BROKER]: normalizePasswordBroker(
+      DEFAULT_AUTH_PASSWORD_BROKER,
+      holoAuthDefaults.passwords[DEFAULT_AUTH_PASSWORD_BROKER],
+      providers
+    )
+  }) : Object.freeze(Object.fromEntries(Object.entries(config2.passwords).map(([name, broker]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth password broker name");
+    return [normalizedName, normalizePasswordBroker(normalizedName, broker, providers)];
+  })));
+  const defaultGuard = config2.defaults?.guard?.trim() || DEFAULT_AUTH_GUARD;
+  if (!(defaultGuard in guards)) {
+    throw new Error(`[Holo Auth] default auth guard "${defaultGuard}" is not configured.`);
+  }
+  const defaultPasswords = config2.defaults?.passwords?.trim() || DEFAULT_AUTH_PASSWORD_BROKER;
+  if (!(defaultPasswords in passwords)) {
+    throw new Error(`[Holo Auth] default password broker "${defaultPasswords}" is not configured.`);
+  }
+  const social = !config2.social || Object.keys(config2.social).length === 0 ? holoAuthDefaults.social : Object.freeze(Object.fromEntries(Object.entries(config2.social).map(([name, provider]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth social provider name");
+    return [normalizedName, normalizeSocialProvider(normalizedName, provider, guards, providers)];
+  })));
+  const workos = !config2.workos || Object.keys(config2.workos).length === 0 ? holoAuthDefaults.workos : Object.freeze(Object.fromEntries(Object.entries(config2.workos).map(([name, provider]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth WorkOS provider name");
+    return [normalizedName, normalizeWorkosProvider(normalizedName, provider, guards, providers)];
+  })));
+  const clerk = !config2.clerk || Object.keys(config2.clerk).length === 0 ? holoAuthDefaults.clerk : Object.freeze(Object.fromEntries(Object.entries(config2.clerk).map(([name, provider]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth Clerk provider name");
+    return [normalizedName, normalizeClerkProvider(normalizedName, provider, guards, providers)];
+  })));
+  return Object.freeze({
+    defaults: Object.freeze({
+      guard: defaultGuard,
+      passwords: defaultPasswords
+    }),
+    guards,
+    providers,
+    passwords,
+    emailVerification: Object.freeze({
+      required: typeof config2.emailVerification === "boolean" ? config2.emailVerification : config2.emailVerification?.required ?? false
+    }),
+    personalAccessTokens: Object.freeze({
+      defaultAbilities: Object.freeze([...config2.personalAccessTokens?.defaultAbilities ?? []])
+    }),
+    socialEncryptionKey: config2.socialEncryptionKey?.trim() || void 0,
+    social,
+    workos,
+    clerk
+  });
+}
 function normalizeDatabaseConfig(config2 = {}) {
   const configuredConnections = config2.connections;
   const connections = configuredConnections && Object.keys(configuredConnections).length > 0 ? Object.freeze({ ...configuredConnections }) : holoDatabaseDefaults.connections;
@@ -91,8 +1182,357 @@ function normalizeStorageConfig(config2 = {}) {
     })
   });
 }
-function normalizeQueueConfigForHolo(config2 = {}) {
-  return normalizeQueueConfig(config2);
+function normalizeOptionalBroadcastString(value, label) {
+  if (typeof value === "undefined") {
+    return void 0;
+  }
+  const normalized = String(value).trim();
+  if (!normalized) {
+    throw new Error(`[Holo Broadcast] ${label} must be a non-empty string when provided.`);
+  }
+  return normalized;
+}
+function normalizeBroadcastPort(value, fallback, label) {
+  const normalized = typeof value === "number" ? value : typeof value === "string" && value.trim() ? Number(value.trim()) : fallback;
+  if (!Number.isInteger(normalized) || normalized <= 0) {
+    throw new Error(`[Holo Broadcast] ${label} must be a positive integer.`);
+  }
+  return normalized;
+}
+function normalizeBroadcastScheme(value, fallback, label) {
+  const normalized = normalizeOptionalBroadcastString(value, label)?.toLowerCase();
+  if (typeof normalized === "undefined") {
+    return fallback;
+  }
+  if (normalized !== "http" && normalized !== "https") {
+    throw new Error(`[Holo Broadcast] ${label} must be "http" or "https".`);
+  }
+  return normalized;
+}
+function normalizeBroadcastConnectionOptions(options, fallbackHost, label) {
+  const scheme = normalizeBroadcastScheme(
+    options?.scheme,
+    options?.useTLS === false ? "http" : "https",
+    `${label} scheme`
+  );
+  const resolvedFallbackPort = scheme === "http" ? DEFAULT_BROADCAST_HTTP_PORT : DEFAULT_BROADCAST_HTTPS_PORT;
+  return Object.freeze({
+    host: normalizeOptionalBroadcastString(options?.host, `${label} host`) ?? fallbackHost,
+    port: normalizeBroadcastPort(options?.port, resolvedFallbackPort, `${label} port`),
+    scheme,
+    useTLS: options?.useTLS ?? scheme === "https",
+    cluster: normalizeOptionalBroadcastString(options?.cluster, `${label} cluster`) ?? void 0
+  });
+}
+function normalizeBroadcastWorkerConfig(worker) {
+  const scaling = worker?.scaling;
+  const publicScheme = normalizeBroadcastScheme(worker?.publicScheme, "https", "Broadcast worker public scheme");
+  if (scaling && scaling.driver !== "redis") {
+    throw new Error('[Holo Broadcast] Broadcast worker scaling driver must be "redis".');
+  }
+  return Object.freeze({
+    host: normalizeOptionalBroadcastString(worker?.host, "Broadcast worker host") ?? DEFAULT_BROADCAST_WORKER_HOST,
+    port: normalizeBroadcastPort(worker?.port, DEFAULT_BROADCAST_WORKER_PORT, "Broadcast worker port"),
+    path: normalizeOptionalBroadcastString(worker?.path, "Broadcast worker path") ?? DEFAULT_BROADCAST_WORKER_PATH,
+    publicHost: normalizeOptionalBroadcastString(worker?.publicHost, "Broadcast worker public host") ?? void 0,
+    publicPort: typeof worker?.publicPort === "undefined" ? publicScheme === "http" ? DEFAULT_BROADCAST_HTTP_PORT : void 0 : normalizeBroadcastPort(
+      worker.publicPort,
+      /* v8 ignore next -- defensive HTTPS port default; tests only exercise HTTP scheme */
+      publicScheme === "http" ? DEFAULT_BROADCAST_HTTP_PORT : DEFAULT_BROADCAST_HTTPS_PORT,
+      "Broadcast worker public port"
+    ),
+    publicScheme,
+    healthPath: normalizeOptionalBroadcastString(worker?.healthPath, "Broadcast worker health path") ?? DEFAULT_BROADCAST_HEALTH_PATH,
+    statsPath: normalizeOptionalBroadcastString(worker?.statsPath, "Broadcast worker stats path") ?? DEFAULT_BROADCAST_STATS_PATH,
+    scaling: scaling && typeof scaling === "object" ? Object.freeze({
+      driver: "redis",
+      connection: normalizeOptionalBroadcastString(scaling.connection, "Broadcast worker scaling connection") ?? "default"
+    }) : holoBroadcastDefaults.worker.scaling
+  });
+}
+function normalizeBroadcastConnection(name, connection) {
+  const normalizedName = normalizeOptionalBroadcastString(name, "Broadcast connection name");
+  const driver = normalizeOptionalBroadcastString(connection.driver, `Broadcast connection "${name}" driver`);
+  if (!normalizedName || !driver) {
+    throw new Error("[Holo Broadcast] Broadcast connections must define a name and driver.");
+  }
+  const clientOptions = Object.freeze({
+    ...connection.clientOptions ?? {}
+  });
+  if (driver === "holo") {
+    return Object.freeze({
+      name: normalizedName,
+      driver: "holo",
+      key: normalizeOptionalBroadcastString(connection.key, `Broadcast connection "${name}" key`) ?? (() => {
+        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a key.`);
+      })(),
+      secret: normalizeOptionalBroadcastString(connection.secret, `Broadcast connection "${name}" secret`) ?? (() => {
+        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a secret.`);
+      })(),
+      appId: normalizeOptionalBroadcastString(connection.appId, `Broadcast connection "${name}" appId`) ?? (() => {
+        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define an appId.`);
+      })(),
+      options: normalizeBroadcastConnectionOptions(connection.options, DEFAULT_BROADCAST_HOST, `Broadcast connection "${name}" options`),
+      clientOptions
+    });
+  }
+  if (driver === "pusher") {
+    const cluster = normalizeOptionalBroadcastString(connection.options?.cluster, `Broadcast connection "${name}" cluster`) ?? void 0;
+    return Object.freeze({
+      name: normalizedName,
+      driver: "pusher",
+      key: normalizeOptionalBroadcastString(connection.key, `Broadcast connection "${name}" key`) ?? (() => {
+        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a key.`);
+      })(),
+      secret: normalizeOptionalBroadcastString(connection.secret, `Broadcast connection "${name}" secret`) ?? (() => {
+        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a secret.`);
+      })(),
+      appId: normalizeOptionalBroadcastString(connection.appId, `Broadcast connection "${name}" appId`) ?? (() => {
+        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define an appId.`);
+      })(),
+      options: normalizeBroadcastConnectionOptions(
+        {
+          ...connection.options,
+          cluster
+        },
+        normalizeOptionalBroadcastString(connection.options?.host, `Broadcast connection "${name}" host`) ?? (cluster ? `api-${cluster}.pusher.com` : "api-mt1.pusher.com"),
+        `Broadcast connection "${name}" options`
+      ),
+      clientOptions
+    });
+  }
+  if (driver === "log") {
+    return Object.freeze({
+      name: normalizedName,
+      driver: "log",
+      clientOptions
+    });
+  }
+  if (driver === "null") {
+    return Object.freeze({
+      name: normalizedName,
+      driver: "null",
+      clientOptions
+    });
+  }
+  if (driver === "ably") {
+    throw new Error('[Holo Broadcast] Broadcast driver "ably" is not supported yet.');
+  }
+  const {
+    driver: _ignoredDriver,
+    clientOptions: _ignoredClientOptions,
+    ...customConfig
+  } = connection;
+  return Object.freeze({
+    driver,
+    clientOptions,
+    ...customConfig,
+    name: normalizedName
+  });
+}
+function normalizeBroadcastConfig(config2 = {}) {
+  const normalizedConnections = Object.fromEntries(
+    Object.entries(config2.connections ?? holoBroadcastDefaults.connections).map(([name, connection]) => [name, normalizeBroadcastConnection(name, connection)])
+  );
+  const defaultConnection = normalizeOptionalBroadcastString(config2.default, "Default broadcast connection") ?? holoBroadcastDefaults.default;
+  if (!normalizedConnections[defaultConnection]) {
+    throw new Error(
+      `[Holo Broadcast] default broadcast connection "${defaultConnection}" is not configured. Available connections: ${Object.keys(normalizedConnections).join(", ")}`
+    );
+  }
+  return Object.freeze({
+    default: defaultConnection,
+    connections: Object.freeze(normalizedConnections),
+    worker: normalizeBroadcastWorkerConfig(config2.worker)
+  });
+}
+function normalizeOptionalMailString(value, label) {
+  if (typeof value === "undefined") {
+    return void 0;
+  }
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`[Holo Mail] ${label} must be a non-empty string when provided.`);
+  }
+  return normalized;
+}
+function isValidMailAddress(email) {
+  if (email.includes(" ")) {
+    return false;
+  }
+  const parts = email.split("@");
+  return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;
+}
+function normalizeMailAddress(address, label) {
+  if (!address) {
+    return void 0;
+  }
+  const email = normalizeOptionalMailString(address.email, `${label} email`)?.toLowerCase();
+  if (!email || !isValidMailAddress(email)) {
+    throw new Error(`[Holo Mail] ${label} email must be a valid email address.`);
+  }
+  const name = normalizeOptionalMailString(address.name, `${label} name`);
+  return Object.freeze({
+    email,
+    ...name ? { name } : {}
+  });
+}
+function normalizeMailQueueConfig(queue, fallback = holoMailDefaults.queue) {
+  return Object.freeze({
+    queued: queue?.queued ?? fallback.queued,
+    connection: normalizeOptionalMailString(queue?.connection, "Mail queue connection") ?? fallback.connection,
+    queue: normalizeOptionalMailString(queue?.queue, "Mail queue name") ?? fallback.queue,
+    afterCommit: queue?.afterCommit ?? fallback.afterCommit
+  });
+}
+function normalizeMailPreviewEnvironments(environments) {
+  if (typeof environments === "undefined") {
+    return holoMailDefaults.preview.allowedEnvironments;
+  }
+  const normalized = /* @__PURE__ */ new Set();
+  for (const environment of environments) {
+    if (environment !== "development" && environment !== "production" && environment !== "test") {
+      throw new Error("[Holo Mail] Mail preview environments must be development, production, or test.");
+    }
+    normalized.add(environment);
+  }
+  return Object.freeze([...normalized]);
+}
+function normalizeMailMailerConfig(name, config2, fallback) {
+  const normalizedName = normalizeOptionalMailString(name, "Mail mailer name");
+  const driver = normalizeOptionalMailString(config2.driver, `Mail mailer "${name}" driver`);
+  if (!normalizedName || !driver) {
+    throw new Error("[Holo Mail] Mailers must define a name and driver.");
+  }
+  const base = {
+    name: normalizedName,
+    driver,
+    from: normalizeMailAddress(config2.from, `Mail mailer "${name}" from`) ?? fallback?.from,
+    replyTo: normalizeMailAddress(config2.replyTo, `Mail mailer "${name}" replyTo`) ?? fallback?.replyTo,
+    queue: normalizeMailQueueConfig(config2.queue, fallback?.queue ?? holoMailDefaults.queue)
+  };
+  if (driver === "preview") {
+    const previewFallback = fallback?.driver === "preview" ? fallback : void 0;
+    return Object.freeze({
+      ...base,
+      driver: "preview",
+      path: normalizeOptionalMailString(config2.path, `Mail mailer "${name}" preview path`) ?? previewFallback?.path ?? DEFAULT_MAIL_PREVIEW_PATH
+    });
+  }
+  if (driver === "log") {
+    const logFallback = fallback?.driver === "log" ? fallback : void 0;
+    return Object.freeze({
+      ...base,
+      driver: "log",
+      logBodies: config2.logBodies ?? logFallback?.logBodies ?? false
+    });
+  }
+  if (driver === "fake") {
+    return Object.freeze({
+      ...base,
+      driver: "fake"
+    });
+  }
+  if (driver === "smtp") {
+    const smtpFallback = fallback?.driver === "smtp" ? fallback : void 0;
+    const rawPort = config2.port;
+    const normalizedPort = typeof rawPort === "number" ? rawPort : typeof rawPort === "string" && rawPort.trim() ? Number(rawPort.trim()) : smtpFallback?.port ?? DEFAULT_SMTP_PORT;
+    if (!Number.isFinite(normalizedPort) || normalizedPort <= 0) {
+      throw new Error(`[Holo Mail] Mail mailer "${name}" SMTP port must be a positive number.`);
+    }
+    return Object.freeze({
+      ...base,
+      driver: "smtp",
+      host: normalizeOptionalMailString(config2.host, `Mail mailer "${name}" SMTP host`) ?? smtpFallback?.host ?? DEFAULT_SMTP_HOST,
+      port: normalizedPort,
+      secure: config2.secure ?? smtpFallback?.secure ?? false,
+      user: normalizeOptionalMailString(config2.user, `Mail mailer "${name}" SMTP user`) ?? smtpFallback?.user ?? void 0,
+      password: normalizeOptionalMailString(config2.password, `Mail mailer "${name}" SMTP password`) ?? smtpFallback?.password ?? void 0
+    });
+  }
+  const customFields = Object.fromEntries(
+    Object.entries(config2).filter(([key]) => key !== "driver" && key !== "from" && key !== "replyTo" && key !== "queue")
+  );
+  return Object.freeze({
+    ...base,
+    ...customFields
+  });
+}
+function normalizeMailConfig(config2 = {}) {
+  const mergedMailers = {
+    ...holoMailDefaults.mailers
+  };
+  for (const [name, mailer] of Object.entries(config2.mailers ?? {})) {
+    mergedMailers[name] = normalizeMailMailerConfig(name, mailer, mergedMailers[name]);
+  }
+  const defaultMailer = normalizeOptionalMailString(config2.default, "Default mailer") ?? holoMailDefaults.default;
+  if (!mergedMailers[defaultMailer]) {
+    throw new Error(
+      `[Holo Mail] default mailer "${defaultMailer}" is not configured. Available mailers: ${Object.keys(mergedMailers).join(", ")}`
+    );
+  }
+  return Object.freeze({
+    default: defaultMailer,
+    from: normalizeMailAddress(config2.from, "Mail from") ?? holoMailDefaults.from,
+    replyTo: normalizeMailAddress(config2.replyTo, "Mail replyTo") ?? holoMailDefaults.replyTo,
+    queue: normalizeMailQueueConfig(config2.queue),
+    preview: Object.freeze({
+      allowedEnvironments: normalizeMailPreviewEnvironments(config2.preview?.allowedEnvironments)
+    }),
+    markdown: Object.freeze({
+      wrapper: normalizeOptionalMailString(config2.markdown?.wrapper, "Mail markdown wrapper") ?? holoMailDefaults.markdown.wrapper
+    }),
+    mailers: Object.freeze(mergedMailers)
+  });
+}
+function normalizeOptionalNotificationsString(value, label) {
+  if (typeof value === "undefined") {
+    return void 0;
+  }
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`[Holo Notifications] ${label} must be a non-empty string when provided.`);
+  }
+  return normalized;
+}
+function normalizeNotificationsConfig(config2 = {}) {
+  return Object.freeze({
+    table: normalizeOptionalNotificationsString(config2.table, "Notifications table") ?? DEFAULT_NOTIFICATIONS_TABLE,
+    queue: Object.freeze({
+      connection: normalizeOptionalNotificationsString(config2.queue?.connection, "Notifications queue connection"),
+      queue: normalizeOptionalNotificationsString(config2.queue?.queue, "Notifications queue name"),
+      afterCommit: config2.queue?.afterCommit === true
+    })
+  });
+}
+function normalizeRedisConfig(config2 = {}) {
+  const connections = normalizeRedisConnections(config2.connections);
+  const connectionNames = Object.keys(connections);
+  const defaultConnection = config2.default?.trim() || connectionNames[0];
+  if (!connections[defaultConnection]) {
+    throw new Error(
+      `[Holo Redis] default redis connection "${defaultConnection}" is not configured. Available connections: ${connectionNames.join(", ")}`
+    );
+  }
+  return Object.freeze({
+    default: defaultConnection,
+    connections
+  });
+}
+function normalizeQueueConfigForHolo(config2 = {}, redisConfig) {
+  const connections = normalizeConnections(config2.connections, redisConfig);
+  const connectionNames = Object.keys(connections);
+  const defaultConnection = config2.default?.trim() || connectionNames[0];
+  if (!connections[defaultConnection]) {
+    throw new Error(
+      `[Holo Queue] default queue connection "${defaultConnection}" is not configured. Available connections: ${connectionNames.join(", ")}`
+    );
+  }
+  return Object.freeze({
+    default: defaultConnection,
+    failed: normalizeFailedStore(config2.failed),
+    connections
+  });
 }
 
 // src/access.ts
@@ -312,11 +1752,11 @@ function resolveEnvPlaceholders(value, envValues) {
 
 // src/loader.ts
 import { mkdir, readFile as readFile2, readdir, rm, writeFile } from "fs/promises";
-import { dirname, extname, join as join2, resolve as resolve2 } from "path";
+import { basename as basename2, dirname, extname, join as join2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 var CONFIG_EXTENSION_PRIORITY = [".ts", ".mts", ".js", ".mjs", ".cts", ".cjs"];
 var SUPPORTED_CONFIG_EXTENSIONS = new Set(CONFIG_EXTENSION_PRIORITY);
-var HOLO_CONFIG_CACHE_VERSION = 1;
+var HOLO_CONFIG_CACHE_VERSION = 3;
 var HOLO_CONFIG_CACHE_PATH = join2(".holo-js", "generated", "config-cache.json");
 var TRANSIENT_CONFIG_IMPORT_MARKER = ".__holo_import_";
 var LEGACY_TRANSIENT_CONFIG_IMPORT_MARKERS = [TRANSIENT_CONFIG_IMPORT_MARKER, ".__native_test__"];
@@ -411,6 +1851,7 @@ async function collectRawConfig(configDir, environmentValues, options = {}) {
   const rawConfig = {};
   const loadedFiles = [];
   const configEntries = await collectConfigEntries(configDir);
+  const allowedConfigNames = options.onlyConfigNames ? new Set(options.onlyConfigNames) : void 0;
   const previousEnvEntries = /* @__PURE__ */ new Map();
   try {
     configureEnvRuntime(environmentValues, {
@@ -427,6 +1868,9 @@ async function collectRawConfig(configDir, environmentValues, options = {}) {
       Reflect.deleteProperty(process.env, "HOLO_CAPTURE_ENV");
     }
     for (const entry of configEntries) {
+      if (allowedConfigNames && !allowedConfigNames.has(entry.configName)) {
+        continue;
+      }
       rawConfig[entry.configName] = resolveConfigExport(await importConfigModule(entry.filePath));
       loadedFiles.push(entry.filePath);
     }
@@ -445,31 +1889,69 @@ async function collectRawConfig(configDir, environmentValues, options = {}) {
     loadedFiles: Object.freeze([...loadedFiles])
   };
 }
+function mergeLoadedFiles(cachedFiles, liveFiles, deferredConfigNames) {
+  const deferredNames = new Set(deferredConfigNames);
+  const retainedCachedFiles = cachedFiles.filter((filePath) => {
+    return !deferredNames.has(getConfigName(basename2(filePath)));
+  });
+  return Object.freeze([
+    ...retainedCachedFiles,
+    ...liveFiles
+  ]);
+}
 function normalizeLoadedConfig(rawConfig, options) {
   const resolvedRawConfig = resolveEnvPlaceholders(rawConfig, options.environment.values);
   const app = normalizeAppConfig(resolvedRawConfig.app);
   const database = normalizeDatabaseConfig(resolvedRawConfig.database);
+  const redis = normalizeRedisConfig(resolvedRawConfig.redis);
+  const resolvedRedisConfig = typeof resolvedRawConfig.redis === "undefined" ? void 0 : redis;
+  const cache = normalizeCacheConfig(resolvedRawConfig.cache, {
+    database,
+    redis: resolvedRedisConfig
+  });
   const storage = normalizeStorageConfig(resolvedRawConfig.storage);
-  const queue = normalizeQueueConfigForHolo(resolvedRawConfig.queue);
+  const queue = normalizeQueueConfigForHolo(resolvedRawConfig.queue, resolvedRedisConfig);
+  const broadcast = normalizeBroadcastConfig(resolvedRawConfig.broadcast);
+  const mail = normalizeMailConfig(resolvedRawConfig.mail);
+  const notifications = normalizeNotificationsConfig(resolvedRawConfig.notifications);
   const media = Object.freeze({ ...resolvedRawConfig.media ?? {} });
+  const session = normalizeSessionConfig(resolvedRawConfig.session, resolvedRedisConfig);
+  const security = normalizeSecurityConfig(resolvedRawConfig.security, resolvedRedisConfig);
+  const auth = normalizeAuthConfig(resolvedRawConfig.auth);
   const customEntries = Object.entries(resolvedRawConfig).filter(([key]) => {
-    return key !== "app" && key !== "database" && key !== "storage" && key !== "queue" && key !== "media";
+    return key !== "app" && key !== "database" && key !== "redis" && key !== "cache" && key !== "storage" && key !== "queue" && key !== "broadcast" && key !== "mail" && key !== "notifications" && key !== "media" && key !== "session" && key !== "security" && key !== "auth";
   });
   const custom = Object.freeze(Object.fromEntries(customEntries));
   const all = Object.freeze({
     app,
     database,
+    redis,
+    cache,
     storage,
     queue,
+    broadcast,
+    mail,
+    notifications,
     media,
+    session,
+    security,
+    auth,
     ...custom
   });
   return {
     app,
     database,
+    redis,
+    cache,
     storage,
     queue,
+    broadcast,
+    mail,
+    notifications,
     media,
+    session,
+    security,
+    auth,
     custom,
     all,
     environment: options.environment,
@@ -489,13 +1971,30 @@ function isSerializableConfigValue(value) {
   }
   return false;
 }
-function assertSerializableConfig(rawConfig) {
-  if (!isSerializableConfigValue(rawConfig)) {
+function splitCacheableConfig(rawConfig) {
+  const cacheableConfig = {};
+  const deferredConfigNames = [];
+  for (const [name, value] of Object.entries(rawConfig)) {
+    if (isSerializableConfigValue(value)) {
+      cacheableConfig[name] = value;
+      continue;
+    }
+    if (name === "security") {
+      deferredConfigNames.push(name);
+      continue;
+    }
     throw new TypeError("Holo config cache only supports plain JSON-serializable config values.");
   }
+  return {
+    cacheableConfig,
+    deferredConfigNames: Object.freeze([...deferredConfigNames])
+  };
+}
+function getDeferredConfigNames(payload) {
+  return Array.isArray(payload.deferredConfigNames) ? payload.deferredConfigNames : Object.freeze([]);
 }
 function isCachePayload(value) {
-  return isObject2(value) && value.version === HOLO_CONFIG_CACHE_VERSION && isObject2(value.environment) && typeof value.environment.name === "string" && Array.isArray(value.environment.loadedFiles) && Array.isArray(value.environment.warnings) && Array.isArray(value.configFiles) && isObject2(value.config);
+  return isObject2(value) && (value.version === 1 || value.version === HOLO_CONFIG_CACHE_VERSION) && isObject2(value.environment) && typeof value.environment.name === "string" && Array.isArray(value.environment.loadedFiles) && Array.isArray(value.environment.warnings) && Array.isArray(value.configFiles) && isObject2(value.config) && (typeof value.deferredConfigNames === "undefined" || Array.isArray(value.deferredConfigNames));
 }
 function resolveConfigCachePath(projectRoot) {
   return join2(resolve2(projectRoot), HOLO_CONFIG_CACHE_PATH);
@@ -524,7 +2023,10 @@ async function writeConfigCache(projectRoot, options = {}) {
   const { rawConfig, loadedFiles } = await collectRawConfig(configDir, environment.values, {
     captureEnvPlaceholders: true
   });
-  assertSerializableConfig(rawConfig);
+  const {
+    cacheableConfig,
+    deferredConfigNames
+  } = splitCacheableConfig(rawConfig);
   const cachePath = resolveConfigCachePath(root);
   const contents = `${JSON.stringify({
     version: HOLO_CONFIG_CACHE_VERSION,
@@ -534,7 +2036,8 @@ async function writeConfigCache(projectRoot, options = {}) {
       warnings: environment.warnings
     },
     configFiles: loadedFiles,
-    config: rawConfig
+    config: cacheableConfig,
+    deferredConfigNames
   }, null, 2)}
 `;
   await writeFileIfChanged(cachePath, contents);
@@ -562,9 +2065,22 @@ async function loadConfigDirectory(projectRoot, options = {}) {
         envName,
         processEnv: options.processEnv
       });
-      return normalizeLoadedConfig(cached.config, {
+      const deferredConfigNames = getDeferredConfigNames(cached);
+      let rawConfig2 = cached.config;
+      let loadedFiles2 = cached.configFiles;
+      if (deferredConfigNames.length > 0) {
+        const live = await collectRawConfig(configDir, environment2.values, {
+          onlyConfigNames: deferredConfigNames
+        });
+        rawConfig2 = {
+          ...cached.config,
+          ...live.rawConfig
+        };
+        loadedFiles2 = mergeLoadedFiles(cached.configFiles, live.loadedFiles, deferredConfigNames);
+      }
+      return normalizeLoadedConfig(rawConfig2, {
         environment: environment2,
-        loadedFiles: cached.configFiles
+        loadedFiles: loadedFiles2
       });
     }
   }
@@ -588,18 +2104,44 @@ function defineAppConfig(config2) {
 function defineDatabaseConfig(config2) {
   return defineConfig(config2);
 }
+function defineRedisConfig(config2) {
+  return defineConfig(config2);
+}
+function defineCacheConfig(config2) {
+  return defineConfig(config2);
+}
 function defineStorageConfig(config2) {
   return defineConfig(config2);
 }
 function defineQueueConfig(config2) {
   return defineConfig(config2);
 }
+function defineBroadcastConfig(config2) {
+  return defineConfig(config2);
+}
+function defineMailConfig(config2) {
+  return defineConfig(config2);
+}
+function defineNotificationsConfig(config2) {
+  return defineConfig(config2);
+}
 function defineMediaConfig(config2) {
   return defineConfig(config2);
 }
+function defineSessionConfig(config2) {
+  return defineConfig(config2);
+}
+function defineSecurityConfig(config2) {
+  return defineConfig(config2);
+}
+function defineAuthConfig(config2) {
+  return defineConfig(config2);
+}
 var loaderInternals = {
+  getDeferredConfigNames,
   getConfigExtensionPriority,
-  resolveConfigExport
+  resolveConfigExport,
+  splitCacheableConfig
 };
 export {
   DEFAULT_APP_NAME,
@@ -609,15 +2151,31 @@ export {
   configureEnvRuntime,
   createConfigAccessors,
   defineAppConfig,
+  defineAuthConfig,
+  defineBroadcastConfig,
+  defineCacheConfig,
   defineConfig,
   defineDatabaseConfig,
+  defineMailConfig,
   defineMediaConfig,
+  defineNotificationsConfig,
   defineQueueConfig,
+  defineRedisConfig,
+  defineSecurityConfig,
+  defineSessionConfig,
   defineStorageConfig,
   env,
   holoAppDefaults,
+  holoAuthDefaults,
+  holoBroadcastDefaults,
+  holoCacheDefaults,
   holoDatabaseDefaults,
+  holoMailDefaults,
+  holoNotificationsDefaults,
   holoQueueDefaultsNormalized,
+  holoRedisDefaults,
+  holoSecurityDefaults,
+  holoSessionDefaults,
   holoStorageDefaults,
   isEnvPlaceholder,
   loadConfigDirectory,
@@ -625,8 +2183,16 @@ export {
   loaderInternals,
   normalizeAppConfig,
   normalizeAppEnv,
+  normalizeAuthConfig,
+  normalizeBroadcastConfig,
+  normalizeCacheConfig,
   normalizeDatabaseConfig,
+  normalizeMailConfig,
+  normalizeNotificationsConfig,
   normalizeQueueConfigForHolo,
+  normalizeRedisConfig,
+  normalizeSecurityConfig,
+  normalizeSessionConfig,
   normalizeStorageConfig,
   resetConfigRuntime,
   resolveAppEnvironment,