@holo-js/config 0.1.4 → 0.1.6

package/dist/index.d.ts

@@ -1,3 +1,59 @@
+interface HoloConfigRegistry {
+    app: NormalizedHoloAppConfig;
+    database: NormalizedHoloDatabaseConfig;
+    redis: NormalizedHoloRedisConfig;
+    cache: NormalizedHoloCacheConfig;
+    cors: NormalizedHoloCorsConfig;
+    storage: NormalizedHoloStorageConfig;
+    queue: NormalizedHoloQueueConfig;
+    broadcast: NormalizedHoloBroadcastConfig;
+    mail: NormalizedHoloMailConfig;
+    notifications: NormalizedHoloNotificationsConfig;
+    media: HoloMediaConfig;
+    session: NormalizedHoloSessionConfig;
+    security: NormalizedHoloSecurityConfig;
+    auth: NormalizedHoloAuthConfig;
+}
+type HoloConfigMap = object;
+interface LoadedEnvironment {
+    readonly name: HoloAppEnv;
+    readonly values: Readonly<Record<string, string>>;
+    readonly loadedFiles: readonly string[];
+    readonly warnings: readonly string[];
+}
+interface LoadedHoloConfig<TCustom extends HoloConfigMap = HoloConfigMap> {
+    readonly app: NormalizedHoloAppConfig;
+    readonly database: NormalizedHoloDatabaseConfig;
+    readonly redis: NormalizedHoloRedisConfig;
+    readonly cache: NormalizedHoloCacheConfig;
+    readonly cors: NormalizedHoloCorsConfig;
+    readonly storage: NormalizedHoloStorageConfig;
+    readonly queue: NormalizedHoloQueueConfig;
+    readonly broadcast: NormalizedHoloBroadcastConfig;
+    readonly notifications: NormalizedHoloNotificationsConfig;
+    readonly mail: NormalizedHoloMailConfig;
+    readonly media: HoloMediaConfig;
+    readonly session: NormalizedHoloSessionConfig;
+    readonly security: NormalizedHoloSecurityConfig;
+    readonly auth: NormalizedHoloAuthConfig;
+    readonly custom: Readonly<TCustom>;
+    readonly all: Readonly<HoloConfigRegistry & TCustom>;
+    readonly environment: LoadedEnvironment;
+    readonly loadedFiles: readonly string[];
+    readonly warnings: readonly string[];
+}
+type ConfigFileName = keyof HoloConfigRegistry | (string & {});
+type Primitive = string | number | boolean | bigint | symbol | null | undefined;
+type NonTraversable = Primitive | readonly unknown[] | ((...args: never[]) => unknown);
+type KnownPathKey<T> = Extract<{
+    [K in keyof T & string]: K extends `${number}` ? never : [T[K]] extends [undefined] ? never : K;
+}[keyof T & string], string>;
+type DotPath<T> = T extends NonTraversable ? never : {
+    [K in KnownPathKey<T>]: T[K] extends NonTraversable ? K : K | `${K}.${DotPath<T[K]>}`;
+}[KnownPathKey<T>];
+type ValueAtPath<T, TPath extends string> = TPath extends `${infer THead}.${infer TTail}` ? THead extends keyof T ? ValueAtPath<T[THead], TTail> : never : TPath extends keyof T ? T[TPath] : never;
+type DefineConfigValue<TConfig extends object> = Readonly<TConfig>;
+
 interface HoloProjectPaths {
     models: string;
     migrations: string;
@@ -363,6 +419,24 @@ interface NormalizedHoloSessionConfig {
     readonly absoluteLifetime: number;
     readonly rememberMeLifetime: number;
 }
+interface HoloCorsConfig {
+    readonly paths?: readonly string[];
+    readonly origins?: readonly string[];
+    readonly methods?: readonly string[];
+    readonly headers?: readonly string[];
+    readonly credentials?: boolean;
+    readonly maxAge?: number | string;
+    readonly statefulDomains?: readonly string[];
+}
+interface NormalizedHoloCorsConfig {
+    readonly paths: readonly string[];
+    readonly origins: readonly string[];
+    readonly methods: readonly string[];
+    readonly headers: readonly string[];
+    readonly credentials: boolean;
+    readonly maxAge: number;
+    readonly statefulDomains: readonly string[];
+}
 type SecurityRateLimitDriver = 'memory' | 'file' | 'redis';
 interface HoloSecurityCsrfConfig {
     readonly enabled?: boolean;
@@ -468,9 +542,11 @@ interface AuthPasswordBrokerConfig {
     readonly table?: string;
     readonly expire?: number | string;
     readonly throttle?: number | string;
+    readonly route?: string;
 }
 interface AuthEmailVerificationConfig {
     readonly required?: boolean;
+    readonly route?: string;
 }
 interface AuthPersonalAccessTokenConfig {
     readonly defaultAbilities?: readonly string[];
@@ -488,23 +564,49 @@ interface AuthSocialProviderConfig {
 interface AuthWorkosProviderConfig {
     readonly clientId?: string;
     readonly apiKey?: string;
-    readonly cookiePassword?: string;
     readonly redirectUri?: string;
-    readonly sessionCookie?: string;
     readonly guard?: string;
     readonly mapToProvider?: string;
 }
+interface AuthHostedIdentityRecord {
+    readonly provider: string;
+    readonly providerUserId: string;
+    readonly guard: string;
+    readonly authProvider: string;
+    readonly userId: string | number;
+    readonly email?: string;
+    readonly emailVerified: boolean;
+    readonly profile: Readonly<Record<string, unknown>>;
+    readonly linkedAt: Date;
+    readonly updatedAt: Date;
+}
+interface AuthHostedIdentityStore {
+    findByProviderUserId(provider: string, providerUserId: string): Promise<AuthHostedIdentityRecord | null>;
+    findByUserId(provider: string, authProvider: string, userId: string | number): Promise<AuthHostedIdentityRecord | null>;
+    claim?(record: AuthHostedIdentityRecord): Promise<AuthHostedIdentityRecord>;
+    save(record: AuthHostedIdentityRecord): Promise<void>;
+}
+interface HoloAuthWorkosConfig {
+    readonly provider?: string;
+    readonly identityStore?: AuthHostedIdentityStore;
+    readonly [provider: string]: AuthHostedIdentityStore | AuthWorkosProviderConfig | string | undefined;
+}
 interface AuthClerkProviderConfig {
     readonly publishableKey?: string;
     readonly secretKey?: string;
-    readonly jwtKey?: string;
     readonly apiUrl?: string;
     readonly frontendApi?: string;
+    readonly redirectUri?: string;
     readonly sessionCookie?: string;
     readonly authorizedParties?: readonly string[];
     readonly guard?: string;
     readonly mapToProvider?: string;
 }
+interface HoloAuthClerkConfig {
+    readonly provider?: string;
+    readonly identityStore?: AuthHostedIdentityStore;
+    readonly [provider: string]: AuthHostedIdentityStore | AuthClerkProviderConfig | string | undefined;
+}
 interface HoloAuthConfig {
     readonly defaults?: {
         readonly guard?: string;
@@ -517,8 +619,8 @@ interface HoloAuthConfig {
     readonly personalAccessTokens?: AuthPersonalAccessTokenConfig;
     readonly socialEncryptionKey?: string;
     readonly social?: Readonly<Record<string, AuthSocialProviderConfig>>;
-    readonly workos?: Readonly<Record<string, AuthWorkosProviderConfig>>;
-    readonly clerk?: Readonly<Record<string, AuthClerkProviderConfig>>;
+    readonly workos?: HoloAuthWorkosConfig;
+    readonly clerk?: HoloAuthClerkConfig;
 }
 interface NormalizedAuthGuardConfig {
     readonly name: string;
@@ -536,6 +638,7 @@ interface NormalizedAuthPasswordBrokerConfig {
     readonly table: string;
     readonly expire: number;
     readonly throttle: number;
+    readonly route: string;
 }
 interface NormalizedAuthSocialProviderConfig {
     readonly name: string;
@@ -552,24 +655,33 @@ interface NormalizedAuthWorkosProviderConfig {
     readonly name: string;
     readonly clientId?: string;
     readonly apiKey?: string;
-    readonly cookiePassword?: string;
     readonly redirectUri?: string;
     readonly sessionCookie: string;
     readonly guard?: string;
     readonly mapToProvider?: string;
 }
+interface NormalizedHoloAuthWorkosConfig {
+    readonly provider?: string;
+    readonly identityStore?: AuthHostedIdentityStore;
+    readonly [provider: string]: AuthHostedIdentityStore | NormalizedAuthWorkosProviderConfig | string | undefined;
+}
 interface NormalizedAuthClerkProviderConfig {
     readonly name: string;
     readonly publishableKey?: string;
     readonly secretKey?: string;
-    readonly jwtKey?: string;
     readonly apiUrl?: string;
     readonly frontendApi?: string;
+    readonly redirectUri?: string;
     readonly sessionCookie: string;
     readonly authorizedParties: readonly string[];
     readonly guard?: string;
     readonly mapToProvider?: string;
 }
+interface NormalizedHoloAuthClerkConfig {
+    readonly provider?: string;
+    readonly identityStore?: AuthHostedIdentityStore;
+    readonly [provider: string]: AuthHostedIdentityStore | NormalizedAuthClerkProviderConfig | string | undefined;
+}
 interface NormalizedHoloAuthConfig {
     readonly defaults: {
         readonly guard: string;
@@ -580,14 +692,15 @@ interface NormalizedHoloAuthConfig {
     readonly passwords: Readonly<Record<string, NormalizedAuthPasswordBrokerConfig>>;
     readonly emailVerification: {
         readonly required: boolean;
+        readonly route: string;
     };
     readonly personalAccessTokens: {
         readonly defaultAbilities: readonly string[];
     };
     readonly socialEncryptionKey?: string;
     readonly social: Readonly<Record<string, NormalizedAuthSocialProviderConfig>>;
-    readonly workos: Readonly<Record<string, NormalizedAuthWorkosProviderConfig>>;
-    readonly clerk: Readonly<Record<string, NormalizedAuthClerkProviderConfig>>;
+    readonly workos: NormalizedHoloAuthWorkosConfig;
+    readonly clerk: NormalizedHoloAuthClerkConfig;
 }
 interface QueueRedisConnectionConfig {
     readonly driver: 'redis';
@@ -800,59 +913,6 @@ interface NormalizedHoloMailConfig {
     readonly markdown: NormalizedHoloMailMarkdownConfig;
     readonly mailers: Readonly<Record<string, NormalizedHoloMailMailerConfig>>;
 }
-interface HoloConfigRegistry {
-    app: NormalizedHoloAppConfig;
-    database: NormalizedHoloDatabaseConfig;
-    redis: NormalizedHoloRedisConfig;
-    cache: NormalizedHoloCacheConfig;
-    storage: NormalizedHoloStorageConfig;
-    queue: NormalizedHoloQueueConfig;
-    broadcast: NormalizedHoloBroadcastConfig;
-    mail: NormalizedHoloMailConfig;
-    notifications: NormalizedHoloNotificationsConfig;
-    media: HoloMediaConfig;
-    session: NormalizedHoloSessionConfig;
-    security: NormalizedHoloSecurityConfig;
-    auth: NormalizedHoloAuthConfig;
-}
-type HoloConfigMap = object;
-interface LoadedEnvironment {
-    readonly name: HoloAppEnv;
-    readonly values: Readonly<Record<string, string>>;
-    readonly loadedFiles: readonly string[];
-    readonly warnings: readonly string[];
-}
-interface LoadedHoloConfig<TCustom extends HoloConfigMap = HoloConfigMap> {
-    readonly app: NormalizedHoloAppConfig;
-    readonly database: NormalizedHoloDatabaseConfig;
-    readonly redis: NormalizedHoloRedisConfig;
-    readonly cache: NormalizedHoloCacheConfig;
-    readonly storage: NormalizedHoloStorageConfig;
-    readonly queue: NormalizedHoloQueueConfig;
-    readonly broadcast: NormalizedHoloBroadcastConfig;
-    readonly mail: NormalizedHoloMailConfig;
-    readonly notifications: NormalizedHoloNotificationsConfig;
-    readonly media: HoloMediaConfig;
-    readonly session: NormalizedHoloSessionConfig;
-    readonly security: NormalizedHoloSecurityConfig;
-    readonly auth: NormalizedHoloAuthConfig;
-    readonly custom: Readonly<TCustom>;
-    readonly all: Readonly<HoloConfigRegistry & TCustom>;
-    readonly environment: LoadedEnvironment;
-    readonly loadedFiles: readonly string[];
-    readonly warnings: readonly string[];
-}
-type ConfigFileName = keyof HoloConfigRegistry | (string & {});
-type Primitive = string | number | boolean | bigint | symbol | null | undefined;
-type NonTraversable = Primitive | readonly unknown[] | ((...args: never[]) => unknown);
-type KnownPathKey<T> = Extract<{
-    [K in keyof T]: K extends string ? string extends K ? never : K : never;
-}[keyof T], string>;
-type DotPath<T> = T extends NonTraversable ? never : {
-    [K in KnownPathKey<T>]: T[K] extends NonTraversable ? K : T[K] extends object ? K | `${K}.${DotPath<T[K]>}` : K;
-}[KnownPathKey<T>];
-type ValueAtPath<T, TPath extends string> = TPath extends `${infer Head}.${infer Tail}` ? Head extends keyof T ? ValueAtPath<T[Head], Tail> : never : TPath extends keyof T ? T[TPath] : never;
-type DefineConfigValue<TConfig extends object> = Readonly<TConfig>;
 
 declare const DEFAULT_APP_NAME = "Holo";
 declare const holoAppDefaults: Readonly<NormalizedHoloAppConfig>;
@@ -867,16 +927,21 @@ type CacheNormalizationOptions = {
     readonly redis?: NormalizedHoloRedisConfig;
 };
 declare const holoMailDefaults: Readonly<NormalizedHoloMailConfig>;
+declare const DEFAULT_SESSION_COOKIE_NAME = "holo_session";
 declare const holoSessionDefaults: Readonly<NormalizedHoloSessionConfig>;
+declare const holoCorsDefaults: Readonly<NormalizedHoloCorsConfig>;
 declare const holoSecurityDefaults: Readonly<NormalizedHoloSecurityConfig>;
 declare const holoAuthDefaults: Readonly<NormalizedHoloAuthConfig>;
 declare function normalizeCacheConfig(config?: HoloCacheConfig, options?: CacheNormalizationOptions): NormalizedHoloCacheConfig;
+declare function normalizeCorsConfig(config?: HoloCorsConfig): NormalizedHoloCorsConfig;
 declare const holoQueueDefaultsNormalized: Readonly<NormalizedHoloQueueConfig>;
 declare function normalizeAppEnv(value: string | undefined, fallback?: HoloAppEnv): HoloAppEnv;
 declare function normalizeAppConfig(config?: HoloAppConfig): NormalizedHoloAppConfig;
 declare function normalizeSessionConfig(config?: HoloSessionConfig, redisConfig?: NormalizedHoloRedisConfig): NormalizedHoloSessionConfig;
 declare function normalizeSecurityConfig(config?: HoloSecurityConfig, redisConfig?: NormalizedHoloRedisConfig): NormalizedHoloSecurityConfig;
-declare function normalizeAuthConfig(config?: HoloAuthConfig): NormalizedHoloAuthConfig;
+declare function normalizeAuthConfig(config?: HoloAuthConfig, _options?: {
+    readonly appKey?: string;
+}): NormalizedHoloAuthConfig;
 declare function normalizeDatabaseConfig(config?: HoloDatabaseConfig): NormalizedHoloDatabaseConfig;
 declare function normalizeStorageConfig(config?: HoloStorageConfig): NormalizedHoloStorageConfig;
 declare function normalizeBroadcastConfig(config?: HoloBroadcastConfig): NormalizedHoloBroadcastConfig;
@@ -973,6 +1038,7 @@ declare function defineNotificationsConfig<const TConfig extends HoloNotificatio
 declare function defineMediaConfig<TConfig extends HoloMediaConfig>(config: TConfig): DefineConfigValue<TConfig>;
 declare function defineSessionConfig<TConfig extends HoloSessionConfig>(config: TConfig): DefineConfigValue<TConfig>;
 declare function defineSecurityConfig<TConfig extends HoloSecurityConfig>(config: TConfig): DefineConfigValue<TConfig>;
+declare function defineCorsConfig<TConfig extends HoloCorsConfig>(config: TConfig): DefineConfigValue<TConfig>;
 declare function defineAuthConfig<TConfig extends HoloAuthConfig>(config: TConfig): DefineConfigValue<TConfig>;
 declare const loaderInternals: {
     getDeferredConfigNames: typeof getDeferredConfigNames;
@@ -981,4 +1047,4 @@ declare const loaderInternals: {
     splitCacheableConfig: typeof splitCacheableConfig;
 };
 
-export { type AuthClerkProviderConfig, type AuthEmailVerificationConfig, type AuthGuardConfig, type AuthPasswordBrokerConfig, type AuthPersonalAccessTokenConfig, type AuthProviderConfig, type AuthSocialProviderConfig, type AuthWorkosProviderConfig, type BroadcastConnectionDriver, type BroadcastConnectionOptionsConfig, type BroadcastConnectionScheme, type BroadcastWorkerConfig, type BroadcastWorkerScalingConfig, type CacheDatabaseDriverConfig, type CacheDriver, type CacheDriverConfig, type CacheFileDriverConfig, type CacheMemoryDriverConfig, type CacheRedisDriverConfig, type ConfigFileName, DEFAULT_APP_NAME, type DefineConfigValue, type DiskConfig, type DotPath, type HoloAppConfig, type HoloAppEnv, type HoloAuthConfig, type HoloBroadcastConfig, type HoloBroadcastConnection, type HoloBroadcastConnectionConfig, type HoloCacheConfig, type HoloConfigMap, type HoloConfigRegistry, type HoloDatabaseConfig, type HoloDatabaseConnectionConfig, type HoloMailAddressConfig, type HoloMailConfig, type HoloMailMailerConfig, type HoloMailPreviewConfig, type HoloMailQueueConfig, type HoloMediaConfig, type HoloNotificationsConfig, type HoloQueueConfig, type HoloRedisClusterNodeConfig, type HoloRedisConfig, type HoloRedisConnectionConfig, type HoloSecurityConfig, type HoloSecurityCsrfConfig, type HoloSecurityRateLimitConfig, type HoloSessionConfig, type HoloSessionCookieConfig, type HoloStorageConfig, type LoadedEnvironment, type LoadedHoloConfig, type NormalizedAuthClerkProviderConfig, type NormalizedAuthGuardConfig, type NormalizedAuthPasswordBrokerConfig, type NormalizedAuthProviderConfig, type NormalizedAuthSocialProviderConfig, type NormalizedAuthWorkosProviderConfig, type NormalizedBroadcastConnectionOptionsConfig, type NormalizedBroadcastWorkerConfig, type NormalizedCacheDatabaseDriverConfig, type NormalizedCacheDriverConfig, type NormalizedCacheFileDriverConfig, type NormalizedCacheMemoryDriverConfig, type NormalizedCacheRedisDriverConfig, type NormalizedHoloAppConfig, type NormalizedHoloAuthConfig, type NormalizedHoloBroadcastConfig, type NormalizedHoloBroadcastConnection, type NormalizedHoloCacheConfig, type NormalizedHoloDatabaseConfig, type NormalizedHoloMailAddressConfig, type NormalizedHoloMailConfig, type NormalizedHoloMailMailerConfig, type NormalizedHoloMailPreviewConfig, type NormalizedHoloMailQueueConfig, type NormalizedHoloNotificationsConfig, type NormalizedHoloQueueConfig, type NormalizedHoloRedisClusterNodeConfig, type NormalizedHoloRedisConfig, type NormalizedHoloRedisConnectionConfig, type NormalizedHoloSecurityConfig, type NormalizedHoloSecurityCsrfConfig, type NormalizedHoloSecurityRateLimitConfig, type NormalizedHoloSessionConfig, type NormalizedHoloSessionCookieConfig, type NormalizedHoloStorageConfig, type NormalizedSecurityLimiterConfig, type NormalizedSecurityRateLimitRedisConfig, type NormalizedSessionDatabaseStoreConfig, type NormalizedSessionFileStoreConfig, type NormalizedSessionRedisStoreConfig, type NormalizedSessionStoreConfig, type SecurityLimiterConfig, type SecurityRateLimitContext, type SecurityRateLimitDriver, type SecurityRateLimitFileConfig, type SecurityRateLimitKeyResolver, type SecurityRateLimitMemoryConfig, type SecurityRateLimitRedisConfig, type SecurityRateLimitRedisConnectionConfig, type SessionCookieSameSite, type SessionDatabaseStoreConfig, type SessionFileStoreConfig, type SessionRedisStoreConfig, type SessionStoreConfig, type SupportedDatabaseDriver, type ValueAtPath, clearConfigCache, config, configureConfigRuntime, configureEnvRuntime, createConfigAccessors, defineAppConfig, defineAuthConfig, defineBroadcastConfig, defineCacheConfig, defineConfig, defineDatabaseConfig, defineMailConfig, defineMediaConfig, defineNotificationsConfig, defineQueueConfig, defineRedisConfig, defineSecurityConfig, defineSessionConfig, defineStorageConfig, env, holoAppDefaults, holoAuthDefaults, holoBroadcastDefaults, holoCacheDefaults, holoDatabaseDefaults, holoMailDefaults, holoNotificationsDefaults, holoQueueDefaultsNormalized, holoRedisDefaults, holoSecurityDefaults, holoSessionDefaults, holoStorageDefaults, isEnvPlaceholder, loadConfigDirectory, loadEnvironment, loaderInternals, normalizeAppConfig, normalizeAppEnv, normalizeAuthConfig, normalizeBroadcastConfig, normalizeCacheConfig, normalizeDatabaseConfig, normalizeMailConfig, normalizeNotificationsConfig, normalizeQueueConfigForHolo, normalizeRedisConfig, normalizeSecurityConfig, normalizeSessionConfig, normalizeStorageConfig, resetConfigRuntime, resolveAppEnvironment, resolveConfigCachePath, resolveEnvPlaceholders, resolveEnvironmentFileOrder, useConfig, writeConfigCache };
+export { type AuthClerkProviderConfig, type AuthEmailVerificationConfig, type AuthGuardConfig, type AuthHostedIdentityRecord, type AuthHostedIdentityStore, type AuthPasswordBrokerConfig, type AuthPersonalAccessTokenConfig, type AuthProviderConfig, type AuthSocialProviderConfig, type AuthWorkosProviderConfig, type BroadcastConnectionDriver, type BroadcastConnectionOptionsConfig, type BroadcastConnectionScheme, type BroadcastWorkerConfig, type BroadcastWorkerScalingConfig, type CacheDatabaseDriverConfig, type CacheDriver, type CacheDriverConfig, type CacheFileDriverConfig, type CacheMemoryDriverConfig, type CacheRedisDriverConfig, type ConfigFileName, DEFAULT_APP_NAME, DEFAULT_SESSION_COOKIE_NAME, type DefineConfigValue, type DiskConfig, type DotPath, type HoloAppConfig, type HoloAppEnv, type HoloAuthClerkConfig, type HoloAuthConfig, type HoloAuthWorkosConfig, type HoloBroadcastConfig, type HoloBroadcastConnection, type HoloBroadcastConnectionConfig, type HoloCacheConfig, type HoloConfigMap, type HoloConfigRegistry, type HoloCorsConfig, type HoloDatabaseConfig, type HoloDatabaseConnectionConfig, type HoloMailAddressConfig, type HoloMailConfig, type HoloMailMailerConfig, type HoloMailPreviewConfig, type HoloMailQueueConfig, type HoloMediaConfig, type HoloNotificationsConfig, type HoloQueueConfig, type HoloRedisClusterNodeConfig, type HoloRedisConfig, type HoloRedisConnectionConfig, type HoloSecurityConfig, type HoloSecurityCsrfConfig, type HoloSecurityRateLimitConfig, type HoloSessionConfig, type HoloSessionCookieConfig, type HoloStorageConfig, type LoadedEnvironment, type LoadedHoloConfig, type NormalizedAuthClerkProviderConfig, type NormalizedAuthGuardConfig, type NormalizedAuthPasswordBrokerConfig, type NormalizedAuthProviderConfig, type NormalizedAuthSocialProviderConfig, type NormalizedAuthWorkosProviderConfig, type NormalizedBroadcastConnectionOptionsConfig, type NormalizedBroadcastWorkerConfig, type NormalizedCacheDatabaseDriverConfig, type NormalizedCacheDriverConfig, type NormalizedCacheFileDriverConfig, type NormalizedCacheMemoryDriverConfig, type NormalizedCacheRedisDriverConfig, type NormalizedHoloAppConfig, type NormalizedHoloAuthClerkConfig, type NormalizedHoloAuthConfig, type NormalizedHoloAuthWorkosConfig, type NormalizedHoloBroadcastConfig, type NormalizedHoloBroadcastConnection, type NormalizedHoloCacheConfig, type NormalizedHoloCorsConfig, type NormalizedHoloDatabaseConfig, type NormalizedHoloMailAddressConfig, type NormalizedHoloMailConfig, type NormalizedHoloMailMailerConfig, type NormalizedHoloMailPreviewConfig, type NormalizedHoloMailQueueConfig, type NormalizedHoloNotificationsConfig, type NormalizedHoloQueueConfig, type NormalizedHoloRedisClusterNodeConfig, type NormalizedHoloRedisConfig, type NormalizedHoloRedisConnectionConfig, type NormalizedHoloSecurityConfig, type NormalizedHoloSecurityCsrfConfig, type NormalizedHoloSecurityRateLimitConfig, type NormalizedHoloSessionConfig, type NormalizedHoloSessionCookieConfig, type NormalizedHoloStorageConfig, type NormalizedSecurityLimiterConfig, type NormalizedSecurityRateLimitRedisConfig, type NormalizedSessionDatabaseStoreConfig, type NormalizedSessionFileStoreConfig, type NormalizedSessionRedisStoreConfig, type NormalizedSessionStoreConfig, type SecurityLimiterConfig, type SecurityRateLimitContext, type SecurityRateLimitDriver, type SecurityRateLimitFileConfig, type SecurityRateLimitKeyResolver, type SecurityRateLimitMemoryConfig, type SecurityRateLimitRedisConfig, type SecurityRateLimitRedisConnectionConfig, type SessionCookieSameSite, type SessionDatabaseStoreConfig, type SessionFileStoreConfig, type SessionRedisStoreConfig, type SessionStoreConfig, type SupportedDatabaseDriver, type ValueAtPath, clearConfigCache, config, configureConfigRuntime, configureEnvRuntime, createConfigAccessors, defineAppConfig, defineAuthConfig, defineBroadcastConfig, defineCacheConfig, defineConfig, defineCorsConfig, defineDatabaseConfig, defineMailConfig, defineMediaConfig, defineNotificationsConfig, defineQueueConfig, defineRedisConfig, defineSecurityConfig, defineSessionConfig, defineStorageConfig, env, holoAppDefaults, holoAuthDefaults, holoBroadcastDefaults, holoCacheDefaults, holoCorsDefaults, holoDatabaseDefaults, holoMailDefaults, holoNotificationsDefaults, holoQueueDefaultsNormalized, holoRedisDefaults, holoSecurityDefaults, holoSessionDefaults, holoStorageDefaults, isEnvPlaceholder, loadConfigDirectory, loadEnvironment, loaderInternals, normalizeAppConfig, normalizeAppEnv, normalizeAuthConfig, normalizeBroadcastConfig, normalizeCacheConfig, normalizeCorsConfig, normalizeDatabaseConfig, normalizeMailConfig, normalizeNotificationsConfig, normalizeQueueConfigForHolo, normalizeRedisConfig, normalizeSecurityConfig, normalizeSessionConfig, normalizeStorageConfig, resetConfigRuntime, resolveAppEnvironment, resolveConfigCachePath, resolveEnvPlaceholders, resolveEnvironmentFileOrder, useConfig, writeConfigCache };

package/dist/index.mjs

@@ -222,6 +222,19 @@ var holoSessionDefaults = Object.freeze({
   absoluteLifetime: DEFAULT_SESSION_ABSOLUTE_LIFETIME,
   rememberMeLifetime: DEFAULT_SESSION_REMEMBER_ME_LIFETIME
 });
+var DEFAULT_CORS_PATHS = Object.freeze(["/api/*"]);
+var DEFAULT_CORS_METHODS = Object.freeze(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]);
+var DEFAULT_CORS_HEADERS = Object.freeze(["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-Requested-With"]);
+var DEFAULT_CORS_MAX_AGE = 7200;
+var holoCorsDefaults = Object.freeze({
+  paths: DEFAULT_CORS_PATHS,
+  origins: Object.freeze([]),
+  methods: DEFAULT_CORS_METHODS,
+  headers: DEFAULT_CORS_HEADERS,
+  credentials: false,
+  maxAge: DEFAULT_CORS_MAX_AGE,
+  statefulDomains: Object.freeze([])
+});
 var DEFAULT_SECURITY_CSRF_FIELD = "_token";
 var DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
 var DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
@@ -266,6 +279,8 @@ var DEFAULT_AUTH_PASSWORD_BROKER = "users";
 var DEFAULT_AUTH_PASSWORD_RESET_TABLE = "password_reset_tokens";
 var DEFAULT_AUTH_PASSWORD_EXPIRE = 60;
 var DEFAULT_AUTH_PASSWORD_THROTTLE = 60;
+var DEFAULT_AUTH_PASSWORD_RESET_ROUTE = "/reset-password";
+var DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE = "/verify-email";
 var DEFAULT_WORKOS_SESSION_COOKIE = "wos-session";
 var DEFAULT_CLERK_SESSION_COOKIE = "__session";
 var holoAuthDefaults = Object.freeze({
@@ -293,14 +308,16 @@ var holoAuthDefaults = Object.freeze({
       provider: DEFAULT_AUTH_PROVIDER,
       table: DEFAULT_AUTH_PASSWORD_RESET_TABLE,
       expire: DEFAULT_AUTH_PASSWORD_EXPIRE,
-      throttle: DEFAULT_AUTH_PASSWORD_THROTTLE
+      throttle: DEFAULT_AUTH_PASSWORD_THROTTLE,
+      route: DEFAULT_AUTH_PASSWORD_RESET_ROUTE
     })
   }),
   emailVerification: Object.freeze({
-    required: false
+    required: false,
+    route: DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE
   }),
   personalAccessTokens: Object.freeze({
-    defaultAbilities: Object.freeze([])
+    defaultAbilities: Object.freeze(["*"])
   }),
   socialEncryptionKey: void 0,
   social: Object.freeze({}),
@@ -668,6 +685,37 @@ function normalizeSecurityOptionalString(value) {
   const normalized = value?.trim();
   return normalized || void 0;
 }
+function normalizeCorsStringList(values, defaults, label) {
+  if (!values) {
+    return defaults;
+  }
+  return Object.freeze(values.map((value, index) => {
+    const normalized = value.trim();
+    if (!normalized) {
+      throw new Error(`[Holo CORS] ${label} entry at index ${index} must be a non-empty string.`);
+    }
+    return normalized;
+  }));
+}
+function normalizeCorsMethods(values) {
+  return Object.freeze(normalizeCorsStringList(values, DEFAULT_CORS_METHODS, "methods").map((value) => value.toUpperCase()));
+}
+function normalizeCorsMaxAge(value) {
+  return parseSecurityInteger(value ?? DEFAULT_CORS_MAX_AGE, DEFAULT_CORS_MAX_AGE, "cors maxAge", {
+    minimum: 0
+  });
+}
+function normalizeCorsConfig(config2 = {}) {
+  return Object.freeze({
+    paths: normalizeCorsStringList(config2.paths, DEFAULT_CORS_PATHS, "paths"),
+    origins: normalizeCorsStringList(config2.origins, holoCorsDefaults.origins, "origins"),
+    methods: normalizeCorsMethods(config2.methods),
+    headers: normalizeCorsStringList(config2.headers, DEFAULT_CORS_HEADERS, "headers"),
+    credentials: config2.credentials ?? holoCorsDefaults.credentials,
+    maxAge: normalizeCorsMaxAge(config2.maxAge),
+    statefulDomains: normalizeCorsStringList(config2.statefulDomains, holoCorsDefaults.statefulDomains, "statefulDomains")
+  });
+}
 function normalizeSyncConnection(name, config2) {
   return Object.freeze({
     name,
@@ -1031,7 +1079,8 @@ function normalizePasswordBroker(name, config2, providers) {
     }),
     throttle: parseInteger(config2.throttle, DEFAULT_AUTH_PASSWORD_THROTTLE, `auth password broker "${name}" throttle`, {
       minimum: 0
-    })
+    }),
+    route: config2.route?.trim() || DEFAULT_AUTH_PASSWORD_RESET_ROUTE
   });
 }
 function normalizeSocialProvider(name, config2, guards, providers) {
@@ -1068,13 +1117,73 @@ function normalizeWorkosProvider(name, config2, guards, providers) {
     name,
     clientId: config2.clientId?.trim() || void 0,
     apiKey: config2.apiKey?.trim() || void 0,
-    cookiePassword: config2.cookiePassword?.trim() || void 0,
     redirectUri: config2.redirectUri?.trim() || void 0,
-    sessionCookie: config2.sessionCookie?.trim() || DEFAULT_WORKOS_SESSION_COOKIE,
+    sessionCookie: DEFAULT_WORKOS_SESSION_COOKIE,
     guard,
     mapToProvider
   });
 }
+function isHostedIdentityStore(value) {
+  return Boolean(value) && typeof value === "object" && typeof value.findByProviderUserId === "function" && typeof value.findByUserId === "function" && typeof value.save === "function";
+}
+function isWorkosProviderConfig(value) {
+  return typeof value === "object" && value !== null && !isHostedIdentityStore(value);
+}
+function getWorkosProviderEntries(config2) {
+  if (!config2) {
+    return Object.freeze([]);
+  }
+  const entries = [];
+  for (const [name, value] of Object.entries(config2)) {
+    if (name === "provider") {
+      if (typeof value !== "undefined" && typeof value !== "string") {
+        throw new Error('[Holo Auth] WorkOS provider key "provider" is reserved for the default provider name.');
+      }
+      continue;
+    }
+    if (name === "identityStore") {
+      if (typeof value !== "undefined" && !isHostedIdentityStore(value)) {
+        throw new Error("[Holo Auth] WorkOS identityStore must implement the hosted identity store contract.");
+      }
+      continue;
+    }
+    if (!isWorkosProviderConfig(value)) {
+      throw new Error(`[Holo Auth] WorkOS provider "${name}" must be an object.`);
+    }
+    entries.push([name, value]);
+  }
+  return Object.freeze(entries);
+}
+function normalizeWorkosConfig(config2, guards, providers) {
+  const providerEntries = getWorkosProviderEntries(config2);
+  const provider = typeof config2?.provider === "string" ? config2.provider.trim() || void 0 : void 0;
+  if (providerEntries.length === 0) {
+    if (provider) {
+      throw new Error(`[Holo Auth] WorkOS provider "${provider}" is not configured.`);
+    }
+    if (config2?.identityStore) {
+      return Object.freeze({
+        identityStore: config2.identityStore
+      });
+    }
+    return holoAuthDefaults.workos;
+  }
+  const normalizedEntries = providerEntries.map(([name, providerConfig]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth WorkOS provider name");
+    return [normalizedName, providerConfig];
+  });
+  if (provider && !normalizedEntries.some(([name]) => name === provider)) {
+    throw new Error(`[Holo Auth] WorkOS provider "${provider}" is not configured.`);
+  }
+  return Object.freeze({
+    ...typeof provider === "undefined" ? {} : { provider },
+    ...config2?.identityStore ? { identityStore: config2.identityStore } : {},
+    ...Object.fromEntries(normalizedEntries.map(([name, providerConfig]) => [
+      name,
+      normalizeWorkosProvider(name, providerConfig, guards, providers)
+    ]))
+  });
+}
 function normalizeClerkProvider(name, config2, guards, providers) {
   const guard = config2.guard?.trim();
   if (guard && !(guard in guards)) {
@@ -1084,20 +1193,96 @@ function normalizeClerkProvider(name, config2, guards, providers) {
   if (mapToProvider && !(mapToProvider in providers)) {
     throw new Error(`[Holo Auth] Clerk provider "${name}" references unknown provider "${mapToProvider}".`);
   }
+  const redirectUri = config2.redirectUri?.trim();
+  if (redirectUri) {
+    try {
+      new URL(redirectUri);
+    } catch {
+      throw new Error(`Invalid redirectUri in Clerk provider "${name}": ${redirectUri}`);
+    }
+  }
   return Object.freeze({
     name,
     publishableKey: config2.publishableKey?.trim() || void 0,
     secretKey: config2.secretKey?.trim() || void 0,
-    jwtKey: config2.jwtKey?.trim() || void 0,
     apiUrl: config2.apiUrl?.trim() || void 0,
     frontendApi: config2.frontendApi?.trim() || void 0,
+    redirectUri: redirectUri || void 0,
     sessionCookie: config2.sessionCookie?.trim() || DEFAULT_CLERK_SESSION_COOKIE,
     authorizedParties: Object.freeze((config2.authorizedParties ?? []).map((value) => value.trim()).filter(Boolean)),
     guard,
     mapToProvider
   });
 }
-function normalizeAuthConfig(config2 = {}) {
+function isClerkProviderConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const candidate = value;
+  for (const key of ["publishableKey", "secretKey", "apiUrl", "frontendApi", "redirectUri", "sessionCookie", "guard", "mapToProvider"]) {
+    const field = candidate[key];
+    if (typeof field !== "undefined" && typeof field !== "string") {
+      return false;
+    }
+  }
+  return typeof candidate.authorizedParties === "undefined" || Array.isArray(candidate.authorizedParties) && candidate.authorizedParties.every((value2) => typeof value2 === "string");
+}
+function getClerkProviderEntries(config2) {
+  if (!config2) {
+    return Object.freeze([]);
+  }
+  const entries = [];
+  for (const [name, value] of Object.entries(config2)) {
+    if (name === "provider") {
+      if (typeof value !== "undefined" && typeof value !== "string") {
+        throw new Error('[Holo Auth] Clerk provider key "provider" is reserved for the default provider name.');
+      }
+      continue;
+    }
+    if (name === "identityStore") {
+      if (typeof value !== "undefined" && !isHostedIdentityStore(value)) {
+        throw new Error("[Holo Auth] Clerk identityStore must implement the hosted identity store contract.");
+      }
+      continue;
+    }
+    if (!isClerkProviderConfig(value)) {
+      throw new Error(`[Holo Auth] Clerk provider "${name}" must be a Clerk provider config object.`);
+    }
+    entries.push([name, value]);
+  }
+  return Object.freeze(entries);
+}
+function normalizeClerkConfig(config2, guards, providers) {
+  const providerEntries = getClerkProviderEntries(config2);
+  const provider = typeof config2?.provider === "string" ? config2.provider.trim() || void 0 : void 0;
+  if (providerEntries.length === 0) {
+    if (provider) {
+      throw new Error(`[Holo Auth] Clerk provider "${provider}" is not configured.`);
+    }
+    if (config2?.identityStore) {
+      return Object.freeze({
+        identityStore: config2.identityStore
+      });
+    }
+    return holoAuthDefaults.clerk;
+  }
+  const normalizedEntries = providerEntries.map(([name, providerConfig]) => {
+    const normalizedName = normalizeConnectionName(name, "Auth Clerk provider name");
+    return [normalizedName, providerConfig];
+  });
+  if (provider && !normalizedEntries.some(([name]) => name === provider)) {
+    throw new Error(`[Holo Auth] Clerk provider "${provider}" is not configured.`);
+  }
+  return Object.freeze({
+    ...typeof provider === "undefined" ? {} : { provider },
+    ...config2?.identityStore ? { identityStore: config2.identityStore } : {},
+    ...Object.fromEntries(normalizedEntries.map(([name, providerConfig]) => [
+      name,
+      normalizeClerkProvider(name, providerConfig, guards, providers)
+    ]))
+  });
+}
+function normalizeAuthConfig(config2 = {}, _options = {}) {
   const providers = !config2.providers || Object.keys(config2.providers).length === 0 ? holoAuthDefaults.providers : Object.freeze(Object.fromEntries(Object.entries(config2.providers).map(([name, provider]) => {
     const normalizedName = normalizeConnectionName(name, "Auth provider name");
     return [normalizedName, normalizeAuthProvider(normalizedName, provider)];
@@ -1134,14 +1319,8 @@ function normalizeAuthConfig(config2 = {}) {
     const normalizedName = normalizeConnectionName(name, "Auth social provider name");
     return [normalizedName, normalizeSocialProvider(normalizedName, provider, guards, providers)];
   })));
-  const workos = !config2.workos || Object.keys(config2.workos).length === 0 ? holoAuthDefaults.workos : Object.freeze(Object.fromEntries(Object.entries(config2.workos).map(([name, provider]) => {
-    const normalizedName = normalizeConnectionName(name, "Auth WorkOS provider name");
-    return [normalizedName, normalizeWorkosProvider(normalizedName, provider, guards, providers)];
-  })));
-  const clerk = !config2.clerk || Object.keys(config2.clerk).length === 0 ? holoAuthDefaults.clerk : Object.freeze(Object.fromEntries(Object.entries(config2.clerk).map(([name, provider]) => {
-    const normalizedName = normalizeConnectionName(name, "Auth Clerk provider name");
-    return [normalizedName, normalizeClerkProvider(normalizedName, provider, guards, providers)];
-  })));
+  const workos = normalizeWorkosConfig(config2.workos, guards, providers);
+  const clerk = normalizeClerkConfig(config2.clerk, guards, providers);
   return Object.freeze({
     defaults: Object.freeze({
       guard: defaultGuard,
@@ -1151,12 +1330,13 @@ function normalizeAuthConfig(config2 = {}) {
     providers,
     passwords,
     emailVerification: Object.freeze({
-      required: typeof config2.emailVerification === "boolean" ? config2.emailVerification : config2.emailVerification?.required ?? false
+      required: typeof config2.emailVerification === "boolean" ? config2.emailVerification : config2.emailVerification?.required ?? false,
+      route: typeof config2.emailVerification === "boolean" ? DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE : config2.emailVerification?.route?.trim() || DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE
     }),
     personalAccessTokens: Object.freeze({
-      defaultAbilities: Object.freeze([...config2.personalAccessTokens?.defaultAbilities ?? []])
+      defaultAbilities: Object.freeze([...config2.personalAccessTokens?.defaultAbilities ?? holoAuthDefaults.personalAccessTokens.defaultAbilities])
     }),
-    socialEncryptionKey: config2.socialEncryptionKey?.trim() || void 0,
+    socialEncryptionKey: config2.socialEncryptionKey?.trim() || _options.appKey?.trim() || void 0,
     social,
     workos,
     clerk
@@ -1580,10 +1760,10 @@ function requireConfigRuntime() {
   return runtimeConfigMap;
 }
 function useConfig(path) {
-  return createConfigAccessors(requireConfigRuntime()).useConfig(path);
+  return getValueAtPath(requireConfigRuntime(), path);
 }
 function config(path) {
-  return createConfigAccessors(requireConfigRuntime()).config(path);
+  return getValueAtPath(requireConfigRuntime(), path);
 }
 
 // src/env.ts
@@ -1684,6 +1864,9 @@ function configureEnvRuntime(values, options = {}) {
   state.mode = options.mode ?? "resolve";
 }
 function coerceEnvScalar(runtimeValue, fallback) {
+  if (runtimeValue.trim().length === 0) {
+    return fallback;
+  }
   if (typeof fallback === "boolean") {
     const normalized = runtimeValue.trim().toLowerCase();
     if (normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on") {
@@ -1909,6 +2092,7 @@ function normalizeLoadedConfig(rawConfig, options) {
     database,
     redis: resolvedRedisConfig
   });
+  const cors = normalizeCorsConfig(resolvedRawConfig.cors);
   const storage = normalizeStorageConfig(resolvedRawConfig.storage);
   const queue = normalizeQueueConfigForHolo(resolvedRawConfig.queue, resolvedRedisConfig);
   const broadcast = normalizeBroadcastConfig(resolvedRawConfig.broadcast);
@@ -1917,16 +2101,15 @@ function normalizeLoadedConfig(rawConfig, options) {
   const media = Object.freeze({ ...resolvedRawConfig.media ?? {} });
   const session = normalizeSessionConfig(resolvedRawConfig.session, resolvedRedisConfig);
   const security = normalizeSecurityConfig(resolvedRawConfig.security, resolvedRedisConfig);
-  const auth = normalizeAuthConfig(resolvedRawConfig.auth);
-  const customEntries = Object.entries(resolvedRawConfig).filter(([key]) => {
-    return key !== "app" && key !== "database" && key !== "redis" && key !== "cache" && key !== "storage" && key !== "queue" && key !== "broadcast" && key !== "mail" && key !== "notifications" && key !== "media" && key !== "session" && key !== "security" && key !== "auth";
+  const auth = normalizeAuthConfig(resolvedRawConfig.auth, {
+    appKey: app.key
   });
-  const custom = Object.freeze(Object.fromEntries(customEntries));
-  const all = Object.freeze({
+  const firstPartyConfig = {
     app,
     database,
     redis,
     cache,
+    cors,
     storage,
     queue,
     broadcast,
@@ -1935,23 +2118,19 @@ function normalizeLoadedConfig(rawConfig, options) {
     media,
     session,
     security,
-    auth,
+    auth
+  };
+  const firstPartyConfigKeys = new Set(Object.keys(firstPartyConfig));
+  const customEntries = Object.entries(resolvedRawConfig).filter(([key]) => {
+    return !firstPartyConfigKeys.has(key);
+  });
+  const custom = Object.freeze(Object.fromEntries(customEntries));
+  const all = Object.freeze({
+    ...firstPartyConfig,
     ...custom
   });
   return {
-    app,
-    database,
-    redis,
-    cache,
-    storage,
-    queue,
-    broadcast,
-    mail,
-    notifications,
-    media,
-    session,
-    security,
-    auth,
+    ...firstPartyConfig,
     custom,
     all,
     environment: options.environment,
@@ -2134,6 +2313,9 @@ function defineSessionConfig(config2) {
 function defineSecurityConfig(config2) {
   return defineConfig(config2);
 }
+function defineCorsConfig(config2) {
+  return defineConfig(config2);
+}
 function defineAuthConfig(config2) {
   return defineConfig(config2);
 }
@@ -2145,6 +2327,7 @@ var loaderInternals = {
 };
 export {
   DEFAULT_APP_NAME,
+  DEFAULT_SESSION_COOKIE_NAME,
   clearConfigCache,
   config,
   configureConfigRuntime,
@@ -2155,6 +2338,7 @@ export {
   defineBroadcastConfig,
   defineCacheConfig,
   defineConfig,
+  defineCorsConfig,
   defineDatabaseConfig,
   defineMailConfig,
   defineMediaConfig,
@@ -2169,6 +2353,7 @@ export {
   holoAuthDefaults,
   holoBroadcastDefaults,
   holoCacheDefaults,
+  holoCorsDefaults,
   holoDatabaseDefaults,
   holoMailDefaults,
   holoNotificationsDefaults,
@@ -2186,6 +2371,7 @@ export {
   normalizeAuthConfig,
   normalizeBroadcastConfig,
   normalizeCacheConfig,
+  normalizeCorsConfig,
   normalizeDatabaseConfig,
   normalizeMailConfig,
   normalizeNotificationsConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/config",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Holo-JS Framework - typed config loading, env layering, and runtime access",
   "type": "module",
   "license": "MIT",
@@ -22,11 +22,11 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/db": "^0.1.4"
+    "@holo-js/db": "^0.1.6"
   },
   "devDependencies": {
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.5"
   }
 }