@holo-js/config 0.2.6 → 0.3.0

package/dist/index.mjs

@@ -1,8 +1,15 @@
+import {
+  composeRegisteredConfig,
+  configRegistryInternals,
+  registerConfigNormalizer,
+  resetConfigNormalizers
+} from "./chunk-SAQGYMAD.mjs";
+
 // src/defaults.ts
 import {
   DEFAULT_HOLO_PROJECT_PATHS,
   normalizeHoloProjectConfig
-} from "@holo-js/db";
+} from "@holo-js/kernel";
 var DEFAULT_APP_NAME = "Holo";
 var holoAppDefaults = Object.freeze({
   name: DEFAULT_APP_NAME,
@@ -10,785 +17,12 @@ var holoAppDefaults = Object.freeze({
   url: "http://localhost:3000",
   debug: true,
   env: "development",
+  plugins: Object.freeze([]),
   paths: Object.freeze({ ...DEFAULT_HOLO_PROJECT_PATHS }),
   models: Object.freeze([]),
   migrations: Object.freeze([]),
   seeders: Object.freeze([])
 });
-var holoDatabaseDefaults = Object.freeze({
-  defaultConnection: "default",
-  connections: Object.freeze({
-    default: Object.freeze({
-      driver: "sqlite",
-      url: "./data/database.sqlite",
-      schema: "public",
-      logging: false
-    })
-  })
-});
-var DEFAULT_REDIS_CONNECTION = "default";
-var DEFAULT_REDIS_HOST = "127.0.0.1";
-var DEFAULT_REDIS_PORT = 6379;
-var DEFAULT_REDIS_DB = 0;
-var holoRedisDefaults = Object.freeze({
-  default: DEFAULT_REDIS_CONNECTION,
-  connections: Object.freeze({
-    [DEFAULT_REDIS_CONNECTION]: Object.freeze({
-      name: DEFAULT_REDIS_CONNECTION,
-      host: DEFAULT_REDIS_HOST,
-      port: DEFAULT_REDIS_PORT,
-      username: void 0,
-      password: void 0,
-      db: DEFAULT_REDIS_DB
-    })
-  })
-});
-var holoStorageDefaults = Object.freeze({
-  defaultDisk: "local",
-  routePrefix: "/storage",
-  disks: Object.freeze({
-    local: Object.freeze({
-      driver: "local",
-      root: "./storage/app"
-    }),
-    public: Object.freeze({
-      driver: "public",
-      root: "./storage/app/public",
-      visibility: "public"
-    })
-  })
-});
-var DEFAULT_NOTIFICATIONS_TABLE = "notifications";
-var DEFAULT_BROADCAST_CONNECTION = "null";
-var DEFAULT_BROADCAST_HOST = "127.0.0.1";
-var DEFAULT_BROADCAST_HTTP_PORT = 80;
-var DEFAULT_BROADCAST_HTTPS_PORT = 443;
-var DEFAULT_BROADCAST_WORKER_HOST = "0.0.0.0";
-var DEFAULT_BROADCAST_WORKER_PORT = 8080;
-var DEFAULT_BROADCAST_WORKER_PATH = "/app";
-var DEFAULT_BROADCAST_HEALTH_PATH = "/health";
-var DEFAULT_BROADCAST_STATS_PATH = "/stats";
-var holoNotificationsDefaults = Object.freeze({
-  table: DEFAULT_NOTIFICATIONS_TABLE,
-  queue: Object.freeze({
-    connection: void 0,
-    queue: void 0,
-    afterCommit: false
-  })
-});
-var holoBroadcastDefaults = Object.freeze({
-  default: DEFAULT_BROADCAST_CONNECTION,
-  connections: Object.freeze({
-    log: Object.freeze({
-      name: "log",
-      driver: "log",
-      clientOptions: Object.freeze({})
-    }),
-    null: Object.freeze({
-      name: "null",
-      driver: "null",
-      clientOptions: Object.freeze({})
-    })
-  }),
-  worker: Object.freeze({
-    host: DEFAULT_BROADCAST_WORKER_HOST,
-    port: DEFAULT_BROADCAST_WORKER_PORT,
-    path: DEFAULT_BROADCAST_WORKER_PATH,
-    publicHost: void 0,
-    publicPort: void 0,
-    publicScheme: "https",
-    healthPath: DEFAULT_BROADCAST_HEALTH_PATH,
-    statsPath: DEFAULT_BROADCAST_STATS_PATH,
-    scaling: false
-  })
-});
-var DEFAULT_CACHE_DRIVER = "file";
-var DEFAULT_CACHE_PREFIX = "";
-var DEFAULT_CACHE_FILE_PATH = "./storage/framework/cache/data";
-var DEFAULT_CACHE_REDIS_CONNECTION = "default";
-var DEFAULT_CACHE_DATABASE_CONNECTION = "default";
-var DEFAULT_CACHE_DATABASE_TABLE = "cache";
-var DEFAULT_CACHE_DATABASE_LOCK_TABLE = "cache_locks";
-var holoCacheDefaults = Object.freeze({
-  default: DEFAULT_CACHE_DRIVER,
-  prefix: DEFAULT_CACHE_PREFIX,
-  drivers: Object.freeze({
-    file: Object.freeze({
-      name: "file",
-      driver: "file",
-      path: DEFAULT_CACHE_FILE_PATH,
-      prefix: DEFAULT_CACHE_PREFIX
-    }),
-    memory: Object.freeze({
-      name: "memory",
-      driver: "memory",
-      maxEntries: void 0,
-      prefix: DEFAULT_CACHE_PREFIX
-    })
-  })
-});
-var DEFAULT_MAILER_NAME = "preview";
-var DEFAULT_MAIL_PREVIEW_PATH = ".holo-js/runtime/mail-preview";
-var DEFAULT_SMTP_HOST = "127.0.0.1";
-var DEFAULT_SMTP_PORT = 1025;
-var DEFAULT_MAIL_QUEUE_CONFIG = Object.freeze({
-  queued: false,
-  connection: void 0,
-  queue: void 0,
-  afterCommit: false
-});
-var holoMailDefaults = Object.freeze({
-  default: DEFAULT_MAILER_NAME,
-  from: void 0,
-  replyTo: void 0,
-  queue: DEFAULT_MAIL_QUEUE_CONFIG,
-  preview: Object.freeze({
-    allowedEnvironments: Object.freeze(["development"])
-  }),
-  markdown: Object.freeze({
-    wrapper: void 0
-  }),
-  mailers: Object.freeze({
-    preview: Object.freeze({
-      name: "preview",
-      driver: "preview",
-      from: void 0,
-      replyTo: void 0,
-      queue: DEFAULT_MAIL_QUEUE_CONFIG,
-      path: DEFAULT_MAIL_PREVIEW_PATH
-    }),
-    log: Object.freeze({
-      name: "log",
-      driver: "log",
-      from: void 0,
-      replyTo: void 0,
-      queue: DEFAULT_MAIL_QUEUE_CONFIG,
-      logBodies: false
-    }),
-    fake: Object.freeze({
-      name: "fake",
-      driver: "fake",
-      from: void 0,
-      replyTo: void 0,
-      queue: DEFAULT_MAIL_QUEUE_CONFIG
-    }),
-    smtp: Object.freeze({
-      name: "smtp",
-      driver: "smtp",
-      from: void 0,
-      replyTo: void 0,
-      queue: DEFAULT_MAIL_QUEUE_CONFIG,
-      host: DEFAULT_SMTP_HOST,
-      port: DEFAULT_SMTP_PORT,
-      secure: false
-    })
-  })
-});
-var DEFAULT_SESSION_DRIVER = "file";
-var DEFAULT_SESSION_IDLE_TIMEOUT = 120;
-var DEFAULT_SESSION_ABSOLUTE_LIFETIME = 120;
-var DEFAULT_SESSION_REMEMBER_ME_LIFETIME = 43200;
-var DEFAULT_SESSION_COOKIE_NAME = "holo_session";
-var DEFAULT_SESSION_COOKIE_PATH = "/";
-var DEFAULT_SESSION_COOKIE_SAME_SITE = "lax";
-var DEFAULT_SESSION_DATABASE_CONNECTION = "default";
-var DEFAULT_SESSION_DATABASE_TABLE = "sessions";
-var DEFAULT_SESSION_FILE_PATH = "./storage/framework/sessions";
-var holoSessionDefaults = Object.freeze({
-  driver: DEFAULT_SESSION_DRIVER,
-  stores: Object.freeze({
-    database: Object.freeze({
-      name: "database",
-      driver: "database",
-      connection: DEFAULT_SESSION_DATABASE_CONNECTION,
-      table: DEFAULT_SESSION_DATABASE_TABLE
-    }),
-    file: Object.freeze({
-      name: "file",
-      driver: "file",
-      path: DEFAULT_SESSION_FILE_PATH
-    })
-  }),
-  cookie: Object.freeze({
-    name: DEFAULT_SESSION_COOKIE_NAME,
-    path: DEFAULT_SESSION_COOKIE_PATH,
-    secure: false,
-    httpOnly: true,
-    sameSite: DEFAULT_SESSION_COOKIE_SAME_SITE,
-    partitioned: false,
-    maxAge: DEFAULT_SESSION_ABSOLUTE_LIFETIME
-  }),
-  idleTimeout: DEFAULT_SESSION_IDLE_TIMEOUT,
-  absoluteLifetime: DEFAULT_SESSION_ABSOLUTE_LIFETIME,
-  rememberMeLifetime: DEFAULT_SESSION_REMEMBER_ME_LIFETIME
-});
-var DEFAULT_CORS_PATHS = Object.freeze(["/api/*"]);
-var DEFAULT_CORS_METHODS = Object.freeze(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]);
-var DEFAULT_CORS_HEADERS = Object.freeze(["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-Requested-With"]);
-var DEFAULT_CORS_MAX_AGE = 7200;
-var holoCorsDefaults = Object.freeze({
-  paths: DEFAULT_CORS_PATHS,
-  origins: Object.freeze([]),
-  methods: DEFAULT_CORS_METHODS,
-  headers: DEFAULT_CORS_HEADERS,
-  credentials: false,
-  maxAge: DEFAULT_CORS_MAX_AGE,
-  statefulDomains: Object.freeze([])
-});
-var DEFAULT_SECURITY_CSRF_FIELD = "_token";
-var DEFAULT_SECURITY_CSRF_HEADER = "X-CSRF-TOKEN";
-var DEFAULT_SECURITY_CSRF_COOKIE = "XSRF-TOKEN";
-var DEFAULT_SECURITY_RATE_LIMIT_DRIVER = "memory";
-var DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
-var DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
-var DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
-var DEFAULT_SECURITY_CSRF_CONFIG = Object.freeze({
-  enabled: false,
-  field: DEFAULT_SECURITY_CSRF_FIELD,
-  header: DEFAULT_SECURITY_CSRF_HEADER,
-  cookie: DEFAULT_SECURITY_CSRF_COOKIE,
-  except: Object.freeze([])
-});
-var DEFAULT_SECURITY_RATE_LIMIT_CONFIG = Object.freeze({
-  driver: DEFAULT_SECURITY_RATE_LIMIT_DRIVER,
-  memory: Object.freeze({
-    driver: "memory"
-  }),
-  file: Object.freeze({
-    path: DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH
-  }),
-  redis: Object.freeze({
-    host: DEFAULT_REDIS_HOST,
-    port: DEFAULT_REDIS_PORT,
-    password: void 0,
-    username: void 0,
-    db: DEFAULT_REDIS_DB,
-    connection: DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION,
-    prefix: DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX
-  }),
-  limiters: Object.freeze({})
-});
-var holoSecurityDefaults = Object.freeze({
-  csrf: DEFAULT_SECURITY_CSRF_CONFIG,
-  rateLimit: DEFAULT_SECURITY_RATE_LIMIT_CONFIG
-});
-var DEFAULT_AUTH_GUARD = "web";
-var DEFAULT_AUTH_PROVIDER = "users";
-var DEFAULT_AUTH_IDENTIFIERS = Object.freeze(["email"]);
-var DEFAULT_AUTH_PASSWORD_BROKER = "users";
-var DEFAULT_AUTH_PASSWORD_RESET_TABLE = "password_reset_tokens";
-var DEFAULT_AUTH_PASSWORD_EXPIRE = 60;
-var DEFAULT_AUTH_PASSWORD_THROTTLE = 60;
-var DEFAULT_AUTH_PASSWORD_RESET_ROUTE = "/reset-password";
-var DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE = "/verify-email";
-var DEFAULT_WORKOS_SESSION_COOKIE = "wos-session";
-var DEFAULT_CLERK_SESSION_COOKIE = "__session";
-var holoAuthDefaults = Object.freeze({
-  defaults: Object.freeze({
-    guard: DEFAULT_AUTH_GUARD,
-    passwords: DEFAULT_AUTH_PASSWORD_BROKER
-  }),
-  guards: Object.freeze({
-    web: Object.freeze({
-      name: "web",
-      driver: "session",
-      provider: DEFAULT_AUTH_PROVIDER
-    })
-  }),
-  providers: Object.freeze({
-    users: Object.freeze({
-      name: "users",
-      model: "User",
-      identifiers: DEFAULT_AUTH_IDENTIFIERS
-    })
-  }),
-  passwords: Object.freeze({
-    users: Object.freeze({
-      name: "users",
-      provider: DEFAULT_AUTH_PROVIDER,
-      table: DEFAULT_AUTH_PASSWORD_RESET_TABLE,
-      expire: DEFAULT_AUTH_PASSWORD_EXPIRE,
-      throttle: DEFAULT_AUTH_PASSWORD_THROTTLE,
-      route: DEFAULT_AUTH_PASSWORD_RESET_ROUTE
-    })
-  }),
-  emailVerification: Object.freeze({
-    required: false,
-    route: DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE
-  }),
-  personalAccessTokens: Object.freeze({
-    defaultAbilities: Object.freeze(["*"])
-  }),
-  socialEncryptionKey: void 0,
-  social: Object.freeze({}),
-  workos: Object.freeze({}),
-  clerk: Object.freeze({})
-});
-var DEFAULT_QUEUE_CONNECTION = "sync";
-var DEFAULT_QUEUE_NAME = "default";
-var DEFAULT_QUEUE_RETRY_AFTER = 90;
-var DEFAULT_QUEUE_BLOCK_FOR = 5;
-var DEFAULT_QUEUE_SLEEP = 1;
-var DEFAULT_FAILED_JOBS_CONNECTION = "default";
-var DEFAULT_FAILED_JOBS_TABLE = "failed_jobs";
-var DEFAULT_DATABASE_QUEUE_TABLE = "jobs";
-var DEFAULT_QUEUE_CONFIG = Object.freeze({
-  default: DEFAULT_QUEUE_CONNECTION,
-  failed: Object.freeze({
-    driver: "database",
-    connection: DEFAULT_FAILED_JOBS_CONNECTION,
-    table: DEFAULT_FAILED_JOBS_TABLE
-  }),
-  connections: Object.freeze({
-    [DEFAULT_QUEUE_CONNECTION]: Object.freeze({
-      name: DEFAULT_QUEUE_CONNECTION,
-      driver: "sync",
-      queue: DEFAULT_QUEUE_NAME
-    })
-  })
-});
-function parseIntegerCandidate(value, parser) {
-  if (typeof value === "number") {
-    return value;
-  }
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return Number.NaN;
-  }
-  if (parser === "parse-int") {
-    return Number.parseInt(value, 10);
-  }
-  if (parser === "digits") {
-    return /^\d+$/.test(trimmed) ? Number.parseInt(trimmed, 10) : Number.NaN;
-  }
-  return Number(trimmed);
-}
-function parseScopedInteger(value, fallback, namespace, label, options = {}) {
-  const normalized = typeof value === "undefined" ? fallback : parseIntegerCandidate(value, options.parser ?? "number");
-  if (!Number.isFinite(normalized) || !Number.isInteger(normalized)) {
-    throw new Error(`[${namespace}] ${label} must be an integer.`);
-  }
-  if (typeof options.minimum === "number" && normalized < options.minimum) {
-    throw new Error(`[${namespace}] ${label} must be greater than or equal to ${options.minimum}.`);
-  }
-  return normalized;
-}
-function parseScopedOptionalInteger(value, namespace, label, options = {}) {
-  if (typeof value === "undefined") {
-    return void 0;
-  }
-  return parseScopedInteger(value, Number.NaN, namespace, label, options);
-}
-function parseInteger(value, fallback, namespace, label, options = {}) {
-  return parseScopedInteger(value, fallback, namespace, label, {
-    ...options,
-    parser: "parse-int"
-  });
-}
-function normalizeNonEmptyString(value, label) {
-  const normalized = value?.trim();
-  if (!normalized) {
-    throw new Error(label);
-  }
-  return normalized;
-}
-function normalizeScopedName(value, namespace, label) {
-  const normalized = value?.trim();
-  if (!normalized) {
-    throw new Error(`[${namespace}] ${label} must be a non-empty string.`);
-  }
-  return normalized;
-}
-function normalizeConnectionName(value, namespace, label) {
-  return normalizeScopedName(value, namespace, label);
-}
-function normalizeCacheName(value, label) {
-  return normalizeScopedName(value, "Holo Cache", label);
-}
-function normalizeCacheOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-function parseCacheInteger(value, label, options = {}) {
-  return parseScopedOptionalInteger(value, "Holo Cache", label, options);
-}
-function resolveCachePrefix(globalPrefix, localPrefix) {
-  return normalizeCacheOptionalString(localPrefix) ?? globalPrefix;
-}
-function normalizeCacheDriverConfig(name, config2, globalPrefix) {
-  switch (config2.driver) {
-    case "memory": {
-      const memoryConfig = config2;
-      return Object.freeze({
-        name,
-        driver: "memory",
-        prefix: resolveCachePrefix(globalPrefix, memoryConfig.prefix),
-        maxEntries: parseCacheInteger(memoryConfig.maxEntries, `cache driver "${name}" maxEntries`, {
-          minimum: 1
-        })
-      });
-    }
-    case "file": {
-      const fileConfig = config2;
-      return Object.freeze({
-        name,
-        driver: "file",
-        path: normalizeCacheOptionalString(fileConfig.path) || DEFAULT_CACHE_FILE_PATH,
-        prefix: resolveCachePrefix(globalPrefix, fileConfig.prefix)
-      });
-    }
-    case "redis": {
-      const redisConfig = config2;
-      return Object.freeze({
-        name,
-        driver: "redis",
-        connection: redisConfig.connection,
-        prefix: resolveCachePrefix(globalPrefix, redisConfig.prefix)
-      });
-    }
-    case "database": {
-      const databaseConfig = config2;
-      return Object.freeze({
-        name,
-        driver: "database",
-        connection: databaseConfig.connection,
-        table: normalizeCacheOptionalString(databaseConfig.table) || DEFAULT_CACHE_DATABASE_TABLE,
-        lockTable: normalizeCacheOptionalString(databaseConfig.lockTable) || DEFAULT_CACHE_DATABASE_LOCK_TABLE,
-        prefix: resolveCachePrefix(globalPrefix, databaseConfig.prefix)
-      });
-    }
-    default:
-      throw new Error(`[Holo Cache] Unsupported cache driver "${String(config2.driver)}" on driver "${name}".`);
-  }
-}
-function normalizeCacheConfig(config2 = {}, options = {}) {
-  const prefix = normalizeCacheOptionalString(config2.prefix) ?? DEFAULT_CACHE_PREFIX;
-  const defaultRedisConnection = options.redis?.default ?? DEFAULT_CACHE_REDIS_CONNECTION;
-  const defaultDatabaseConnection = options.database?.defaultConnection ?? DEFAULT_CACHE_DATABASE_CONNECTION;
-  const driverEntries = !config2.drivers || Object.keys(config2.drivers).length === 0 ? Object.entries(holoCacheDefaults.drivers) : Object.entries(config2.drivers);
-  const normalizedDriverEntries = driverEntries.map(([name, driver]) => {
-    const normalizedName = normalizeCacheName(name, "Cache driver name");
-    const driverConfig = (() => {
-      switch (driver.driver) {
-        case "redis":
-          return {
-            ...driver,
-            connection: normalizeCacheOptionalString(driver.connection) ?? defaultRedisConnection
-          };
-        case "database":
-          return {
-            ...driver,
-            connection: normalizeCacheOptionalString(driver.connection) ?? defaultDatabaseConnection
-          };
-        default:
-          return driver;
-      }
-    })();
-    return [normalizedName, normalizeCacheDriverConfig(normalizedName, driverConfig, prefix)];
-  });
-  const drivers = Object.freeze(Object.fromEntries(normalizedDriverEntries));
-  const configuredDefault = normalizeCacheOptionalString(config2.default);
-  if (configuredDefault && !Object.hasOwn(drivers, configuredDefault)) {
-    throw new Error(`[Holo Cache] default cache driver "${configuredDefault}" is not configured.`);
-  }
-  const fallbackDefaultDriver = normalizedDriverEntries.find(([name]) => name === DEFAULT_CACHE_DRIVER)?.[0] ?? normalizedDriverEntries[0][0];
-  const defaultDriver = configuredDefault ?? fallbackDefaultDriver;
-  return Object.freeze({
-    default: defaultDriver,
-    prefix,
-    drivers
-  });
-}
-function normalizeQueueName(value) {
-  return value?.trim() || DEFAULT_QUEUE_NAME;
-}
-function parseRedisInteger(value, fallback, label, options = {}) {
-  return parseScopedInteger(value, fallback, "Holo Redis", label, {
-    ...options,
-    parser: "digits"
-  });
-}
-function normalizeRedisConnectionName(value, label) {
-  return normalizeScopedName(value, "Holo Redis", label);
-}
-function normalizeOptionalRedisString(value, label) {
-  if (typeof value === "undefined") {
-    return void 0;
-  }
-  const normalized = normalizeRedisConnectionName(value, label);
-  try {
-    const parsed = new URL(normalized);
-    if (parsed.protocol !== "redis:" && parsed.protocol !== "rediss:") {
-      throw new Error(`[Holo Redis] ${label} must use the redis:// or rediss:// scheme.`);
-    }
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("[Holo Redis]")) {
-      throw error;
-    }
-    throw new Error(`[Holo Redis] ${label} must be a valid redis:// or rediss:// URL.`);
-  }
-  return normalized;
-}
-function normalizeOptionalRedisSocketPath(value, label) {
-  if (typeof value === "undefined") {
-    return void 0;
-  }
-  return normalizeRedisConnectionName(value, label);
-}
-function deriveNormalizedRedisSocketPath(socketPath, host) {
-  if (socketPath) {
-    return socketPath;
-  }
-  if (typeof host === "string" && (host.startsWith("unix://") || host.startsWith("/"))) {
-    return host.startsWith("unix://") ? host.slice("unix://".length) : host;
-  }
-  return void 0;
-}
-function normalizeRedisClusterNodeConfig(connectionName, index, config2) {
-  const label = `redis connection "${connectionName}" cluster node ${index + 1}`;
-  const url = normalizeOptionalRedisString(config2.url, `${label} url`);
-  const socketPath = normalizeOptionalRedisSocketPath(config2.socketPath, `${label} socketPath`);
-  const normalizedSocketPath = deriveNormalizedRedisSocketPath(socketPath, config2.host?.trim());
-  if (typeof normalizedSocketPath !== "undefined") {
-    throw new Error(`[Holo Redis] ${label} cannot use socketPath in cluster mode.`);
-  }
-  parseRedisDatabaseFromUrl(url, {
-    allowPath: false,
-    label: `${label} url`
-  });
-  const host = config2.host?.trim() || DEFAULT_REDIS_HOST;
-  return Object.freeze({
-    ...typeof url === "undefined" ? {} : { url },
-    host,
-    port: parseRedisInteger(config2.port, DEFAULT_REDIS_PORT, `${label} port`, {
-      minimum: 1
-    })
-  });
-}
-function normalizeRedisClusterNodes(connectionName, nodes) {
-  if (!nodes || nodes.length === 0) {
-    return void 0;
-  }
-  return Object.freeze(nodes.map((node, index) => normalizeRedisClusterNodeConfig(connectionName, index, node)));
-}
-function parseRedisDatabaseFromUrl(url, options) {
-  if (typeof url === "undefined") {
-    return void 0;
-  }
-  try {
-    const parsed = new URL(url);
-    const pathname = parsed.pathname.replace(/^\/+/, "");
-    if (!pathname) {
-      return void 0;
-    }
-    const [databaseSegment] = pathname.split("/");
-    const { label } = options;
-    if (options.allowPath === false) {
-      throw new Error(`[Holo Redis] ${label} cannot include a database path in cluster mode.`);
-    }
-    if (!databaseSegment || !/^\d+$/.test(databaseSegment) || pathname !== databaseSegment) {
-      throw new Error(`[Holo Redis] ${label} database path must be a single integer segment.`);
-    }
-    return Number.parseInt(databaseSegment, 10);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("[Holo Redis]")) {
-      throw error;
-    }
-    return void 0;
-  }
-}
-function normalizeRedisConnectionConfig(name, config2) {
-  const url = normalizeOptionalRedisString(config2.url, `redis connection "${name}" url`);
-  const clusters = normalizeRedisClusterNodes(name, config2.clusters);
-  const socketPath = normalizeOptionalRedisSocketPath(config2.socketPath, `redis connection "${name}" socketPath`);
-  const normalizedSocketPath = deriveNormalizedRedisSocketPath(socketPath, config2.host?.trim());
-  const targetModeCount = [url, clusters, normalizedSocketPath].filter((value) => typeof value !== "undefined").length;
-  if (targetModeCount > 1) {
-    throw new Error(`[Holo Redis] redis connection "${name}" must configure exactly one target mode: url, clusters, or socketPath.`);
-  }
-  const host = config2.host?.trim() || normalizedSocketPath || DEFAULT_REDIS_HOST;
-  const databaseFromUrl = parseRedisDatabaseFromUrl(url, {
-    label: `redis connection "${name}" url`
-  });
-  const database = parseRedisInteger(config2.db ?? databaseFromUrl, DEFAULT_REDIS_DB, `redis connection "${name}" db`, {
-    minimum: 0
-  });
-  if (typeof clusters !== "undefined" && database !== 0) {
-    throw new Error(`[Holo Redis] redis connection "${name}" cannot select redis.db=${database} in cluster mode; Redis Cluster only supports database 0.`);
-  }
-  return Object.freeze({
-    name,
-    ...typeof url === "undefined" ? {} : { url },
-    ...typeof clusters === "undefined" ? {} : { clusters },
-    ...typeof normalizedSocketPath === "undefined" ? {} : { socketPath: normalizedSocketPath },
-    host,
-    port: parseRedisInteger(config2.port, DEFAULT_REDIS_PORT, `redis connection "${name}" port`, {
-      minimum: 1
-    }),
-    username: config2.username?.trim() || void 0,
-    password: config2.password?.trim() || void 0,
-    db: database
-  });
-}
-function normalizeRedisConnections(connections) {
-  if (!connections || Object.keys(connections).length === 0) {
-    return holoRedisDefaults.connections;
-  }
-  return Object.freeze(Object.fromEntries(
-    Object.entries(connections).map(([name, config2]) => {
-      const normalizedName = normalizeRedisConnectionName(name, "Redis connection name");
-      return [normalizedName, normalizeRedisConnectionConfig(normalizedName, config2)];
-    })
-  ));
-}
-function resolveNormalizedRedisConnection(redisConfig, connectionName, label) {
-  const { connections } = redisConfig;
-  const resolved = connections[connectionName];
-  if (!resolved) {
-    throw new Error(`[Holo Redis] ${label} "${connectionName}" is not configured.`);
-  }
-  return resolved;
-}
-function parseSecurityInteger(value, fallback, label, options = {}) {
-  return parseScopedInteger(value, fallback, "Holo Security", label, options);
-}
-function normalizeSecurityName(value, label) {
-  return normalizeScopedName(value, "Holo Security", label);
-}
-function normalizeSecurityOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-function normalizeCorsStringList(values, defaults, label) {
-  if (!values) {
-    return defaults;
-  }
-  return Object.freeze(values.map((value, index) => {
-    const normalized = value.trim();
-    if (!normalized) {
-      throw new Error(`[Holo CORS] ${label} entry at index ${index} must be a non-empty string.`);
-    }
-    return normalized;
-  }));
-}
-function normalizeCorsMethods(values) {
-  return Object.freeze(normalizeCorsStringList(values, DEFAULT_CORS_METHODS, "methods").map((value) => value.toUpperCase()));
-}
-function normalizeCorsMaxAge(value) {
-  return parseSecurityInteger(value ?? DEFAULT_CORS_MAX_AGE, DEFAULT_CORS_MAX_AGE, "cors maxAge", {
-    minimum: 0
-  });
-}
-function normalizeCorsConfig(config2 = {}) {
-  return Object.freeze({
-    paths: normalizeCorsStringList(config2.paths, DEFAULT_CORS_PATHS, "paths"),
-    origins: normalizeCorsStringList(config2.origins, holoCorsDefaults.origins, "origins"),
-    methods: normalizeCorsMethods(config2.methods),
-    headers: normalizeCorsStringList(config2.headers, DEFAULT_CORS_HEADERS, "headers"),
-    credentials: config2.credentials ?? holoCorsDefaults.credentials,
-    maxAge: normalizeCorsMaxAge(config2.maxAge),
-    statefulDomains: normalizeCorsStringList(config2.statefulDomains, holoCorsDefaults.statefulDomains, "statefulDomains")
-  });
-}
-function normalizeSyncConnection(name, config2) {
-  return Object.freeze({
-    name,
-    driver: "sync",
-    queue: normalizeQueueName(config2.queue)
-  });
-}
-function normalizeRedisConnection(name, config2, redisConfig) {
-  const explicitConnectionName = config2.connection?.trim();
-  const connectionName = explicitConnectionName || redisConfig?.default;
-  if (!connectionName) {
-    throw new Error(
-      `[@holo-js/config] Queue Redis connection "${name}" requires a top-level redis config with a default connection or an explicit connection name.`
-    );
-  }
-  if (!redisConfig) {
-    throw new Error(
-      `[@holo-js/config] Queue Redis connection "${name}" references shared Redis connection "${connectionName}" but no top-level redis config is loaded.`
-    );
-  }
-  const resolvedRedisConnection = resolveNormalizedRedisConnection(
-    redisConfig,
-    connectionName,
-    "Queue Redis connection"
-  );
-  return Object.freeze({
-    name,
-    driver: "redis",
-    connection: resolvedRedisConnection.name,
-    queue: normalizeQueueName(config2.queue),
-    retryAfter: parseInteger(config2.retryAfter, DEFAULT_QUEUE_RETRY_AFTER, "Holo Queue", `queue connection "${name}" retryAfter`, {
-      minimum: 0
-    }),
-    blockFor: parseInteger(config2.blockFor, DEFAULT_QUEUE_BLOCK_FOR, "Holo Queue", `queue connection "${name}" blockFor`, {
-      minimum: 0
-    }),
-    redis: Object.freeze({
-      ...typeof resolvedRedisConnection.url === "undefined" ? {} : { url: resolvedRedisConnection.url },
-      ...typeof resolvedRedisConnection.clusters === "undefined" ? {} : { clusters: resolvedRedisConnection.clusters },
-      host: resolvedRedisConnection.host,
-      port: resolvedRedisConnection.port,
-      password: resolvedRedisConnection.password,
-      username: resolvedRedisConnection.username,
-      db: resolvedRedisConnection.db
-    })
-  });
-}
-function normalizeDatabaseConnection(name, config2) {
-  return Object.freeze({
-    name,
-    driver: "database",
-    queue: normalizeQueueName(config2.queue),
-    retryAfter: parseInteger(config2.retryAfter, DEFAULT_QUEUE_RETRY_AFTER, "Holo Queue", `queue connection "${name}" retryAfter`, {
-      minimum: 0
-    }),
-    sleep: parseInteger(config2.sleep, DEFAULT_QUEUE_SLEEP, "Holo Queue", `queue connection "${name}" sleep`, {
-      minimum: 0
-    }),
-    connection: config2.connection?.trim() || DEFAULT_FAILED_JOBS_CONNECTION,
-    table: config2.table?.trim() || DEFAULT_DATABASE_QUEUE_TABLE
-  });
-}
-function normalizeConnectionConfig(name, config2, redisConfig) {
-  switch (config2.driver) {
-    case "sync":
-      return normalizeSyncConnection(name, config2);
-    case "redis":
-      return normalizeRedisConnection(name, config2, redisConfig);
-    case "database":
-      return normalizeDatabaseConnection(name, config2);
-    default:
-      throw new Error(`[Holo Queue] Unsupported queue driver "${String(config2.driver)}" on connection "${name}".`);
-  }
-}
-function normalizeConnections(connections, redisConfig) {
-  if (!connections || Object.keys(connections).length === 0) {
-    return DEFAULT_QUEUE_CONFIG.connections;
-  }
-  const normalizedEntries = Object.entries(connections).map(([name, config2]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Queue", "Queue connection name");
-    return [normalizedName, normalizeConnectionConfig(normalizedName, config2, redisConfig)];
-  });
-  return Object.freeze(Object.fromEntries(normalizedEntries));
-}
-function normalizeFailedStore(config2) {
-  if (config2 === false) {
-    return false;
-  }
-  const normalized = config2 ?? DEFAULT_QUEUE_CONFIG.failed;
-  if (normalized.driver && normalized.driver !== "database") {
-    throw new Error(`[Holo Queue] Unsupported failed job store driver "${normalized.driver}".`);
-  }
-  return Object.freeze({
-    driver: "database",
-    connection: normalized.connection?.trim() || DEFAULT_FAILED_JOBS_CONNECTION,
-    table: normalized.table?.trim() || DEFAULT_FAILED_JOBS_TABLE
-  });
-}
-var holoQueueDefaultsNormalized = DEFAULT_QUEUE_CONFIG;
 function normalizeAppEnv(value, fallback = "development") {
   if (!value) {
     return fallback;
@@ -808,893 +42,13 @@ function normalizeAppConfig(config2 = {}) {
     url: config2.url ?? holoAppDefaults.url,
     debug: debug ?? holoAppDefaults.debug,
     env: normalizeAppEnv(config2.env, holoAppDefaults.env),
+    plugins: Object.freeze([...new Set((config2.plugins ?? []).map((plugin) => plugin.trim()).filter((plugin) => plugin.length > 0))]),
     paths: project.paths,
     models: project.models,
     migrations: project.migrations,
     seeders: project.seeders
   });
 }
-function normalizeSessionStoreConfig(name, config2, redisConfig) {
-  switch (config2.driver) {
-    case "database": {
-      const databaseConfig = config2;
-      return Object.freeze({
-        name,
-        driver: "database",
-        connection: databaseConfig.connection?.trim() || DEFAULT_SESSION_DATABASE_CONNECTION,
-        table: databaseConfig.table?.trim() || DEFAULT_SESSION_DATABASE_TABLE
-      });
-    }
-    case "file": {
-      const fileConfig = config2;
-      return Object.freeze({
-        name,
-        driver: "file",
-        path: fileConfig.path?.trim() || DEFAULT_SESSION_FILE_PATH
-      });
-    }
-    case "redis": {
-      const redisStoreConfig = config2;
-      const configuredConnection = redisStoreConfig.connection?.trim();
-      const connectionName = configuredConnection || redisConfig?.default;
-      if (!connectionName) {
-        throw new Error(
-          `[@holo-js/config] Session Redis store "${name}" requires a top-level redis config with a default connection or an explicit connection name.`
-        );
-      }
-      if (!redisConfig) {
-        throw new Error(
-          `[@holo-js/config] Session Redis store "${name}" references shared Redis connection "${connectionName}" but no top-level redis config is loaded.`
-        );
-      }
-      const resolvedConnection = resolveNormalizedRedisConnection(
-        redisConfig,
-        connectionName,
-        "Session Redis store"
-      );
-      return Object.freeze({
-        name,
-        driver: "redis",
-        connection: resolvedConnection.name,
-        ...typeof resolvedConnection.url === "undefined" ? {} : { url: resolvedConnection.url },
-        ...typeof resolvedConnection.clusters === "undefined" ? {} : { clusters: resolvedConnection.clusters },
-        host: resolvedConnection.host,
-        port: resolvedConnection.port,
-        username: resolvedConnection.username,
-        password: resolvedConnection.password,
-        db: resolvedConnection.db,
-        prefix: redisStoreConfig.prefix?.trim() || ""
-      });
-    }
-    default:
-      throw new Error(`[Holo Session] Unsupported session store driver "${String(config2.driver)}" on store "${name}".`);
-  }
-}
-function normalizeSessionConfig(config2 = {}, redisConfig) {
-  const stores = !config2.stores || Object.keys(config2.stores).length === 0 ? holoSessionDefaults.stores : Object.freeze(Object.fromEntries(Object.entries(config2.stores).map(([name, store]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Session", "Session store name");
-    return [normalizedName, normalizeSessionStoreConfig(normalizedName, store, redisConfig)];
-  })));
-  const configuredDriver = config2.driver?.trim();
-  const driver = configuredDriver || (DEFAULT_SESSION_DRIVER in stores ? DEFAULT_SESSION_DRIVER : void 0) || Object.keys(stores)[0] || DEFAULT_SESSION_DRIVER;
-  if (!(driver in stores)) {
-    throw new Error(`[Holo Session] default session driver "${driver}" is not configured.`);
-  }
-  const cookie = config2.cookie ?? {};
-  const sameSite = cookie.sameSite ?? DEFAULT_SESSION_COOKIE_SAME_SITE;
-  if (sameSite !== "lax" && sameSite !== "strict" && sameSite !== "none") {
-    throw new Error(`[Holo Session] cookie sameSite must be "lax", "strict", or "none".`);
-  }
-  const idleTimeout = parseInteger(config2.idleTimeout, DEFAULT_SESSION_IDLE_TIMEOUT, "Holo Session", "session idleTimeout", {
-    minimum: 0
-  });
-  const absoluteLifetime = parseInteger(
-    config2.absoluteLifetime,
-    DEFAULT_SESSION_ABSOLUTE_LIFETIME,
-    "Holo Session",
-    "session absoluteLifetime",
-    {
-      minimum: 0
-    }
-  );
-  const rememberMeLifetime = parseInteger(
-    config2.rememberMeLifetime,
-    DEFAULT_SESSION_REMEMBER_ME_LIFETIME,
-    "Holo Session",
-    "session rememberMeLifetime",
-    {
-      minimum: 0
-    }
-  );
-  return Object.freeze({
-    driver,
-    stores,
-    cookie: Object.freeze({
-      name: cookie.name?.trim() || DEFAULT_SESSION_COOKIE_NAME,
-      path: cookie.path?.trim() || DEFAULT_SESSION_COOKIE_PATH,
-      domain: cookie.domain?.trim() || void 0,
-      secure: cookie.secure ?? false,
-      httpOnly: cookie.httpOnly ?? true,
-      sameSite,
-      partitioned: cookie.partitioned ?? false,
-      maxAge: parseInteger(cookie.maxAge, absoluteLifetime, "Holo Session", "session cookie maxAge", {
-        minimum: 0
-      })
-    }),
-    idleTimeout,
-    absoluteLifetime,
-    rememberMeLifetime
-  });
-}
-function normalizeSecurityLimiter(name, config2) {
-  const key = typeof config2.key === "function" ? config2.key : void 0;
-  if (typeof config2.key !== "undefined" && typeof config2.key !== "function") {
-    throw new Error(`[Holo Security] rate limiter "${name}" key resolver must be a function when provided.`);
-  }
-  return Object.freeze({
-    name,
-    maxAttempts: parseSecurityInteger(config2.maxAttempts, 0, `rate limiter "${name}" maxAttempts`, {
-      minimum: 1
-    }),
-    decaySeconds: parseSecurityInteger(config2.decaySeconds, 0, `rate limiter "${name}" decaySeconds`, {
-      minimum: 1
-    }),
-    ...key ? { key } : {}
-  });
-}
-function normalizeSecurityRateLimitConfig(config2, redisConfig) {
-  const driver = normalizeSecurityOptionalString(config2?.driver) || DEFAULT_SECURITY_RATE_LIMIT_DRIVER;
-  if (driver !== "memory" && driver !== "file" && driver !== "redis") {
-    throw new Error(`[Holo Security] Unsupported rate limit driver "${driver}".`);
-  }
-  const file = config2?.file ?? {};
-  const redis = config2?.redis ?? {};
-  const limiters = !config2?.limiters || Object.keys(config2.limiters).length === 0 ? holoSecurityDefaults.rateLimit.limiters : Object.freeze(Object.fromEntries(Object.entries(config2.limiters).map(([name, limiter]) => {
-    const normalizedName = normalizeSecurityName(name, "Rate limiter name");
-    return [normalizedName, normalizeSecurityLimiter(normalizedName, limiter)];
-  })));
-  return Object.freeze({
-    driver,
-    memory: Object.freeze({
-      driver: "memory"
-    }),
-    file: Object.freeze({
-      path: normalizeSecurityOptionalString(file.path) || DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH
-    }),
-    redis: Object.freeze((() => {
-      const connectionName = normalizeSecurityOptionalString(redis.connection) || redisConfig?.default || DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION;
-      const resolvedConnection = redisConfig ? resolveNormalizedRedisConnection(
-        redisConfig,
-        connectionName,
-        "Security rate-limit Redis connection"
-      ) : driver === "redis" ? (() => {
-        throw new Error(
-          `[@holo-js/config] Security rate-limit Redis config references shared Redis connection "${connectionName}" but no top-level redis config is loaded.`
-        );
-      })() : {
-        name: connectionName,
-        host: DEFAULT_REDIS_HOST,
-        port: DEFAULT_REDIS_PORT,
-        password: void 0,
-        username: void 0,
-        db: DEFAULT_REDIS_DB
-      };
-      return {
-        ...typeof resolvedConnection.url === "undefined" ? {} : { url: resolvedConnection.url },
-        ...typeof resolvedConnection.clusters === "undefined" ? {} : { clusters: resolvedConnection.clusters },
-        host: resolvedConnection.host,
-        port: resolvedConnection.port,
-        password: resolvedConnection.password,
-        username: resolvedConnection.username,
-        db: resolvedConnection.db,
-        connection: resolvedConnection.name,
-        prefix: normalizeSecurityOptionalString(redis.prefix) || DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX
-      };
-    })()),
-    limiters
-  });
-}
-function normalizeSecurityConfig(config2 = {}, redisConfig) {
-  const csrf = typeof config2.csrf === "boolean" ? { enabled: config2.csrf } : config2.csrf ?? {};
-  const except = csrf.except ? Object.freeze(csrf.except.map((value, index) => {
-    const normalized = value.trim();
-    if (!normalized) {
-      throw new Error(`[Holo Security] csrf except entry at index ${index} must be a non-empty string.`);
-    }
-    return normalized;
-  })) : DEFAULT_SECURITY_CSRF_CONFIG.except;
-  return Object.freeze({
-    csrf: Object.freeze({
-      enabled: csrf.enabled ?? DEFAULT_SECURITY_CSRF_CONFIG.enabled,
-      field: normalizeSecurityOptionalString(csrf.field) || DEFAULT_SECURITY_CSRF_FIELD,
-      header: normalizeSecurityOptionalString(csrf.header) || DEFAULT_SECURITY_CSRF_HEADER,
-      cookie: normalizeSecurityOptionalString(csrf.cookie) || DEFAULT_SECURITY_CSRF_COOKIE,
-      except
-    }),
-    rateLimit: normalizeSecurityRateLimitConfig(config2.rateLimit, redisConfig)
-  });
-}
-function normalizeAuthProvider(name, config2) {
-  const identifiers = Object.freeze(
-    Array.from(new Set((config2.identifiers ?? DEFAULT_AUTH_IDENTIFIERS).map((value) => normalizeNonEmptyString(value, `[Holo Auth] provider "${name}" identifier entries must be non-empty strings.`))))
-  );
-  if (identifiers.length === 0) {
-    throw new Error(`[Holo Auth] provider "${name}" must declare at least one identifier.`);
-  }
-  return Object.freeze({
-    name,
-    model: normalizeNonEmptyString(config2.model, `[Holo Auth] provider "${name}" model must be a non-empty string.`),
-    identifiers
-  });
-}
-function normalizeAuthGuard(name, config2, providers) {
-  const provider = config2.provider?.trim() || DEFAULT_AUTH_PROVIDER;
-  if (!(provider in providers)) {
-    throw new Error(`[Holo Auth] guard "${name}" references unknown provider "${provider}".`);
-  }
-  if (config2.driver !== "session" && config2.driver !== "token") {
-    throw new Error(`[Holo Auth] Unsupported auth guard driver "${String(config2.driver)}" on guard "${name}".`);
-  }
-  return Object.freeze({
-    name,
-    driver: config2.driver,
-    provider
-  });
-}
-function normalizePasswordBroker(name, config2, providers) {
-  const provider = config2.provider?.trim() || DEFAULT_AUTH_PROVIDER;
-  if (!(provider in providers)) {
-    throw new Error(`[Holo Auth] password broker "${name}" references unknown provider "${provider}".`);
-  }
-  return Object.freeze({
-    name,
-    provider,
-    table: config2.table?.trim() || DEFAULT_AUTH_PASSWORD_RESET_TABLE,
-    expire: parseInteger(config2.expire, DEFAULT_AUTH_PASSWORD_EXPIRE, "Holo Auth", `auth password broker "${name}" expire`, {
-      minimum: 0
-    }),
-    throttle: parseInteger(config2.throttle, DEFAULT_AUTH_PASSWORD_THROTTLE, "Holo Auth", `auth password broker "${name}" throttle`, {
-      minimum: 0
-    }),
-    route: config2.route?.trim() || DEFAULT_AUTH_PASSWORD_RESET_ROUTE
-  });
-}
-function normalizeSocialProvider(name, config2, guards, providers) {
-  const guard = config2.guard?.trim();
-  if (guard && !(guard in guards)) {
-    throw new Error(`[Holo Auth] social provider "${name}" references unknown guard "${guard}".`);
-  }
-  const mapToProvider = config2.mapToProvider?.trim();
-  if (mapToProvider && !(mapToProvider in providers)) {
-    throw new Error(`[Holo Auth] social provider "${name}" references unknown provider "${mapToProvider}".`);
-  }
-  return Object.freeze({
-    name,
-    runtime: config2.runtime?.trim() || void 0,
-    clientId: config2.clientId?.trim() || void 0,
-    clientSecret: config2.clientSecret?.trim() || void 0,
-    redirectUri: config2.redirectUri?.trim() || void 0,
-    scopes: Object.freeze([...config2.scopes ?? []]),
-    guard,
-    mapToProvider,
-    encryptTokens: config2.encryptTokens === true
-  });
-}
-function normalizeWorkosProvider(name, config2, guards, providers) {
-  const guard = config2.guard?.trim();
-  if (guard && !(guard in guards)) {
-    throw new Error(`[Holo Auth] WorkOS provider "${name}" references unknown guard "${guard}".`);
-  }
-  const mapToProvider = config2.mapToProvider?.trim();
-  if (mapToProvider && !(mapToProvider in providers)) {
-    throw new Error(`[Holo Auth] WorkOS provider "${name}" references unknown provider "${mapToProvider}".`);
-  }
-  return Object.freeze({
-    name,
-    clientId: config2.clientId?.trim() || void 0,
-    apiKey: config2.apiKey?.trim() || void 0,
-    redirectUri: config2.redirectUri?.trim() || void 0,
-    sessionCookie: DEFAULT_WORKOS_SESSION_COOKIE,
-    guard,
-    mapToProvider
-  });
-}
-function isHostedIdentityStore(value) {
-  return Boolean(value) && typeof value === "object" && typeof value.findByProviderUserId === "function" && typeof value.findByUserId === "function" && typeof value.save === "function";
-}
-function isWorkosProviderConfig(value) {
-  return typeof value === "object" && value !== null && !isHostedIdentityStore(value);
-}
-function getWorkosProviderEntries(config2) {
-  if (!config2) {
-    return Object.freeze([]);
-  }
-  const entries = [];
-  for (const [name, value] of Object.entries(config2)) {
-    if (name === "provider") {
-      if (typeof value !== "undefined" && typeof value !== "string") {
-        throw new Error('[Holo Auth] WorkOS provider key "provider" is reserved for the default provider name.');
-      }
-      continue;
-    }
-    if (name === "identityStore") {
-      if (typeof value !== "undefined" && !isHostedIdentityStore(value)) {
-        throw new Error("[Holo Auth] WorkOS identityStore must implement the hosted identity store contract.");
-      }
-      continue;
-    }
-    if (!isWorkosProviderConfig(value)) {
-      throw new Error(`[Holo Auth] WorkOS provider "${name}" must be an object.`);
-    }
-    entries.push([name, value]);
-  }
-  return Object.freeze(entries);
-}
-function normalizeWorkosConfig(config2, guards, providers) {
-  const providerEntries = getWorkosProviderEntries(config2);
-  const provider = typeof config2?.provider === "string" ? config2.provider.trim() || void 0 : void 0;
-  if (providerEntries.length === 0) {
-    if (provider) {
-      throw new Error(`[Holo Auth] WorkOS provider "${provider}" is not configured.`);
-    }
-    if (config2?.identityStore) {
-      return Object.freeze({
-        identityStore: config2.identityStore
-      });
-    }
-    return holoAuthDefaults.workos;
-  }
-  const normalizedEntries = providerEntries.map(([name, providerConfig]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Auth", "Auth WorkOS provider name");
-    return [normalizedName, providerConfig];
-  });
-  if (provider && !normalizedEntries.some(([name]) => name === provider)) {
-    throw new Error(`[Holo Auth] WorkOS provider "${provider}" is not configured.`);
-  }
-  return Object.freeze({
-    ...typeof provider === "undefined" ? {} : { provider },
-    ...config2?.identityStore ? { identityStore: config2.identityStore } : {},
-    ...Object.fromEntries(normalizedEntries.map(([name, providerConfig]) => [
-      name,
-      normalizeWorkosProvider(name, providerConfig, guards, providers)
-    ]))
-  });
-}
-function normalizeClerkProvider(name, config2, guards, providers) {
-  const guard = config2.guard?.trim();
-  if (guard && !(guard in guards)) {
-    throw new Error(`[Holo Auth] Clerk provider "${name}" references unknown guard "${guard}".`);
-  }
-  const mapToProvider = config2.mapToProvider?.trim();
-  if (mapToProvider && !(mapToProvider in providers)) {
-    throw new Error(`[Holo Auth] Clerk provider "${name}" references unknown provider "${mapToProvider}".`);
-  }
-  const redirectUri = config2.redirectUri?.trim();
-  if (redirectUri) {
-    try {
-      new URL(redirectUri);
-    } catch {
-      throw new Error(`Invalid redirectUri in Clerk provider "${name}": ${redirectUri}`);
-    }
-  }
-  return Object.freeze({
-    name,
-    publishableKey: config2.publishableKey?.trim() || void 0,
-    secretKey: config2.secretKey?.trim() || void 0,
-    apiUrl: config2.apiUrl?.trim() || void 0,
-    frontendApi: config2.frontendApi?.trim() || void 0,
-    redirectUri: redirectUri || void 0,
-    sessionCookie: config2.sessionCookie?.trim() || DEFAULT_CLERK_SESSION_COOKIE,
-    authorizedParties: Object.freeze((config2.authorizedParties ?? []).map((value) => value.trim()).filter(Boolean)),
-    guard,
-    mapToProvider
-  });
-}
-function isClerkProviderConfig(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const candidate = value;
-  for (const key of ["publishableKey", "secretKey", "apiUrl", "frontendApi", "redirectUri", "sessionCookie", "guard", "mapToProvider"]) {
-    const field = candidate[key];
-    if (typeof field !== "undefined" && typeof field !== "string") {
-      return false;
-    }
-  }
-  return typeof candidate.authorizedParties === "undefined" || Array.isArray(candidate.authorizedParties) && candidate.authorizedParties.every((value2) => typeof value2 === "string");
-}
-function getClerkProviderEntries(config2) {
-  if (!config2) {
-    return Object.freeze([]);
-  }
-  const entries = [];
-  for (const [name, value] of Object.entries(config2)) {
-    if (name === "provider") {
-      if (typeof value !== "undefined" && typeof value !== "string") {
-        throw new Error('[Holo Auth] Clerk provider key "provider" is reserved for the default provider name.');
-      }
-      continue;
-    }
-    if (name === "identityStore") {
-      if (typeof value !== "undefined" && !isHostedIdentityStore(value)) {
-        throw new Error("[Holo Auth] Clerk identityStore must implement the hosted identity store contract.");
-      }
-      continue;
-    }
-    if (!isClerkProviderConfig(value)) {
-      throw new Error(`[Holo Auth] Clerk provider "${name}" must be a Clerk provider config object.`);
-    }
-    entries.push([name, value]);
-  }
-  return Object.freeze(entries);
-}
-function normalizeClerkConfig(config2, guards, providers) {
-  const providerEntries = getClerkProviderEntries(config2);
-  const provider = typeof config2?.provider === "string" ? config2.provider.trim() || void 0 : void 0;
-  if (providerEntries.length === 0) {
-    if (provider) {
-      throw new Error(`[Holo Auth] Clerk provider "${provider}" is not configured.`);
-    }
-    if (config2?.identityStore) {
-      return Object.freeze({
-        identityStore: config2.identityStore
-      });
-    }
-    return holoAuthDefaults.clerk;
-  }
-  const normalizedEntries = providerEntries.map(([name, providerConfig]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Auth", "Auth Clerk provider name");
-    return [normalizedName, providerConfig];
-  });
-  if (provider && !normalizedEntries.some(([name]) => name === provider)) {
-    throw new Error(`[Holo Auth] Clerk provider "${provider}" is not configured.`);
-  }
-  return Object.freeze({
-    ...typeof provider === "undefined" ? {} : { provider },
-    ...config2?.identityStore ? { identityStore: config2.identityStore } : {},
-    ...Object.fromEntries(normalizedEntries.map(([name, providerConfig]) => [
-      name,
-      normalizeClerkProvider(name, providerConfig, guards, providers)
-    ]))
-  });
-}
-function normalizeAuthConfig(config2 = {}, _options = {}) {
-  const providers = !config2.providers || Object.keys(config2.providers).length === 0 ? holoAuthDefaults.providers : Object.freeze(Object.fromEntries(Object.entries(config2.providers).map(([name, provider]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Auth", "Auth provider name");
-    return [normalizedName, normalizeAuthProvider(normalizedName, provider)];
-  })));
-  const guards = !config2.guards || Object.keys(config2.guards).length === 0 ? Object.freeze({
-    [DEFAULT_AUTH_GUARD]: normalizeAuthGuard(
-      DEFAULT_AUTH_GUARD,
-      holoAuthDefaults.guards[DEFAULT_AUTH_GUARD],
-      providers
-    )
-  }) : Object.freeze(Object.fromEntries(Object.entries(config2.guards).map(([name, guard]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Auth", "Auth guard name");
-    return [normalizedName, normalizeAuthGuard(normalizedName, guard, providers)];
-  })));
-  const passwords = !config2.passwords || Object.keys(config2.passwords).length === 0 ? Object.freeze({
-    [DEFAULT_AUTH_PASSWORD_BROKER]: normalizePasswordBroker(
-      DEFAULT_AUTH_PASSWORD_BROKER,
-      holoAuthDefaults.passwords[DEFAULT_AUTH_PASSWORD_BROKER],
-      providers
-    )
-  }) : Object.freeze(Object.fromEntries(Object.entries(config2.passwords).map(([name, broker]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Auth", "Auth password broker name");
-    return [normalizedName, normalizePasswordBroker(normalizedName, broker, providers)];
-  })));
-  const defaultGuard = config2.defaults?.guard?.trim() || DEFAULT_AUTH_GUARD;
-  if (!(defaultGuard in guards)) {
-    throw new Error(`[Holo Auth] default auth guard "${defaultGuard}" is not configured.`);
-  }
-  const defaultPasswords = config2.defaults?.passwords?.trim() || DEFAULT_AUTH_PASSWORD_BROKER;
-  if (!(defaultPasswords in passwords)) {
-    throw new Error(`[Holo Auth] default password broker "${defaultPasswords}" is not configured.`);
-  }
-  const social = !config2.social || Object.keys(config2.social).length === 0 ? holoAuthDefaults.social : Object.freeze(Object.fromEntries(Object.entries(config2.social).map(([name, provider]) => {
-    const normalizedName = normalizeConnectionName(name, "Holo Auth", "Auth social provider name");
-    return [normalizedName, normalizeSocialProvider(normalizedName, provider, guards, providers)];
-  })));
-  const workos = normalizeWorkosConfig(config2.workos, guards, providers);
-  const clerk = normalizeClerkConfig(config2.clerk, guards, providers);
-  return Object.freeze({
-    defaults: Object.freeze({
-      guard: defaultGuard,
-      passwords: defaultPasswords
-    }),
-    guards,
-    providers,
-    passwords,
-    emailVerification: Object.freeze({
-      required: typeof config2.emailVerification === "boolean" ? config2.emailVerification : config2.emailVerification?.required ?? false,
-      route: typeof config2.emailVerification === "boolean" ? DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE : config2.emailVerification?.route?.trim() || DEFAULT_AUTH_EMAIL_VERIFICATION_ROUTE
-    }),
-    personalAccessTokens: Object.freeze({
-      defaultAbilities: Object.freeze([...config2.personalAccessTokens?.defaultAbilities ?? holoAuthDefaults.personalAccessTokens.defaultAbilities])
-    }),
-    socialEncryptionKey: config2.socialEncryptionKey?.trim() || _options.appKey?.trim() || void 0,
-    social,
-    workos,
-    clerk
-  });
-}
-function normalizeDatabaseConfig(config2 = {}) {
-  const configuredConnections = config2.connections;
-  const connections = configuredConnections && Object.keys(configuredConnections).length > 0 ? Object.freeze({ ...configuredConnections }) : holoDatabaseDefaults.connections;
-  const defaultConnection = config2.defaultConnection ?? Object.keys(connections)[0];
-  return Object.freeze({
-    /* v8 ignore next */
-    defaultConnection: defaultConnection ?? "default",
-    connections
-  });
-}
-function normalizeStorageConfig(config2 = {}) {
-  return Object.freeze({
-    defaultDisk: config2.defaultDisk ?? holoStorageDefaults.defaultDisk,
-    routePrefix: config2.routePrefix ?? holoStorageDefaults.routePrefix,
-    disks: Object.freeze({
-      ...holoStorageDefaults.disks,
-      ...config2.disks ?? {}
-    })
-  });
-}
-function normalizeOptionalBroadcastString(value, label) {
-  if (typeof value === "undefined") {
-    return void 0;
-  }
-  const normalized = String(value).trim();
-  if (!normalized) {
-    throw new Error(`[Holo Broadcast] ${label} must be a non-empty string when provided.`);
-  }
-  return normalized;
-}
-function normalizeBroadcastPort(value, fallback, label) {
-  const normalized = typeof value === "number" ? value : typeof value === "string" && value.trim() ? Number(value.trim()) : fallback;
-  if (!Number.isInteger(normalized) || normalized <= 0) {
-    throw new Error(`[Holo Broadcast] ${label} must be a positive integer.`);
-  }
-  return normalized;
-}
-function normalizeBroadcastScheme(value, fallback, label) {
-  const normalized = normalizeOptionalBroadcastString(value, label)?.toLowerCase();
-  if (typeof normalized === "undefined") {
-    return fallback;
-  }
-  if (normalized !== "http" && normalized !== "https") {
-    throw new Error(`[Holo Broadcast] ${label} must be "http" or "https".`);
-  }
-  return normalized;
-}
-function normalizeBroadcastConnectionOptions(options, fallbackHost, label) {
-  const scheme = normalizeBroadcastScheme(
-    options?.scheme,
-    options?.useTLS === false ? "http" : "https",
-    `${label} scheme`
-  );
-  const resolvedFallbackPort = scheme === "http" ? DEFAULT_BROADCAST_HTTP_PORT : DEFAULT_BROADCAST_HTTPS_PORT;
-  return Object.freeze({
-    host: normalizeOptionalBroadcastString(options?.host, `${label} host`) ?? fallbackHost,
-    port: normalizeBroadcastPort(options?.port, resolvedFallbackPort, `${label} port`),
-    scheme,
-    useTLS: options?.useTLS ?? scheme === "https",
-    cluster: normalizeOptionalBroadcastString(options?.cluster, `${label} cluster`) ?? void 0
-  });
-}
-function normalizeBroadcastWorkerConfig(worker, connectionOptions, configuredConnectionPort) {
-  const scaling = worker?.scaling;
-  const publicScheme = normalizeBroadcastScheme(worker?.publicScheme, connectionOptions?.scheme ?? "https", "Broadcast worker public scheme");
-  const fallbackPort = typeof configuredConnectionPort === "undefined" ? DEFAULT_BROADCAST_WORKER_PORT : normalizeBroadcastPort(configuredConnectionPort, DEFAULT_BROADCAST_WORKER_PORT, "Broadcast worker port");
-  if (scaling && scaling.driver !== "redis") {
-    throw new Error('[Holo Broadcast] Broadcast worker scaling driver must be "redis".');
-  }
-  return Object.freeze({
-    host: normalizeOptionalBroadcastString(worker?.host, "Broadcast worker host") ?? DEFAULT_BROADCAST_WORKER_HOST,
-    port: normalizeBroadcastPort(worker?.port, fallbackPort, "Broadcast worker port"),
-    path: normalizeOptionalBroadcastString(worker?.path, "Broadcast worker path") ?? DEFAULT_BROADCAST_WORKER_PATH,
-    publicHost: normalizeOptionalBroadcastString(worker?.publicHost, "Broadcast worker public host") ?? void 0,
-    publicPort: typeof worker?.publicPort === "undefined" ? publicScheme === "http" ? DEFAULT_BROADCAST_HTTP_PORT : void 0 : normalizeBroadcastPort(
-      worker.publicPort,
-      /* v8 ignore next -- defensive HTTPS port default; tests only exercise HTTP scheme */
-      publicScheme === "http" ? DEFAULT_BROADCAST_HTTP_PORT : DEFAULT_BROADCAST_HTTPS_PORT,
-      "Broadcast worker public port"
-    ),
-    publicScheme,
-    healthPath: normalizeOptionalBroadcastString(worker?.healthPath, "Broadcast worker health path") ?? DEFAULT_BROADCAST_HEALTH_PATH,
-    statsPath: normalizeOptionalBroadcastString(worker?.statsPath, "Broadcast worker stats path") ?? DEFAULT_BROADCAST_STATS_PATH,
-    scaling: scaling && typeof scaling === "object" ? Object.freeze({
-      driver: "redis",
-      connection: normalizeOptionalBroadcastString(scaling.connection, "Broadcast worker scaling connection") ?? "default"
-    }) : holoBroadcastDefaults.worker.scaling
-  });
-}
-function normalizeBroadcastConnection(name, connection) {
-  const normalizedName = normalizeOptionalBroadcastString(name, "Broadcast connection name");
-  const driver = normalizeOptionalBroadcastString(connection.driver, `Broadcast connection "${name}" driver`);
-  if (!normalizedName || !driver) {
-    throw new Error("[Holo Broadcast] Broadcast connections must define a name and driver.");
-  }
-  const clientOptions = Object.freeze({
-    ...connection.clientOptions ?? {}
-  });
-  if (driver === "holo") {
-    return Object.freeze({
-      name: normalizedName,
-      driver: "holo",
-      key: normalizeOptionalBroadcastString(connection.key, `Broadcast connection "${name}" key`) ?? (() => {
-        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a key.`);
-      })(),
-      secret: normalizeOptionalBroadcastString(connection.secret, `Broadcast connection "${name}" secret`) ?? (() => {
-        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a secret.`);
-      })(),
-      appId: normalizeOptionalBroadcastString(connection.appId, `Broadcast connection "${name}" appId`) ?? (() => {
-        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define an appId.`);
-      })(),
-      options: normalizeBroadcastConnectionOptions(connection.options, DEFAULT_BROADCAST_HOST, `Broadcast connection "${name}" options`),
-      clientOptions
-    });
-  }
-  if (driver === "pusher") {
-    const cluster = normalizeOptionalBroadcastString(connection.options?.cluster, `Broadcast connection "${name}" cluster`) ?? void 0;
-    return Object.freeze({
-      name: normalizedName,
-      driver: "pusher",
-      key: normalizeOptionalBroadcastString(connection.key, `Broadcast connection "${name}" key`) ?? (() => {
-        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a key.`);
-      })(),
-      secret: normalizeOptionalBroadcastString(connection.secret, `Broadcast connection "${name}" secret`) ?? (() => {
-        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define a secret.`);
-      })(),
-      appId: normalizeOptionalBroadcastString(connection.appId, `Broadcast connection "${name}" appId`) ?? (() => {
-        throw new Error(`[Holo Broadcast] Broadcast connection "${name}" must define an appId.`);
-      })(),
-      options: normalizeBroadcastConnectionOptions(
-        {
-          ...connection.options,
-          cluster
-        },
-        normalizeOptionalBroadcastString(connection.options?.host, `Broadcast connection "${name}" host`) ?? (cluster ? `api-${cluster}.pusher.com` : "api-mt1.pusher.com"),
-        `Broadcast connection "${name}" options`
-      ),
-      clientOptions
-    });
-  }
-  if (driver === "log") {
-    return Object.freeze({
-      name: normalizedName,
-      driver: "log",
-      clientOptions
-    });
-  }
-  if (driver === "null") {
-    return Object.freeze({
-      name: normalizedName,
-      driver: "null",
-      clientOptions
-    });
-  }
-  if (driver === "ably") {
-    throw new Error('[Holo Broadcast] Broadcast driver "ably" is not supported yet.');
-  }
-  const {
-    driver: _ignoredDriver,
-    clientOptions: _ignoredClientOptions,
-    ...customConfig
-  } = connection;
-  return Object.freeze({
-    driver,
-    clientOptions,
-    ...customConfig,
-    name: normalizedName
-  });
-}
-function normalizeBroadcastConfig(config2 = {}) {
-  const normalizedConnections = Object.fromEntries(
-    Object.entries(config2.connections ?? holoBroadcastDefaults.connections).map(([name, connection]) => [name, normalizeBroadcastConnection(name, connection)])
-  );
-  const defaultConnection = normalizeOptionalBroadcastString(config2.default, "Default broadcast connection") ?? holoBroadcastDefaults.default;
-  if (!normalizedConnections[defaultConnection]) {
-    throw new Error(
-      `[Holo Broadcast] default broadcast connection "${defaultConnection}" is not configured. Available connections: ${Object.keys(normalizedConnections).join(", ")}`
-    );
-  }
-  const defaultBroadcastConnection = normalizedConnections[defaultConnection];
-  const defaultHoloConnectionOptions = defaultBroadcastConnection && defaultBroadcastConnection.driver === "holo" && "options" in defaultBroadcastConnection ? defaultBroadcastConnection.options : void 0;
-  const configuredDefaultConnection = config2.connections?.[defaultConnection];
-  const configuredDefaultHoloConnectionPort = configuredDefaultConnection?.driver === "holo" ? configuredDefaultConnection.options?.port : void 0;
-  return Object.freeze({
-    default: defaultConnection,
-    connections: Object.freeze(normalizedConnections),
-    worker: normalizeBroadcastWorkerConfig(config2.worker, defaultHoloConnectionOptions, configuredDefaultHoloConnectionPort)
-  });
-}
-function normalizeOptionalMailString(value, label) {
-  if (typeof value === "undefined") {
-    return void 0;
-  }
-  const normalized = value.trim();
-  if (!normalized) {
-    throw new Error(`[Holo Mail] ${label} must be a non-empty string when provided.`);
-  }
-  return normalized;
-}
-function isValidMailAddress(email) {
-  if (email.includes(" ")) {
-    return false;
-  }
-  const parts = email.split("@");
-  return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;
-}
-function normalizeMailAddress(address, label) {
-  if (!address) {
-    return void 0;
-  }
-  const email = normalizeOptionalMailString(address.email, `${label} email`)?.toLowerCase();
-  if (!email || !isValidMailAddress(email)) {
-    throw new Error(`[Holo Mail] ${label} email must be a valid email address.`);
-  }
-  const name = normalizeOptionalMailString(address.name, `${label} name`);
-  return Object.freeze({
-    email,
-    ...name ? { name } : {}
-  });
-}
-function normalizeMailQueueConfig(queue, fallback = holoMailDefaults.queue) {
-  return Object.freeze({
-    queued: queue?.queued ?? fallback.queued,
-    connection: normalizeOptionalMailString(queue?.connection, "Mail queue connection") ?? fallback.connection,
-    queue: normalizeOptionalMailString(queue?.queue, "Mail queue name") ?? fallback.queue,
-    afterCommit: queue?.afterCommit ?? fallback.afterCommit
-  });
-}
-function normalizeMailPreviewEnvironments(environments) {
-  if (typeof environments === "undefined") {
-    return holoMailDefaults.preview.allowedEnvironments;
-  }
-  const normalized = /* @__PURE__ */ new Set();
-  for (const environment of environments) {
-    if (environment !== "development" && environment !== "production" && environment !== "test") {
-      throw new Error("[Holo Mail] Mail preview environments must be development, production, or test.");
-    }
-    normalized.add(environment);
-  }
-  return Object.freeze([...normalized]);
-}
-function normalizeMailMailerConfig(name, config2, fallback) {
-  const normalizedName = normalizeOptionalMailString(name, "Mail mailer name");
-  const driver = normalizeOptionalMailString(config2.driver, `Mail mailer "${name}" driver`);
-  if (!normalizedName || !driver) {
-    throw new Error("[Holo Mail] Mailers must define a name and driver.");
-  }
-  const base = {
-    name: normalizedName,
-    driver,
-    from: normalizeMailAddress(config2.from, `Mail mailer "${name}" from`) ?? fallback?.from,
-    replyTo: normalizeMailAddress(config2.replyTo, `Mail mailer "${name}" replyTo`) ?? fallback?.replyTo,
-    queue: normalizeMailQueueConfig(config2.queue, fallback?.queue ?? holoMailDefaults.queue)
-  };
-  if (driver === "preview") {
-    const previewFallback = fallback?.driver === "preview" ? fallback : void 0;
-    return Object.freeze({
-      ...base,
-      driver: "preview",
-      path: normalizeOptionalMailString(config2.path, `Mail mailer "${name}" preview path`) ?? previewFallback?.path ?? DEFAULT_MAIL_PREVIEW_PATH
-    });
-  }
-  if (driver === "log") {
-    const logFallback = fallback?.driver === "log" ? fallback : void 0;
-    return Object.freeze({
-      ...base,
-      driver: "log",
-      logBodies: config2.logBodies ?? logFallback?.logBodies ?? false
-    });
-  }
-  if (driver === "fake") {
-    return Object.freeze({
-      ...base,
-      driver: "fake"
-    });
-  }
-  if (driver === "smtp") {
-    const smtpFallback = fallback?.driver === "smtp" ? fallback : void 0;
-    const rawPort = config2.port;
-    const normalizedPort = typeof rawPort === "number" ? rawPort : typeof rawPort === "string" && rawPort.trim() ? Number(rawPort.trim()) : smtpFallback?.port ?? DEFAULT_SMTP_PORT;
-    if (!Number.isFinite(normalizedPort) || normalizedPort <= 0) {
-      throw new Error(`[Holo Mail] Mail mailer "${name}" SMTP port must be a positive number.`);
-    }
-    return Object.freeze({
-      ...base,
-      driver: "smtp",
-      host: normalizeOptionalMailString(config2.host, `Mail mailer "${name}" SMTP host`) ?? smtpFallback?.host ?? DEFAULT_SMTP_HOST,
-      port: normalizedPort,
-      secure: config2.secure ?? smtpFallback?.secure ?? false,
-      user: normalizeOptionalMailString(config2.user, `Mail mailer "${name}" SMTP user`) ?? smtpFallback?.user ?? void 0,
-      password: normalizeOptionalMailString(config2.password, `Mail mailer "${name}" SMTP password`) ?? smtpFallback?.password ?? void 0
-    });
-  }
-  const customFields = Object.fromEntries(
-    Object.entries(config2).filter(([key]) => key !== "driver" && key !== "from" && key !== "replyTo" && key !== "queue")
-  );
-  return Object.freeze({
-    ...base,
-    ...customFields
-  });
-}
-function normalizeMailConfig(config2 = {}) {
-  const mergedMailers = {
-    ...holoMailDefaults.mailers
-  };
-  for (const [name, mailer] of Object.entries(config2.mailers ?? {})) {
-    mergedMailers[name] = normalizeMailMailerConfig(name, mailer, mergedMailers[name]);
-  }
-  const defaultMailer = normalizeOptionalMailString(config2.default, "Default mailer") ?? holoMailDefaults.default;
-  if (!mergedMailers[defaultMailer]) {
-    throw new Error(
-      `[Holo Mail] default mailer "${defaultMailer}" is not configured. Available mailers: ${Object.keys(mergedMailers).join(", ")}`
-    );
-  }
-  return Object.freeze({
-    default: defaultMailer,
-    from: normalizeMailAddress(config2.from, "Mail from") ?? holoMailDefaults.from,
-    replyTo: normalizeMailAddress(config2.replyTo, "Mail replyTo") ?? holoMailDefaults.replyTo,
-    queue: normalizeMailQueueConfig(config2.queue),
-    preview: Object.freeze({
-      allowedEnvironments: normalizeMailPreviewEnvironments(config2.preview?.allowedEnvironments)
-    }),
-    markdown: Object.freeze({
-      wrapper: normalizeOptionalMailString(config2.markdown?.wrapper, "Mail markdown wrapper") ?? holoMailDefaults.markdown.wrapper
-    }),
-    mailers: Object.freeze(mergedMailers)
-  });
-}
-function normalizeOptionalNotificationsString(value, label) {
-  if (typeof value === "undefined") {
-    return void 0;
-  }
-  const normalized = value.trim();
-  if (!normalized) {
-    throw new Error(`[Holo Notifications] ${label} must be a non-empty string when provided.`);
-  }
-  return normalized;
-}
-function normalizeNotificationsConfig(config2 = {}) {
-  return Object.freeze({
-    table: normalizeOptionalNotificationsString(config2.table, "Notifications table") ?? DEFAULT_NOTIFICATIONS_TABLE,
-    queue: Object.freeze({
-      connection: normalizeOptionalNotificationsString(config2.queue?.connection, "Notifications queue connection"),
-      queue: normalizeOptionalNotificationsString(config2.queue?.queue, "Notifications queue name"),
-      afterCommit: config2.queue?.afterCommit === true
-    })
-  });
-}
-function normalizeRedisConfig(config2 = {}) {
-  const connections = normalizeRedisConnections(config2.connections);
-  const connectionNames = Object.keys(connections);
-  const defaultConnection = config2.default?.trim() || connectionNames[0];
-  if (!connections[defaultConnection]) {
-    throw new Error(
-      `[Holo Redis] default redis connection "${defaultConnection}" is not configured. Available connections: ${connectionNames.join(", ")}`
-    );
-  }
-  return Object.freeze({
-    default: defaultConnection,
-    connections
-  });
-}
-function normalizeQueueConfigForHolo(config2 = {}, redisConfig) {
-  const connections = normalizeConnections(config2.connections, redisConfig);
-  const connectionNames = Object.keys(connections);
-  const defaultConnection = config2.default?.trim() || connectionNames[0];
-  if (!connections[defaultConnection]) {
-    throw new Error(
-      `[Holo Queue] default queue connection "${defaultConnection}" is not configured. Available connections: ${connectionNames.join(", ")}`
-    );
-  }
-  return Object.freeze({
-    default: defaultConnection,
-    failed: normalizeFailedStore(config2.failed),
-    connections
-  });
-}
 
 // src/access.ts
 function isObject(value) {
@@ -1918,6 +272,9 @@ function resolveEnvPlaceholders(value, envValues) {
 import { mkdir, readFile as readFile2, readdir, rm, writeFile } from "fs/promises";
 import { basename as basename2, dirname, extname, join as join2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
+import {
+  normalizeRedisConfig
+} from "@holo-js/kernel";
 var CONFIG_EXTENSION_PRIORITY = [".ts", ".mts", ".js", ".mjs", ".cts", ".cjs"];
 var SUPPORTED_CONFIG_EXTENSIONS = new Set(CONFIG_EXTENSION_PRIORITY);
 var HOLO_CONFIG_CACHE_VERSION = 3;
@@ -2066,41 +423,11 @@ function mergeLoadedFiles(cachedFiles, liveFiles, deferredConfigNames) {
 function normalizeLoadedConfig(rawConfig, options) {
   const resolvedRawConfig = resolveEnvPlaceholders(rawConfig, options.environment.values);
   const app = normalizeAppConfig(resolvedRawConfig.app);
-  const database = normalizeDatabaseConfig(resolvedRawConfig.database);
   const redis = normalizeRedisConfig(resolvedRawConfig.redis);
-  const resolvedRedisConfig = typeof resolvedRawConfig.redis === "undefined" ? void 0 : redis;
-  const cache = normalizeCacheConfig(resolvedRawConfig.cache, {
-    database,
-    redis: resolvedRedisConfig
-  });
-  const cors = normalizeCorsConfig(resolvedRawConfig.cors);
-  const storage = normalizeStorageConfig(resolvedRawConfig.storage);
-  const queue = normalizeQueueConfigForHolo(resolvedRawConfig.queue, resolvedRedisConfig);
-  const broadcast = normalizeBroadcastConfig(resolvedRawConfig.broadcast);
-  const mail = normalizeMailConfig(resolvedRawConfig.mail);
-  const notifications = normalizeNotificationsConfig(resolvedRawConfig.notifications);
-  const media = Object.freeze({ ...resolvedRawConfig.media ?? {} });
-  const session = normalizeSessionConfig(resolvedRawConfig.session, resolvedRedisConfig);
-  const security = normalizeSecurityConfig(resolvedRawConfig.security, resolvedRedisConfig);
-  const auth = normalizeAuthConfig(resolvedRawConfig.auth, {
-    appKey: app.key
-  });
-  const firstPartyConfig = {
+  const firstPartyConfig = composeRegisteredConfig(resolvedRawConfig, {
     app,
-    database,
-    redis,
-    cache,
-    cors,
-    storage,
-    queue,
-    broadcast,
-    mail,
-    notifications,
-    media,
-    session,
-    security,
-    auth
-  };
+    redis
+  });
   const firstPartyConfigKeys = new Set(Object.keys(firstPartyConfig));
   const customEntries = Object.entries(resolvedRawConfig).filter(([key]) => {
     return !firstPartyConfigKeys.has(key);
@@ -2153,8 +480,11 @@ function splitCacheableConfig(rawConfig) {
 function getDeferredConfigNames(payload) {
   return Array.isArray(payload.deferredConfigNames) ? payload.deferredConfigNames : Object.freeze([]);
 }
+function getNormalizerConfigNames(payload) {
+  return payload.normalizerConfigNames ?? Object.freeze([]);
+}
 function isCachePayload(value) {
-  return isObject2(value) && (value.version === 1 || value.version === HOLO_CONFIG_CACHE_VERSION) && isObject2(value.environment) && typeof value.environment.name === "string" && Array.isArray(value.environment.loadedFiles) && Array.isArray(value.environment.warnings) && Array.isArray(value.configFiles) && isObject2(value.config) && (typeof value.deferredConfigNames === "undefined" || Array.isArray(value.deferredConfigNames));
+  return isObject2(value) && (value.version === 1 || value.version === HOLO_CONFIG_CACHE_VERSION) && isObject2(value.environment) && typeof value.environment.name === "string" && Array.isArray(value.environment.loadedFiles) && Array.isArray(value.environment.warnings) && Array.isArray(value.configFiles) && isObject2(value.config) && (typeof value.deferredConfigNames === "undefined" || Array.isArray(value.deferredConfigNames)) && (typeof value.normalizerConfigNames === "undefined" || Array.isArray(value.normalizerConfigNames));
 }
 function resolveConfigCachePath(projectRoot) {
   return join2(resolve2(projectRoot), HOLO_CONFIG_CACHE_PATH);
@@ -2197,7 +527,8 @@ async function writeConfigCache(projectRoot, options = {}) {
     },
     configFiles: loadedFiles,
     config: cacheableConfig,
-    deferredConfigNames
+    deferredConfigNames,
+    normalizerConfigNames: configRegistryInternals.getRegisteredNames().filter((name) => Object.hasOwn(rawConfig, name))
   }, null, 2)}
 `;
   await writeFileIfChanged(cachePath, contents);
@@ -2228,6 +559,12 @@ async function loadConfigDirectory(projectRoot, options = {}) {
       const deferredConfigNames = getDeferredConfigNames(cached);
       let rawConfig2 = cached.config;
       let loadedFiles2 = cached.configFiles;
+      const cachedConfigNames = getNormalizerConfigNames(cached).filter((name) => !deferredConfigNames.includes(name));
+      if (cachedConfigNames.length > 0) {
+        await collectRawConfig(configDir, environment2.values, {
+          onlyConfigNames: cachedConfigNames
+        });
+      }
       if (deferredConfigNames.length > 0) {
         const live = await collectRawConfig(configDir, environment2.values, {
           onlyConfigNames: deferredConfigNames
@@ -2261,106 +598,34 @@ function defineConfig(config2) {
 function defineAppConfig(config2) {
   return defineConfig(config2);
 }
-function defineDatabaseConfig(config2) {
-  return defineConfig(config2);
-}
-function defineRedisConfig(config2) {
-  return defineConfig(config2);
-}
-function defineCacheConfig(config2) {
-  return defineConfig(config2);
-}
-function defineStorageConfig(config2) {
-  return defineConfig(config2);
-}
-function defineQueueConfig(config2) {
-  return defineConfig(config2);
-}
-function defineBroadcastConfig(config2) {
-  return defineConfig(config2);
-}
-function defineMailConfig(config2) {
-  return defineConfig(config2);
-}
-function defineNotificationsConfig(config2) {
-  return defineConfig(config2);
-}
-function defineMediaConfig(config2) {
-  return defineConfig(config2);
-}
-function defineSessionConfig(config2) {
-  return defineConfig(config2);
-}
-function defineSecurityConfig(config2) {
-  return defineConfig(config2);
-}
-function defineCorsConfig(config2) {
-  return defineConfig(config2);
-}
-function defineAuthConfig(config2) {
-  return defineConfig(config2);
-}
 var loaderInternals = {
   getDeferredConfigNames,
+  getNormalizerConfigNames,
   getConfigExtensionPriority,
   resolveConfigExport,
   splitCacheableConfig
 };
 export {
   DEFAULT_APP_NAME,
-  DEFAULT_SESSION_COOKIE_NAME,
   clearConfigCache,
+  composeRegisteredConfig,
   config,
+  configRegistryInternals,
   configureConfigRuntime,
   configureEnvRuntime,
   createConfigAccessors,
   defineAppConfig,
-  defineAuthConfig,
-  defineBroadcastConfig,
-  defineCacheConfig,
   defineConfig,
-  defineCorsConfig,
-  defineDatabaseConfig,
-  defineMailConfig,
-  defineMediaConfig,
-  defineNotificationsConfig,
-  defineQueueConfig,
-  defineRedisConfig,
-  defineSecurityConfig,
-  defineSessionConfig,
-  defineStorageConfig,
   env,
   holoAppDefaults,
-  holoAuthDefaults,
-  holoBroadcastDefaults,
-  holoCacheDefaults,
-  holoCorsDefaults,
-  holoDatabaseDefaults,
-  holoMailDefaults,
-  holoNotificationsDefaults,
-  holoQueueDefaultsNormalized,
-  holoRedisDefaults,
-  holoSecurityDefaults,
-  holoSessionDefaults,
-  holoStorageDefaults,
   isEnvPlaceholder,
   loadConfigDirectory,
   loadEnvironment,
   loaderInternals,
   normalizeAppConfig,
   normalizeAppEnv,
-  normalizeAuthConfig,
-  normalizeBroadcastConfig,
-  normalizeCacheConfig,
-  normalizeCorsConfig,
-  normalizeDatabaseConfig,
-  normalizeMailConfig,
-  normalizeNotificationsConfig,
-  normalizeQueueConfigForHolo,
-  normalizeRedisConfig,
-  normalizeSecurityConfig,
-  normalizeSessionConfig,
-  normalizeStorageConfig,
+  registerConfigNormalizer,
+  resetConfigNormalizers,
   resetConfigRuntime,
   resolveAppEnvironment,
   resolveConfigCachePath,