@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/src/framework/buildContext.js

@@ -0,0 +1,119 @@
+import { closeMetricsQueues, resetMetrics } from './lib/metrics';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+async function clearIfPresent(value) {
+    const clear = value?.clear;
+    if (typeof clear === 'function') {
+        await clear.call(value);
+    }
+}
+/**
+ * Apply the drain() snapshot to the context after all plugin phases complete.
+ * Replaces the mutable cast pattern in createApp() — single internal mutation point.
+ */
+export function finalizeContext(ctx, snapshot) {
+    const mutable = ctx;
+    mutable.routeAuth = snapshot.routeAuth;
+    mutable.userResolver = snapshot.userResolver;
+    mutable.rateLimitAdapter = snapshot.rateLimitAdapter;
+    mutable.fingerprintBuilder = snapshot.fingerprintBuilder;
+    mutable.cacheAdapters.clear();
+    for (const [store, adapter] of snapshot.cacheAdapters) {
+        mutable.cacheAdapters.set(store, adapter);
+    }
+    mutable.emailTemplates.clear();
+    for (const [name, template] of snapshot.emailTemplates) {
+        mutable.emailTemplates.set(name, template);
+    }
+}
+export function buildContext(params) {
+    const { app, appName, infra, signing, captcha, upload, metricsState, plugins, bus, secretBundle, } = params;
+    const { sessions, oauthState, cache, authStore, sqlite } = infra.resolvedStores;
+    return {
+        app,
+        config: Object.freeze({
+            appName,
+            resolvedStores: Object.freeze({ sessions, oauthState, cache, authStore, sqlite }),
+            security: Object.freeze({ cors: infra.corsOrigins }),
+            signing: signing ?? null,
+            dataEncryptionKeys: Object.freeze([...infra.dataEncryptionKeys]),
+            redis: infra.redis ?? undefined,
+            mongo: infra.mongo ? { auth: infra.mongo.auth, app: infra.mongo.app } : undefined,
+            captcha: captcha ?? null,
+        }),
+        redis: infra.redis ?? null,
+        mongo: infra.mongo ? { auth: infra.mongo.auth ?? null, app: infra.mongo.app ?? null } : null,
+        sqlite: sqlite ?? null,
+        signing: signing ?? null,
+        dataEncryptionKeys: Object.freeze([...infra.dataEncryptionKeys]),
+        ws: null,
+        persistence: infra.persistence,
+        pluginState: new Map(),
+        plugins: Object.freeze([...plugins]),
+        bus,
+        routeAuth: null,
+        userResolver: null,
+        rateLimitAdapter: null,
+        fingerprintBuilder: null,
+        cacheAdapters: new Map(),
+        emailTemplates: new Map(),
+        trustProxy: infra.frameworkConfig.trustProxy,
+        upload: upload
+            ? {
+                adapter: upload.storage,
+                config: Object.freeze({
+                    maxFileSize: upload.maxFileSize,
+                    maxFiles: upload.maxFiles,
+                    allowedMimeTypes: upload.allowedMimeTypes,
+                    keyPrefix: upload.keyPrefix,
+                    generateKey: upload.generateKey,
+                    tenantScopedKeys: upload.tenantScopedKeys,
+                }),
+            }
+            : null,
+        metrics: metricsState,
+        secrets: secretBundle.provider,
+        resolvedSecrets: secretBundle.merged,
+        async clear() {
+            resetMetrics(this.metrics);
+            await clearIfPresent(this.persistence.idempotency);
+            await clearIfPresent(this.persistence.uploadRegistry);
+            await clearIfPresent(this.persistence.wsMessages);
+            if (this.ws) {
+                this.ws.roomRegistry.clear();
+                this.ws.heartbeatSockets.clear();
+                this.ws.heartbeatEndpointConfigs.clear();
+                this.ws.socketUsers.clear();
+                this.ws.roomPresence.clear();
+                if (this.ws.heartbeatTimer) {
+                    clearInterval(this.ws.heartbeatTimer);
+                    this.ws.heartbeatTimer = null;
+                }
+            }
+        },
+        async destroy() {
+            await this.clear();
+            await closeMetricsQueues(this.metrics);
+            if (infra.redisEnabled && infra.redis) {
+                try {
+                    const { disconnectRedis } = await import('../lib/redis');
+                    await disconnectRedis(infra.redis);
+                }
+                catch {
+                    /* best-effort */
+                }
+            }
+            if (infra.mongoMode !== false && infra.mongo) {
+                try {
+                    const { disconnectMongo } = await import('../lib/mongo');
+                    await disconnectMongo(infra.mongo.auth, infra.mongo.app);
+                }
+                catch {
+                    /* best-effort */
+                }
+            }
+            await secretBundle.provider.destroy?.();
+        },
+    };
+}

package/dist/src/framework/config/schema.d.ts

@@ -0,0 +1,447 @@
+/**
+ * Zod schemas for full-depth config validation.
+ *
+ * These schemas validate the complete shape of CreateAppConfig and
+ * CreateServerConfig at startup — catching typos, wrong types, and structural
+ * errors at every nesting level. Type mismatches always throw.
+ * Unknown keys throw in production, warn in development.
+ */
+import { z } from 'zod';
+export declare const appConfigSchema: z.ZodObject<{
+    routesDir: z.ZodString;
+    modelSchemas: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        registration: z.ZodOptional<z.ZodEnum<{
+            explicit: "explicit";
+            auto: "auto";
+        }>>;
+    }, z.core.$loose>]>>;
+    app: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    security: z.ZodOptional<z.ZodObject<{
+        cors: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+            origin: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+            credentials: z.ZodOptional<z.ZodBoolean>;
+            allowHeaders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            exposeHeaders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            maxAge: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>]>>;
+        headers: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+        rateLimit: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            windowMs: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+            message: z.ZodOptional<z.ZodString>;
+            standardHeaders: z.ZodOptional<z.ZodBoolean>;
+            keyGenerator: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            skip: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            handler: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        }, z.core.$loose>, z.ZodLiteral<false>]>>;
+        botProtection: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            blockList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            fingerprintRateLimit: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>, z.ZodLiteral<false>]>>;
+        trustProxy: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodNumber]>>;
+        signing: z.ZodOptional<z.ZodObject<{
+            secret: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+            cookies: z.ZodOptional<z.ZodBoolean>;
+            cursors: z.ZodOptional<z.ZodBoolean>;
+            presignedUrls: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                defaultExpiry: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>]>>;
+            requestSigning: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                tolerance: z.ZodOptional<z.ZodNumber>;
+                header: z.ZodOptional<z.ZodString>;
+                timestampHeader: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>]>>;
+            idempotencyKeys: z.ZodOptional<z.ZodBoolean>;
+            sessionBinding: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    ip: "ip";
+                    ua: "ua";
+                    "accept-language": "accept-language";
+                }>>>;
+                onMismatch: z.ZodOptional<z.ZodEnum<{
+                    unauthenticate: "unauthenticate";
+                    reject: "reject";
+                    "log-only": "log-only";
+                }>>;
+            }, z.core.$loose>]>>;
+        }, z.core.$loose>>;
+        captcha: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            provider: z.ZodString;
+            secretKey: z.ZodString;
+            minScore: z.ZodOptional<z.ZodNumber>;
+            tokenField: z.ZodOptional<z.ZodString>;
+            adaptive: z.ZodOptional<z.ZodBoolean>;
+            adaptiveThreshold: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>, z.ZodLiteral<false>]>>;
+    }, z.core.$loose>>;
+    middleware: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    db: z.ZodOptional<z.ZodObject<{
+        sqlite: z.ZodOptional<z.ZodString>;
+        mongo: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            single: "single";
+            separate: "separate";
+        }>, z.ZodLiteral<false>]>>;
+        redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString, z.ZodObject<{
+            url: z.ZodOptional<z.ZodString>;
+            maxRetriesPerRequest: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>]>>;
+        sessions: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+        oauthState: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+        cache: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+        auth: z.ZodOptional<z.ZodEnum<{
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+    }, z.core.$loose>>;
+    jobs: z.ZodOptional<z.ZodObject<{
+        statusEndpoint: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            none: "none";
+            userAuth: "userAuth";
+        }>, z.ZodArray<z.ZodUnknown>]>>;
+        roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowedQueues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        scopeToUser: z.ZodOptional<z.ZodBoolean>;
+        unsafePublic: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    tenancy: z.ZodOptional<z.ZodObject<{
+        resolution: z.ZodEnum<{
+            header: "header";
+            path: "path";
+            subdomain: "subdomain";
+        }>;
+        headerName: z.ZodOptional<z.ZodString>;
+        pathSegment: z.ZodOptional<z.ZodNumber>;
+        onResolve: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        cacheTtlMs: z.ZodOptional<z.ZodNumber>;
+        cacheMaxSize: z.ZodOptional<z.ZodNumber>;
+        exemptPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        rejectionStatus: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$loose>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        onLog: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        level: z.ZodOptional<z.ZodEnum<{
+            error: "error";
+            debug: "debug";
+            info: "info";
+            warn: "warn";
+        }>>;
+        excludePaths: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodCustom<RegExp, RegExp>]>>>;
+        excludeMethods: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            none: "none";
+            userAuth: "userAuth";
+        }>, z.ZodArray<z.ZodUnknown>]>>;
+        excludePaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        normalizePath: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        queues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        unsafePublic: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    validation: z.ZodOptional<z.ZodObject<{
+        formatError: z.ZodOptional<z.ZodCustom<Function, Function>>;
+    }, z.core.$loose>>;
+    upload: z.ZodOptional<z.ZodObject<{
+        storage: z.ZodAny;
+        maxFileSize: z.ZodOptional<z.ZodNumber>;
+        maxFiles: z.ZodOptional<z.ZodNumber>;
+        allowedMimeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        keyPrefix: z.ZodOptional<z.ZodString>;
+        generateKey: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        tenantScopedKeys: z.ZodOptional<z.ZodBoolean>;
+        presignedUrls: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            expirySeconds: z.ZodOptional<z.ZodNumber>;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>]>>;
+        authorization: z.ZodOptional<z.ZodObject<{
+            authorize: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        }, z.core.$loose>>;
+        allowExternalKeys: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    versioning: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        versions: z.ZodArray<z.ZodString>;
+        sharedDir: z.ZodOptional<z.ZodString>;
+        defaultVersion: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodArray<z.ZodString>]>>;
+    plugins: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    eventBus: z.ZodOptional<z.ZodUnknown>;
+    secrets: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+export declare const serverConfigSchema: z.ZodObject<{
+    routesDir: z.ZodString;
+    modelSchemas: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+        paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        registration: z.ZodOptional<z.ZodEnum<{
+            explicit: "explicit";
+            auto: "auto";
+        }>>;
+    }, z.core.$loose>]>>;
+    app: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    security: z.ZodOptional<z.ZodObject<{
+        cors: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
+            origin: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+            credentials: z.ZodOptional<z.ZodBoolean>;
+            allowHeaders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            exposeHeaders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            maxAge: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>]>>;
+        headers: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+        rateLimit: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            windowMs: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+            message: z.ZodOptional<z.ZodString>;
+            standardHeaders: z.ZodOptional<z.ZodBoolean>;
+            keyGenerator: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            skip: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            handler: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        }, z.core.$loose>, z.ZodLiteral<false>]>>;
+        botProtection: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            blockList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            fingerprintRateLimit: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>, z.ZodLiteral<false>]>>;
+        trustProxy: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodNumber]>>;
+        signing: z.ZodOptional<z.ZodObject<{
+            secret: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+            cookies: z.ZodOptional<z.ZodBoolean>;
+            cursors: z.ZodOptional<z.ZodBoolean>;
+            presignedUrls: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                defaultExpiry: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>]>>;
+            requestSigning: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                tolerance: z.ZodOptional<z.ZodNumber>;
+                header: z.ZodOptional<z.ZodString>;
+                timestampHeader: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>]>>;
+            idempotencyKeys: z.ZodOptional<z.ZodBoolean>;
+            sessionBinding: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    ip: "ip";
+                    ua: "ua";
+                    "accept-language": "accept-language";
+                }>>>;
+                onMismatch: z.ZodOptional<z.ZodEnum<{
+                    unauthenticate: "unauthenticate";
+                    reject: "reject";
+                    "log-only": "log-only";
+                }>>;
+            }, z.core.$loose>]>>;
+        }, z.core.$loose>>;
+        captcha: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            provider: z.ZodString;
+            secretKey: z.ZodString;
+            minScore: z.ZodOptional<z.ZodNumber>;
+            tokenField: z.ZodOptional<z.ZodString>;
+            adaptive: z.ZodOptional<z.ZodBoolean>;
+            adaptiveThreshold: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>, z.ZodLiteral<false>]>>;
+    }, z.core.$loose>>;
+    middleware: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    db: z.ZodOptional<z.ZodObject<{
+        sqlite: z.ZodOptional<z.ZodString>;
+        mongo: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            single: "single";
+            separate: "separate";
+        }>, z.ZodLiteral<false>]>>;
+        redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString, z.ZodObject<{
+            url: z.ZodOptional<z.ZodString>;
+            maxRetriesPerRequest: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>]>>;
+        sessions: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+        oauthState: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+        cache: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+        auth: z.ZodOptional<z.ZodEnum<{
+            mongo: "mongo";
+            sqlite: "sqlite";
+            memory: "memory";
+        }>>;
+    }, z.core.$loose>>;
+    jobs: z.ZodOptional<z.ZodObject<{
+        statusEndpoint: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            none: "none";
+            userAuth: "userAuth";
+        }>, z.ZodArray<z.ZodUnknown>]>>;
+        roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowedQueues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        scopeToUser: z.ZodOptional<z.ZodBoolean>;
+        unsafePublic: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    tenancy: z.ZodOptional<z.ZodObject<{
+        resolution: z.ZodEnum<{
+            header: "header";
+            path: "path";
+            subdomain: "subdomain";
+        }>;
+        headerName: z.ZodOptional<z.ZodString>;
+        pathSegment: z.ZodOptional<z.ZodNumber>;
+        onResolve: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        cacheTtlMs: z.ZodOptional<z.ZodNumber>;
+        cacheMaxSize: z.ZodOptional<z.ZodNumber>;
+        exemptPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        rejectionStatus: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$loose>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        onLog: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        level: z.ZodOptional<z.ZodEnum<{
+            error: "error";
+            debug: "debug";
+            info: "info";
+            warn: "warn";
+        }>>;
+        excludePaths: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodCustom<RegExp, RegExp>]>>>;
+        excludeMethods: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            none: "none";
+            userAuth: "userAuth";
+        }>, z.ZodArray<z.ZodUnknown>]>>;
+        excludePaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        normalizePath: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        queues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        unsafePublic: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    validation: z.ZodOptional<z.ZodObject<{
+        formatError: z.ZodOptional<z.ZodCustom<Function, Function>>;
+    }, z.core.$loose>>;
+    upload: z.ZodOptional<z.ZodObject<{
+        storage: z.ZodAny;
+        maxFileSize: z.ZodOptional<z.ZodNumber>;
+        maxFiles: z.ZodOptional<z.ZodNumber>;
+        allowedMimeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        keyPrefix: z.ZodOptional<z.ZodString>;
+        generateKey: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        tenantScopedKeys: z.ZodOptional<z.ZodBoolean>;
+        presignedUrls: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            expirySeconds: z.ZodOptional<z.ZodNumber>;
+            path: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>]>>;
+        authorization: z.ZodOptional<z.ZodObject<{
+            authorize: z.ZodOptional<z.ZodCustom<Function, Function>>;
+        }, z.core.$loose>>;
+        allowExternalKeys: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    versioning: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        versions: z.ZodArray<z.ZodString>;
+        sharedDir: z.ZodOptional<z.ZodString>;
+        defaultVersion: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodArray<z.ZodString>]>>;
+    plugins: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    eventBus: z.ZodOptional<z.ZodUnknown>;
+    secrets: z.ZodOptional<z.ZodUnknown>;
+    port: z.ZodOptional<z.ZodNumber>;
+    hostname: z.ZodOptional<z.ZodString>;
+    unix: z.ZodOptional<z.ZodString>;
+    tls: z.ZodOptional<z.ZodObject<{
+        key: z.ZodOptional<z.ZodAny>;
+        cert: z.ZodOptional<z.ZodAny>;
+        ca: z.ZodOptional<z.ZodAny>;
+        passphrase: z.ZodOptional<z.ZodString>;
+        serverName: z.ZodOptional<z.ZodString>;
+        dhParamsFile: z.ZodOptional<z.ZodString>;
+        lowMemoryMode: z.ZodOptional<z.ZodBoolean>;
+        secureOptions: z.ZodOptional<z.ZodNumber>;
+        rejectUnauthorized: z.ZodOptional<z.ZodBoolean>;
+        requestCert: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    workersDir: z.ZodOptional<z.ZodString>;
+    enableWorkers: z.ZodOptional<z.ZodBoolean>;
+    ws: z.ZodOptional<z.ZodObject<{
+        endpoints: z.ZodRecord<z.ZodString, z.ZodObject<{
+            upgrade: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            on: z.ZodOptional<z.ZodObject<{
+                open: z.ZodOptional<z.ZodCustom<Function, Function>>;
+                message: z.ZodOptional<z.ZodCustom<Function, Function>>;
+                close: z.ZodOptional<z.ZodCustom<Function, Function>>;
+                drain: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            }, z.core.$loose>>;
+            onRoomSubscribe: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            maxMessageSize: z.ZodOptional<z.ZodNumber>;
+            heartbeat: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                intervalMs: z.ZodOptional<z.ZodNumber>;
+                timeoutMs: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>]>>;
+            presence: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                broadcastEvents: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$loose>]>>;
+            persistence: z.ZodOptional<z.ZodObject<{
+                store: z.ZodOptional<z.ZodAny>;
+                defaults: z.ZodOptional<z.ZodAny>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
+        transport: z.ZodOptional<z.ZodAny>;
+        idleTimeout: z.ZodOptional<z.ZodNumber>;
+        backpressureLimit: z.ZodOptional<z.ZodNumber>;
+        closeOnBackpressureLimit: z.ZodOptional<z.ZodBoolean>;
+        perMessageDeflate: z.ZodOptional<z.ZodBoolean>;
+        publishToSelf: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    sse: z.ZodOptional<z.ZodObject<{
+        endpoints: z.ZodRecord<z.ZodString, z.ZodObject<{
+            events: z.ZodArray<z.ZodString>;
+            upgrade: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            filter: z.ZodOptional<z.ZodCustom<Function, Function>>;
+            heartbeat: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
+    maxRequestBodySize: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+export interface ConfigValidationResult {
+    /** Warnings for unknown keys (fatal in production, logged in development). */
+    warnings: string[];
+}
+/**
+ * Validate a CreateAppConfig at startup.
+ * - Throws on type mismatches or missing required fields.
+ * - Returns warnings for unknown keys at any depth.
+ */
+export declare function validateAppConfig(config: Record<string, unknown>): ConfigValidationResult;
+/**
+ * Validate a CreateServerConfig at startup.
+ * - Throws on type mismatches or missing required fields.
+ * - Returns warnings for unknown keys at any depth.
+ */
+export declare function validateServerConfig(config: Record<string, unknown>): ConfigValidationResult;