@maudecode/kanvil 0.0.0-stage → 0.1.0

package/apps/server/dist/config-Qxr_7oqZ.mjs

@@ -0,0 +1,575 @@
+import pg from "pg";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { relations } from "drizzle-orm";
+import { boolean, index, integer, jsonb, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+import { z } from "zod";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/auth-schema.ts
+var auth_schema_exports = /* @__PURE__ */ __exportAll({
+	account: () => account,
+	accountRelations: () => accountRelations,
+	apikey: () => apikey,
+	jwks: () => jwks,
+	oauthAccessToken: () => oauthAccessToken,
+	oauthAccessTokenRelations: () => oauthAccessTokenRelations,
+	oauthClient: () => oauthClient,
+	oauthClientAssertion: () => oauthClientAssertion,
+	oauthClientRelations: () => oauthClientRelations,
+	oauthClientResource: () => oauthClientResource,
+	oauthClientResourceRelations: () => oauthClientResourceRelations,
+	oauthConsent: () => oauthConsent,
+	oauthConsentRelations: () => oauthConsentRelations,
+	oauthRefreshToken: () => oauthRefreshToken,
+	oauthRefreshTokenRelations: () => oauthRefreshTokenRelations,
+	oauthResource: () => oauthResource,
+	oauthResourceRelations: () => oauthResourceRelations,
+	session: () => session,
+	sessionRelations: () => sessionRelations,
+	user: () => user,
+	userRelations: () => userRelations,
+	verification: () => verification
+});
+const user = pgTable("user", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	email: text("email").notNull().unique(),
+	emailVerified: boolean("email_verified").default(false).notNull(),
+	image: text("image"),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").defaultNow().$onUpdate(() => /* @__PURE__ */ new Date()).notNull(),
+	role: text("role"),
+	banned: boolean("banned").default(false),
+	banReason: text("ban_reason"),
+	banExpires: timestamp("ban_expires")
+});
+const session = pgTable("session", {
+	id: text("id").primaryKey(),
+	expiresAt: timestamp("expires_at").notNull(),
+	token: text("token").notNull().unique(),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").$onUpdate(() => /* @__PURE__ */ new Date()).notNull(),
+	ipAddress: text("ip_address"),
+	userAgent: text("user_agent"),
+	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+	impersonatedBy: text("impersonated_by")
+}, (table) => [index("session_userId_idx").on(table.userId)]);
+const account = pgTable("account", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	providerId: text("provider_id").notNull(),
+	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+	accessToken: text("access_token"),
+	refreshToken: text("refresh_token"),
+	idToken: text("id_token"),
+	accessTokenExpiresAt: timestamp("access_token_expires_at"),
+	refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+	scope: text("scope"),
+	password: text("password"),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
+}, (table) => [index("account_userId_idx").on(table.userId)]);
+const verification = pgTable("verification", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull(),
+	value: text("value").notNull(),
+	expiresAt: timestamp("expires_at").notNull(),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").defaultNow().$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
+}, (table) => [index("verification_identifier_idx").on(table.identifier)]);
+const apikey = pgTable("apikey", {
+	id: text("id").primaryKey(),
+	configId: text("config_id").default("default").notNull(),
+	name: text("name"),
+	start: text("start"),
+	referenceId: text("reference_id").notNull(),
+	prefix: text("prefix"),
+	key: text("key").notNull(),
+	refillInterval: integer("refill_interval"),
+	refillAmount: integer("refill_amount"),
+	lastRefillAt: timestamp("last_refill_at"),
+	enabled: boolean("enabled").default(true),
+	rateLimitEnabled: boolean("rate_limit_enabled").default(true),
+	rateLimitTimeWindow: integer("rate_limit_time_window").default(864e5),
+	rateLimitMax: integer("rate_limit_max").default(10),
+	requestCount: integer("request_count").default(0),
+	remaining: integer("remaining"),
+	lastRequest: timestamp("last_request"),
+	expiresAt: timestamp("expires_at"),
+	createdAt: timestamp("created_at").notNull(),
+	updatedAt: timestamp("updated_at").notNull(),
+	permissions: text("permissions"),
+	metadata: text("metadata")
+}, (table) => [
+	index("apikey_configId_idx").on(table.configId),
+	index("apikey_referenceId_idx").on(table.referenceId),
+	index("apikey_key_idx").on(table.key)
+]);
+const jwks = pgTable("jwks", {
+	id: text("id").primaryKey(),
+	publicKey: text("public_key").notNull(),
+	privateKey: text("private_key").notNull(),
+	createdAt: timestamp("created_at").notNull(),
+	expiresAt: timestamp("expires_at"),
+	alg: text("alg"),
+	crv: text("crv")
+});
+const oauthClient = pgTable("oauth_client", {
+	id: text("id").primaryKey(),
+	clientId: text("client_id").notNull().unique(),
+	clientSecret: text("client_secret"),
+	clientDiscoveryId: text("client_discovery_id"),
+	disabled: boolean("disabled").default(false),
+	skipConsent: boolean("skip_consent"),
+	enableEndSession: boolean("enable_end_session"),
+	subjectType: text("subject_type"),
+	scopes: text("scopes").array(),
+	clientCredentialsScopes: text("client_credentials_scopes").array().default([]),
+	userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+	createdAt: timestamp("created_at"),
+	updatedAt: timestamp("updated_at"),
+	name: text("name"),
+	uri: text("uri"),
+	icon: text("icon"),
+	contacts: text("contacts").array(),
+	tos: text("tos"),
+	policy: text("policy"),
+	softwareId: text("software_id"),
+	softwareVersion: text("software_version"),
+	softwareStatement: text("software_statement"),
+	redirectUris: text("redirect_uris").array().notNull(),
+	postLogoutRedirectUris: text("post_logout_redirect_uris").array(),
+	backchannelLogoutUri: text("backchannel_logout_uri"),
+	backchannelLogoutSessionRequired: boolean("backchannel_logout_session_required"),
+	tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+	applicationType: text("application_type"),
+	jwks: text("jwks"),
+	jwksUri: text("jwks_uri"),
+	grantTypes: text("grant_types").array(),
+	responseTypes: text("response_types").array(),
+	requirePKCE: boolean("require_pkce"),
+	dpopBoundAccessTokens: boolean("dpop_bound_access_tokens").default(false),
+	referenceId: text("reference_id"),
+	metadata: jsonb("metadata")
+}, (table) => [index("oauthClient_userId_idx").on(table.userId)]);
+const oauthResource = pgTable("oauth_resource", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull().unique(),
+	name: text("name").notNull(),
+	accessTokenTtl: integer("access_token_ttl"),
+	refreshTokenTtl: integer("refresh_token_ttl"),
+	signingAlgorithm: text("signing_algorithm"),
+	signingKeyId: text("signing_key_id"),
+	allowedScopes: text("allowed_scopes").array(),
+	customClaims: jsonb("custom_claims"),
+	dpopBoundAccessTokensRequired: boolean("dpop_bound_access_tokens_required").default(false),
+	disabled: boolean("disabled").default(false),
+	createdAt: timestamp("created_at"),
+	updatedAt: timestamp("updated_at"),
+	policyVersion: integer("policy_version").default(1),
+	metadata: jsonb("metadata")
+});
+const oauthClientResource = pgTable("oauth_client_resource", {
+	id: text("id").primaryKey(),
+	clientId: text("client_id").notNull().references(() => oauthClient.clientId, { onDelete: "cascade" }),
+	resourceId: text("resource_id").notNull().references(() => oauthResource.identifier, { onDelete: "cascade" }),
+	metadata: jsonb("metadata"),
+	createdAt: timestamp("created_at")
+}, (table) => [
+	uniqueIndex("oauthClientResource_clientId_resourceId_uidx").on(table.clientId, table.resourceId),
+	index("oauthClientResource_clientId_idx").on(table.clientId),
+	index("oauthClientResource_resourceId_idx").on(table.resourceId)
+]);
+const oauthRefreshToken = pgTable("oauth_refresh_token", {
+	id: text("id").primaryKey(),
+	token: text("token").notNull().unique(),
+	clientId: text("client_id").notNull().references(() => oauthClient.clientId, { onDelete: "cascade" }),
+	sessionId: text("session_id").references(() => session.id, { onDelete: "set null" }),
+	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+	referenceId: text("reference_id"),
+	authorizationCodeId: text("authorization_code_id"),
+	resources: text("resources").array(),
+	requestedUserInfoClaims: text("requested_user_info_claims").array(),
+	expiresAt: timestamp("expires_at").notNull(),
+	createdAt: timestamp("created_at").notNull(),
+	revoked: timestamp("revoked"),
+	rotatedAt: timestamp("rotated_at"),
+	rotationReplayResponse: text("rotation_replay_response"),
+	rotationReplayExpiresAt: timestamp("rotation_replay_expires_at"),
+	authTime: timestamp("auth_time"),
+	confirmation: jsonb("confirmation"),
+	scopes: text("scopes").array().notNull()
+}, (table) => [
+	index("oauthRefreshToken_clientId_idx").on(table.clientId),
+	index("oauthRefreshToken_sessionId_idx").on(table.sessionId),
+	index("oauthRefreshToken_userId_idx").on(table.userId),
+	index("oauthRefreshToken_authorizationCodeId_idx").on(table.authorizationCodeId)
+]);
+const oauthAccessToken = pgTable("oauth_access_token", {
+	id: text("id").primaryKey(),
+	token: text("token").notNull().unique(),
+	clientId: text("client_id").notNull().references(() => oauthClient.clientId, { onDelete: "cascade" }),
+	sessionId: text("session_id").references(() => session.id, { onDelete: "set null" }),
+	userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+	referenceId: text("reference_id"),
+	authorizationCodeId: text("authorization_code_id"),
+	resources: text("resources").array(),
+	requestedUserInfoClaims: text("requested_user_info_claims").array(),
+	refreshId: text("refresh_id").references(() => oauthRefreshToken.id, { onDelete: "cascade" }),
+	expiresAt: timestamp("expires_at").notNull(),
+	createdAt: timestamp("created_at").notNull(),
+	revoked: timestamp("revoked"),
+	confirmation: jsonb("confirmation"),
+	scopes: text("scopes").array().notNull()
+}, (table) => [
+	index("oauthAccessToken_clientId_idx").on(table.clientId),
+	index("oauthAccessToken_sessionId_idx").on(table.sessionId),
+	index("oauthAccessToken_userId_idx").on(table.userId),
+	index("oauthAccessToken_authorizationCodeId_idx").on(table.authorizationCodeId),
+	index("oauthAccessToken_refreshId_idx").on(table.refreshId)
+]);
+const oauthConsent = pgTable("oauth_consent", {
+	id: text("id").primaryKey(),
+	clientId: text("client_id").notNull().references(() => oauthClient.clientId, { onDelete: "cascade" }),
+	userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+	referenceId: text("reference_id"),
+	resources: text("resources").array(),
+	requestedUserInfoClaims: text("requested_user_info_claims").array(),
+	scopes: text("scopes").array().notNull(),
+	createdAt: timestamp("created_at").notNull(),
+	updatedAt: timestamp("updated_at").notNull()
+}, (table) => [index("oauthConsent_clientId_idx").on(table.clientId), index("oauthConsent_userId_idx").on(table.userId)]);
+const oauthClientAssertion = pgTable("oauth_client_assertion", {
+	id: text("id").primaryKey(),
+	expiresAt: timestamp("expires_at").notNull()
+});
+const userRelations = relations(user, ({ many }) => ({
+	sessions: many(session),
+	accounts: many(account),
+	oauthClients: many(oauthClient),
+	oauthRefreshTokens: many(oauthRefreshToken),
+	oauthAccessTokens: many(oauthAccessToken),
+	oauthConsents: many(oauthConsent)
+}));
+const sessionRelations = relations(session, ({ one, many }) => ({
+	user: one(user, {
+		fields: [session.userId],
+		references: [user.id]
+	}),
+	oauthRefreshTokens: many(oauthRefreshToken),
+	oauthAccessTokens: many(oauthAccessToken)
+}));
+const accountRelations = relations(account, ({ one }) => ({ user: one(user, {
+	fields: [account.userId],
+	references: [user.id]
+}) }));
+const oauthClientRelations = relations(oauthClient, ({ one, many }) => ({
+	user: one(user, {
+		fields: [oauthClient.userId],
+		references: [user.id]
+	}),
+	oauthClientResources: many(oauthClientResource),
+	oauthRefreshTokens: many(oauthRefreshToken),
+	oauthAccessTokens: many(oauthAccessToken),
+	oauthConsents: many(oauthConsent)
+}));
+const oauthResourceRelations = relations(oauthResource, ({ many }) => ({ oauthClientResources: many(oauthClientResource) }));
+const oauthClientResourceRelations = relations(oauthClientResource, ({ one }) => ({
+	oauthClient: one(oauthClient, {
+		fields: [oauthClientResource.clientId],
+		references: [oauthClient.clientId]
+	}),
+	oauthResource: one(oauthResource, {
+		fields: [oauthClientResource.resourceId],
+		references: [oauthResource.identifier]
+	})
+}));
+const oauthRefreshTokenRelations = relations(oauthRefreshToken, ({ one, many }) => ({
+	oauthClient: one(oauthClient, {
+		fields: [oauthRefreshToken.clientId],
+		references: [oauthClient.clientId]
+	}),
+	session: one(session, {
+		fields: [oauthRefreshToken.sessionId],
+		references: [session.id]
+	}),
+	user: one(user, {
+		fields: [oauthRefreshToken.userId],
+		references: [user.id]
+	}),
+	oauthAccessTokens: many(oauthAccessToken)
+}));
+const oauthAccessTokenRelations = relations(oauthAccessToken, ({ one }) => ({
+	oauthClient: one(oauthClient, {
+		fields: [oauthAccessToken.clientId],
+		references: [oauthClient.clientId]
+	}),
+	session: one(session, {
+		fields: [oauthAccessToken.sessionId],
+		references: [session.id]
+	}),
+	user: one(user, {
+		fields: [oauthAccessToken.userId],
+		references: [user.id]
+	}),
+	oauthRefreshToken: one(oauthRefreshToken, {
+		fields: [oauthAccessToken.refreshId],
+		references: [oauthRefreshToken.id]
+	})
+}));
+const oauthConsentRelations = relations(oauthConsent, ({ one }) => ({
+	oauthClient: one(oauthClient, {
+		fields: [oauthConsent.clientId],
+		references: [oauthClient.clientId]
+	}),
+	user: one(user, {
+		fields: [oauthConsent.userId],
+		references: [user.id]
+	})
+}));
+//#endregion
+//#region src/database.ts
+function createDatabase(url) {
+	const pool = new pg.Pool({
+		connectionString: url,
+		max: 10,
+		idleTimeoutMillis: 3e4
+	});
+	pool.on("error", () => {
+		console.error("A PostgreSQL idle connection was lost; the pool will reconnect.");
+	});
+	return {
+		pool,
+		db: drizzle(pool, { schema: auth_schema_exports })
+	};
+}
+//#endregion
+//#region ../../packages/contracts/src/instance.ts
+const endpoint = z.url({ protocol: /^https?$/ }).refine((value) => !/^https?:\/\/[^/]*@/.test(value) && !/[?#]/.test(value), "Use an HTTP(S) endpoint without embedded credentials");
+const s3SettingsSchema = z.object({
+	endpoint: z.union([endpoint, z.literal("")]).default(""),
+	region: z.string().min(1).max(100).default("us-east-1"),
+	bucket: z.string().min(3).max(255),
+	prefix: z.string().max(200).regex(/^[a-zA-Z0-9/_-]*$/).default("kanvil/"),
+	forcePathStyle: z.boolean().default(true),
+	accessKeyId: z.string().max(500).default(""),
+	secretAccessKey: z.string().max(2e3).optional()
+}).strict();
+const searchAuthenticationSchema = z.enum([
+	"none",
+	"apiKey",
+	"basic"
+]);
+const searchSettingsSchema = z.object({
+	url: endpoint,
+	auth: searchAuthenticationSchema.optional(),
+	index: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,100}$/),
+	apiKey: z.string().max(4e3).optional(),
+	username: z.string().max(500).default(""),
+	password: z.string().max(2e3).optional()
+}).strict();
+const storageSettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("local") }).strict(), s3SettingsSchema.extend({ provider: z.literal("s3") })]);
+const externalSearchSettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("postgres") }).strict(), searchSettingsSchema.extend({ provider: z.literal("elasticsearch") })]);
+const brokerSettingsSchema = z.object({
+	url: z.url({ protocol: /^amqps?$/ }).max(4e3).optional(),
+	exchange: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.-]+$/).refine((value) => !value.startsWith("amq."), "Use an application exchange").default("kanvil.events")
+}).strict();
+const eventDeliverySettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("postgres") }).strict(), brokerSettingsSchema.extend({ provider: z.literal("rabbitmq") })]);
+const instanceUpdateSchema = z.object({
+	expectedVersion: z.number().int().positive(),
+	name: z.string().trim().min(1).max(100),
+	description: z.string().max(500),
+	storage: storageSettingsSchema,
+	search: externalSearchSettingsSchema,
+	broker: eventDeliverySettingsSchema.optional()
+}).strict();
+z.object({
+	name: z.string(),
+	description: z.string()
+});
+const adminInstanceSchema = z.object({
+	id: z.uuid(),
+	version: z.number().int(),
+	name: z.string(),
+	description: z.string(),
+	storage: z.object({
+		provider: z.enum(["local", "s3"]),
+		source: z.enum(["deployment", "admin"]),
+		settings: s3SettingsSchema.omit({ secretAccessKey: true }).nullable(),
+		secretConfigured: z.boolean(),
+		pending: z.number().int(),
+		status: z.enum([
+			"ready",
+			"transferring",
+			"unavailable"
+		]),
+		error: z.string().nullable()
+	}),
+	search: z.object({
+		provider: z.enum(["postgres", "elasticsearch"]),
+		source: z.enum(["deployment", "admin"]),
+		settings: searchSettingsSchema.omit({
+			apiKey: true,
+			password: true
+		}).nullable(),
+		secretConfigured: z.boolean(),
+		status: z.enum([
+			"builtin",
+			"indexing",
+			"ready",
+			"unavailable"
+		]),
+		cursor: z.string(),
+		error: z.string().nullable()
+	}),
+	broker: z.object({
+		provider: z.enum(["postgres", "rabbitmq"]),
+		source: z.enum(["deployment", "admin"]),
+		settings: z.object({
+			endpoint: z.string(),
+			exchange: z.string()
+		}).nullable(),
+		secretConfigured: z.boolean(),
+		status: z.enum([
+			"builtin",
+			"connecting",
+			"ready",
+			"unavailable"
+		]),
+		error: z.string().nullable()
+	}),
+	deployment: z.object({
+		url: z.string(),
+		oidc: z.object({
+			name: z.string(),
+			discoveryUrl: z.string(),
+			clientId: z.string()
+		}).nullable(),
+		push: z.boolean(),
+		version: z.string()
+	}),
+	locations: z.array(z.object({
+		id: z.uuid(),
+		bucket: z.string(),
+		endpoint: z.string(),
+		prefix: z.string(),
+		objects: z.number().int()
+	}))
+});
+const photoInputSchema = z.object({
+	data: z.string().max(7e5),
+	contentType: z.enum([
+		"image/png",
+		"image/jpeg",
+		"image/webp"
+	])
+}).strict();
+const photoResultSchema = z.object({ image: z.string().nullable() });
+function searchAuthentication(settings) {
+	return settings.auth ?? (settings.apiKey ? "apiKey" : settings.username && settings.password ? "basic" : "none");
+}
+//#endregion
+//#region src/config.ts
+const optionalEnv = (schema) => z.preprocess((value) => value === "" ? void 0 : value, schema.optional());
+const envSchema = z.object({
+	DATABASE_URL: z.url(),
+	KANVIL_STORAGE_PROVIDER: optionalEnv(z.enum(["local", "s3"])),
+	S3_ENDPOINT: optionalEnv(s3SettingsSchema.shape.endpoint),
+	S3_REGION: s3SettingsSchema.shape.region,
+	S3_BUCKET: optionalEnv(s3SettingsSchema.shape.bucket),
+	S3_PREFIX: s3SettingsSchema.shape.prefix,
+	S3_ACCESS_KEY_ID: optionalEnv(s3SettingsSchema.shape.accessKeyId),
+	S3_SECRET_ACCESS_KEY: optionalEnv(s3SettingsSchema.shape.secretAccessKey),
+	S3_FORCE_PATH_STYLE: z.enum(["true", "false"]).default("true").transform((value) => value === "true"),
+	KANVIL_SEARCH_PROVIDER: optionalEnv(z.enum(["postgres", "elasticsearch"])),
+	ELASTICSEARCH_URL: optionalEnv(searchSettingsSchema.shape.url),
+	ELASTICSEARCH_INDEX: optionalEnv(searchSettingsSchema.shape.index),
+	ELASTICSEARCH_AUTH: optionalEnv(searchSettingsSchema.shape.auth),
+	ELASTICSEARCH_API_KEY: optionalEnv(searchSettingsSchema.shape.apiKey),
+	ELASTICSEARCH_USERNAME: searchSettingsSchema.shape.username,
+	ELASTICSEARCH_PASSWORD: optionalEnv(searchSettingsSchema.shape.password),
+	KANVIL_BROKER_PROVIDER: optionalEnv(z.enum(["postgres", "rabbitmq"])),
+	RABBITMQ_URL: optionalEnv(brokerSettingsSchema.shape.url),
+	RABBITMQ_EXCHANGE: brokerSettingsSchema.shape.exchange,
+	KANVIL_URL: z.url().default("http://localhost:5180"),
+	BETTER_AUTH_SECRET: z.string().min(32),
+	KANVIL_SETUP_TOKEN: optionalEnv(z.string().min(24)),
+	PORT: z.coerce.number().int().min(1).max(65535).default(5180),
+	HOST: z.string().default("127.0.0.1"),
+	KANVIL_TRUSTED_ORIGINS: z.string().default(""),
+	OIDC_DISCOVERY_URL: optionalEnv(z.url()),
+	OIDC_CLIENT_ID: optionalEnv(z.string().min(1)),
+	OIDC_CLIENT_SECRET: optionalEnv(z.string().min(1)),
+	OIDC_NAME: z.string().default("PocketID"),
+	KANVIL_SESSION_WRITE_LIMIT: z.coerce.number().int().min(1).max(1e5).default(120),
+	KANVIL_PUSH_ENABLED: z.enum(["true", "false"]).default("false").transform((value) => value === "true"),
+	EXPO_ACCESS_TOKEN: optionalEnv(z.string().min(1)),
+	NODE_ENV: z.enum([
+		"development",
+		"test",
+		"production"
+	]).default("development")
+}).superRefine((value, ctx) => {
+	if (value.KANVIL_STORAGE_PROVIDER === "s3" && !value.S3_BUCKET) ctx.addIssue({
+		code: "custom",
+		message: "S3_BUCKET is required for S3 storage"
+	});
+	if (value.KANVIL_SEARCH_PROVIDER === "elasticsearch" && !value.ELASTICSEARCH_URL) ctx.addIssue({
+		code: "custom",
+		message: "ELASTICSEARCH_URL is required for external search"
+	});
+	if (value.KANVIL_BROKER_PROVIDER === "rabbitmq" && !value.RABBITMQ_URL) ctx.addIssue({
+		code: "custom",
+		message: "RABBITMQ_URL is required for RabbitMQ delivery"
+	});
+	if (value.KANVIL_SEARCH_PROVIDER === "elasticsearch") {
+		if (value.ELASTICSEARCH_AUTH === "apiKey" && !value.ELASTICSEARCH_API_KEY) ctx.addIssue({
+			code: "custom",
+			message: "ELASTICSEARCH_API_KEY is required for API-key authentication"
+		});
+		if (value.ELASTICSEARCH_AUTH === "basic" && (!value.ELASTICSEARCH_USERNAME || !value.ELASTICSEARCH_PASSWORD)) ctx.addIssue({
+			code: "custom",
+			message: "ELASTICSEARCH_USERNAME and ELASTICSEARCH_PASSWORD are required for basic authentication"
+		});
+	}
+	const supplied = [
+		value.OIDC_DISCOVERY_URL,
+		value.OIDC_CLIENT_ID,
+		value.OIDC_CLIENT_SECRET
+	].filter(Boolean).length;
+	if (supplied !== 0 && supplied !== 3) ctx.addIssue({
+		code: "custom",
+		message: "Configure all three OIDC settings together"
+	});
+	if (!new URL(value.DATABASE_URL).protocol.startsWith("postgres")) ctx.addIssue({
+		code: "custom",
+		message: "DATABASE_URL must be PostgreSQL"
+	});
+	if (value.NODE_ENV === "production" && !value.KANVIL_URL.startsWith("https://")) ctx.addIssue({
+		code: "custom",
+		message: "Production KANVIL_URL must use HTTPS"
+	});
+});
+function readConfig(env = process.env) {
+	const values = envSchema.parse(env);
+	return {
+		...values,
+		trustedOrigins: [
+			new URL(values.KANVIL_URL).origin,
+			...values.KANVIL_TRUSTED_ORIGINS.split(",").map((value) => value.trim()).filter(Boolean),
+			"kanvil://"
+		]
+	};
+}
+//#endregion
+export { photoInputSchema as a, searchAuthentication as c, account as d, apikey as f, user as h, instanceUpdateSchema as i, searchSettingsSchema as l, session as m, adminInstanceSchema as n, photoResultSchema as o, auth_schema_exports as p, brokerSettingsSchema as r, s3SettingsSchema as s, readConfig as t, createDatabase as u };

package/apps/server/dist/configure.mjs

@@ -0,0 +1,23 @@
+import { randomBytes } from "node:crypto";
+import { parseArgs } from "node:util";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+//#region ../../scripts/configure.ts
+const { values } = parseArgs({ options: { production: { type: "string" } } });
+const root = new URL("../", import.meta.url);
+let origin;
+if (values.production) {
+	const url = new URL(values.production);
+	if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new Error("Use your public HTTPS origin without a path or credentials.");
+	origin = url.origin;
+}
+const databasePassword = randomBytes(32).toString("hex");
+let contents = (await readFile(new URL(".env.example", root), "utf8")).replace(/^POSTGRES_PASSWORD=$/m, `POSTGRES_PASSWORD=${databasePassword}`).replace(/^BETTER_AUTH_SECRET=$/m, `BETTER_AUTH_SECRET=${randomBytes(48).toString("base64url")}`).replace(/^KANVIL_SETUP_TOKEN=$/m, `KANVIL_SETUP_TOKEN=${randomBytes(32).toString("base64url")}`);
+if (origin) contents = contents.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgres://kanvil:${databasePassword}@db:5432/kanvil`).replace(/^KANVIL_URL=.*$/m, `KANVIL_URL=${origin}`).replace(/^HOST=.*$/m, "HOST=0.0.0.0").replace(/^KANVIL_TRUSTED_ORIGINS=.*$/m, "KANVIL_TRUSTED_ORIGINS=");
+await writeFile(resolve(".env"), contents, {
+	mode: 384,
+	flag: "wx"
+});
+console.info("Created private .env configuration. The initial owner setup token is stored as KANVIL_SETUP_TOKEN.");
+//#endregion
+export {};