npm - @nymbalhq/config - Versions diffs - 1.1.0 → 1.3.0 - Mend

@nymbalhq/config 1.1.0 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -215,7 +215,7 @@ declare const infrastructureSchema: z.ZodEffects<z.ZodObject<{
         forcePathStyle?: boolean | undefined;
     } | undefined;
 }>;
-declare const securitySchema: z.ZodObject<{
+declare const securitySchema: z.ZodEffects<z.ZodObject<{
     adapter: z.ZodEnum<["middleware", "cloudflare", "aws-waf", "akamai"]>;
     rateLimit: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         requests: z.ZodNumber;
@@ -270,6 +270,41 @@ declare const securitySchema: z.ZodObject<{
         accessTtl?: string | undefined;
         refreshTtl?: string | undefined;
     }>>;
+    cloudflare: z.ZodOptional<z.ZodObject<{
+        zoneId: z.ZodOptional<z.ZodString>;
+        apiToken: z.ZodOptional<z.ZodString>;
+        /** The Cloudflare v4 API; the adapter defaults it to https://api.cloudflare.com/client/v4. */
+        apiBase: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        zoneId?: string | undefined;
+        apiToken?: string | undefined;
+        apiBase?: string | undefined;
+    }, {
+        zoneId?: string | undefined;
+        apiToken?: string | undefined;
+        apiBase?: string | undefined;
+    }>>;
+    geo: z.ZodDefault<z.ZodObject<{
+        block: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        block: string[];
+    }, {
+        block?: string[] | undefined;
+    }>>;
+    customRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        expression: z.ZodString;
+        action: z.ZodEnum<["block", "managed_challenge", "js_challenge", "log"]>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        action: "block" | "managed_challenge" | "js_challenge" | "log";
+        expression: string;
+    }, {
+        name: string;
+        action: "block" | "managed_challenge" | "js_challenge" | "log";
+        expression: string;
+    }>, "many">>;
+    managedRulesets: z.ZodDefault<z.ZodArray<z.ZodEnum<["cloudflare", "owasp"]>, "many">>;
 }, "strip", z.ZodTypeAny, {
     adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
     rateLimit: Record<string, {
@@ -293,8 +328,101 @@ declare const securitySchema: z.ZodObject<{
         accessTtl: string;
         refreshTtl: string;
     };
+    geo: {
+        block: string[];
+    };
+    customRules: {
+        name: string;
+        action: "block" | "managed_challenge" | "js_challenge" | "log";
+        expression: string;
+    }[];
+    managedRulesets: ("cloudflare" | "owasp")[];
+    cloudflare?: {
+        zoneId?: string | undefined;
+        apiToken?: string | undefined;
+        apiBase?: string | undefined;
+    } | undefined;
+}, {
+    adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+    cloudflare?: {
+        zoneId?: string | undefined;
+        apiToken?: string | undefined;
+        apiBase?: string | undefined;
+    } | undefined;
+    rateLimit?: Record<string, {
+        requests: number;
+        window: string;
+        action: "block" | "challenge" | "throttle";
+    }> | undefined;
+    botProtection?: {
+        mode?: "strict" | "off" | "managed" | undefined;
+        allowList?: string[] | undefined;
+    } | undefined;
+    headers?: {
+        hsts?: boolean | undefined;
+        contentSecurityPolicy?: string | undefined;
+        referrerPolicy?: string | undefined;
+        xFrameOptions?: "deny" | "sameorigin" | undefined;
+    } | undefined;
+    csrf?: boolean | undefined;
+    auth?: {
+        jwtSecret?: string | undefined;
+        accessTtl?: string | undefined;
+        refreshTtl?: string | undefined;
+    } | undefined;
+    geo?: {
+        block?: string[] | undefined;
+    } | undefined;
+    customRules?: {
+        name: string;
+        action: "block" | "managed_challenge" | "js_challenge" | "log";
+        expression: string;
+    }[] | undefined;
+    managedRulesets?: ("cloudflare" | "owasp")[] | undefined;
+}>, {
+    adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+    rateLimit: Record<string, {
+        requests: number;
+        window: string;
+        action: "block" | "challenge" | "throttle";
+    }>;
+    botProtection: {
+        mode: "strict" | "off" | "managed";
+        allowList: string[];
+    };
+    headers: {
+        hsts: boolean;
+        contentSecurityPolicy: string;
+        referrerPolicy: string;
+        xFrameOptions: "deny" | "sameorigin";
+    };
+    csrf: boolean;
+    auth: {
+        jwtSecret: string;
+        accessTtl: string;
+        refreshTtl: string;
+    };
+    geo: {
+        block: string[];
+    };
+    customRules: {
+        name: string;
+        action: "block" | "managed_challenge" | "js_challenge" | "log";
+        expression: string;
+    }[];
+    managedRulesets: ("cloudflare" | "owasp")[];
+    cloudflare?: {
+        zoneId?: string | undefined;
+        apiToken?: string | undefined;
+        apiBase?: string | undefined;
+    } | undefined;
 }, {
     adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+    cloudflare?: {
+        zoneId?: string | undefined;
+        apiToken?: string | undefined;
+        apiBase?: string | undefined;
+    } | undefined;
     rateLimit?: Record<string, {
         requests: number;
         window: string;
@@ -316,87 +444,128 @@ declare const securitySchema: z.ZodObject<{
         accessTtl?: string | undefined;
         refreshTtl?: string | undefined;
     } | undefined;
+    geo?: {
+        block?: string[] | undefined;
+    } | undefined;
+    customRules?: {
+        name: string;
+        action: "block" | "managed_challenge" | "js_challenge" | "log";
+        expression: string;
+    }[] | undefined;
+    managedRulesets?: ("cloudflare" | "owasp")[] | undefined;
 }>;
 declare const commerceSchema: z.ZodObject<{
     payments: z.ZodObject<{
         provider: z.ZodEnum<["native", "stripe", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "stripe" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "stripe" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     email: z.ZodObject<{
         provider: z.ZodEnum<["native", "smtp", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "custom" | "smtp";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "custom" | "smtp";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     reviews: z.ZodObject<{
         provider: z.ZodEnum<["native", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     search: z.ZodObject<{
         provider: z.ZodEnum<["native", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     analytics: z.ZodObject<{
         provider: z.ZodEnum<["native", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     shipping: z.ZodObject<{
         provider: z.ZodEnum<["native", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     tax: z.ZodObject<{
         provider: z.ZodEnum<["native", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     ai: z.ZodObject<{
         provider: z.ZodEnum<["none", "anthropic", "custom"]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+        package: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         provider: "custom" | "none" | "anthropic";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }, {
         provider: "custom" | "none" | "anthropic";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     }>;
     orders: z.ZodDefault<z.ZodObject<{
         numberPrefix: z.ZodDefault<z.ZodString>;
@@ -412,34 +581,42 @@ declare const commerceSchema: z.ZodObject<{
     payments: {
         provider: "native" | "stripe" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     email: {
         provider: "native" | "custom" | "smtp";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     reviews: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     search: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     analytics: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     shipping: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     tax: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     ai: {
         provider: "custom" | "none" | "anthropic";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     orders: {
         numberPrefix: string;
@@ -449,34 +626,42 @@ declare const commerceSchema: z.ZodObject<{
     payments: {
         provider: "native" | "stripe" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     email: {
         provider: "native" | "custom" | "smtp";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     reviews: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     search: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     analytics: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     shipping: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     tax: {
         provider: "native" | "custom";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     ai: {
         provider: "custom" | "none" | "anthropic";
         config?: Record<string, unknown> | undefined;
+        package?: string | undefined;
     };
     orders?: {
         numberPrefix?: string | undefined;
@@ -538,6 +723,87 @@ declare const featuresSchema: z.ZodObject<{
     heartbeat?: boolean | undefined;
     autoUpdates?: boolean | undefined;
 }>;
+/**
+ * The bucket delivered events past retention are archived to before they are deleted. Its objects hold customer
+ * data, so it must be private: never the media bucket, which serves its objects publicly. Credentials come from the
+ * AWS SDK's default chain, as `infrastructure.s3`'s do.
+ */
+declare const eventArchiveSchema: z.ZodObject<{
+    adapter: z.ZodLiteral<"s3">;
+    bucket: z.ZodString;
+    /** Where every archive key starts; none when not given. */
+    prefix: z.ZodOptional<z.ZodString>;
+    /** `'us-east-1'` when not given. */
+    region: z.ZodOptional<z.ZodString>;
+    /** An S3-compatible API (MinIO, R2). */
+    endpoint: z.ZodOptional<z.ZodString>;
+    /** Path-style requests; true by default when an endpoint is set. */
+    forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    bucket: string;
+    adapter: "s3";
+    prefix?: string | undefined;
+    region?: string | undefined;
+    endpoint?: string | undefined;
+    forcePathStyle?: boolean | undefined;
+}, {
+    bucket: string;
+    adapter: "s3";
+    prefix?: string | undefined;
+    region?: string | undefined;
+    endpoint?: string | undefined;
+    forcePathStyle?: boolean | undefined;
+}>;
+declare const eventsSchema: z.ZodObject<{
+    /** Days a delivered event stays in the log. */
+    retentionDays: z.ZodDefault<z.ZodNumber>;
+    archive: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodLiteral<"s3">;
+        bucket: z.ZodString;
+        /** Where every archive key starts; none when not given. */
+        prefix: z.ZodOptional<z.ZodString>;
+        /** `'us-east-1'` when not given. */
+        region: z.ZodOptional<z.ZodString>;
+        /** An S3-compatible API (MinIO, R2). */
+        endpoint: z.ZodOptional<z.ZodString>;
+        /** Path-style requests; true by default when an endpoint is set. */
+        forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        bucket: string;
+        adapter: "s3";
+        prefix?: string | undefined;
+        region?: string | undefined;
+        endpoint?: string | undefined;
+        forcePathStyle?: boolean | undefined;
+    }, {
+        bucket: string;
+        adapter: "s3";
+        prefix?: string | undefined;
+        region?: string | undefined;
+        endpoint?: string | undefined;
+        forcePathStyle?: boolean | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    retentionDays: number;
+    archive?: {
+        bucket: string;
+        adapter: "s3";
+        prefix?: string | undefined;
+        region?: string | undefined;
+        endpoint?: string | undefined;
+        forcePathStyle?: boolean | undefined;
+    } | undefined;
+}, {
+    retentionDays?: number | undefined;
+    archive?: {
+        bucket: string;
+        adapter: "s3";
+        prefix?: string | undefined;
+        region?: string | undefined;
+        endpoint?: string | undefined;
+        forcePathStyle?: boolean | undefined;
+    } | undefined;
+}>;
 declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
     store: z.ZodObject<{
         name: z.ZodString;
@@ -694,7 +960,7 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             forcePathStyle?: boolean | undefined;
         } | undefined;
     }>;
-    security: z.ZodObject<{
+    security: z.ZodEffects<z.ZodObject<{
         adapter: z.ZodEnum<["middleware", "cloudflare", "aws-waf", "akamai"]>;
         rateLimit: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             requests: z.ZodNumber;
@@ -749,6 +1015,41 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl?: string | undefined;
             refreshTtl?: string | undefined;
         }>>;
+        cloudflare: z.ZodOptional<z.ZodObject<{
+            zoneId: z.ZodOptional<z.ZodString>;
+            apiToken: z.ZodOptional<z.ZodString>;
+            /** The Cloudflare v4 API; the adapter defaults it to https://api.cloudflare.com/client/v4. */
+            apiBase: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        }, {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        }>>;
+        geo: z.ZodDefault<z.ZodObject<{
+            block: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            block: string[];
+        }, {
+            block?: string[] | undefined;
+        }>>;
+        customRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            expression: z.ZodString;
+            action: z.ZodEnum<["block", "managed_challenge", "js_challenge", "log"]>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }, {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }>, "many">>;
+        managedRulesets: z.ZodDefault<z.ZodArray<z.ZodEnum<["cloudflare", "owasp"]>, "many">>;
     }, "strip", z.ZodTypeAny, {
         adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
         rateLimit: Record<string, {
@@ -772,8 +1073,101 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl: string;
             refreshTtl: string;
         };
+        geo: {
+            block: string[];
+        };
+        customRules: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[];
+        managedRulesets: ("cloudflare" | "owasp")[];
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
+    }, {
+        adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
+        rateLimit?: Record<string, {
+            requests: number;
+            window: string;
+            action: "block" | "challenge" | "throttle";
+        }> | undefined;
+        botProtection?: {
+            mode?: "strict" | "off" | "managed" | undefined;
+            allowList?: string[] | undefined;
+        } | undefined;
+        headers?: {
+            hsts?: boolean | undefined;
+            contentSecurityPolicy?: string | undefined;
+            referrerPolicy?: string | undefined;
+            xFrameOptions?: "deny" | "sameorigin" | undefined;
+        } | undefined;
+        csrf?: boolean | undefined;
+        auth?: {
+            jwtSecret?: string | undefined;
+            accessTtl?: string | undefined;
+            refreshTtl?: string | undefined;
+        } | undefined;
+        geo?: {
+            block?: string[] | undefined;
+        } | undefined;
+        customRules?: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[] | undefined;
+        managedRulesets?: ("cloudflare" | "owasp")[] | undefined;
+    }>, {
+        adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+        rateLimit: Record<string, {
+            requests: number;
+            window: string;
+            action: "block" | "challenge" | "throttle";
+        }>;
+        botProtection: {
+            mode: "strict" | "off" | "managed";
+            allowList: string[];
+        };
+        headers: {
+            hsts: boolean;
+            contentSecurityPolicy: string;
+            referrerPolicy: string;
+            xFrameOptions: "deny" | "sameorigin";
+        };
+        csrf: boolean;
+        auth: {
+            jwtSecret: string;
+            accessTtl: string;
+            refreshTtl: string;
+        };
+        geo: {
+            block: string[];
+        };
+        customRules: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[];
+        managedRulesets: ("cloudflare" | "owasp")[];
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
     }, {
         adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
         rateLimit?: Record<string, {
             requests: number;
             window: string;
@@ -795,87 +1189,128 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl?: string | undefined;
             refreshTtl?: string | undefined;
         } | undefined;
+        geo?: {
+            block?: string[] | undefined;
+        } | undefined;
+        customRules?: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[] | undefined;
+        managedRulesets?: ("cloudflare" | "owasp")[] | undefined;
     }>;
     commerce: z.ZodObject<{
         payments: z.ZodObject<{
             provider: z.ZodEnum<["native", "stripe", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         email: z.ZodObject<{
             provider: z.ZodEnum<["native", "smtp", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         reviews: z.ZodObject<{
             provider: z.ZodEnum<["native", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         search: z.ZodObject<{
             provider: z.ZodEnum<["native", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         analytics: z.ZodObject<{
             provider: z.ZodEnum<["native", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         shipping: z.ZodObject<{
             provider: z.ZodEnum<["native", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         tax: z.ZodObject<{
             provider: z.ZodEnum<["native", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         ai: z.ZodObject<{
             provider: z.ZodEnum<["none", "anthropic", "custom"]>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            /** The npm package a `custom` slot's adapter comes from, for tooling (`nymbal test:contracts`); the kernel never reads it. */
+            package: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }, {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         }>;
         orders: z.ZodDefault<z.ZodObject<{
             numberPrefix: z.ZodDefault<z.ZodString>;
@@ -891,34 +1326,42 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         payments: {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         email: {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         reviews: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         search: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         analytics: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         shipping: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         tax: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         ai: {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         orders: {
             numberPrefix: string;
@@ -928,34 +1371,42 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         payments: {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         email: {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         reviews: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         search: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         analytics: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         shipping: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         tax: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         ai: {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         orders?: {
             numberPrefix?: string | undefined;
@@ -1017,6 +1468,56 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         heartbeat?: boolean | undefined;
         autoUpdates?: boolean | undefined;
     }>>;
+    events: z.ZodDefault<z.ZodObject<{
+        /** Days a delivered event stays in the log. */
+        retentionDays: z.ZodDefault<z.ZodNumber>;
+        archive: z.ZodOptional<z.ZodObject<{
+            adapter: z.ZodLiteral<"s3">;
+            bucket: z.ZodString;
+            /** Where every archive key starts; none when not given. */
+            prefix: z.ZodOptional<z.ZodString>;
+            /** `'us-east-1'` when not given. */
+            region: z.ZodOptional<z.ZodString>;
+            /** An S3-compatible API (MinIO, R2). */
+            endpoint: z.ZodOptional<z.ZodString>;
+            /** Path-style requests; true by default when an endpoint is set. */
+            forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+        }, "strict", z.ZodTypeAny, {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        }, {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        retentionDays: number;
+        archive?: {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        } | undefined;
+    }, {
+        retentionDays?: number | undefined;
+        archive?: {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        } | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     store: {
         name: string;
@@ -1069,39 +1570,61 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl: string;
             refreshTtl: string;
         };
+        geo: {
+            block: string[];
+        };
+        customRules: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[];
+        managedRulesets: ("cloudflare" | "owasp")[];
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
     };
     commerce: {
         payments: {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         email: {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         reviews: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         search: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         analytics: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         shipping: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         tax: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         ai: {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         orders: {
             numberPrefix: string;
@@ -1126,6 +1649,17 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         heartbeat: boolean;
         autoUpdates: boolean;
     };
+    events: {
+        retentionDays: number;
+        archive?: {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        } | undefined;
+    };
 }, {
     store: {
         name: string;
@@ -1157,6 +1691,11 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
     };
     security: {
         adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
         rateLimit?: Record<string, {
             requests: number;
             window: string;
@@ -1178,39 +1717,56 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl?: string | undefined;
             refreshTtl?: string | undefined;
         } | undefined;
+        geo?: {
+            block?: string[] | undefined;
+        } | undefined;
+        customRules?: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[] | undefined;
+        managedRulesets?: ("cloudflare" | "owasp")[] | undefined;
     };
     commerce: {
         payments: {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         email: {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         reviews: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         search: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         analytics: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         shipping: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         tax: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         ai: {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         orders?: {
             numberPrefix?: string | undefined;
@@ -1235,6 +1791,17 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         heartbeat?: boolean | undefined;
         autoUpdates?: boolean | undefined;
     } | undefined;
+    events?: {
+        retentionDays?: number | undefined;
+        archive?: {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        } | undefined;
+    } | undefined;
 }>, {
     store: {
         name: string;
@@ -1287,39 +1854,61 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl: string;
             refreshTtl: string;
         };
+        geo: {
+            block: string[];
+        };
+        customRules: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[];
+        managedRulesets: ("cloudflare" | "owasp")[];
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
     };
     commerce: {
         payments: {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         email: {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         reviews: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         search: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         analytics: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         shipping: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         tax: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         ai: {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         orders: {
             numberPrefix: string;
@@ -1344,6 +1933,17 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         heartbeat: boolean;
         autoUpdates: boolean;
     };
+    events: {
+        retentionDays: number;
+        archive?: {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        } | undefined;
+    };
 }, {
     store: {
         name: string;
@@ -1375,6 +1975,11 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
     };
     security: {
         adapter: "middleware" | "cloudflare" | "aws-waf" | "akamai";
+        cloudflare?: {
+            zoneId?: string | undefined;
+            apiToken?: string | undefined;
+            apiBase?: string | undefined;
+        } | undefined;
         rateLimit?: Record<string, {
             requests: number;
             window: string;
@@ -1396,39 +2001,56 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
             accessTtl?: string | undefined;
             refreshTtl?: string | undefined;
         } | undefined;
+        geo?: {
+            block?: string[] | undefined;
+        } | undefined;
+        customRules?: {
+            name: string;
+            action: "block" | "managed_challenge" | "js_challenge" | "log";
+            expression: string;
+        }[] | undefined;
+        managedRulesets?: ("cloudflare" | "owasp")[] | undefined;
     };
     commerce: {
         payments: {
             provider: "native" | "stripe" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         email: {
             provider: "native" | "custom" | "smtp";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         reviews: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         search: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         analytics: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         shipping: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         tax: {
             provider: "native" | "custom";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         ai: {
             provider: "custom" | "none" | "anthropic";
             config?: Record<string, unknown> | undefined;
+            package?: string | undefined;
         };
         orders?: {
             numberPrefix?: string | undefined;
@@ -1453,6 +2075,17 @@ declare const nymbalConfigSchema: z.ZodEffects<z.ZodObject<{
         heartbeat?: boolean | undefined;
         autoUpdates?: boolean | undefined;
     } | undefined;
+    events?: {
+        retentionDays?: number | undefined;
+        archive?: {
+            bucket: string;
+            adapter: "s3";
+            prefix?: string | undefined;
+            region?: string | undefined;
+            endpoint?: string | undefined;
+            forcePathStyle?: boolean | undefined;
+        } | undefined;
+    } | undefined;
 }>;
 type NymbalConfigInput = z.input<typeof nymbalConfigSchema>;
 type NymbalConfig = z.output<typeof nymbalConfigSchema>;
@@ -1504,4 +2137,5 @@ interface LoadedConfig {
 declare function findConfigFile(startDir: string): string | null;
 declare function loadConfig(startDir?: string): Promise<LoadedConfig>;
-export { DEFAULT_JWT_SECRET, type InfrastructureSlot, KNOWN_INFRASTRUCTURE, KNOWN_PROVIDERS, type LoadedConfig, type NymbalConfig, type NymbalConfigInput, REMOVED_INFRASTRUCTURE_KEYS, commerceSchema, defineConfig, deploymentSchema, env, envBool, envNumber, envOptional, featuresSchema, findConfigFile, httpSchema, infrastructureSchema, loadConfig, nymbalConfigSchema, redisSchema, s3Schema, securitySchema, storeSchema };
+export { DEFAULT_JWT_SECRET, KNOWN_INFRASTRUCTURE, KNOWN_PROVIDERS, REMOVED_INFRASTRUCTURE_KEYS, commerceSchema, defineConfig, deploymentSchema, env, envBool, envNumber, envOptional, eventArchiveSchema, eventsSchema, featuresSchema, findConfigFile, httpSchema, infrastructureSchema, loadConfig, nymbalConfigSchema, redisSchema, s3Schema, securitySchema, storeSchema };
+export type { InfrastructureSlot, LoadedConfig, NymbalConfig, NymbalConfigInput };