@selvajs/cli 4.20.0-beta.20 → 4.20.0-beta.21

package/src/generated/config.js

@@ -0,0 +1,1099 @@
+// GENERATED by packages/selva/scripts/generate-cli-config.js. Do not edit.
+import { createHash, createHmac, randomBytes } from 'node:crypto';
+// ../platform/src/config/manifest.ts
+function defineSetting(spec) {
+	return spec;
+}
+/** Flattens slices and rejects a key declared twice: two readers, two defaults. */
+function composeManifest(parts) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const part of parts)
+		for (const spec of Array.isArray(part) ? part : [part]) {
+			for (const name of [spec.key, ...(spec.aliases ?? [])]) {
+				if (seen.has(name)) throw new Error(`Config key ${name} is declared twice`);
+				seen.add(name);
+			}
+			out.push(spec);
+		}
+	return out;
+}
+// ../platform/src/config/resolve.ts
+var TRUE = /* @__PURE__ */ new Set(['true', '1', 'yes', 'on']);
+var FALSE = /* @__PURE__ */ new Set(['false', '0', 'no', 'off']);
+function parse(spec, raw) {
+	const v = raw.trim();
+	switch (spec.type) {
+		case 'string':
+			if (spec.minLength !== void 0 && v.length < spec.minLength)
+				return {
+					ok: false,
+					problem: `must be at least ${spec.minLength} characters`
+				};
+			return {
+				ok: true,
+				value: v
+			};
+		case 'key':
+			return isKey32(v)
+				? {
+						ok: true,
+						value: v
+					}
+				: {
+						ok: false,
+						problem: 'must be 32 bytes as 64 hex characters or base64'
+					};
+		case 'url':
+			try {
+				new URL(v);
+				return {
+					ok: true,
+					value: v.replace(/\/+$/, '')
+				};
+			} catch {
+				return {
+					ok: false,
+					problem: 'must be an absolute URL'
+				};
+			}
+		case 'int': {
+			const n = Number(v);
+			if (!Number.isInteger(n))
+				return {
+					ok: false,
+					problem: 'must be a whole number'
+				};
+			if (spec.min !== void 0 && n < spec.min)
+				return {
+					ok: false,
+					problem: `must be ≥ ${spec.min}`
+				};
+			if (spec.max !== void 0 && n > spec.max)
+				return {
+					ok: false,
+					problem: `must be ≤ ${spec.max}`
+				};
+			return {
+				ok: true,
+				value: n
+			};
+		}
+		case 'bool': {
+			const lower = v.toLowerCase();
+			if (TRUE.has(lower))
+				return {
+					ok: true,
+					value: true
+				};
+			if (FALSE.has(lower))
+				return {
+					ok: true,
+					value: false
+				};
+			return {
+				ok: false,
+				problem: 'must be true or false'
+			};
+		}
+		case 'enum': {
+			const lower = v.toLowerCase();
+			const match = spec.values.find((m) => m.toLowerCase() === lower);
+			return match !== void 0
+				? {
+						ok: true,
+						value: match
+					}
+				: {
+						ok: false,
+						problem: `must be one of ${spec.values.join(' | ')}`
+					};
+		}
+		case 'list':
+			return {
+				ok: true,
+				value: v
+					.split(',')
+					.map((s) => s.trim())
+					.filter(Boolean)
+			};
+	}
+}
+function isKey32(v) {
+	if (/^[0-9a-fA-F]{64}$/.test(v)) return true;
+	const buf = Buffer.from(v, 'base64');
+	return buf.length === 32 && buf.toString('base64').replace(/=+$/, '') === v.replace(/=+$/, '');
+}
+/** What `raw` meant to the reader before it parsed strictly. */
+function legacyValue(spec, raw) {
+	const legacy = spec.legacy;
+	if (legacy && 'bool' in legacy)
+		return legacy.bool === 'exact-true' ? raw === 'true' : raw !== 'false';
+	if (legacy && 'enumFallback' in legacy && spec.type === 'enum')
+		return spec.values.includes(raw) ? raw : legacy.enumFallback;
+	const parsed = parse(spec, raw);
+	return parsed.ok ? parsed.value : void 0;
+}
+function resolveKey(spec, env) {
+	let raw = env[spec.key];
+	let source = 'env';
+	let alias;
+	if (raw === void 0 || raw === '') {
+		alias = spec.aliases?.find((a) => env[a] !== void 0 && env[a] !== '');
+		raw = alias ? env[alias] : void 0;
+		source = alias ? 'alias' : spec.default !== void 0 ? 'default' : 'unset';
+	}
+	const base = {
+		key: spec.key,
+		spec,
+		...(alias ? { alias } : {})
+	};
+	if (raw === void 0) {
+		if (spec.required)
+			return {
+				...base,
+				source,
+				status: 'error',
+				value: void 0,
+				problem: 'is required'
+			};
+		return {
+			...base,
+			source,
+			status: 'ok',
+			value: spec.default
+		};
+	}
+	const parsed = parse(spec, raw);
+	if (parsed.ok)
+		return {
+			...base,
+			source,
+			status: 'ok',
+			value: parsed.value
+		};
+	if (spec.onInvalid === 'fail')
+		return {
+			...base,
+			source,
+			status: 'error',
+			value: void 0,
+			problem: parsed.problem
+		};
+	return {
+		...base,
+		source,
+		status: 'invalid',
+		value: spec.default,
+		problem: parsed.problem
+	};
+}
+/** Resolve every declared key from an env map. Pure: reads nothing ambient. */
+function resolveConfig(manifest, env, options = {}) {
+	const values = {};
+	const keys = {};
+	const errors = [];
+	const known = new Set(options.external ?? []);
+	for (const spec of manifest) {
+		known.add(spec.key);
+		for (const a of spec.aliases ?? []) known.add(a);
+		const report = resolveKey(spec, env);
+		keys[spec.key] = report;
+		values[spec.key] = report.value;
+		if (report.status === 'error') errors.push(report);
+	}
+	const declared = manifest.map((s) => s.key);
+	const prefixes = options.prefixes ?? [];
+	const unknown = [];
+	for (const key of Object.keys(env)) {
+		if (known.has(key) || !prefixes.some((p) => key.startsWith(p))) continue;
+		const suggestion = nearest(key, declared);
+		unknown.push(
+			suggestion
+				? {
+						key,
+						suggestion
+					}
+				: { key }
+		);
+	}
+	return {
+		values,
+		keys,
+		errors,
+		unknown
+	};
+}
+/** A declared name within a typo's reach: a prefix of it, or a few edits away. */
+function nearest(key, declared) {
+	let best;
+	let bestDistance = Infinity;
+	for (const candidate of declared) {
+		const d =
+			candidate.startsWith(key) || key.startsWith(candidate) ? 0 : editDistance(key, candidate);
+		if (d < bestDistance) {
+			best = candidate;
+			bestDistance = d;
+		}
+	}
+	return bestDistance <= 3 ? best : void 0;
+}
+function editDistance(a, b) {
+	let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+	for (let i = 1; i <= a.length; i++) {
+		const row = [i];
+		for (let j = 1; j <= b.length; j++)
+			row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+		prev = row;
+	}
+	return prev[b.length];
+}
+// ../platform/src/config/report.ts
+/**
+ * What `selva config show` and the admin page render. Pure, and free of
+ * secret values, so the result can go to a browser or a terminal as is.
+ */
+function buildConfigReport(manifest, env, options = {}) {
+	const resolved = resolveConfig(manifest, env, options);
+	const rows = manifest.map((spec) => {
+		const k = resolved.keys[spec.key];
+		const raw = k.source === 'alias' ? env[k.alias] : env[spec.key];
+		return {
+			key: spec.key,
+			class: spec.class,
+			summary: spec.summary === true,
+			description: spec.description,
+			...(spec.impact ? { impact: spec.impact } : {}),
+			source: k.source,
+			status: k.status,
+			display: display(spec.sensitive === true, spec.generated === true, k.source, raw, k.value),
+			...(k.problem ? { problem: k.problem } : {}),
+			...(k.alias ? { alias: k.alias } : {})
+		};
+	});
+	return {
+		rows: [...rows.filter((r) => r.summary), ...rows.filter((r) => !r.summary)],
+		problems: rows.filter((r) => r.status !== 'ok'),
+		unknown: resolved.unknown
+	};
+}
+function display(sensitive, generated, source, raw, value) {
+	if (source === 'unset') return '';
+	if (sensitive && raw !== void 0) return generated ? fingerprint(raw) : 'set';
+	if (sensitive) return 'set';
+	if (source === 'default' || raw === void 0) return formatValue(value);
+	return raw.trim();
+}
+function formatValue(value) {
+	if (Array.isArray(value)) return value.join(',');
+	return value === void 0 ? '' : String(value);
+}
+/** Short, stable id for a generated key, so two machines can be compared. */
+function fingerprint(value) {
+	return `sha256:${createHash('sha256').update(value.trim()).digest('hex').slice(0, 8)}`;
+}
+// ../platform/src/config/snapshot.ts
+function takeSnapshot(manifest, env, salt = randomBytes(16).toString('hex')) {
+	const values = {};
+	const sensitive = [];
+	for (const spec of manifest) {
+		const name = [spec.key, ...(spec.aliases ?? [])].find(
+			(k) => env[k] !== void 0 && env[k] !== ''
+		);
+		if (name === void 0) continue;
+		const raw = env[name].trim();
+		if (spec.sensitive) {
+			values[spec.key] = createHmac('sha256', salt).update(raw).digest('hex').slice(0, 16);
+			sensitive.push(spec.key);
+		} else values[spec.key] = raw;
+	}
+	return {
+		version: 1,
+		salt,
+		values,
+		sensitive
+	};
+}
+/** Only meaningful when both snapshots share a salt; pass `before.salt` when taking `after`. */
+function diffSnapshots(before, after) {
+	const secret = /* @__PURE__ */ new Set([...before.sensitive, ...after.sensitive]);
+	const changes = [];
+	const plain = (key, from, to) =>
+		secret.has(key)
+			? {}
+			: {
+					...(from !== void 0 ? { from } : {}),
+					...(to !== void 0 ? { to } : {})
+				};
+	for (const [key, to] of Object.entries(after.values)) {
+		const from = before.values[key];
+		if (from === void 0)
+			changes.push({
+				key,
+				change: 'added',
+				...plain(key, void 0, to)
+			});
+		else if (from !== to)
+			changes.push({
+				key,
+				change: 'changed',
+				...plain(key, from, to)
+			});
+	}
+	for (const [key, from] of Object.entries(before.values))
+		if (!(key in after.values))
+			changes.push({
+				key,
+				change: 'removed',
+				...plain(key, from)
+			});
+	return changes;
+}
+// ../platform/src/config/previous-key.ts
+/** How long `selva keys rotate` keeps the previous key accepted. */
+var PREVIOUS_KEY_DAYS = 30;
+var DAY_MS = 864e5;
+/**
+ * The previous key for `base` (`SELVA_HMAC_KEY` or `SELVA_AT_REST_KEY`), if it
+ * is still within its deadline. A rotation is meant to bound how long a key
+ * that leaked unnoticed stays useful, so the overlap ends on its own.
+ */
+function previousKey(env, base, now = Date.now()) {
+	const key = env[`${base}_PREVIOUS`]?.trim();
+	if (!key) return { state: 'none' };
+	const expires = env[`${base}_PREVIOUS_EXPIRES`]?.trim();
+	if (!expires)
+		return {
+			state: 'no-deadline',
+			key
+		};
+	const at = Date.parse(expires);
+	if (!Number.isFinite(at) || at <= now)
+		return {
+			state: 'expired',
+			expires
+		};
+	return {
+		state: 'active',
+		key,
+		expires,
+		daysLeft: Math.ceil((at - now) / DAY_MS)
+	};
+}
+// ../platform/src/logging/interface.ts
+/**
+ * Default `ILogger` — discards everything. Lets library code log
+ * unconditionally without a configured backend, and keeps test output clean.
+ * The app wires a real logger at its composition root; a consumer that wires
+ * nothing gets silence rather than unsolicited stdout writes.
+ */
+var NoopLogger = class {
+	debug(_message, _fields) {}
+	info(_message, _fields) {}
+	warn(_message, _fields) {}
+	error(_message, _fields) {}
+	child(_fields) {
+		return this;
+	}
+};
+new NoopLogger();
+// ../server/src/api/rate-limit.ts
+var DEFAULT_API_RATE_LIMIT = Object.freeze({
+	windowMs: 6e4,
+	maxPerWindow: 600
+});
+Object.freeze({
+	windowMs: 36e5,
+	maxPerWindow: 20
+});
+// ../server/src/config/settings.ts
+var flag = (key, description, impact) =>
+	defineSetting({
+		key: `SELVA_FLAG_${key}`,
+		type: 'bool',
+		default: false,
+		onInvalid: 'fail',
+		class: 'setting',
+		description,
+		...(impact ? { impact } : {})
+	});
+var tunableInt = (key, fallback, description, extra = {}) =>
+	defineSetting({
+		key,
+		type: 'int',
+		min: 1,
+		default: fallback,
+		onInvalid: 'default',
+		class: 'tunable',
+		description,
+		...extra
+	});
+var MB = 1048576;
+var ENGINE_SETTINGS = composeManifest([
+	...['AUTH', 'DATA', 'STORAGE'].map((slot) =>
+		defineSetting({
+			key: `SELVA_${slot}_PROVIDER`,
+			type: 'string',
+			default: 'local',
+			onInvalid: 'fail',
+			class: 'bootstrap',
+			summary: true,
+			description: `${slot.toLowerCase()} provider: local, supabase${slot === 'AUTH' ? ' or header' : ''}.`,
+			impact:
+				'Switching it does not move any data: the instance starts on what the new provider holds.'
+		})
+	),
+	defineSetting({
+		key: 'SELVA_TENANCY',
+		type: 'enum',
+		values: ['single', 'multi'],
+		default: 'single',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'single: one org per deployment. multi: users create their own orgs.'
+	}),
+	defineSetting({
+		key: 'SELVA_CONFIG_PATH',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'A selva.config.js that replaces env-driven provider wiring.'
+	}),
+	defineSetting({
+		key: 'SELVA_HMAC_KEY',
+		type: 'string',
+		minLength: 32,
+		required: true,
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		generated: true,
+		summary: true,
+		description: 'Signs sessions (local auth), OAuth codes, MCP client ids and solve-event tokens.',
+		impact:
+			'Changing it without SELVA_HMAC_KEY_PREVIOUS breaks what it signed: run `selva keys rotate hmac`.'
+	}),
+	defineSetting({
+		key: 'SELVA_AT_REST_KEY',
+		type: 'key',
+		required: true,
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		generated: true,
+		summary: true,
+		description: 'Encrypts stored Rhino.Compute API keys.',
+		impact:
+			'Changing it without SELVA_AT_REST_KEY_PREVIOUS makes stored API keys unreadable: run `selva keys rotate at-rest`.'
+	}),
+	defineSetting({
+		key: 'SELVA_HMAC_KEY_PREVIOUS',
+		type: 'string',
+		minLength: 32,
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		generated: true,
+		summary: true,
+		description: 'The HMAC key before the last rotation. Still accepted for what it signed.',
+		impact: 'Removing it ends sessions, MCP clients and links signed before the rotation.'
+	}),
+	defineSetting({
+		key: 'SELVA_AT_REST_KEY_PREVIOUS',
+		type: 'key',
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		generated: true,
+		summary: true,
+		description:
+			'The encryption key before the last rotation. Stored API keys are re-sealed at boot.',
+		impact: 'Remove it only once /admin/system shows no API key on the previous key.'
+	}),
+	defineSetting({
+		key: 'SELVA_HMAC_KEY_PREVIOUS_EXPIRES',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'secret',
+		description:
+			'When SELVA_HMAC_KEY_PREVIOUS stops being accepted (ISO date). Set by `selva keys rotate`.',
+		impact:
+			'After it, anything only the previous key opens is refused. An unreadable date counts as passed.'
+	}),
+	defineSetting({
+		key: 'SELVA_AT_REST_KEY_PREVIOUS_EXPIRES',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'secret',
+		description:
+			'When SELVA_AT_REST_KEY_PREVIOUS stops being accepted (ISO date). Set by `selva keys rotate`.',
+		impact:
+			'After it, anything only the previous key opens is refused. An unreadable date counts as passed.'
+	}),
+	defineSetting({
+		key: 'BOOTSTRAP_INSTANCE_ADMIN_EMAIL',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		sensitive: true,
+		summary: true,
+		description:
+			'Only this address may claim instance admin while none exists. Break-glass recovery.'
+	}),
+	defineSetting({
+		key: 'SIGN_IN_MAX_AGE_DAYS',
+		type: 'int',
+		min: 0,
+		default: 0,
+		onInvalid: 'fail',
+		class: 'setting',
+		summary: true,
+		description: 'How long one sign-in at the identity provider lasts. 0 is off.',
+		impact: 'API tokens of anyone who has not signed in within this many days are revoked.'
+	}),
+	flag('ALLOW_ORG_CREATION', 'Self-service org creation (read by host apps).'),
+	flag(
+		'ALLOW_CROSS_ORG_PUBLIC',
+		'Public projects are visible to every signed-in user, not just the publishing org.',
+		'Turning it on widens who sees existing public projects.'
+	),
+	flag('ALLOW_ORG_COMPUTE_OVERRIDE', 'Orgs may configure their own Rhino.Compute server.'),
+	flag(
+		'ENABLE_SHARING',
+		'Per-definition share links for anonymous access.',
+		'Turning it off stops every existing share link from resolving.'
+	),
+	flag(
+		'ENABLE_PLATFORM_PROJECTS',
+		'Projects owned by instance admins and granted to orgs or users.'
+	),
+	...[
+		['NAME', 'Product name in the header and titles.'],
+		['COPYRIGHT_NAME', 'Footer copyright owner. Defaults to the brand name.'],
+		['TAGLINE', 'Subtitle on the landing page.'],
+		['DESCRIPTION', 'Meta description for search and link previews.']
+	].map(([key, description]) =>
+		defineSetting({
+			key: `SELVA_BRAND_${key}`,
+			type: 'string',
+			onInvalid: 'fail',
+			class: 'setting',
+			description
+		})
+	),
+	defineSetting({
+		key: 'SMTP_HOST',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'setting',
+		description: 'SMTP server. Unset: invites return a link to send by hand.'
+	}),
+	defineSetting({
+		key: 'SMTP_PORT',
+		type: 'int',
+		min: 1,
+		max: 65535,
+		default: 587,
+		onInvalid: 'fail',
+		class: 'setting',
+		description: '587 for STARTTLS, 465 for implicit TLS.'
+	}),
+	defineSetting({
+		key: 'SMTP_USER',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'setting',
+		sensitive: true,
+		description: 'SMTP login.'
+	}),
+	defineSetting({
+		key: 'SMTP_PASS',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		description: 'SMTP password.'
+	}),
+	defineSetting({
+		key: 'SMTP_FROM',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'setting',
+		sensitive: true,
+		description: 'Sender address. Required once SMTP_HOST is set.'
+	}),
+	defineSetting({
+		key: 'SMTP_SECURE',
+		type: 'bool',
+		onInvalid: 'fail',
+		class: 'tunable',
+		description: 'Override the TLS mode inferred from the port.',
+		legacy: { bool: 'exact-true' }
+	}),
+	tunableInt('COMPUTE_SOLVE_DEADLINE_MS', 1e5, 'Longest one solve may run.', {
+		aliases: ['MAX_SOLVE_DURATION_MS'],
+		impact: 'Past the reverse proxy read timeout, solves fail there with a 502 instead.'
+	}),
+	tunableInt('COMPUTE_RATE_LIMIT_WINDOW_MS', 1e5, 'Compute rate-limit window.'),
+	tunableInt('COMPUTE_RATE_LIMIT_MAX', 120, 'Solves per user or share link per window.'),
+	tunableInt('MAX_DEFINITION_FILE_SIZE_BYTES', 50 * MB, 'Largest .gh upload.'),
+	tunableInt('MAX_IMAGE_FILE_SIZE_BYTES', 10 * MB, 'Largest cover image upload.'),
+	tunableInt('COMPUTE_REQUEST_MAX_BYTES', 256 * MB, 'Largest solve request body.', {
+		impact: 'Must stay at or below BODY_SIZE_LIMIT, or that limit rejects first.'
+	}),
+	tunableInt('COMPUTE_RESPONSE_MAX_BYTES', 300 * MB, 'Largest solve response body.'),
+	tunableInt('REMOTE_DEFINITION_FETCH_TIMEOUT_MS', 3e4, 'Deadline for fetching a remote .gh.'),
+	tunableInt('REMOTE_DEFINITION_CACHE_TTL_MS', 3e5, 'How long remote .gh bytes stay cached.', {
+		aliases: ['DEFINITION_CACHE_TTL_MS']
+	}),
+	tunableInt(
+		'COMPUTE_MAX_QUEUE_DEPTH',
+		0,
+		'Solves allowed to wait per compute server. 0 is unbounded.',
+		{ min: 0 }
+	),
+	tunableInt('COMPUTE_QUEUE_WAIT_MS', 0, 'Longest a solve may wait queued. 0 is no deadline.', {
+		min: 0
+	}),
+	tunableInt('COMPUTE_DEFINITION_CACHE_MB', 256, 'Definition cache budget. 0 turns it off.', {
+		min: 0,
+		aliases: ['COMPUTE_DEFINITION_BYTE_CACHE_MB']
+	}),
+	tunableInt(
+		'COMPUTE_SOLVE_CACHE_MB',
+		256,
+		'Solve cache budget per warm compute server. 0 turns it off.',
+		{
+			min: 0,
+			aliases: ['COMPUTE_RESPONSE_CACHE_MB']
+		}
+	),
+	defineSetting({
+		key: 'COMPUTE_REUSE_DEFINITION_CACHE',
+		type: 'bool',
+		default: true,
+		onInvalid: 'default',
+		class: 'tunable',
+		description: 'Reuse the compute server’s cached definition instead of re-uploading it.',
+		impact:
+			'Leave on only with a compute server that reports a stale pointer (the VektorNode fork).'
+	}),
+	defineSetting({
+		key: 'COMPUTE_SERVER_CACHESOLVE',
+		type: 'bool',
+		default: true,
+		onInvalid: 'default',
+		class: 'tunable',
+		description: 'Ask Rhino.Compute to cache solve results server-side.'
+	}),
+	tunableInt(
+		'API_TOKEN_RATE_LIMIT_WINDOW_MS',
+		DEFAULT_API_RATE_LIMIT.windowMs,
+		'API token rate-limit window.'
+	),
+	tunableInt(
+		'API_TOKEN_RATE_LIMIT_MAX',
+		DEFAULT_API_RATE_LIMIT.maxPerWindow,
+		'Requests per API token per window. 0 is off.',
+		{ min: 0 }
+	)
+]);
+// ../providers/header-auth/src/config.ts
+var header = (key, fallback, slot) =>
+	defineSetting({
+		key,
+		type: 'string',
+		default: fallback,
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: `Header the proxy puts the user's ${slot} in.`,
+		impact: 'A name the proxy never sends signs nobody in. Override all three or none.'
+	});
+var HEADER_AUTH_SETTINGS = composeManifest([
+	defineSetting({
+		key: 'HEADER_AUTH_DATA_DIR',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'Directory holding header-allowlist.json. Falls back to DATA_PATH.'
+	}),
+	header('HEADER_AUTH_UPN_HEADER', 'SELVA-UserPrincipalName', 'UPN'),
+	header('HEADER_AUTH_EMAIL_HEADER', 'SELVA-Email', 'email'),
+	header('HEADER_AUTH_DISPLAY_NAME_HEADER', 'SELVA-DisplayName', 'display name')
+]);
+// ../providers/local/src/config.ts
+var LOCAL_SETTINGS = composeManifest([
+	defineSetting({
+		key: 'DATA_PATH',
+		type: 'string',
+		required: true,
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Directory holding users, orgs, projects and uploaded files.',
+		impact: 'Pointing it elsewhere starts an empty instance; the old data stays where it was.'
+	})
+]);
+// ../providers/supabase/src/config.ts
+var SUPABASE_SETTINGS = composeManifest([
+	defineSetting({
+		key: 'SUPABASE_URL',
+		type: 'url',
+		required: true,
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Supabase project URL.',
+		impact: 'Pointing it at another project shows that project’s users and data.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_ANON_KEY',
+		type: 'string',
+		required: true,
+		onInvalid: 'fail',
+		class: 'secret',
+		description: 'Publishable key (sb_publishable_…).'
+	}),
+	defineSetting({
+		key: 'SUPABASE_SERVICE_ROLE_KEY',
+		type: 'string',
+		required: true,
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		description: 'Secret key (sb_secret_…). Bypasses row security: server only.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_JWT_SIGNING_KEY',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		description: 'Private ES256 JWK, one line. Needed for API tokens.',
+		impact: 'Without it, or SUPABASE_JWT_SECRET, API tokens answer 503.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_JWT_SECRET',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		description: 'Legacy HS256 JWT secret. Used only without SUPABASE_JWT_SIGNING_KEY.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_ENABLE_SELF_SIGNUP',
+		type: 'bool',
+		default: false,
+		onInvalid: 'fail',
+		class: 'setting',
+		description: 'Allow self-service sign-up at /signup.',
+		legacy: { bool: 'exact-true' }
+	}),
+	defineSetting({
+		key: 'SUPABASE_ALLOW_EMAIL_LINK_SIGNUP',
+		type: 'bool',
+		default: true,
+		onInvalid: 'fail',
+		class: 'setting',
+		description: 'A magic link to an unknown address creates an account.',
+		legacy: { bool: 'not-false' }
+	}),
+	defineSetting({
+		key: 'SUPABASE_OAUTH_PROVIDERS',
+		type: 'list',
+		default: [],
+		onInvalid: 'fail',
+		class: 'setting',
+		description: 'OAuth buttons on the login page (google, github, azure, gitlab).'
+	}),
+	defineSetting({
+		key: 'SUPABASE_TOKEN_VERIFICATION',
+		type: 'enum',
+		values: ['hybrid', 'strict'],
+		default: 'hybrid',
+		onInvalid: 'fail',
+		class: 'tunable',
+		description:
+			'hybrid verifies JWTs locally and rechecks periodically; strict asks Supabase every request.',
+		legacy: { enumFallback: 'hybrid' }
+	}),
+	defineSetting({
+		key: 'SUPABASE_REVALIDATE_MS',
+		type: 'int',
+		min: 1,
+		default: 6e4,
+		onInvalid: 'default',
+		class: 'tunable',
+		description: 'Hybrid recheck window: the longest a revoked session keeps working.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_PUBLIC_BUCKET',
+		type: 'string',
+		default: 'selva-public',
+		onInvalid: 'fail',
+		class: 'tunable',
+		description: 'Storage bucket for public files.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_PRIVATE_BUCKET',
+		type: 'string',
+		default: 'selva-private',
+		onInvalid: 'fail',
+		class: 'tunable',
+		description: 'Storage bucket for private files.'
+	}),
+	defineSetting({
+		key: 'SUPABASE_PRIVATE_URL_PREFIX',
+		type: 'string',
+		default: '/api/files',
+		onInvalid: 'fail',
+		class: 'tunable',
+		description: 'URL prefix the app serves private files at.'
+	})
+]);
+// src/lib/server/config/settings.ts
+/** Keys only this app reads. adapter-node's own keys are here too: they decide whether it works. */
+var APP_SETTINGS = composeManifest([
+	defineSetting({
+		key: 'ORIGIN',
+		type: 'url',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Public URL of the app. Required behind a reverse proxy.',
+		impact:
+			'Wrong or unset behind a proxy: form posts fail the CSRF check and invite links carry an internal host.'
+	}),
+	defineSetting({
+		key: 'PORT',
+		type: 'int',
+		min: 1,
+		max: 65535,
+		default: 3e3,
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'Port the app listens on.'
+	}),
+	defineSetting({
+		key: 'HOST',
+		type: 'string',
+		default: '0.0.0.0',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Address the app binds to. 127.0.0.1 behind a proxy.',
+		impact: 'Under header auth, anything that reaches the port directly can claim to be any user.'
+	}),
+	defineSetting({
+		key: 'BODY_SIZE_LIMIT',
+		type: 'string',
+		default: '512K',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Largest request body adapter-node accepts (K, M or G suffix).',
+		impact: 'Below COMPUTE_REQUEST_MAX_BYTES, uploads and file inputs fail with 413.'
+	}),
+	defineSetting({
+		key: 'ADDRESS_HEADER',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Header carrying the client IP behind a proxy (X-Forwarded-For).',
+		impact: 'Unset behind a proxy: every client shares one rate-limit bucket.'
+	}),
+	defineSetting({
+		key: 'XFF_DEPTH',
+		type: 'int',
+		min: 1,
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		summary: true,
+		description: 'Number of proxies in front of the app.'
+	}),
+	defineSetting({
+		key: 'PROTOCOL_HEADER',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'Header carrying the original protocol, when ORIGIN is unset.'
+	}),
+	defineSetting({
+		key: 'HOST_HEADER',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'Header carrying the original host, when ORIGIN is unset.'
+	}),
+	defineSetting({
+		key: 'NODE_ENV',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'production in deployments: hides stack traces and makes cookies Secure.'
+	}),
+	defineSetting({
+		key: 'ALLOW_INSECURE_COOKIES',
+		type: 'bool',
+		default: false,
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description: 'Drop the Secure cookie flag so sign-in works over plain http.',
+		legacy: { bool: 'exact-true' }
+	}),
+	defineSetting({
+		key: 'INSTALL_DIR',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description:
+			'Deployment directory the admin updater runs in. Defaults to the working directory.'
+	}),
+	defineSetting({
+		key: 'SELVA_EVENT_CALLBACK_ORIGIN',
+		type: 'url',
+		onInvalid: 'fail',
+		class: 'bootstrap',
+		description:
+			'Origin Rhino.Compute posts live solve events to, when it differs from the browser’s.'
+	}),
+	defineSetting({
+		key: 'MCP_ALLOWED_ORIGINS',
+		type: 'list',
+		default: [],
+		onInvalid: 'fail',
+		class: 'setting',
+		description: 'Browser origins /mcp accepts besides its own.'
+	}),
+	defineSetting({
+		key: 'LOG_LEVEL',
+		type: 'enum',
+		values: ['debug', 'info', 'warn', 'error'],
+		onInvalid: 'default',
+		class: 'setting',
+		description: 'Lowest severity written to the log. Default info (debug in development).'
+	}),
+	defineSetting({
+		key: 'SELVA_FLAG_COMPUTE_DEBUG',
+		type: 'string',
+		default: 'off',
+		onInvalid: 'default',
+		class: 'setting',
+		description:
+			'off, on (cache and timing lines per solve) or verbose (adds Compute’s raw error bodies).',
+		impact: 'verbose can write what was solved to the log, which erasure cannot reach.'
+	}),
+	defineSetting({
+		key: 'SELVA_FLAG_COMPUTE_DEBUG_VERBOSE',
+		type: 'bool',
+		onInvalid: 'default',
+		class: 'setting',
+		description: 'Replaced by SELVA_FLAG_COMPUTE_DEBUG=verbose.'
+	}),
+	defineSetting({
+		key: 'SENTRY_DSN',
+		type: 'url',
+		onInvalid: 'fail',
+		class: 'secret',
+		sensitive: true,
+		description: 'Ship unexpected server errors to Sentry.'
+	}),
+	defineSetting({
+		key: 'SELVA_RELEASE',
+		type: 'string',
+		onInvalid: 'fail',
+		class: 'tunable',
+		description: 'Release tag on Sentry events and log records.'
+	})
+]);
+/** Prefixes whose undeclared keys are reported as unknown (likely typos). */
+var WATCHED_PREFIXES = [
+	'SELVA_',
+	'SUPABASE_',
+	'COMPUTE_',
+	'SMTP_',
+	'HEADER_AUTH_',
+	'API_TOKEN_',
+	'MAX_',
+	'REMOTE_DEFINITION_',
+	'SIGN_IN_',
+	'BOOTSTRAP_'
+];
+/** Read by tooling, not by the app: not unknown, not reported. */
+var EXTERNAL_KEYS = ['SELVA_REQUIRE_SUPABASE'];
+/**
+ * The manifest for this deployment: engine and app keys, plus the slices of
+ * the providers it selects. A provider's required keys only apply when it is
+ * in use, so slices are chosen here rather than all composed at once.
+ */
+function deploymentManifest(env) {
+	const chosen = new Set(
+		['SELVA_AUTH_PROVIDER', 'SELVA_DATA_PROVIDER', 'SELVA_STORAGE_PROVIDER'].map((k) =>
+			(env[k] ?? 'local').toLowerCase()
+		)
+	);
+	return composeManifest([
+		ENGINE_SETTINGS,
+		APP_SETTINGS,
+		...(chosen.has('local') ? [LOCAL_SETTINGS] : []),
+		...(chosen.has('supabase') ? [SUPABASE_SETTINGS] : []),
+		...(chosen.has('header') ? [HEADER_AUTH_SETTINGS] : [])
+	]);
+}
+/** Every key any slice declares, whichever providers are chosen. */
+var ALL_SETTINGS = composeManifest([
+	ENGINE_SETTINGS,
+	APP_SETTINGS,
+	LOCAL_SETTINGS,
+	SUPABASE_SETTINGS,
+	HEADER_AUTH_SETTINGS
+]);
+/** The report for this deployment. Keys of providers it doesn't use are known, not typos. */
+function deploymentReport(env) {
+	const manifest = deploymentManifest(env);
+	const active = new Set(manifest.flatMap((s) => [s.key, ...(s.aliases ?? [])]));
+	const inactive = ALL_SETTINGS.flatMap((s) => [s.key, ...(s.aliases ?? [])]).filter(
+		(k) => !active.has(k)
+	);
+	return buildConfigReport(manifest, env, {
+		prefixes: WATCHED_PREFIXES,
+		external: [...EXTERNAL_KEYS, ...inactive]
+	});
+}
+var NOT_FROM_ENV_FILE = /* @__PURE__ */ new Set(['NODE_ENV']);
+/** What the boot snapshot and the CLI's drift check compare. */
+function deploymentSnapshot(env, salt) {
+	return takeSnapshot(
+		deploymentManifest(env).filter((s) => !NOT_FROM_ENV_FILE.has(s.key)),
+		env,
+		salt
+	);
+}
+/** The rotation overlap of each root key: what the admin page and doctor count down. */
+function keyRotationStatus(env, now = Date.now()) {
+	return ['SELVA_HMAC_KEY', 'SELVA_AT_REST_KEY'].map((key) => {
+		const p = previousKey(env, key, now);
+		return {
+			key,
+			state: p.state,
+			...('expires' in p ? { expires: p.expires } : {}),
+			...('daysLeft' in p ? { daysLeft: p.daysLeft } : {})
+		};
+	});
+}
+export {
+	ALL_SETTINGS,
+	PREVIOUS_KEY_DAYS,
+	buildConfigReport,
+	deploymentManifest,
+	deploymentReport,
+	deploymentSnapshot,
+	diffSnapshots,
+	fingerprint,
+	keyRotationStatus,
+	legacyValue,
+	resolveConfig,
+	takeSnapshot
+};