@stackframe/stack-shared 2.8.22 → 2.8.27

package/dist/config/schema.d.mts

@@ -1,83 +1,107 @@
 import * as yup from 'yup';
-import { DeepMerge, DeepPartial } from '../utils/objects.mjs';
-import { NormalizesTo, Config } from './format.mjs';
+import { DeepMerge } from '../utils/objects.mjs';
+import { Result } from '../utils/results.mjs';
+import { Expand, IsUnion, CollapseObjectUnion } from '../utils/types.mjs';
+import { Config, NormalizesTo } from './format.mjs';
+import '../utils/strings.mjs';
 
 declare const configLevels: readonly ["project", "branch", "environment", "organization"];
 type ConfigLevel = typeof configLevels[number];
+declare module "yup" {
+    interface CustomSchemaMetadata {
+        stackConfigCanNoLongerBeOverridden?: true;
+    }
+}
 /**
  * All fields that can be overridden at this level.
  */
 declare const projectConfigSchema: yup.ObjectSchema<{
     sourceOfTruth: {
-        type?: "hosted" | undefined;
+        type: "hosted";
     } | {
-        type?: "neon" | undefined;
+        type: "neon";
         connectionStrings: Record<string, string>;
     } | {
-        type?: "postgres" | undefined;
+        type: "postgres";
         connectionString: string;
-    } | undefined;
+    };
 }, yup.AnyObject, {
     sourceOfTruth: undefined;
 }, "">;
-declare const branchConfigSchema: yup.ObjectSchema<{} & {
+declare const branchConfigSchema: yup.Schema<Omit<Omit<{
+    sourceOfTruth: {
+        type: "hosted";
+    } | {
+        type: "neon";
+        connectionStrings: Record<string, string>;
+    } | {
+        type: "postgres";
+        connectionString: string;
+    };
+}, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
+    domains: {
+        allowLocalhost?: boolean | undefined;
+    };
+    teams: {
+        createPersonalTeamOnSignUp?: boolean | undefined;
+        allowClientTeamCreation?: boolean | undefined;
+    };
     rbac: {
-        permissions?: Record<string, {
+        permissions: Record<string, {
             description?: string | undefined;
             scope?: "team" | "project" | undefined;
             containedPermissionIds?: Record<string, true | undefined> | undefined;
-        } | undefined> | undefined;
-        defaultPermissions?: {
-            teamCreator?: Record<string, true | undefined> | undefined;
-            teamMember?: Record<string, true | undefined> | undefined;
-            signUp?: Record<string, true | undefined> | undefined;
-        } | undefined;
-    } | undefined;
-    teams: {
-        createPersonalTeamOnSignUp?: boolean | undefined;
-        allowClientTeamCreation?: boolean | undefined;
-    } | undefined;
-    users: {
-        allowClientUserDeletion?: boolean | undefined;
-    } | undefined;
+        } | undefined>;
+        defaultPermissions: {
+            teamCreator: Record<string, true | undefined>;
+            teamMember: Record<string, true | undefined>;
+            signUp: Record<string, true | undefined>;
+        };
+    };
     apiKeys: {
-        enabled?: {
+        enabled: {
             user?: boolean | undefined;
             team?: boolean | undefined;
-        } | undefined;
-    } | undefined;
-    domains: {
-        allowLocalhost?: boolean | undefined;
-    } | undefined;
+        };
+    };
     auth: {
-        password?: {
-            allowSignIn?: boolean | undefined;
-        } | undefined;
         allowSignUp?: boolean | undefined;
-        otp?: {
+        password: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        passkey?: {
+        };
+        otp: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        oauth?: {
+        };
+        passkey: {
+            allowSignIn?: boolean | undefined;
+        };
+        oauth: {
             accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 allowSignIn?: boolean | undefined;
                 allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        } | undefined;
-    } | undefined;
+            }>;
+        };
+    };
+    users: {
+        allowClientUserDeletion?: boolean | undefined;
+    };
     emails: {
-        theme?: string | undefined;
-        themeList?: Record<string, {
+        selectedThemeId?: string | undefined;
+        themes: Record<string, {
+            displayName: string;
+            tsxSource: string;
+        }>;
+        templates: Record<string, {
+            themeId?: string | false | undefined;
             displayName: string;
             tsxSource: string;
-        }> | undefined;
+        }>;
     };
-}, yup.AnyObject, {
+}, yup.AnyObject, Omit<Omit<{
     sourceOfTruth: undefined;
+}, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
     rbac: {
         permissions: undefined;
         defaultPermissions: {
@@ -119,132 +143,121 @@ declare const branchConfigSchema: yup.ObjectSchema<{} & {
         };
     };
     emails: {
-        theme: undefined;
-        themeList: undefined;
+        selectedThemeId: undefined;
+        themes: undefined;
+        templates: undefined;
     };
 }, "">;
-declare const environmentConfigSchema: yup.ObjectSchema<{
+declare const environmentConfigSchema: yup.Schema<Omit<NonNullable<Omit<Omit<{
+    sourceOfTruth: {
+        type: "hosted";
+    } | {
+        type: "neon";
+        connectionStrings: Record<string, string>;
+    } | {
+        type: "postgres";
+        connectionString: string;
+    };
+}, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
+    domains: {
+        allowLocalhost?: boolean | undefined;
+    };
+    teams: {
+        createPersonalTeamOnSignUp?: boolean | undefined;
+        allowClientTeamCreation?: boolean | undefined;
+    };
     rbac: {
-        permissions?: Record<string, {
+        permissions: Record<string, {
             description?: string | undefined;
             scope?: "team" | "project" | undefined;
             containedPermissionIds?: Record<string, true | undefined> | undefined;
-        } | undefined> | undefined;
-        defaultPermissions?: {
-            teamCreator?: Record<string, true | undefined> | undefined;
-            teamMember?: Record<string, true | undefined> | undefined;
-            signUp?: Record<string, true | undefined> | undefined;
-        } | undefined;
-    } | undefined;
-    teams: {
-        createPersonalTeamOnSignUp?: boolean | undefined;
-        allowClientTeamCreation?: boolean | undefined;
-    } | undefined;
-    users: {
-        allowClientUserDeletion?: boolean | undefined;
-    } | undefined;
+        } | undefined>;
+        defaultPermissions: {
+            teamCreator: Record<string, true | undefined>;
+            teamMember: Record<string, true | undefined>;
+            signUp: Record<string, true | undefined>;
+        };
+    };
     apiKeys: {
-        enabled?: {
+        enabled: {
             user?: boolean | undefined;
             team?: boolean | undefined;
-        } | undefined;
-    } | undefined;
-    domains: (Omit<{
-        allowLocalhost?: boolean | undefined;
-    }, "trustedDomains"> & {
-        trustedDomains?: Record<string, {
-            baseUrl?: string | undefined;
-            handlerPath?: string | undefined;
-        }> | undefined;
-    }) | undefined;
-    auth: (Omit<{
-        password?: {
-            allowSignIn?: boolean | undefined;
-        } | undefined;
+        };
+    };
+    auth: {
         allowSignUp?: boolean | undefined;
-        otp?: {
+        password: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        passkey?: {
+        };
+        otp: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        oauth?: {
-            accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
-                allowSignIn?: boolean | undefined;
-                allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        } | undefined;
-    }, "oauth"> & {
-        oauth?: (Omit<{
+        };
+        passkey: {
+            allowSignIn?: boolean | undefined;
+        };
+        oauth: {
             accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 allowSignIn?: boolean | undefined;
                 allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        }, never> & {
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
-                clientId?: string | undefined;
-                clientSecret?: string | undefined;
-                allowSignIn?: boolean | undefined;
-                allowConnectedAccounts?: boolean | undefined;
-                isShared?: boolean | undefined;
-                facebookConfigId?: string | undefined;
-                microsoftTenantId?: string | undefined;
-            }> | undefined;
-        }) | undefined;
-    }) | undefined;
-    emails: Omit<{
-        theme?: string | undefined;
-        themeList?: Record<string, {
+            }>;
+        };
+    };
+    users: {
+        allowClientUserDeletion?: boolean | undefined;
+    };
+    emails: {
+        selectedThemeId?: string | undefined;
+        themes: Record<string, {
             displayName: string;
             tsxSource: string;
-        }> | undefined;
-    }, never> & {
-        server: {
-            host?: string | undefined;
-            port?: number | undefined;
-            username?: string | undefined;
-            password?: string | undefined;
-            isShared?: boolean | undefined;
-            senderName?: string | undefined;
-            senderEmail?: string | undefined;
-        };
+        }>;
+        templates: Record<string, {
+            themeId?: string | false | undefined;
+            displayName: string;
+            tsxSource: string;
+        }>;
     };
-} & {
-    auth: (Omit<{
-        password?: {
-            allowSignIn?: boolean | undefined;
-        } | undefined;
+}>, "domains" | "auth" | "emails"> & {
+    domains: Omit<{
+        allowLocalhost?: boolean | undefined;
+    }, "trustedDomains"> & {
+        trustedDomains: Record<string, {
+            baseUrl?: string | undefined;
+            handlerPath?: string | undefined;
+        }>;
+    };
+    auth: Omit<{
         allowSignUp?: boolean | undefined;
-        otp?: {
+        password: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        passkey?: {
+        };
+        otp: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        oauth?: {
+        };
+        passkey: {
+            allowSignIn?: boolean | undefined;
+        };
+        oauth: {
             accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 allowSignIn?: boolean | undefined;
                 allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        } | undefined;
+            }>;
+        };
     }, "oauth"> & {
-        oauth?: (Omit<{
+        oauth: Omit<{
             accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 allowSignIn?: boolean | undefined;
                 allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        }, never> & {
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            }>;
+        }, "providers"> & {
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 clientId?: string | undefined;
                 clientSecret?: string | undefined;
                 allowSignIn?: boolean | undefined;
@@ -252,16 +265,21 @@ declare const environmentConfigSchema: yup.ObjectSchema<{
                 isShared?: boolean | undefined;
                 facebookConfigId?: string | undefined;
                 microsoftTenantId?: string | undefined;
-            }> | undefined;
-        }) | undefined;
-    }) | undefined;
+            }>;
+        };
+    };
     emails: Omit<{
-        theme?: string | undefined;
-        themeList?: Record<string, {
+        selectedThemeId?: string | undefined;
+        themes: Record<string, {
             displayName: string;
             tsxSource: string;
-        }> | undefined;
-    }, never> & {
+        }>;
+        templates: Record<string, {
+            themeId?: string | false | undefined;
+            displayName: string;
+            tsxSource: string;
+        }>;
+    }, "server"> & {
         server: {
             host?: string | undefined;
             port?: number | undefined;
@@ -272,16 +290,9 @@ declare const environmentConfigSchema: yup.ObjectSchema<{
             senderEmail?: string | undefined;
         };
     };
-    domains: (Omit<{
-        allowLocalhost?: boolean | undefined;
-    }, "trustedDomains"> & {
-        trustedDomains?: Record<string, {
-            baseUrl?: string | undefined;
-            handlerPath?: string | undefined;
-        }> | undefined;
-    }) | undefined;
-}, yup.AnyObject, {
+}, yup.AnyObject, Omit<NonNullable<Omit<Omit<{
     sourceOfTruth: undefined;
+}, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
     rbac: {
         permissions: undefined;
         defaultPermissions: {
@@ -304,7 +315,33 @@ declare const environmentConfigSchema: yup.ObjectSchema<{
         };
     };
     domains: {
+        allowLocalhost: undefined;
+    };
+    auth: {
+        allowSignUp: undefined;
+        password: {
+            allowSignIn: undefined;
+        };
+        otp: {
+            allowSignIn: undefined;
+        };
+        passkey: {
+            allowSignIn: undefined;
+        };
+        oauth: {
+            accountMergeStrategy: undefined;
+            providers: undefined;
+        };
+    };
+    emails: {
+        selectedThemeId: undefined;
+        themes: undefined;
+        templates: undefined;
+    };
+}>, "domains" | "auth" | "emails"> & {
+    auth: Omit<NonNullable<Omit<Omit<{
         sourceOfTruth: undefined;
+    }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
         rbac: {
             permissions: undefined;
             defaultPermissions: {
@@ -346,12 +383,66 @@ declare const environmentConfigSchema: yup.ObjectSchema<{
             };
         };
         emails: {
-            theme: undefined;
-            themeList: undefined;
+            selectedThemeId: undefined;
+            themes: undefined;
+            templates: undefined;
+        };
+    }>, "oauth"> & {
+        oauth: Omit<NonNullable<Omit<Omit<{
+            sourceOfTruth: undefined;
+        }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
+            rbac: {
+                permissions: undefined;
+                defaultPermissions: {
+                    teamCreator: undefined;
+                    teamMember: undefined;
+                    signUp: undefined;
+                };
+            };
+            teams: {
+                createPersonalTeamOnSignUp: undefined;
+                allowClientTeamCreation: undefined;
+            };
+            users: {
+                allowClientUserDeletion: undefined;
+            };
+            apiKeys: {
+                enabled: {
+                    team: undefined;
+                    user: undefined;
+                };
+            };
+            domains: {
+                allowLocalhost: undefined;
+            };
+            auth: {
+                allowSignUp: undefined;
+                password: {
+                    allowSignIn: undefined;
+                };
+                otp: {
+                    allowSignIn: undefined;
+                };
+                passkey: {
+                    allowSignIn: undefined;
+                };
+                oauth: {
+                    accountMergeStrategy: undefined;
+                    providers: undefined;
+                };
+            };
+            emails: {
+                selectedThemeId: undefined;
+                themes: undefined;
+                templates: undefined;
+            };
+        }>, "providers"> & {
+            providers: undefined;
         };
     };
-    auth: {
+    emails: Omit<NonNullable<Omit<Omit<{
         sourceOfTruth: undefined;
+    }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
         rbac: {
             permissions: undefined;
             defaultPermissions: {
@@ -393,12 +484,24 @@ declare const environmentConfigSchema: yup.ObjectSchema<{
             };
         };
         emails: {
-            theme: undefined;
-            themeList: undefined;
+            selectedThemeId: undefined;
+            themes: undefined;
+            templates: undefined;
+        };
+    }>, "server"> & {
+        server: {
+            isShared: undefined;
+            host: undefined;
+            port: undefined;
+            username: undefined;
+            password: undefined;
+            senderName: undefined;
+            senderEmail: undefined;
         };
     };
-    emails: {
+    domains: Omit<NonNullable<Omit<Omit<{
         sourceOfTruth: undefined;
+    }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
         rbac: {
             permissions: undefined;
             defaultPermissions: {
@@ -440,75 +543,124 @@ declare const environmentConfigSchema: yup.ObjectSchema<{
             };
         };
         emails: {
-            theme: undefined;
-            themeList: undefined;
+            selectedThemeId: undefined;
+            themes: undefined;
+            templates: undefined;
         };
+    }>, "trustedDomains"> & {
+        trustedDomains: undefined;
     };
 }, "">;
-declare const organizationConfigSchema: yup.ObjectSchema<{
+declare const organizationConfigSchema: yup.Schema<Omit<NonNullable<Omit<NonNullable<Omit<Omit<{
+    sourceOfTruth: {
+        type: "hosted";
+    } | {
+        type: "neon";
+        connectionStrings: Record<string, string>;
+    } | {
+        type: "postgres";
+        connectionString: string;
+    };
+}, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
+    domains: {
+        allowLocalhost?: boolean | undefined;
+    };
+    teams: {
+        createPersonalTeamOnSignUp?: boolean | undefined;
+        allowClientTeamCreation?: boolean | undefined;
+    };
     rbac: {
-        permissions?: Record<string, {
+        permissions: Record<string, {
             description?: string | undefined;
             scope?: "team" | "project" | undefined;
             containedPermissionIds?: Record<string, true | undefined> | undefined;
-        } | undefined> | undefined;
-        defaultPermissions?: {
-            teamCreator?: Record<string, true | undefined> | undefined;
-            teamMember?: Record<string, true | undefined> | undefined;
-            signUp?: Record<string, true | undefined> | undefined;
-        } | undefined;
-    } | undefined;
-    teams: {
-        createPersonalTeamOnSignUp?: boolean | undefined;
-        allowClientTeamCreation?: boolean | undefined;
-    } | undefined;
-    users: {
-        allowClientUserDeletion?: boolean | undefined;
-    } | undefined;
+        } | undefined>;
+        defaultPermissions: {
+            teamCreator: Record<string, true | undefined>;
+            teamMember: Record<string, true | undefined>;
+            signUp: Record<string, true | undefined>;
+        };
+    };
     apiKeys: {
-        enabled?: {
+        enabled: {
             user?: boolean | undefined;
             team?: boolean | undefined;
-        } | undefined;
-    } | undefined;
-    domains: (Omit<{
+        };
+    };
+    auth: {
+        allowSignUp?: boolean | undefined;
+        password: {
+            allowSignIn?: boolean | undefined;
+        };
+        otp: {
+            allowSignIn?: boolean | undefined;
+        };
+        passkey: {
+            allowSignIn?: boolean | undefined;
+        };
+        oauth: {
+            accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
+                allowSignIn?: boolean | undefined;
+                allowConnectedAccounts?: boolean | undefined;
+            }>;
+        };
+    };
+    users: {
+        allowClientUserDeletion?: boolean | undefined;
+    };
+    emails: {
+        selectedThemeId?: string | undefined;
+        themes: Record<string, {
+            displayName: string;
+            tsxSource: string;
+        }>;
+        templates: Record<string, {
+            themeId?: string | false | undefined;
+            displayName: string;
+            tsxSource: string;
+        }>;
+    };
+}>, "domains" | "auth" | "emails"> & {
+    domains: Omit<{
         allowLocalhost?: boolean | undefined;
     }, "trustedDomains"> & {
-        trustedDomains?: Record<string, {
+        trustedDomains: Record<string, {
             baseUrl?: string | undefined;
             handlerPath?: string | undefined;
-        }> | undefined;
-    }) | undefined;
-    auth: (Omit<{
-        password?: {
-            allowSignIn?: boolean | undefined;
-        } | undefined;
+        }>;
+    };
+    auth: Omit<{
         allowSignUp?: boolean | undefined;
-        otp?: {
+        password: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        passkey?: {
+        };
+        otp: {
             allowSignIn?: boolean | undefined;
-        } | undefined;
-        oauth?: {
+        };
+        passkey: {
+            allowSignIn?: boolean | undefined;
+        };
+        oauth: {
             accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 allowSignIn?: boolean | undefined;
                 allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        } | undefined;
+            }>;
+        };
     }, "oauth"> & {
-        oauth?: (Omit<{
+        oauth: Omit<{
             accountMergeStrategy?: "link_method" | "raise_error" | "allow_duplicates" | undefined;
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 allowSignIn?: boolean | undefined;
                 allowConnectedAccounts?: boolean | undefined;
-            }> | undefined;
-        }, never> & {
-            providers?: Record<string, {
-                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | undefined;
+            }>;
+        }, "providers"> & {
+            providers: Record<string, {
+                type?: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
                 clientId?: string | undefined;
                 clientSecret?: string | undefined;
                 allowSignIn?: boolean | undefined;
@@ -516,16 +668,21 @@ declare const organizationConfigSchema: yup.ObjectSchema<{
                 isShared?: boolean | undefined;
                 facebookConfigId?: string | undefined;
                 microsoftTenantId?: string | undefined;
-            }> | undefined;
-        }) | undefined;
-    }) | undefined;
+            }>;
+        };
+    };
     emails: Omit<{
-        theme?: string | undefined;
-        themeList?: Record<string, {
+        selectedThemeId?: string | undefined;
+        themes: Record<string, {
             displayName: string;
             tsxSource: string;
-        }> | undefined;
-    }, never> & {
+        }>;
+        templates: Record<string, {
+            themeId?: string | false | undefined;
+            displayName: string;
+            tsxSource: string;
+        }>;
+    }, "server"> & {
         server: {
             host?: string | undefined;
             port?: number | undefined;
@@ -536,8 +693,9 @@ declare const organizationConfigSchema: yup.ObjectSchema<{
             senderEmail?: string | undefined;
         };
     };
-} & {}, yup.AnyObject, {
+}>, never> & {}, yup.AnyObject, Omit<NonNullable<Omit<NonNullable<Omit<Omit<{
     sourceOfTruth: undefined;
+}, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
     rbac: {
         permissions: undefined;
         defaultPermissions: {
@@ -560,7 +718,33 @@ declare const organizationConfigSchema: yup.ObjectSchema<{
         };
     };
     domains: {
+        allowLocalhost: undefined;
+    };
+    auth: {
+        allowSignUp: undefined;
+        password: {
+            allowSignIn: undefined;
+        };
+        otp: {
+            allowSignIn: undefined;
+        };
+        passkey: {
+            allowSignIn: undefined;
+        };
+        oauth: {
+            accountMergeStrategy: undefined;
+            providers: undefined;
+        };
+    };
+    emails: {
+        selectedThemeId: undefined;
+        themes: undefined;
+        templates: undefined;
+    };
+}>, "domains" | "auth" | "emails"> & {
+    auth: Omit<NonNullable<Omit<Omit<{
         sourceOfTruth: undefined;
+    }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
         rbac: {
             permissions: undefined;
             defaultPermissions: {
@@ -602,12 +786,66 @@ declare const organizationConfigSchema: yup.ObjectSchema<{
             };
         };
         emails: {
-            theme: undefined;
-            themeList: undefined;
+            selectedThemeId: undefined;
+            themes: undefined;
+            templates: undefined;
+        };
+    }>, "oauth"> & {
+        oauth: Omit<NonNullable<Omit<Omit<{
+            sourceOfTruth: undefined;
+        }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
+            rbac: {
+                permissions: undefined;
+                defaultPermissions: {
+                    teamCreator: undefined;
+                    teamMember: undefined;
+                    signUp: undefined;
+                };
+            };
+            teams: {
+                createPersonalTeamOnSignUp: undefined;
+                allowClientTeamCreation: undefined;
+            };
+            users: {
+                allowClientUserDeletion: undefined;
+            };
+            apiKeys: {
+                enabled: {
+                    team: undefined;
+                    user: undefined;
+                };
+            };
+            domains: {
+                allowLocalhost: undefined;
+            };
+            auth: {
+                allowSignUp: undefined;
+                password: {
+                    allowSignIn: undefined;
+                };
+                otp: {
+                    allowSignIn: undefined;
+                };
+                passkey: {
+                    allowSignIn: undefined;
+                };
+                oauth: {
+                    accountMergeStrategy: undefined;
+                    providers: undefined;
+                };
+            };
+            emails: {
+                selectedThemeId: undefined;
+                themes: undefined;
+                templates: undefined;
+            };
+        }>, "providers"> & {
+            providers: undefined;
         };
     };
-    auth: {
+    emails: Omit<NonNullable<Omit<Omit<{
         sourceOfTruth: undefined;
+    }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
         rbac: {
             permissions: undefined;
             defaultPermissions: {
@@ -649,12 +887,24 @@ declare const organizationConfigSchema: yup.ObjectSchema<{
             };
         };
         emails: {
-            theme: undefined;
-            themeList: undefined;
+            selectedThemeId: undefined;
+            themes: undefined;
+            templates: undefined;
+        };
+    }>, "server"> & {
+        server: {
+            isShared: undefined;
+            host: undefined;
+            port: undefined;
+            username: undefined;
+            password: undefined;
+            senderName: undefined;
+            senderEmail: undefined;
         };
     };
-    emails: {
+    domains: Omit<NonNullable<Omit<Omit<{
         sourceOfTruth: undefined;
+    }, string>, "domains" | "teams" | "rbac" | "apiKeys" | "auth" | "users" | "emails"> & {
         rbac: {
             permissions: undefined;
             defaultPermissions: {
@@ -696,72 +946,97 @@ declare const organizationConfigSchema: yup.ObjectSchema<{
             };
         };
         emails: {
-            theme: undefined;
-            themeList: undefined;
+            selectedThemeId: undefined;
+            themes: undefined;
+            templates: undefined;
         };
+    }>, "trustedDomains"> & {
+        trustedDomains: undefined;
     };
-}, "">;
+}>, never> & {}, "">;
+declare function migrateConfigOverride(type: "project" | "branch" | "environment" | "organization", oldUnmigratedConfigOverride: any): any;
 declare const projectConfigDefaults: {
-    sourceOfTruth: {
-        type: "hosted";
+    readonly sourceOfTruth: {
+        readonly type: "hosted";
+        readonly connectionStrings: undefined;
+        readonly connectionString: undefined;
     };
 };
 declare const branchConfigDefaults: {};
 declare const environmentConfigDefaults: {};
 declare const organizationConfigDefaults: {
-    rbac: {
-        permissions: (key: string) => {};
-        defaultPermissions: {
-            teamCreator: {};
-            teamMember: {};
-            signUp: {};
+    readonly rbac: {
+        readonly permissions: (key: string) => {
+            containedPermissionIds: (key: string) => undefined;
+            description: undefined;
+            scope: undefined;
+        };
+        readonly defaultPermissions: {
+            readonly teamCreator: (key: string) => undefined;
+            readonly teamMember: (key: string) => undefined;
+            readonly signUp: (key: string) => undefined;
         };
     };
-    apiKeys: {
-        enabled: {
-            team: false;
-            user: false;
+    readonly apiKeys: {
+        readonly enabled: {
+            readonly team: false;
+            readonly user: false;
         };
     };
-    teams: {
-        createPersonalTeamOnSignUp: false;
-        allowClientTeamCreation: false;
+    readonly teams: {
+        readonly createPersonalTeamOnSignUp: false;
+        readonly allowClientTeamCreation: false;
     };
-    users: {
-        allowClientUserDeletion: false;
+    readonly users: {
+        readonly allowClientUserDeletion: false;
     };
-    domains: {
-        allowLocalhost: false;
-        trustedDomains: (key: string) => {
-            handlerPath: string;
+    readonly domains: {
+        readonly allowLocalhost: false;
+        readonly trustedDomains: (key: string) => {
+            readonly baseUrl: undefined;
+            readonly handlerPath: "/handler";
         };
     };
-    auth: {
-        allowSignUp: true;
-        password: {
-            allowSignIn: false;
+    readonly auth: {
+        readonly allowSignUp: true;
+        readonly password: {
+            readonly allowSignIn: false;
         };
-        otp: {
-            allowSignIn: false;
+        readonly otp: {
+            readonly allowSignIn: false;
         };
-        passkey: {
-            allowSignIn: false;
+        readonly passkey: {
+            readonly allowSignIn: false;
         };
-        oauth: {
-            accountMergeStrategy: "link_method";
-            providers: (key: string) => {
+        readonly oauth: {
+            readonly accountMergeStrategy: "link_method";
+            readonly providers: (key: string) => {
+                type: undefined;
                 isShared: true;
                 allowSignIn: false;
                 allowConnectedAccounts: false;
+                clientId: undefined;
+                clientSecret: undefined;
+                facebookConfigId: undefined;
+                microsoftTenantId: undefined;
             };
         };
     };
-    emails: {
-        server: {
-            isShared: true;
-        };
-        theme: string;
-        themeList: {
+    readonly emails: {
+        readonly server: {
+            readonly isShared: true;
+            readonly host: undefined;
+            readonly port: undefined;
+            readonly username: undefined;
+            readonly password: undefined;
+            readonly senderName: undefined;
+            readonly senderEmail: undefined;
+        };
+        readonly selectedThemeId: "1df07ae6-abf3-4a40-83a5-a1a2cbe336ac";
+        readonly themes: ((key: string) => {
+            displayName: string;
+            tsxSource: string;
+        }) & {
             "1df07ae6-abf3-4a40-83a5-a1a2cbe336ac": {
                 displayName: string;
                 tsxSource: string;
@@ -771,39 +1046,286 @@ declare const organizationConfigDefaults: {
                 tsxSource: string;
             };
         };
+        readonly templates: ((key: string) => {
+            displayName: string;
+            tsxSource: string;
+            themeId: undefined;
+        }) & {
+            "e7d009ce-8d47-4528-b245-5bf119f2ffa3": {
+                displayName: string;
+                tsxSource: string;
+                themeId: undefined;
+            };
+            "a70fb3a4-56c1-4e42-af25-49d25603abd0": {
+                displayName: string;
+                tsxSource: string;
+                themeId: undefined;
+            };
+            "822687fe-8d0a-4467-a0d1-416b6e639478": {
+                displayName: string;
+                tsxSource: string;
+                themeId: undefined;
+            };
+            "e84de395-2076-4831-9c19-8e9a96a868e4": {
+                displayName: string;
+                tsxSource: string;
+                themeId: undefined;
+            };
+            "066dd73c-36da-4fd0-b6d6-ebf87683f8bc": {
+                displayName: string;
+                tsxSource: string;
+                themeId: undefined;
+            };
+        };
     };
 };
-type DeepReplaceAllowFunctionsForObjects<T> = T extends object ? {
-    [K in keyof T]: DeepReplaceAllowFunctionsForObjects<T[K]>;
-} | ((arg: keyof T) => DeepReplaceAllowFunctionsForObjects<T[keyof T]>) : T;
-type DeepReplaceFunctionsWithObjects<T> = T extends (arg: infer K extends string) => infer R ? DeepReplaceFunctionsWithObjects<Record<K, R>> : (T extends object ? {
-    [K in keyof T]: DeepReplaceFunctionsWithObjects<T[K]>;
-} : T);
-type ApplyDefaults<D extends object | ((key: string) => unknown), C extends object> = DeepMerge<DeepReplaceFunctionsWithObjects<D>, C>;
-declare function applyDefaults<D extends object | ((key: string) => unknown), C extends object>(defaults: D, config: C): ApplyDefaults<D, C>;
-type ProjectConfigNormalizedOverride = yup.InferType<typeof projectConfigSchema>;
-type BranchConfigNormalizedOverride = yup.InferType<typeof branchConfigSchema>;
-type EnvironmentConfigNormalizedOverride = yup.InferType<typeof environmentConfigSchema>;
-type OrganizationConfigNormalizedOverride = yup.InferType<typeof organizationConfigSchema>;
-type ProjectConfigStrippedNormalizedOverride = Omit<ProjectConfigNormalizedOverride, keyof BranchConfigNormalizedOverride | keyof EnvironmentConfigNormalizedOverride | keyof OrganizationConfigNormalizedOverride>;
-type BranchConfigStrippedNormalizedOverride = Omit<BranchConfigNormalizedOverride, keyof EnvironmentConfigNormalizedOverride | keyof OrganizationConfigNormalizedOverride>;
-type EnvironmentConfigStrippedNormalizedOverride = Omit<EnvironmentConfigNormalizedOverride, keyof OrganizationConfigNormalizedOverride>;
-type OrganizationConfigStrippedNormalizedOverride = OrganizationConfigNormalizedOverride;
+type ReplaceFunctionsWithObjects<T> = T & (T extends (arg: infer K extends string) => infer R ? Record<K, R> & object : unknown);
+type DeepReplaceFunctionsWithObjects<T> = T extends object ? {
+    [K in keyof ReplaceFunctionsWithObjects<T>]: DeepReplaceFunctionsWithObjects<ReplaceFunctionsWithObjects<T>[K]>;
+} : T;
+type ApplyDefaults<D extends object | ((key: string) => unknown), C extends object> = {} extends D ? C : DeepMerge<DeepReplaceFunctionsWithObjects<D>, C>;
+declare function applyProjectDefaults<T extends ProjectRenderedConfigBeforeDefaults>(config: T): DeepMerge<{
+    readonly sourceOfTruth: {
+        readonly type: "hosted";
+        readonly connectionStrings: undefined;
+        readonly connectionString: undefined;
+    };
+}, T>;
+declare function applyBranchDefaults<T extends BranchRenderedConfigBeforeDefaults>(config: T): DeepMerge<{
+    readonly sourceOfTruth: {
+        readonly type: "hosted";
+        readonly connectionStrings: undefined;
+        readonly connectionString: undefined;
+    };
+}, T>;
+declare function applyEnvironmentDefaults<T extends EnvironmentRenderedConfigBeforeDefaults>(config: T): ApplyDefaults<typeof environmentConfigDefaults, ApplyDefaults<typeof branchConfigDefaults, ApplyDefaults<typeof projectConfigDefaults, T>>>;
+declare function applyOrganizationDefaults(config: OrganizationRenderedConfigBeforeDefaults): ApplyDefaults<typeof organizationConfigDefaults, ApplyDefaults<typeof environmentConfigDefaults, ApplyDefaults<typeof branchConfigDefaults, ApplyDefaults<typeof projectConfigDefaults, OrganizationRenderedConfigBeforeDefaults>>>>;
+declare function sanitizeProjectConfig<T extends ProjectRenderedConfigBeforeSanitization>(config: T): Promise<T & {
+    sourceOfTruth: {
+        readonly type: "neon";
+        readonly connectionStrings: {
+            readonly [x: string]: string;
+        };
+        readonly connectionString?: undefined;
+    } | {
+        readonly type: "postgres";
+        readonly connectionString: string;
+        readonly connectionStrings?: undefined;
+    } | {
+        readonly type: "hosted";
+        readonly connectionStrings?: undefined;
+        readonly connectionString?: undefined;
+    };
+}>;
+declare function sanitizeBranchConfig<T extends BranchRenderedConfigBeforeSanitization>(config: T): Promise<T & {
+    sourceOfTruth: {
+        readonly type: "neon";
+        readonly connectionStrings: {
+            readonly [x: string]: string;
+        };
+        readonly connectionString?: undefined;
+    } | {
+        readonly type: "postgres";
+        readonly connectionString: string;
+        readonly connectionStrings?: undefined;
+    } | {
+        readonly type: "hosted";
+        readonly connectionStrings?: undefined;
+        readonly connectionString?: undefined;
+    };
+}>;
+declare function sanitizeEnvironmentConfig<T extends EnvironmentRenderedConfigBeforeSanitization>(config: T): Promise<T & {
+    sourceOfTruth: {
+        readonly type: "neon";
+        readonly connectionStrings: {
+            readonly [x: string]: string;
+        };
+        readonly connectionString?: undefined;
+    } | {
+        readonly type: "postgres";
+        readonly connectionString: string;
+        readonly connectionStrings?: undefined;
+    } | {
+        readonly type: "hosted";
+        readonly connectionStrings?: undefined;
+        readonly connectionString?: undefined;
+    };
+}>;
+declare function sanitizeOrganizationConfig(config: OrganizationRenderedConfigBeforeSanitization): Promise<{
+    emails: {
+        selectedThemeId: string;
+        themes: {
+            [x: string]: {
+                displayName: string;
+                tsxSource: string;
+            };
+        };
+        templates: {
+            [x: string]: {
+                displayName: string;
+                tsxSource: string;
+                themeId: string | false | undefined;
+            };
+        };
+        server: {
+            host: string | undefined;
+            port: number | undefined;
+            username: string | undefined;
+            password: string | undefined;
+            isShared: boolean;
+            senderName: string | undefined;
+            senderEmail: string | undefined;
+        };
+    };
+    sourceOfTruth: {
+        type: "hosted" | "neon" | "postgres";
+        connectionStrings: {
+            [x: string]: string | undefined;
+        } | undefined;
+        connectionString: string | undefined;
+    } & ({
+        readonly type: "neon";
+        readonly connectionStrings: {
+            readonly [x: string]: string;
+        };
+        readonly connectionString?: undefined;
+    } | {
+        readonly type: "postgres";
+        readonly connectionString: string;
+        readonly connectionStrings?: undefined;
+    } | {
+        readonly type: "hosted";
+        readonly connectionStrings?: undefined;
+        readonly connectionString?: undefined;
+    });
+    domains: {
+        allowLocalhost: boolean;
+        trustedDomains: {
+            [x: string]: {
+                baseUrl: string | undefined;
+                handlerPath: string;
+            };
+        };
+    };
+    teams: {
+        createPersonalTeamOnSignUp: boolean;
+        allowClientTeamCreation: boolean;
+    };
+    rbac: {
+        permissions: {
+            [x: string]: {
+                description: string | undefined;
+                scope: "team" | "project" | undefined;
+                containedPermissionIds: {
+                    [x: string]: true | undefined;
+                };
+            };
+        };
+        defaultPermissions: {
+            teamCreator: {
+                [x: string]: true | undefined;
+            };
+            teamMember: {
+                [x: string]: true | undefined;
+            };
+            signUp: {
+                [x: string]: true | undefined;
+            };
+        };
+    };
+    apiKeys: {
+        enabled: {
+            user: boolean;
+            team: boolean;
+        };
+    };
+    auth: {
+        password: {
+            allowSignIn: boolean;
+        };
+        allowSignUp: boolean;
+        otp: {
+            allowSignIn: boolean;
+        };
+        passkey: {
+            allowSignIn: boolean;
+        };
+        oauth: {
+            accountMergeStrategy: "link_method" | "raise_error" | "allow_duplicates";
+            providers: {
+                [x: string]: {
+                    type: "google" | "github" | "microsoft" | "spotify" | "facebook" | "discord" | "gitlab" | "bitbucket" | "linkedin" | "apple" | "x" | "twitch" | undefined;
+                    clientId: string | undefined;
+                    clientSecret: string | undefined;
+                    allowSignIn: boolean;
+                    allowConnectedAccounts: boolean;
+                    isShared: boolean;
+                    facebookConfigId: string | undefined;
+                    microsoftTenantId: string | undefined;
+                };
+            };
+        };
+    };
+    users: {
+        allowClientUserDeletion: boolean;
+    };
+}>;
+/**
+ * Does not require a base config, and hence solely relies on the override itself to validate the config. If it returns
+ * no error, you know that the
+ *
+ * It's crucial that our DB never contains any configs that are not valid according to this function, as this would mean
+ * that the config object does not satisfy the ValidatedToHaveNoConfigOverrideErrors type (which is used as an assumption
+ * in a whole bunch of places in the code).
+ */
+declare function getConfigOverrideErrors<T extends yup.AnySchema>(schema: T, configOverride: unknown, options?: {
+    allowPropertiesThatCanNoLongerBeOverridden?: boolean;
+}): Promise<Result<null, string>>;
+declare function assertNoConfigOverrideErrors<T extends yup.AnySchema>(schema: T, config: unknown, options?: {
+    allowPropertiesThatCanNoLongerBeOverridden?: boolean;
+    extraInfo?: any;
+}): Promise<void>;
+type _ValidatedToHaveNoConfigOverrideErrorsImpl<T> = IsUnion<T & object> extends true ? _ValidatedToHaveNoConfigOverrideErrorsImpl<CollapseObjectUnion<T & object> | Exclude<T, object>> : T extends object ? (T extends any[] ? T : {
+    [K in keyof T]+?: _ValidatedToHaveNoConfigOverrideErrorsImpl<T[K]>;
+}) : T;
+type ValidatedToHaveNoConfigOverrideErrors<T extends yup.AnySchema> = _ValidatedToHaveNoConfigOverrideErrorsImpl<yup.InferType<T>>;
+/**
+ * Checks whether there are any warnings in the incomplete config. A warning doesn't stop the config from being valid,
+ * but may require action regardless.
+ *
+ * The DB can contain configs that are not valid according to this function, as long as they are valid according to
+ * the getConfigOverrideErrors function. (This is necessary, because a changing base config may make an override invalid
+ * that was previously valid.)
+ */
+declare function getIncompleteConfigWarnings<T extends yup.AnySchema>(schema: T, incompleteConfig: Config): Promise<Result<null, string>>;
+type ValidatedToHaveNoIncompleteConfigWarnings<T extends yup.AnySchema> = yup.InferType<T>;
+type ProjectConfigNormalizedOverride = Expand<ValidatedToHaveNoConfigOverrideErrors<typeof projectConfigSchema>>;
+type BranchConfigNormalizedOverride = Expand<ValidatedToHaveNoConfigOverrideErrors<typeof branchConfigSchema>>;
+type EnvironmentConfigNormalizedOverride = Expand<ValidatedToHaveNoConfigOverrideErrors<typeof environmentConfigSchema>>;
+type OrganizationConfigNormalizedOverride = Expand<ValidatedToHaveNoConfigOverrideErrors<typeof organizationConfigSchema>>;
 type ProjectConfigOverride = NormalizesTo<ProjectConfigNormalizedOverride>;
 type BranchConfigOverride = NormalizesTo<BranchConfigNormalizedOverride>;
 type EnvironmentConfigOverride = NormalizesTo<EnvironmentConfigNormalizedOverride>;
 type OrganizationConfigOverride = NormalizesTo<OrganizationConfigNormalizedOverride>;
-type ProjectConfigOverrideOverride = Config & DeepPartial<ProjectConfigOverride>;
-type BranchConfigOverrideOverride = Config & DeepPartial<BranchConfigOverride>;
-type EnvironmentConfigOverrideOverride = Config & DeepPartial<EnvironmentConfigOverride>;
-type OrganizationConfigOverrideOverride = Config & DeepPartial<OrganizationConfigOverride>;
-type ProjectIncompleteConfig = ApplyDefaults<typeof projectConfigDefaults, ProjectConfigNormalizedOverride>;
-type BranchIncompleteConfig = ApplyDefaults<typeof branchConfigDefaults, ProjectIncompleteConfig & BranchConfigNormalizedOverride>;
-type EnvironmentIncompleteConfig = ApplyDefaults<typeof environmentConfigDefaults, BranchIncompleteConfig & EnvironmentConfigNormalizedOverride>;
-type OrganizationIncompleteConfig = ApplyDefaults<typeof organizationConfigDefaults, EnvironmentIncompleteConfig & OrganizationConfigNormalizedOverride>;
-type ProjectRenderedConfig = Omit<ProjectIncompleteConfig, keyof BranchConfigNormalizedOverride | keyof EnvironmentConfigNormalizedOverride | keyof OrganizationConfigNormalizedOverride>;
-type BranchRenderedConfig = Omit<BranchIncompleteConfig, keyof EnvironmentConfigNormalizedOverride | keyof OrganizationConfigNormalizedOverride>;
-type EnvironmentRenderedConfig = Omit<EnvironmentIncompleteConfig, keyof OrganizationConfigNormalizedOverride>;
-type OrganizationRenderedConfig = OrganizationIncompleteConfig;
+type ProjectConfigOverrideOverride = ProjectConfigOverride;
+type BranchConfigOverrideOverride = BranchConfigOverride;
+type EnvironmentConfigOverrideOverride = EnvironmentConfigOverride;
+type OrganizationConfigOverrideOverride = OrganizationConfigOverride;
+type ProjectIncompleteConfig = Expand<ProjectConfigNormalizedOverride>;
+type BranchIncompleteConfig = Expand<ProjectIncompleteConfig & BranchConfigNormalizedOverride>;
+type EnvironmentIncompleteConfig = Expand<BranchIncompleteConfig & EnvironmentConfigNormalizedOverride>;
+type OrganizationIncompleteConfig = Expand<EnvironmentIncompleteConfig & OrganizationConfigNormalizedOverride>;
+type ProjectRenderedConfigBeforeDefaults = Omit<ProjectIncompleteConfig, keyof BranchConfigNormalizedOverride | keyof EnvironmentConfigNormalizedOverride | keyof OrganizationConfigNormalizedOverride>;
+type BranchRenderedConfigBeforeDefaults = Omit<BranchIncompleteConfig, keyof EnvironmentConfigNormalizedOverride | keyof OrganizationConfigNormalizedOverride>;
+type EnvironmentRenderedConfigBeforeDefaults = Omit<EnvironmentIncompleteConfig, keyof OrganizationConfigNormalizedOverride>;
+type OrganizationRenderedConfigBeforeDefaults = OrganizationIncompleteConfig;
+type ProjectRenderedConfigBeforeSanitization = Expand<Awaited<ReturnType<typeof applyProjectDefaults<ProjectRenderedConfigBeforeDefaults>>>>;
+type BranchRenderedConfigBeforeSanitization = Expand<Awaited<ReturnType<typeof applyBranchDefaults<BranchRenderedConfigBeforeDefaults>>>>;
+type EnvironmentRenderedConfigBeforeSanitization = Expand<Awaited<ReturnType<typeof applyEnvironmentDefaults<EnvironmentRenderedConfigBeforeDefaults>>>>;
+type OrganizationRenderedConfigBeforeSanitization = Expand<Awaited<ReturnType<typeof applyOrganizationDefaults>>>;
+type ProjectRenderedConfig = Expand<Awaited<ReturnType<typeof sanitizeProjectConfig<ProjectRenderedConfigBeforeSanitization>>>>;
+type BranchRenderedConfig = Expand<Awaited<ReturnType<typeof sanitizeBranchConfig<BranchRenderedConfigBeforeSanitization>>>>;
+type EnvironmentRenderedConfig = Expand<Awaited<ReturnType<typeof sanitizeEnvironmentConfig<EnvironmentRenderedConfigBeforeSanitization>>>>;
+type OrganizationRenderedConfig = Expand<Awaited<ReturnType<typeof sanitizeOrganizationConfig>>>;
 
-export { type ApplyDefaults, type BranchConfigNormalizedOverride, type BranchConfigOverride, type BranchConfigOverrideOverride, type BranchConfigStrippedNormalizedOverride, type BranchIncompleteConfig, type BranchRenderedConfig, type ConfigLevel, type DeepReplaceAllowFunctionsForObjects, type DeepReplaceFunctionsWithObjects, type EnvironmentConfigNormalizedOverride, type EnvironmentConfigOverride, type EnvironmentConfigOverrideOverride, type EnvironmentConfigStrippedNormalizedOverride, type EnvironmentIncompleteConfig, type EnvironmentRenderedConfig, type OrganizationConfigNormalizedOverride, type OrganizationConfigOverride, type OrganizationConfigOverrideOverride, type OrganizationConfigStrippedNormalizedOverride, type OrganizationIncompleteConfig, type OrganizationRenderedConfig, type ProjectConfigNormalizedOverride, type ProjectConfigOverride, type ProjectConfigOverrideOverride, type ProjectConfigStrippedNormalizedOverride, type ProjectIncompleteConfig, type ProjectRenderedConfig, applyDefaults, branchConfigDefaults, branchConfigSchema, configLevels, environmentConfigDefaults, environmentConfigSchema, organizationConfigDefaults, organizationConfigSchema, projectConfigDefaults, projectConfigSchema };
+export { type BranchConfigOverride, type BranchConfigOverrideOverride, type BranchIncompleteConfig, type BranchRenderedConfig, type ConfigLevel, type EnvironmentConfigOverride, type EnvironmentConfigOverrideOverride, type EnvironmentIncompleteConfig, type EnvironmentRenderedConfig, type OrganizationConfigOverride, type OrganizationConfigOverrideOverride, type OrganizationIncompleteConfig, type OrganizationRenderedConfig, type ProjectConfigOverride, type ProjectConfigOverrideOverride, type ProjectIncompleteConfig, type ProjectRenderedConfig, type ValidatedToHaveNoConfigOverrideErrors, type ValidatedToHaveNoIncompleteConfigWarnings, applyBranchDefaults, applyEnvironmentDefaults, applyOrganizationDefaults, applyProjectDefaults, assertNoConfigOverrideErrors, branchConfigSchema, configLevels, environmentConfigSchema, getConfigOverrideErrors, getIncompleteConfigWarnings, migrateConfigOverride, organizationConfigSchema, projectConfigSchema, sanitizeBranchConfig, sanitizeEnvironmentConfig, sanitizeOrganizationConfig, sanitizeProjectConfig };