@terreno/mcp 0.24.0 → 0.26.0

package/src/docs/versioned/0.24.0/reference/generated/api/README.md

@@ -0,0 +1,282 @@
+## Classes
+
+- [APIError](classes/APIError.md)
+- [BetterAuthApp](classes/BetterAuthApp.md)
+- [CachingSecretProvider](classes/CachingSecretProvider.md)
+- [CompositeSecretProvider](classes/CompositeSecretProvider.md)
+- [ConfigurationApp](classes/ConfigurationApp.md)
+- [ConsentApp](classes/ConsentApp.md)
+- [DateOnly](classes/DateOnly.md)
+- [EnvSecretProvider](classes/EnvSecretProvider.md)
+- [GcpSecretProvider](classes/GcpSecretProvider.md)
+- [OpenApiMiddlewareBuilder](classes/OpenApiMiddlewareBuilder.md)
+- [RealtimeApp](classes/RealtimeApp.md)
+- [TaskCancelledError](classes/TaskCancelledError.md)
+- [TerrenoApp](classes/TerrenoApp.md)
+- [VersionCheckPlugin](classes/VersionCheckPlugin.md)
+
+## Interfaces
+
+- [ActionContext](interfaces/ActionContext.md)
+- [APIErrorConstructor](interfaces/APIErrorConstructor.md)
+- [AsyncHandlerOptions](interfaces/AsyncHandlerOptions.md)
+- [AuthOptions](interfaces/AuthOptions.md)
+- [BackgroundTaskDocument](interfaces/BackgroundTaskDocument.md)
+- [BackgroundTaskMethods](interfaces/BackgroundTaskMethods.md)
+- [BackgroundTaskModel](interfaces/BackgroundTaskModel.md)
+- [BackgroundTaskStatics](interfaces/BackgroundTaskStatics.md)
+- [BaseUser](interfaces/BaseUser.md)
+- [BetterAuthAppOptions](interfaces/BetterAuthAppOptions.md)
+- [BetterAuthConfig](interfaces/BetterAuthConfig.md)
+- [BetterAuthOAuthProvider](interfaces/BetterAuthOAuthProvider.md)
+- [BetterAuthSession](interfaces/BetterAuthSession.md)
+- [BetterAuthSessionData](interfaces/BetterAuthSessionData.md)
+- [BetterAuthUser](interfaces/BetterAuthUser.md)
+- [CachingSecretProviderOptions](interfaces/CachingSecretProviderOptions.md)
+- [ChangeStreamConfig](interfaces/ChangeStreamConfig.md)
+- [CollectionActionConfig](interfaces/CollectionActionConfig.md)
+- [ConfigRegistration](interfaces/ConfigRegistration.md)
+- [ConfigurationAppOptions](interfaces/ConfigurationAppOptions.md)
+- [ConfigurationMetaResponse](interfaces/ConfigurationMetaResponse.md)
+- [ConfigurationModel](interfaces/ConfigurationModel.md)
+- [ConfigurationPermissions](interfaces/ConfigurationPermissions.md)
+- [ConfigurationPluginOptions](interfaces/ConfigurationPluginOptions.md)
+- [ConfigurationStatics](interfaces/ConfigurationStatics.md)
+- [ConsentAppOptions](interfaces/ConsentAppOptions.md)
+- [ConsentFormCheckbox](interfaces/ConsentFormCheckbox.md)
+- [ConsentFormDefinition](interfaces/ConsentFormDefinition.md)
+- [ConsentFormDocument](interfaces/ConsentFormDocument.md)
+- [ConsentFormModel](interfaces/ConsentFormModel.md)
+- [ConsentFormStatics](interfaces/ConsentFormStatics.md)
+- [ConsentResponseDocument](interfaces/ConsentResponseDocument.md)
+- [ConsentResponseMethods](interfaces/ConsentResponseMethods.md)
+- [ConsentResponseModel](interfaces/ConsentResponseModel.md)
+- [ConsentResponseStatics](interfaces/ConsentResponseStatics.md)
+- [CreateBetterAuthOptions](interfaces/CreateBetterAuthOptions.md)
+- [CreatedDeleted](interfaces/CreatedDeleted.md)
+- [CreateFeatureFlaggedLoggerOptions](interfaces/CreateFeatureFlaggedLoggerOptions.md)
+- [CreateScopedLoggerOptions](interfaces/CreateScopedLoggerOptions.md)
+- [CreateValidatorOptions](interfaces/CreateValidatorOptions.md)
+- [DocumentSubscription](interfaces/DocumentSubscription.md)
+- [FindExactlyOnePlugin](interfaces/FindExactlyOnePlugin.md)
+- [FindOneOrNonePlugin](interfaces/FindOneOrNonePlugin.md)
+- [GcpSecretProviderOptions](interfaces/GcpSecretProviderOptions.md)
+- [GenerateTokensOptions](interfaces/GenerateTokensOptions.md)
+- [GitHubAuthOptions](interfaces/GitHubAuthOptions.md)
+- [GitHubUserFields](interfaces/GitHubUserFields.md)
+- [HasUpsert](interfaces/HasUpsert.md)
+- [InstanceActionConfig](interfaces/InstanceActionConfig.md)
+- [IsDeleted](interfaces/IsDeleted.md)
+- [JSONArray](interfaces/JSONArray.md)
+- [JSONObject](interfaces/JSONObject.md)
+- [JwtSessionPayload](interfaces/JwtSessionPayload.md)
+- [LogContextFields](interfaces/LogContextFields.md)
+- [LoggingOptions](interfaces/LoggingOptions.md)
+- [ModelRouterOptions](interfaces/ModelRouterOptions.md)
+- [ModelRouterRegistration](interfaces/ModelRouterRegistration.md)
+- [ModelRouterValidationOptions](interfaces/ModelRouterValidationOptions.md)
+- [MongoClientLike](interfaces/MongoClientLike.md)
+- [OpenApiBuildResult](interfaces/OpenApiBuildResult.md)
+- [OpenApiMiddleware](interfaces/OpenApiMiddleware.md)
+- [OpenApiParameter](interfaces/OpenApiParameter.md)
+- [OpenApiResponse](interfaces/OpenApiResponse.md)
+- [OpenApiSchema](interfaces/OpenApiSchema.md)
+- [OpenApiSchemaProperty](interfaces/OpenApiSchemaProperty.md)
+- [OpenApiValidatorConfig](interfaces/OpenApiValidatorConfig.md)
+- [PopulatePath](interfaces/PopulatePath.md)
+- [QuerySubscription](interfaces/QuerySubscription.md)
+- [QueryValidatorOptions](interfaces/QueryValidatorOptions.md)
+- [RealtimeAppOptions](interfaces/RealtimeAppOptions.md)
+- [RealtimeConfig](interfaces/RealtimeConfig.md)
+- [RealtimeEvent](interfaces/RealtimeEvent.md)
+- [RealtimeRegistryEntry](interfaces/RealtimeRegistryEntry.md)
+- [RealtimeSocketLike](interfaces/RealtimeSocketLike.md)
+- [RequestBodyValidatorOptions](interfaces/RequestBodyValidatorOptions.md)
+- [RequestContext](interfaces/RequestContext.md)
+- [RESTPermissions](interfaces/RESTPermissions.md)
+- [ScopedLogger](interfaces/ScopedLogger.md)
+- [ScriptArgDef](interfaces/ScriptArgDef.md)
+- [ScriptArgs](interfaces/ScriptArgs.md)
+- [ScriptContext](interfaces/ScriptContext.md)
+- [ScriptResult](interfaces/ScriptResult.md)
+- [SecretFieldMeta](interfaces/SecretFieldMeta.md)
+- [SecretProvider](interfaces/SecretProvider.md)
+- [SyncConsentsOptions](interfaces/SyncConsentsOptions.md)
+- [SyncConsentsResult](interfaces/SyncConsentsResult.md)
+- [TerrenoAppOptions](interfaces/TerrenoAppOptions.md)
+- [TerrenoPlugin](interfaces/TerrenoPlugin.md)
+- [TerrenoRequestLogEntry](interfaces/TerrenoRequestLogEntry.md)
+- [TerrenoTransformer](interfaces/TerrenoTransformer.md)
+- [User](interfaces/User.md)
+- [UserModel](interfaces/UserModel.md)
+- [VersionCheckResponse](interfaces/VersionCheckResponse.md)
+- [VersionConfigDocument](interfaces/VersionConfigDocument.md)
+- [VersionConfigModel](interfaces/VersionConfigModel.md)
+- [WrapScriptOptions](interfaces/WrapScriptOptions.md)
+
+## Type Aliases
+
+- [AddRoutes](type-aliases/AddRoutes.md)
+- [AuthProvider](type-aliases/AuthProvider.md)
+- [BetterAuthInstance](type-aliases/BetterAuthInstance.md)
+- [ConfigType](type-aliases/ConfigType.md)
+- [ConfigurationPostUpdateHook](type-aliases/ConfigurationPostUpdateHook.md)
+- [ConfigurationPreUpdateHook](type-aliases/ConfigurationPreUpdateHook.md)
+- [ConsentFormMethods](type-aliases/ConsentFormMethods.md)
+- [ConsentFormType](type-aliases/ConsentFormType.md)
+- [DeepPartial](type-aliases/DeepPartial.md)
+- [GooseRESTOptions](type-aliases/GooseRESTOptions.md)
+- [JSONPrimitive](type-aliases/JSONPrimitive.md)
+- [JSONValue](type-aliases/JSONValue.md)
+- [Paths](type-aliases/Paths.md)
+- [PathValue](type-aliases/PathValue.md)
+- [PermissionMethod](type-aliases/PermissionMethod.md)
+- [RequestContextAttributes](type-aliases/RequestContextAttributes.md)
+- [RESTMethod](type-aliases/RESTMethod.md)
+- [ScriptArgValue](type-aliases/ScriptArgValue.md)
+- [ScriptRunner](type-aliases/ScriptRunner.md)
+- [VersionCheckStatus](type-aliases/VersionCheckStatus.md)
+
+## Variables
+
+- [ACTION\_NAME\_PATTERN](variables/ACTION_NAME_PATTERN.md)
+- [BackgroundTask](variables/BackgroundTask.md)
+- [Config](variables/Config.md)
+- [ConsentForm](variables/ConsentForm.md)
+- [ConsentResponse](variables/ConsentResponse.md)
+- [consentResponsePopulatePaths](variables/consentResponsePopulatePaths.md)
+- [gooseRestRouter](variables/gooseRestRouter.md)
+- [logger](variables/logger.md)
+- [MAX\_DOCUMENT\_SUBSCRIPTIONS](variables/MAX_DOCUMENT_SUBSCRIPTIONS.md)
+- [MAX\_MODEL\_SUBSCRIPTIONS](variables/MAX_MODEL_SUBSCRIPTIONS.md)
+- [MAX\_QUERY\_SUBSCRIPTIONS](variables/MAX_QUERY_SUBSCRIPTIONS.md)
+- [Permissions](variables/Permissions.md)
+- [REQUEST\_CONTEXT\_ATTRIBUTE\_NAMES](variables/REQUEST_CONTEXT_ATTRIBUTE_NAMES.md)
+- [VersionConfig](variables/VersionConfig.md)
+- [winstonLogger](variables/winstonLogger.md)
+
+## Functions
+
+- [addAuthRoutes](functions/addAuthRoutes.md)
+- [addGitHubAuthRoutes](functions/addGitHubAuthRoutes.md)
+- [addMeRoutes](functions/addMeRoutes.md)
+- [addPopulateToQuery](functions/addPopulateToQuery.md)
+- [addQuerySubscription](functions/addQuerySubscription.md)
+- [AdminOwnerTransformer](functions/AdminOwnerTransformer.md)
+- [apiErrorMiddleware](functions/apiErrorMiddleware.md)
+- [apiFallthroughErrorMiddleware](functions/apiFallthroughErrorMiddleware.md)
+- [apiUnauthorizedMiddleware](functions/apiUnauthorizedMiddleware.md)
+- [applyRequestContextToSentry](functions/applyRequestContextToSentry.md)
+- [assertNoActionCollisions](functions/assertNoActionCollisions.md)
+- [asyncHandler](functions/asyncHandler.md)
+- [authenticateMiddleware](functions/authenticateMiddleware.md)
+- [baseUserPlugin](functions/baseUserPlugin.md)
+- [buildQuerySchemaFromFields](functions/buildQuerySchemaFromFields.md)
+- [checkModelsStrict](functions/checkModelsStrict.md)
+- [checkPermissions](functions/checkPermissions.md)
+- [clearQueryStore](functions/clearQueryStore.md)
+- [clearRealtimeRegistry](functions/clearRealtimeRegistry.md)
+- [computeQueryId](functions/computeQueryId.md)
+- [configurationPlugin](functions/configurationPlugin.md)
+- [configureOpenApiValidator](functions/configureOpenApiValidator.md)
+- [createActionOpenApiMiddleware](functions/createActionOpenApiMiddleware.md)
+- [createBetterAuth](functions/createBetterAuth.md)
+- [createBetterAuthSessionMiddleware](functions/createBetterAuthSessionMiddleware.md)
+- [createdUpdatedPlugin](functions/createdUpdatedPlugin.md)
+- [createFeatureFlaggedLogger](functions/createFeatureFlaggedLogger.md)
+- [createModelValidators](functions/createModelValidators.md)
+- [createOpenApiBuilder](functions/createOpenApiBuilder.md)
+- [createRouter](functions/createRouter.md)
+- [createRouterWithAuth](functions/createRouterWithAuth.md)
+- [createScopedLogger](functions/createScopedLogger.md)
+- [createScriptArgs](functions/createScriptArgs.md)
+- [createValidator](functions/createValidator.md)
+- [cronjob](functions/cronjob.md)
+- [defaultResponseHandler](functions/defaultResponseHandler.md)
+- [defineCollectionAction](functions/defineCollectionAction.md)
+- [defineInstanceAction](functions/defineInstanceAction.md)
+- [envConfigurationPlugin](functions/envConfigurationPlugin.md)
+- [errorMessage](functions/errorMessage.md)
+- [errorsPlugin](functions/errorsPlugin.md)
+- [errorStack](functions/errorStack.md)
+- [findExactlyOne](functions/findExactlyOne.md)
+- [findOneOrNone](functions/findOneOrNone.md)
+- [findOneOrNoneFor](functions/findOneOrNoneFor.md)
+- [findRegistryEntryByCollection](functions/findRegistryEntryByCollection.md)
+- [findRegistryEntryByRoutePath](functions/findRegistryEntryByRoutePath.md)
+- [firebaseJWTPlugin](functions/firebaseJWTPlugin.md)
+- [fixMixedFields](functions/fixMixedFields.md)
+- [flattenToDotPaths](functions/flattenToDotPaths.md)
+- [formatLogContextSuffix](functions/formatLogContextSuffix.md)
+- [generateTokens](functions/generateTokens.md)
+- [getAPIErrorBody](functions/getAPIErrorBody.md)
+- [getBetterAuthSession](functions/getBetterAuthSession.md)
+- [getCurrentLogContext](functions/getCurrentLogContext.md)
+- [getCurrentRequestContext](functions/getCurrentRequestContext.md)
+- [getCurrentRequestContextAttributes](functions/getCurrentRequestContextAttributes.md)
+- [getDisableExternalErrorTracking](functions/getDisableExternalErrorTracking.md)
+- [getMongoClientFromMongoose](functions/getMongoClientFromMongoose.md)
+- [getOpenApiSpecForModel](functions/getOpenApiSpecForModel.md)
+- [getOpenApiValidatorConfig](functions/getOpenApiValidatorConfig.md)
+- [getQuerySubscriptionsForCollection](functions/getQuerySubscriptionsForCollection.md)
+- [getRealtimeRegistry](functions/getRealtimeRegistry.md)
+- [getRequestContextFromAttributes](functions/getRequestContextFromAttributes.md)
+- [getSchemaFromModel](functions/getSchemaFromModel.md)
+- [getSessionIdFromJwtPayload](functions/getSessionIdFromJwtPayload.md)
+- [githubUserPlugin](functions/githubUserPlugin.md)
+- [hasBetterAuthSession](functions/hasBetterAuthSession.md)
+- [installRealtimeSocketHandlers](functions/installRealtimeSocketHandlers.md)
+- [isAPIError](functions/isAPIError.md)
+- [isDeletedPlugin](functions/isDeletedPlugin.md)
+- [isDisabledPlugin](functions/isDisabledPlugin.md)
+- [isOpenApiValidatorConfigured](functions/isOpenApiValidatorConfigured.md)
+- [isValidObjectId](functions/isValidObjectId.md)
+- [jsonResponseRequestIdMiddleware](functions/jsonResponseRequestIdMiddleware.md)
+- [logRequests](functions/logRequests.md)
+- [matchesQuery](functions/matchesQuery.md)
+- [modelRouter](functions/modelRouter.md)
+- [mongooseErrorToAPIError](functions/mongooseErrorToAPIError.md)
+- [mountBetterAuthRoutes](functions/mountBetterAuthRoutes.md)
+- [openApiCompatMiddleware](functions/openApiCompatMiddleware.md)
+- [openApiEtagMiddleware](functions/openApiEtagMiddleware.md)
+- [OwnerQueryFilter](functions/OwnerQueryFilter.md)
+- [parseScriptArgs](functions/parseScriptArgs.md)
+- [patchAppUse](functions/patchAppUse.md)
+- [permissionMiddleware](functions/permissionMiddleware.md)
+- [registerActionRoutes](functions/registerActionRoutes.md)
+- [registerRealtime](functions/registerRealtime.md)
+- [removeAllSocketQueries](functions/removeAllSocketQueries.md)
+- [removeQuerySubscription](functions/removeQuerySubscription.md)
+- [requestContextMiddleware](functions/requestContextMiddleware.md)
+- [resetOpenApiValidatorConfig](functions/resetOpenApiValidatorConfig.md)
+- [runActionPermissions](functions/runActionPermissions.md)
+- [runWithRequestContext](functions/runWithRequestContext.md)
+- [runWithRequestContextAttributes](functions/runWithRequestContextAttributes.md)
+- [sendToGoogleChat](functions/sendToGoogleChat.md)
+- [sendToSlack](functions/sendToSlack.md)
+- [sendToZoom](functions/sendToZoom.md)
+- [sentryAppVersionMiddleware](functions/sentryAppVersionMiddleware.md)
+- [serialize](functions/serialize.md)
+- [setRequestContext](functions/setRequestContext.md)
+- [setupAuth](functions/setupAuth.md)
+- [setupBetterAuthUserSync](functions/setupBetterAuthUserSync.md)
+- [setupEnvironment](functions/setupEnvironment.md)
+- [setupGitHubAuth](functions/setupGitHubAuth.md)
+- [setupLogging](functions/setupLogging.md)
+- [signupUser](functions/signupUser.md)
+- [startChangeStreamWatcher](functions/startChangeStreamWatcher.md)
+- [stopChangeStreamWatcher](functions/stopChangeStreamWatcher.md)
+- [syncBetterAuthUser](functions/syncBetterAuthUser.md)
+- [syncConsents](functions/syncConsents.md)
+- [timeout](functions/timeout.md)
+- [transform](functions/transform.md)
+- [unpopulate](functions/unpopulate.md)
+- [updateRequestContextFromRequest](functions/updateRequestContextFromRequest.md)
+- [upsertPlugin](functions/upsertPlugin.md)
+- [validateActionRequest](functions/validateActionRequest.md)
+- [validateModelRequestBody](functions/validateModelRequestBody.md)
+- [validateQueryParams](functions/validateQueryParams.md)
+- [validateRequestBody](functions/validateRequestBody.md)
+- [validateResponseData](functions/validateResponseData.md)
+- [wrapActionResponse](functions/wrapActionResponse.md)
+- [wrapScript](functions/wrapScript.md)

package/src/docs/versioned/0.24.0/reference/generated/api/classes/CachingSecretProvider.md

@@ -0,0 +1,118 @@
+Secret provider that wraps any provider with an in-memory TTL cache.
+
+Cache entries are keyed by `secretName@version` so that pinned versions are
+cached independently. `null` results (secret not found) are cached too, to
+avoid hammering the underlying provider for missing secrets. Secret values are
+never logged.
+
+Use `clear()` to drop the entire cache (e.g. on rotation) or `clearKey()` to
+invalidate a single secret.
+
+## Example
+
+```typescript
+const provider = new CachingSecretProvider(
+  new CompositeSecretProvider([gcp, env]),
+  {ttlMs: 30_000}
+);
+```
+
+## Implements
+
+- [`SecretProvider`](../interfaces/SecretProvider.md)
+
+## Constructors
+
+### Constructor
+
+> **new CachingSecretProvider**(`provider`, `options?`): `CachingSecretProvider`
+
+#### Parameters
+
+##### provider
+
+[`SecretProvider`](../interfaces/SecretProvider.md)
+
+##### options?
+
+[`CachingSecretProviderOptions`](../interfaces/CachingSecretProviderOptions.md)
+
+#### Returns
+
+`CachingSecretProvider`
+
+## Properties
+
+### name
+
+> **name**: `string`
+
+#### Implementation of
+
+[`SecretProvider`](../interfaces/SecretProvider.md).[`name`](../interfaces/SecretProvider.md#name)
+
+## Methods
+
+### clear()
+
+> **clear**(): `void`
+
+Clears the entire cache. Useful on secret rotation and in tests.
+
+#### Returns
+
+`void`
+
+***
+
+### clearKey()
+
+> **clearKey**(`secretName`, `version?`): `void`
+
+Invalidates a single cached secret by name (and optional version).
+
+#### Parameters
+
+##### secretName
+
+`string`
+
+##### version?
+
+`string`
+
+#### Returns
+
+`void`
+
+***
+
+### getSecret()
+
+> **getSecret**(`secretName`, `version?`): `Promise`\<`string` \| `null`\>
+
+Resolve a secret value by name. Returns `null` when the secret is not found.
+
+#### Parameters
+
+##### secretName
+
+`string`
+
+The secret identifier (short name or provider-specific path).
+
+##### version?
+
+`string`
+
+Optional version to pin resolution to. Providers that do not
+  support versioning (e.g. environment variables) ignore this parameter. When
+  omitted, the latest version is resolved.
+
+#### Returns
+
+`Promise`\<`string` \| `null`\>
+
+#### Implementation of
+
+[`SecretProvider`](../interfaces/SecretProvider.md).[`getSecret`](../interfaces/SecretProvider.md#getsecret)

package/src/docs/versioned/0.24.0/reference/generated/api/classes/CompositeSecretProvider.md

@@ -0,0 +1,79 @@
+Secret provider that delegates to an ordered list of providers, returning the
+first non-null result.
+
+A provider that throws is warn-logged (secret name only — never the value) and
+resolution falls through to the next provider. This makes it easy to compose a
+primary provider with a fallback, e.g. GCP with an environment-variable
+fallback:
+
+## Example
+
+```typescript
+const provider = new CompositeSecretProvider([
+  new GcpSecretProvider({projectId: "my-project"}),
+  new EnvSecretProvider(),
+]);
+const key = await provider.getSecret("openai-api-key");
+```
+
+## Implements
+
+- [`SecretProvider`](../interfaces/SecretProvider.md)
+
+## Constructors
+
+### Constructor
+
+> **new CompositeSecretProvider**(`providers`): `CompositeSecretProvider`
+
+#### Parameters
+
+##### providers
+
+[`SecretProvider`](../interfaces/SecretProvider.md)[]
+
+#### Returns
+
+`CompositeSecretProvider`
+
+## Properties
+
+### name
+
+> **name**: `string`
+
+#### Implementation of
+
+[`SecretProvider`](../interfaces/SecretProvider.md).[`name`](../interfaces/SecretProvider.md#name)
+
+## Methods
+
+### getSecret()
+
+> **getSecret**(`secretName`, `version?`): `Promise`\<`string` \| `null`\>
+
+Resolve a secret value by name. Returns `null` when the secret is not found.
+
+#### Parameters
+
+##### secretName
+
+`string`
+
+The secret identifier (short name or provider-specific path).
+
+##### version?
+
+`string`
+
+Optional version to pin resolution to. Providers that do not
+  support versioning (e.g. environment variables) ignore this parameter. When
+  omitted, the latest version is resolved.
+
+#### Returns
+
+`Promise`\<`string` \| `null`\>
+
+#### Implementation of
+
+[`SecretProvider`](../interfaces/SecretProvider.md).[`getSecret`](../interfaces/SecretProvider.md#getsecret)

package/src/docs/versioned/0.24.0/reference/generated/api/classes/ConfigurationApp.md

@@ -0,0 +1,94 @@
+TerrenoPlugin that provides configuration management endpoints.
+
+Inspects the Mongoose configuration model to auto-generate:
+- `GET {basePath}/meta` — Schema metadata (sections, fields, types, descriptions)
+- `GET {basePath}` — Current configuration values (secret values redacted)
+- `PATCH {basePath}` — Update configuration values (secret fields stripped; never written)
+- `POST {basePath}/list-secrets` (alias `POST {basePath}/validate-secrets`) —
+  Read-only status of each secret field (whether the provider can resolve it).
+  This endpoint never resolves values into the document and returns no secret values.
+
+By default all endpoints require `Permissions.IsAdmin`. Supply `permissions`
+to gate routes with a consumer's own permission functions, and `preUpdate`/
+`postUpdate` hooks to validate and audit-log changes. This makes
+`ConfigurationApp` suitable as a single, consumer-owned configuration surface
+that can replace a bespoke config router.
+
+Secret values never touch the database, logs, audit payloads, or API
+responses: secret fields are stripped from incoming updates and redacted on
+every read.
+
+Nested subschemas in the model become separate sections in the metadata,
+making them renderable as cards/accordions in the admin UI.
+
+## Example
+
+```typescript
+import {ConfigurationApp, configurationPlugin} from "@terreno/api";
+
+const configSchema = new Schema({
+  general: { type: new Schema({
+    appName: { type: String, description: "App display name", default: "My App" },
+    maintenanceMode: { type: Boolean, description: "Enable maintenance mode", default: false },
+  })},
+  integrations: { type: new Schema({
+    openAiKey: { type: String, description: "OpenAI API key", secret: true, secretName: "openai-key" },
+  })},
+});
+configSchema.plugin(configurationPlugin);
+const AppConfig = mongoose.model("AppConfig", configSchema);
+
+new TerrenoApp({ userModel: User })
+  .configure(AppConfig, {
+    permissions: {read: [IsStaff], update: [IsSuperUser]},
+    postUpdate: (config, prevValue, req) => auditLog(req.user, prevValue, config),
+  })
+  .start();
+```
+
+## Implements
+
+- [`TerrenoPlugin`](../interfaces/TerrenoPlugin.md)
+
+## Constructors
+
+### Constructor
+
+> **new ConfigurationApp**(`options`): `ConfigurationApp`
+
+#### Parameters
+
+##### options
+
+[`ConfigurationAppOptions`](../interfaces/ConfigurationAppOptions.md)
+
+#### Returns
+
+`ConfigurationApp`
+
+## Methods
+
+### register()
+
+> **register**(`app`): `void`
+
+Register routes and middleware with the Express application.
+
+Called during `TerrenoApp.build()` after core middleware has been
+configured but before error handling middleware is added.
+
+#### Parameters
+
+##### app
+
+`Application`
+
+The Express application instance to register with
+
+#### Returns
+
+`void`
+
+#### Implementation of
+
+[`TerrenoPlugin`](../interfaces/TerrenoPlugin.md).[`register`](../interfaces/TerrenoPlugin.md#register)

package/src/docs/versioned/0.24.0/reference/generated/api/classes/EnvSecretProvider.md

@@ -0,0 +1,64 @@
+Secret provider that reads secrets from environment variables.
+Useful for local development and testing.
+
+Maps secret names to environment variable names by converting to SCREAMING_SNAKE_CASE.
+e.g., "openai-api-key" → process.env.OPENAI_API_KEY
+
+## Example
+
+```typescript
+const provider = new EnvSecretProvider();
+// reads process.env.OPENAI_API_KEY
+const key = await provider.getSecret("openai-api-key");
+```
+
+## Implements
+
+- [`SecretProvider`](../interfaces/SecretProvider.md)
+
+## Constructors
+
+### Constructor
+
+> **new EnvSecretProvider**(): `EnvSecretProvider`
+
+#### Returns
+
+`EnvSecretProvider`
+
+## Properties
+
+### name
+
+> **name**: `string` = `"env"`
+
+#### Implementation of
+
+[`SecretProvider`](../interfaces/SecretProvider.md).[`name`](../interfaces/SecretProvider.md#name)
+
+## Methods
+
+### getSecret()
+
+> **getSecret**(`secretName`, `_version?`): `Promise`\<`string` \| `null`\>
+
+Resolve a secret from an environment variable. Environment variables have no
+versions, so the optional `version` parameter is ignored.
+
+#### Parameters
+
+##### secretName
+
+`string`
+
+##### \_version?
+
+`string`
+
+#### Returns
+
+`Promise`\<`string` \| `null`\>
+
+#### Implementation of
+
+[`SecretProvider`](../interfaces/SecretProvider.md).[`getSecret`](../interfaces/SecretProvider.md#getsecret)