@vtechcom/hexcore 2.0.0-beta.1

package/dist/common/http.js

@@ -0,0 +1,171 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var ApiExceptionFilter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiExceptionFilter = exports.ResponseEnvelopeInterceptor = void 0;
+const common_1 = require("@nestjs/common");
+const node_fs_1 = require("node:fs");
+const rxjs_1 = require("rxjs");
+const head_service_1 = require("../hydra/head.service");
+const docker_service_1 = require("../docker/docker.service");
+const provider_1 = require("../chain/provider");
+const setup_service_1 = require("../setup.service");
+/** Wrap every successful payload in { ok: true, data } — matches ApiResponse<T>. */
+let ResponseEnvelopeInterceptor = class ResponseEnvelopeInterceptor {
+    intercept(_ctx, next) {
+        return next.handle().pipe((0, rxjs_1.map)(data => ({ ok: true, data })));
+    }
+};
+exports.ResponseEnvelopeInterceptor = ResponseEnvelopeInterceptor;
+exports.ResponseEnvelopeInterceptor = ResponseEnvelopeInterceptor = __decorate([
+    (0, common_1.Injectable)()
+], ResponseEnvelopeInterceptor);
+/**
+ * Single place that turns any thrown error into { ok: false, error }.
+ *
+ * v1 leaked raw exceptions (and occasionally stack traces) to clients because
+ * each controller handled its own failures. Here domain errors carry their own
+ * HTTP semantics and everything else becomes a clean 500.
+ */
+let ApiExceptionFilter = class ApiExceptionFilter {
+    static { ApiExceptionFilter_1 = this; }
+    logger = new common_1.Logger(ApiExceptionFilter_1.name);
+    /**
+     * Absolute path of the built web UI when the control-plane is also serving
+     * it, otherwise null. Set from main.ts at bootstrap.
+     */
+    static spaIndexPath = null;
+    catch(exception, host) {
+        const http = host.switchToHttp();
+        const reply = http.getResponse();
+        const request = http.getRequest();
+        const { status, code, message, details } = this.describe(exception);
+        /**
+         * SPA deep links.
+         *
+         * /heads/3 has no file on disk, so @fastify/static misses and Nest
+         * raises a 404 that lands here. Serving index.html lets vue-router
+         * resolve the route client-side. Nest owns the not-found handler, so
+         * this filter is the only place that sees the miss.
+         *
+         * API paths must still 404 as JSON — a client fetching a bad endpoint
+         * needs an error, not a page.
+         */
+        if (status === common_1.HttpStatus.NOT_FOUND &&
+            ApiExceptionFilter_1.spaIndexPath &&
+            request.method === 'GET' &&
+            !isApiPath(request.url)) {
+            void reply.type('text/html').send((0, node_fs_1.createReadStream)(ApiExceptionFilter_1.spaIndexPath));
+            return;
+        }
+        if (status >= 500) {
+            this.logger.error(`${code}: ${message}`, exception?.stack);
+        }
+        void reply.status(status).send({ ok: false, error: { code, message, details } });
+    }
+    describe(exception) {
+        if (exception instanceof head_service_1.HeadNotFoundError) {
+            return { status: common_1.HttpStatus.NOT_FOUND, code: 'HEAD_NOT_FOUND', message: exception.message };
+        }
+        if (exception instanceof head_service_1.HeadConflictError) {
+            return { status: common_1.HttpStatus.CONFLICT, code: 'HEAD_CONFLICT', message: exception.message };
+        }
+        /**
+         * Same envelope as a zod failure — including `details[].path` — so the
+         * create form highlights the offending field whether the rule was
+         * checkable from the payload alone or needed server state.
+         */
+        if (exception instanceof head_service_1.HeadValidationError) {
+            return {
+                status: common_1.HttpStatus.BAD_REQUEST,
+                code: 'VALIDATION_ERROR',
+                message: exception.message,
+                details: [{ path: exception.field, message: exception.message }],
+            };
+        }
+        /** Same envelope as a zod failure, so the setup form highlights the field. */
+        if (exception instanceof setup_service_1.SettingsValidationError) {
+            return {
+                status: common_1.HttpStatus.BAD_REQUEST,
+                code: 'VALIDATION_ERROR',
+                message: exception.message,
+                details: [{ path: exception.field, message: exception.message }],
+            };
+        }
+        /**
+         * 403, not 401: a bad setup token is not a missing login, and answering
+         * 401 would send the UI to a sign-in screen for an installation that
+         * has no account yet.
+         */
+        if (exception instanceof setup_service_1.SetupForbiddenError) {
+            return { status: common_1.HttpStatus.FORBIDDEN, code: 'SETUP_FORBIDDEN', message: exception.message };
+        }
+        if (exception instanceof docker_service_1.ImagePullError) {
+            // The reference is a setting someone typed, so this is their input
+            // being wrong rather than the registry misbehaving.
+            return { status: common_1.HttpStatus.BAD_REQUEST, code: 'IMAGE_PULL_FAILED', message: exception.message };
+        }
+        if (exception instanceof docker_service_1.DockerUnavailableError) {
+            return { status: common_1.HttpStatus.SERVICE_UNAVAILABLE, code: 'DOCKER_UNAVAILABLE', message: exception.message };
+        }
+        if (exception instanceof provider_1.ChainProviderError) {
+            return { status: common_1.HttpStatus.BAD_GATEWAY, code: 'CHAIN_PROVIDER_ERROR', message: exception.message };
+        }
+        if (exception instanceof common_1.HttpException) {
+            const res = exception.getResponse();
+            if (typeof res === 'object' && res !== null && 'code' in res) {
+                const body = res;
+                return {
+                    status: exception.getStatus(),
+                    code: body.code,
+                    message: body.message ?? exception.message,
+                    details: body.details,
+                };
+            }
+            return {
+                status: exception.getStatus(),
+                code: httpCodeName(exception.getStatus()),
+                message: typeof res === 'string' ? res : exception.message,
+            };
+        }
+        return {
+            status: common_1.HttpStatus.INTERNAL_SERVER_ERROR,
+            code: 'INTERNAL_ERROR',
+            message: exception?.message ?? 'Unexpected error',
+        };
+    }
+};
+exports.ApiExceptionFilter = ApiExceptionFilter;
+exports.ApiExceptionFilter = ApiExceptionFilter = ApiExceptionFilter_1 = __decorate([
+    (0, common_1.Catch)()
+], ApiExceptionFilter);
+/**
+ * Paths that must always answer with JSON, never the SPA shell.
+ * Kept in one place so the filter and any future middleware agree.
+ */
+function isApiPath(url) {
+    const path = url.split('?')[0] ?? '';
+    return path.startsWith('/api') || path === '/health' || path.startsWith('/api-docs');
+}
+function httpCodeName(status) {
+    switch (status) {
+        case 400:
+            return 'BAD_REQUEST';
+        case 401:
+            return 'UNAUTHORIZED';
+        case 403:
+            return 'FORBIDDEN';
+        case 404:
+            return 'NOT_FOUND';
+        case 409:
+            return 'CONFLICT';
+        default:
+            return 'ERROR';
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/common/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/common/http.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAWwB;AAExB,qCAA2C;AAC3C,+BAA4C;AAC5C,wDAAkG;AAClG,6DAAkF;AAClF,gDAAuD;AACvD,oDAAgF;AAEhF,oFAAoF;AAE7E,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACpC,SAAS,CAAC,IAAsB,EAAE,IAAiB;QAC/C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;CACJ,CAAA;AAJY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;GACA,2BAA2B,CAIvC;AAED;;;;;;GAMG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;;IACV,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,MAAM,CAAC,YAAY,GAAkB,IAAI,CAAC;IAE1C,KAAK,CAAC,SAAkB,EAAE,IAAmB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAgB,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAkB,CAAC;QAClD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEpE;;;;;;;;;;WAUG;QACH,IACI,MAAM,KAAK,mBAAU,CAAC,SAAS;YAC/B,oBAAkB,CAAC,YAAY;YAC/B,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EACzB,CAAC;YACC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAA,0BAAgB,EAAC,oBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrF,OAAO;QACX,CAAC;QAED,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,EAAG,SAAmB,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAEO,QAAQ,CAAC,SAAkB;QAM/B,IAAI,SAAS,YAAY,gCAAiB,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAChG,CAAC;QACD,IAAI,SAAS,YAAY,gCAAiB,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAC9F,CAAC;QACD;;;;WAIG;QACH,IAAI,SAAS,YAAY,kCAAmB,EAAE,CAAC;YAC3C,OAAO;gBACH,MAAM,EAAE,mBAAU,CAAC,WAAW;gBAC9B,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;aACnE,CAAC;QACN,CAAC;QACD,8EAA8E;QAC9E,IAAI,SAAS,YAAY,uCAAuB,EAAE,CAAC;YAC/C,OAAO;gBACH,MAAM,EAAE,mBAAU,CAAC,WAAW;gBAC9B,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;aACnE,CAAC;QACN,CAAC;QACD;;;;WAIG;QACH,IAAI,SAAS,YAAY,mCAAmB,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,SAAS,YAAY,+BAAc,EAAE,CAAC;YACtC,mEAAmE;YACnE,oDAAoD;YACpD,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,SAAS,YAAY,uCAAsB,EAAE,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,mBAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,SAAS,YAAY,6BAAkB,EAAE,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,WAAW,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,SAAS,YAAY,sBAAa,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,GAA4D,CAAC;gBAC1E,OAAO;oBACH,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE;oBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO;oBAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;iBACxB,CAAC;YACN,CAAC;YACD,OAAO;gBACH,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE;gBAC7B,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACzC,OAAO,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;aAC7D,CAAC;QACN,CAAC;QACD,OAAO;YACH,MAAM,EAAE,mBAAU,CAAC,qBAAqB;YACxC,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAG,SAAmB,EAAE,OAAO,IAAI,kBAAkB;SAC/D,CAAC;IACN,CAAC;;AAtHQ,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,cAAK,GAAE;GACK,kBAAkB,CAuH9B;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAChC,QAAQ,MAAM,EAAE,CAAC;QACb,KAAK,GAAG;YACJ,OAAO,aAAa,CAAC;QACzB,KAAK,GAAG;YACJ,OAAO,cAAc,CAAC;QAC1B,KAAK,GAAG;YACJ,OAAO,WAAW,CAAC;QACvB,KAAK,GAAG;YACJ,OAAO,WAAW,CAAC;QACvB,KAAK,GAAG;YACJ,OAAO,UAAU,CAAC;QACtB;YACI,OAAO,OAAO,CAAC;IACvB,CAAC;AACL,CAAC"}

package/dist/common/zod-validation.pipe.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZodValidationPipe = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Validate a request body/query with a zod schema from @hexcore/shared.
+ *
+ * This is what lets v2 keep ONE definition of every payload: the same schema
+ * validates on the server and types the fetch call in the Nuxt UI. With
+ * class-validator DTOs (v1) the frontend had to redeclare each shape by hand,
+ * and the two drifted — several v1 UI bugs were payloads the API had changed.
+ */
+let ZodValidationPipe = class ZodValidationPipe {
+    schema;
+    constructor(schema) {
+        this.schema = schema;
+    }
+    transform(value) {
+        const result = this.schema.safeParse(value);
+        if (!result.success) {
+            throw new common_1.BadRequestException({
+                code: 'VALIDATION_ERROR',
+                message: 'Request payload failed validation',
+                details: result.error.issues.map(i => ({
+                    path: i.path.join('.') || '(root)',
+                    message: i.message,
+                })),
+            });
+        }
+        return result.data;
+    }
+};
+exports.ZodValidationPipe = ZodValidationPipe;
+exports.ZodValidationPipe = ZodValidationPipe = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Function])
+], ZodValidationPipe);
+//# sourceMappingURL=zod-validation.pipe.js.map

package/dist/common/zod-validation.pipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-validation.pipe.js","sourceRoot":"","sources":["../../src/common/zod-validation.pipe.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAqF;AAGrF;;;;;;;GAOG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACG;IAA7B,YAA6B,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAElD,SAAS,CAAC,KAAc;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC;gBAC1B,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,mCAAmC;gBAC5C,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;oBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;iBACrB,CAAC,CAAC;aACN,CAAC,CAAC;QACP,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACvB,CAAC;CACJ,CAAA;AAjBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;;GACA,iBAAiB,CAiB7B"}

package/dist/config.js

@@ -0,0 +1,354 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = exports.dotenvFound = void 0;
+exports.currentLayers = currentLayers;
+exports.loadConfig = loadConfig;
+exports.describeProvenance = describeProvenance;
+exports.getConfig = getConfig;
+exports.reloadConfigInto = reloadConfigInto;
+/**
+ * Configuration.
+ *
+ * v1 required ~30 environment variables with no validation — a typo surfaced as
+ * an undefined deep inside a Docker call. v2 validates everything on boot with
+ * zod and defaults hard enough that it runs with no configuration at all.
+ *
+ * Values arrive in four layers, highest first: a real environment variable, a
+ * `.env` in the current directory, the settings file the setup wizard writes,
+ * then the defaults below. `settings.ts` owns that merge and can explain where
+ * any given value came from — see `describeProvenance`.
+ */
+const zod_1 = require("zod");
+const dotenv_1 = require("dotenv");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const settings_1 = require("./settings");
+/**
+ * The environment as it was BEFORE dotenv ran.
+ *
+ * Taken at module load and never recomputed. dotenv assigns into `process.env`
+ * without overwriting, so once it has run there is no way to tell a variable
+ * the operator exported from one a `.env` supplied — and that difference is
+ * exactly what `hexcore config` has to report.
+ */
+const REAL_ENV = { ...process.env };
+const DOTENV_VALUES = (0, dotenv_1.config)({ quiet: true }).parsed ?? {};
+/** Whether a `.env` was found in the current directory, which counts as setup. */
+exports.dotenvFound = (0, node_fs_1.existsSync)((0, node_path_1.resolve)(process.cwd(), '.env'));
+/** The layers as this process sees them. */
+function currentLayers() {
+    // HEXCORE_HOME decides where the settings file is, so it can only come from
+    // the two layers above it.
+    const forHome = { ...DOTENV_VALUES, ...definedOnly(REAL_ENV) };
+    return { environment: REAL_ENV, dotenv: DOTENV_VALUES, file: (0, settings_1.readSettings)(forHome).env };
+}
+function definedOnly(env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value !== undefined && value !== '')
+            out[key] = value;
+    }
+    return out;
+}
+const bool = (def) => zod_1.z
+    .string()
+    .optional()
+    .transform(v => (v === undefined || v === '' ? def : v === 'true' || v === '1'));
+const int = (def) => zod_1.z
+    .string()
+    .optional()
+    .transform(v => (v === undefined || v === '' ? def : Number(v)))
+    .pipe(zod_1.z.number().int());
+/**
+ * An integer with no default, so "unset" stays distinguishable from a value
+ * that happens to equal the default. Used for the knobs whose real default
+ * comes from the hydra-node version profile — baking one in here would mean an
+ * operator who never touched .env silently overriding every future version.
+ */
+const optInt = () => zod_1.z
+    .string()
+    .optional()
+    .transform(v => (v === undefined || v === '' ? undefined : Number(v)))
+    .pipe(zod_1.z.number().int().optional());
+const envSchema = zod_1.z
+    .object({
+    NODE_ENV: zod_1.z.enum(['development', 'production', 'test']).default('development'),
+    PORT: int(4000),
+    HOST: zod_1.z.string().default('0.0.0.0'),
+    LOG_LEVEL: zod_1.z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace']).default('info'),
+    /**
+     * Root for all mutable state: sqlite db, keys, persistence dirs.
+     *
+     * No default here on purpose — see `defaultStateDir`, which has to
+     * adopt an existing `./.hexcore` before falling back to the home, or a
+     * running installation's signing keys would appear to vanish.
+     */
+    STATE_DIR: zod_1.z.string().optional(),
+    CARDANO_NETWORK: zod_1.z.enum(['preprod', 'preview', 'mainnet']).default('preprod'),
+    /**
+     * Default backend for heads that name none. `offline` runs hydra-node
+     * with its layer-1 interface disabled — no key, no socket, no chain —
+     * which is the useful default on a dev machine with neither credential.
+     */
+    CHAIN_BACKEND: zod_1.z.enum(['blockfrost', 'cardano-node', 'offline']).default('blockfrost'),
+    BLOCKFROST_PROJECT_ID: zod_1.z.string().optional(),
+    BLOCKFROST_BASE_URL: zod_1.z.string().optional(),
+    /**
+     * Blockfrost is an HTTP poller, not a chain follower, so a node's view
+     * of the tip lags. Upstream measured 50-80s of drift on preprod against
+     * ~0s for a local socket.
+     *
+     * That matters because hydra-node treats an unsynced node as unusable:
+     * past --unsynced-period it stops signing snapshots AND rejects client
+     * input. The flag defaults to half the contestation period, so a 120s
+     * contestation gives 60s — inside the drift band, and the node flips
+     * unsynced mid-operation.
+     *
+     * 180s is upstream's tested value: it absorbs the drift while still
+     * catching a genuinely stalled node.
+     *
+     * Left unset, the value comes from the head's hydra-node version
+     * profile (HYDRA_VERSION_PROFILES in @hexcore/shared). Set here it wins
+     * over the profile for every head, on every version.
+     */
+    HYDRA_UNSYNCED_PERIOD: optInt(),
+    /** Per-query and total-retry budgets for the Blockfrost backend. Same precedence. */
+    BLOCKFROST_QUERY_TIMEOUT: optInt(),
+    BLOCKFROST_RETRY_TIMEOUT: optInt(),
+    /** Only used when CHAIN_BACKEND=cardano-node. */
+    CARDANO_NODE_SOCKET: zod_1.z.string().optional(),
+    /**
+     * Default pinned to the 2.x line.
+     *
+     * 2.x is what makes the Blockfrost backend actually dependable: the
+     * drift-tolerance flags (--unsynced-period, --blockfrost-*-timeout)
+     * simply do not exist on 0.22.x, so on that image a Blockfrost head
+     * runs with a 60s unsynced budget inside a 50-80s drift band and can
+     * stop signing snapshots mid-operation.
+     *
+     * Older images still work — every version this build supports declares
+     * its flag set in HYDRA_VERSION_PROFILES, and anything else is probed
+     * (see capabilities.ts) — but they do not get that protection.
+     *
+     * This is only the default. A create request may name a different
+     * image per head, which is how two versions run side by side.
+     *
+     * Note 2.x is a protocol change, not just a version bump: no commit
+     * phase (ADR-33), HydraHeadV2 identity token, SQLite event store, and
+     * new script hashes per network. Heads created against 0.22.x are not
+     * resumable on 2.x; reset them before switching.
+     */
+    HYDRA_NODE_IMAGE: zod_1.z.string().default('ghcr.io/cardano-scaling/hydra-node:2.3.0'),
+    /**
+     * Comma-separated script tx ids. Left empty the node publishes/uses its
+     * own — v1 forced you to hunt these down per version/network before
+     * anything would boot.
+     */
+    HYDRA_SCRIPTS_TX_ID: zod_1.z.string().optional(),
+    DOCKER_SOCKET: zod_1.z.string().default('/var/run/docker.sock'),
+    PORT_BASE: int(14000),
+    MAX_ACTIVE_NODES: int(20),
+    ADMIN_USERNAME: zod_1.z.string().default('admin'),
+    ADMIN_PASSWORD: zod_1.z.string().optional(),
+    /** Generated + persisted on first boot when unset. */
+    JWT_SECRET: zod_1.z.string().optional(),
+    AUTH_ENABLED: bool(true),
+    CORS_ORIGIN: zod_1.z.string().default('*'),
+    /** Serve the built web UI from the control-plane (single-process mode). */
+    SERVE_WEB: bool(false),
+    WEB_DIST: zod_1.z.string().optional(),
+})
+    .superRefine((v, ctx) => {
+    /**
+     * Neither backend's credential is required to boot any more.
+     *
+     * A server-wide BLOCKFROST_PROJECT_ID is now only a DEFAULT: a head — or
+     * an individual node — can carry its own key, so an operator who keys
+     * every head separately has nothing to put here. Refusing to start over
+     * a missing default would make that setup impossible to run.
+     *
+     * What is still checked is a key that cannot work: see the network
+     * prefix rule below.
+     */
+    /**
+     * A Blockfrost project id is network-scoped and its prefix says which
+     * network it is for. Catch a mismatch here: left to hydra-node it
+     * surfaces much later, deep inside chain observation, as a confusing
+     * "cannot find script" or a head that simply never observes its own
+     * init transaction.
+     */
+    if (v.BLOCKFROST_PROJECT_ID && !v.BLOCKFROST_PROJECT_ID.startsWith(v.CARDANO_NETWORK)) {
+        const prefix = v.BLOCKFROST_PROJECT_ID.slice(0, 7);
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['BLOCKFROST_PROJECT_ID'],
+            message: `BLOCKFROST_PROJECT_ID starts with "${prefix}…" but CARDANO_NETWORK is ` +
+                `"${v.CARDANO_NETWORK}". The project id must begin with the network name ` +
+                `(e.g. ${v.CARDANO_NETWORK}XXXXXXXX). Either use a ${v.CARDANO_NETWORK} key ` +
+                'or change CARDANO_NETWORK to match the one you have.',
+        });
+    }
+    /**
+     * A missing CARDANO_NODE_SOCKET is deliberately NOT fatal, even with
+     * CHAIN_BACKEND=cardano-node.
+     *
+     * Refusing to boot took the whole control-plane down over one unusable
+     * backend, when the other one needs nothing but an API key. The socket
+     * is now a capability the server reports (GET /api/system/config): heads
+     * that would need it cannot be created, and the UI steers people to
+     * Blockfrost instead of leaving them with a process that won't start.
+     */
+});
+/**
+ * The built UI, when this build ships one.
+ *
+ * Two shapes to cover. Installed from npm, `dist/main.js` sits beside a `web/`
+ * directory in the same package. In the monorepo it is two packages over. The
+ * first that exists wins; neither existing is fine, since SERVE_WEB is off by
+ * default and an API-only deployment is legitimate.
+ */
+function findWebDist() {
+    const packaged = (0, node_path_1.resolve)(__dirname, '../web');
+    if ((0, node_fs_1.existsSync)(packaged))
+        return packaged;
+    return (0, node_path_1.resolve)(process.cwd(), '../web/.output/public');
+}
+function buildConfig(env) {
+    const stateDir = env.STATE_DIR ? (0, settings_1.absolute)(env.STATE_DIR) : (0, settings_1.defaultStateDir)();
+    const blockfrostBaseUrl = env.BLOCKFROST_BASE_URL ??
+        (env.CARDANO_NETWORK === 'mainnet'
+            ? 'https://cardano-mainnet.blockfrost.io/api/v0'
+            : `https://cardano-${env.CARDANO_NETWORK}.blockfrost.io/api/v0`);
+    return {
+        env: env.NODE_ENV,
+        isProd: env.NODE_ENV === 'production',
+        port: env.PORT,
+        host: env.HOST,
+        logLevel: env.LOG_LEVEL,
+        stateDir,
+        dbPath: `${stateDir}/hexcore.db`,
+        headsDir: `${stateDir}/heads`,
+        secretsPath: `${stateDir}/secrets.json`,
+        network: env.CARDANO_NETWORK,
+        chainBackend: env.CHAIN_BACKEND,
+        blockfrostProjectId: env.BLOCKFROST_PROJECT_ID ?? '',
+        blockfrostBaseUrl,
+        cardanoNodeSocket: env.CARDANO_NODE_SOCKET ? (0, settings_1.absolute)(env.CARDANO_NODE_SOCKET) : '',
+        /**
+         * Operator overrides for the version-profile argv defaults. Undefined
+         * keys mean "whatever this head's hydra-node version declares"; see
+         * resolveHydraArgs in @hexcore/shared for the merge.
+         */
+        hydraArgOverrides: {
+            unsyncedPeriod: env.HYDRA_UNSYNCED_PERIOD,
+            blockfrostQueryTimeout: env.BLOCKFROST_QUERY_TIMEOUT,
+            blockfrostRetryTimeout: env.BLOCKFROST_RETRY_TIMEOUT,
+        },
+        /** Image a head gets when the create request names none. */
+        hydraNodeImage: env.HYDRA_NODE_IMAGE,
+        hydraScriptsTxId: env.HYDRA_SCRIPTS_TX_ID?.trim() || '',
+        dockerSocket: env.DOCKER_SOCKET,
+        portBase: env.PORT_BASE,
+        maxActiveNodes: env.MAX_ACTIVE_NODES,
+        adminUsername: env.ADMIN_USERNAME,
+        adminPassword: env.ADMIN_PASSWORD ?? '',
+        jwtSecret: env.JWT_SECRET ?? '',
+        authEnabled: env.AUTH_ENABLED,
+        corsOrigin: env.CORS_ORIGIN,
+        serveWeb: env.SERVE_WEB,
+        webDist: env.WEB_DIST ? (0, settings_1.absolute)(env.WEB_DIST) : findWebDist(),
+    };
+}
+class ConfigError extends Error {
+    issues;
+    constructor(issues) {
+        super('Invalid configuration:\n' +
+            issues.map(i => `  - ${i.path.join('.') || '(root)'}: ${i.message}`).join('\n'));
+        this.issues = issues;
+        this.name = 'ConfigError';
+    }
+}
+exports.ConfigError = ConfigError;
+/**
+ * Build the running configuration.
+ *
+ * Called with no argument it merges the four layers. Called with an explicit
+ * source it parses exactly that, which is what the tests use — and what a
+ * caller wants when it is holding a hypothetical set of settings rather than
+ * the live ones.
+ */
+function loadConfig(source) {
+    const parsed = envSchema.safeParse(source ?? (0, settings_1.mergeLayers)(currentLayers()));
+    if (!parsed.success)
+        throw new ConfigError(parsed.error.issues);
+    return buildConfig(parsed.data);
+}
+/**
+ * Every setting, its value, and which layer supplied it.
+ *
+ * The point of this is `hexcore config`. Layered configuration fails in one
+ * characteristic way — a value is not wrong, it is unexplainable — and the fix
+ * is not fewer layers, it is being able to name the one that won.
+ */
+function describeProvenance() {
+    const layers = currentLayers();
+    const config = loadConfig((0, settings_1.mergeLayers)(layers));
+    /**
+     * The EFFECTIVE value, not the raw one.
+     *
+     * Reading it back off the built config rather than out of the merged
+     * environment matters for every key nobody has set: the raw view has
+     * nothing to show there, and a report that prints "—" next to "default" is
+     * telling the reader the one thing they already knew. What they came for is
+     * what the default actually is.
+     */
+    return REPORTED_KEYS.map(({ key, read }) => {
+        const value = read(config);
+        return {
+            key,
+            value: value === '' ? null : value,
+            secret: settings_1.SECRET_KEYS.has(key),
+            source: (0, settings_1.sourceOf)(key, layers),
+        };
+    });
+}
+/** Keys worth printing, and how to read each one back off the built config. */
+const REPORTED_KEYS = [
+    { key: 'CARDANO_NETWORK', read: c => c.network },
+    { key: 'CHAIN_BACKEND', read: c => c.chainBackend },
+    { key: 'BLOCKFROST_PROJECT_ID', read: c => c.blockfrostProjectId },
+    { key: 'CARDANO_NODE_SOCKET', read: c => c.cardanoNodeSocket },
+    { key: 'HYDRA_NODE_IMAGE', read: c => c.hydraNodeImage },
+    { key: 'STATE_DIR', read: c => c.stateDir },
+    { key: 'PORT', read: c => String(c.port) },
+    { key: 'HOST', read: c => c.host },
+    { key: 'PORT_BASE', read: c => String(c.portBase) },
+    { key: 'DOCKER_SOCKET', read: c => c.dockerSocket },
+    { key: 'ADMIN_USERNAME', read: c => c.adminUsername },
+    { key: 'AUTH_ENABLED', read: c => String(c.authEnabled) },
+    { key: 'SERVE_WEB', read: c => String(c.serveWeb) },
+];
+let cached = null;
+function getConfig() {
+    if (!cached)
+        cached = loadConfig();
+    return cached;
+}
+/**
+ * Re-read the layers into the SAME config object.
+ *
+ * Mutation rather than replacement is the point: every service holds the object
+ * that was injected as `APP_CONFIG`, so handing back a new one would leave them
+ * all reading the old settings. This is what lets the setup wizard take effect
+ * without a restart.
+ *
+ * Values captured at construction do NOT move — the Docker client is built from
+ * `dockerSocket` once, the HTTP server is bound to `port` once. Those keys are
+ * therefore kept out of the wizard entirely rather than offered and quietly
+ * ignored; see `settingsSchema` in @hexcore/shared.
+ */
+function reloadConfigInto(target) {
+    Object.assign(target, loadConfig());
+    return target;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AA2CA,sCAKC;AA0QD,gCAIC;AASD,gDA0BC;AAoBD,8BAGC;AAeD,4CAGC;AA1YD;;;;;;;;;;;GAWG;AACH,6BAAwB;AAExB,mCAA8C;AAC9C,qCAAqC;AACrC,yCAAoC;AAEpC,yCAQoB;AAEpB;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AACvD,MAAM,aAAa,GAA2B,IAAA,eAAU,EAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;AAEvF,kFAAkF;AACrE,QAAA,WAAW,GAAG,IAAA,oBAAU,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtE,4CAA4C;AAC5C,SAAgB,aAAa;IACzB,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,OAAO,GAAsB,EAAE,GAAG,aAAa,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAA,uBAAY,EAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB;IACvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE,CAC1B,OAAC;KACI,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAEzF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CACxB,OAAC;KACI,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/D,IAAI,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG,EAAE,CAChB,OAAC;KACI,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KACrE,IAAI,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE3C,MAAM,SAAS,GAAG,OAAC;KACd,MAAM,CAAC;IACJ,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9E,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;IACf,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvF;;;;;;OAMG;IACH,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,eAAe,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7E;;;;OAIG;IACH,aAAa,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACtF,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C;;;;;;;;;;;;;;;;;OAiBG;IACH,qBAAqB,EAAE,MAAM,EAAE;IAC/B,qFAAqF;IACrF,wBAAwB,EAAE,MAAM,EAAE;IAClC,wBAAwB,EAAE,MAAM,EAAE;IAElC,iDAAiD;IACjD,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC;IAChF;;;;OAIG;IACH,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACzD,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC;IACrB,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;IAEzB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3C,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,sDAAsD;IACtD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC;IAExB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;IACtB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACpB;;;;;;;;;;OAUG;IACH;;;;;;OAMG;IACH,IAAI,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACT,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,uBAAuB,CAAC;YAC/B,OAAO,EACH,sCAAsC,MAAM,4BAA4B;gBACxE,IAAI,CAAC,CAAC,eAAe,qDAAqD;gBAC1E,SAAS,CAAC,CAAC,eAAe,2BAA2B,CAAC,CAAC,eAAe,OAAO;gBAC7E,sDAAsD;SAC7D,CAAC,CAAC;IACP,CAAC;IACD;;;;;;;;;OASG;AACP,CAAC,CAAC,CAAC;AAIP;;;;;;;GAOG;AACH,SAAS,WAAW;IAChB,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAA8B;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,mBAAQ,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,0BAAe,GAAE,CAAC;IAE7E,MAAM,iBAAiB,GACnB,GAAG,CAAC,mBAAmB;QACvB,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;YAC9B,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,mBAAmB,GAAG,CAAC,eAAe,uBAAuB,CAAC,CAAC;IAEzE,OAAO;QACH,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,SAAS;QAEvB,QAAQ;QACR,MAAM,EAAE,GAAG,QAAQ,aAAa;QAChC,QAAQ,EAAE,GAAG,QAAQ,QAAQ;QAC7B,WAAW,EAAE,GAAG,QAAQ,eAAe;QAEvC,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACpD,iBAAiB;QACjB,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAA,mBAAQ,EAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE;QAEnF;;;;WAIG;QACH,iBAAiB,EAAE;YACf,cAAc,EAAE,GAAG,CAAC,qBAAqB;YACzC,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;YACpD,sBAAsB,EAAE,GAAG,CAAC,wBAAwB;SAC3B;QAE7B,4DAA4D;QAC5D,cAAc,EAAE,GAAG,CAAC,gBAAgB;QACpC,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE;QAEvD,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,cAAc,EAAE,GAAG,CAAC,gBAAgB;QAEpC,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;QAC/B,WAAW,EAAE,GAAG,CAAC,YAAY;QAE7B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,mBAAQ,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACjE,CAAC;AACN,CAAC;AAED,MAAa,WAAY,SAAQ,KAAK;IACN;IAA5B,YAA4B,MAAoB;QAC5C,KAAK,CACD,0BAA0B;YACtB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACtF,CAAC;QAJsB,WAAM,GAAN,MAAM,CAAc;QAK5C,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AARD,kCAQC;AAED;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,MAA0B;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,IAAI,IAAA,sBAAW,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB;IAM9B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAA,sBAAW,EAAC,MAAM,CAAC,CAAC,CAAC;IAC/C;;;;;;;;OAQG;IACH,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO;YACH,GAAG;YACH,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAClC,MAAM,EAAE,sBAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAC5B,MAAM,EAAE,IAAA,mBAAQ,EAAC,GAAG,EAAE,MAAM,CAAC;SAChC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,+EAA+E;AAC/E,MAAM,aAAa,GAA2D;IAC1E,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAChD,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IACnD,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE;IAClE,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE;IAC9D,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IACxD,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;IAC1C,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAClC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;IACnD,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IACnD,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE;IACrD,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;IACzD,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;CACtD,CAAC;AAEF,IAAI,MAAM,GAAqB,IAAI,CAAC;AACpC,SAAgB,SAAS;IACrB,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,UAAU,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,MAAiB;IAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/config.module.js

@@ -0,0 +1,35 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigModule = exports.APP_CONFIG = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("./config");
+/** DI token for the validated, frozen application configuration. */
+exports.APP_CONFIG = 'APP_CONFIG';
+/**
+ * Config is resolved once at process start (so a bad .env fails before Nest
+ * builds the module graph) and exposed globally — every other module injects
+ * APP_CONFIG rather than reading process.env, which is what made v1's
+ * configuration so hard to follow.
+ */
+let ConfigModule = class ConfigModule {
+};
+exports.ConfigModule = ConfigModule;
+exports.ConfigModule = ConfigModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        providers: [
+            {
+                provide: exports.APP_CONFIG,
+                useFactory: () => (0, config_1.loadConfig)(),
+            },
+        ],
+        exports: [exports.APP_CONFIG],
+    })
+], ConfigModule);
+//# sourceMappingURL=config.module.js.map

package/dist/config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.js","sourceRoot":"","sources":["../src/config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,qCAAsD;AAEtD,oEAAoE;AACvD,QAAA,UAAU,GAAG,YAAY,CAAC;AAEvC;;;;;GAKG;AAWI,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAVxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACJ,SAAS,EAAE;YACP;gBACI,OAAO,EAAE,kBAAU;gBACnB,UAAU,EAAE,GAAc,EAAE,CAAC,IAAA,mBAAU,GAAE;aAC5C;SACJ;QACD,OAAO,EAAE,CAAC,kBAAU,CAAC;KACxB,CAAC;GACW,YAAY,CAAG"}