fix: give Doctor the host configuration the runtime receives

`pnpm doctor` and `startApi` each read their own subset of the same
environment variables, and the subsets had drifted. Doctor never read
`S3_*` or module secrets at all, so a correctly configured installation
was told its object storage was "not configured" and every module
requiring a bucket or a secret was reported blocked -- while the runtime,
from the identical environment, bound those buckets and ran the modules.

Both executables now map the environment through one
`loadHostConfiguration(env)` in Core, which takes the environment as an
argument and never reads `process.env` itself. Validation stays with the
existing per-domain validators, so each caller keeps its own failure
behaviour: startup refuses a rejected value, Doctor reports it as a
sanitized code.

Doctor's storage option becomes raw input like its mail option, so a
half-configured provider is reported as a blocking configuration failure
instead of throwing before a report exists. The outbound-email check --
computed, counted toward the result, but absent from every rendered
section -- is now printed, and the rendered set is asserted against a
real report so a future check cannot go missing the same way.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/src/cli/doctor.ts

@@ -7,6 +7,7 @@ import {
   doctorExitCode,
   formatDoctorReport,
 } from "../diagnostics/index.js";
+import { type HostEnvironment, loadHostConfiguration } from "../host/index.js";
 
 interface ModuleSdkPackageDocument {
   readonly version?: unknown;
@@ -18,6 +19,18 @@ interface RootPackageDocument extends ModuleSdkPackageDocument {
   };
 }
 
+/**
+ * Everything Doctor needs that comes from the repository itself rather than the deployment
+ * environment, resolved by the caller so the environment mapping below stays pure and testable.
+ */
+export interface DoctorCommandMetadata {
+  readonly moduleSdkVersion: string;
+  readonly modulesDirectory: string;
+  readonly platformVersion: string;
+  readonly runtimeRange: string;
+  readonly runtimeVersion: string;
+}
+
 async function readJson(pathname: string): Promise<unknown> {
   return JSON.parse(await readFile(pathname, "utf8")) as unknown;
 }
@@ -36,40 +49,40 @@ function requiredString(value: unknown): string {
   return value;
 }
 
-function readIdentityConfigurationFromEnvironment(): DoctorOptions["identityConfiguration"] {
-  const secret = process.env.EKKLESIA_IDENTITY_SECRET;
-  const baseUrl = process.env.EKKLESIA_IDENTITY_BASE_URL;
-  const publicSignupEnabled = process.env.EKKLESIA_PUBLIC_SIGNUP_ENABLED;
-  const trustedOriginsValue = process.env.EKKLESIA_IDENTITY_TRUSTED_ORIGINS;
-  const trustedOrigins = trustedOriginsValue
-    ? trustedOriginsValue
-        .split(",")
-        .map((origin) => origin.trim())
-        .filter((origin) => origin.length > 0)
-    : undefined;
-
+/**
+ * Turns one deployment environment into Doctor's inputs.
+ *
+ * Every infrastructure value comes from `loadHostConfiguration` — the same function `apps/api` calls
+ * with the same environment — so `pnpm doctor` and `startApi` cannot disagree about what this
+ * deployment is configured to use. Doctor previously read its own subset here and silently omitted
+ * object storage and module secrets entirely, which made it report a correctly configured
+ * installation as having neither.
+ *
+ * Everything is handed over **raw**. Doctor validates it and reports a sanitized code, so a
+ * malformed value appears in the report — which is the whole reason an operator runs this command —
+ * instead of throwing before a report exists.
+ */
+export function createDoctorOptions(
+  environment: HostEnvironment,
+  metadata: DoctorCommandMetadata,
+): DoctorOptions {
+  const host = loadHostConfiguration(environment);
   return {
-    ...(baseUrl ? { baseUrl } : {}),
-    environment: process.env.NODE_ENV === "development" ? "development" : "production",
-    ...(publicSignupEnabled ? { publicSignupEnabled } : {}),
-    ...(secret ? { secret } : {}),
-    ...(trustedOrigins ? { trustedOrigins } : {}),
-  };
-}
-
-function readClientAddressFromEnvironment(): DoctorOptions["clientAddress"] {
-  const mode = process.env.EKKLESIA_CLIENT_ADDRESS_MODE;
-  if (mode === undefined) {
-    return undefined;
-  }
-  const trustedProxiesValue = process.env.EKKLESIA_CLIENT_ADDRESS_TRUSTED_PROXIES;
-  return {
-    header: process.env.EKKLESIA_CLIENT_ADDRESS_HEADER,
-    mode,
-    trustedProxies: trustedProxiesValue
-      ?.split(",")
-      .map((entry) => entry.trim())
-      .filter((entry) => entry.length > 0),
+    clientAddress: host.clientAddress,
+    databaseEnvironment: host.environment,
+    databaseTransport: host.databaseTransport,
+    databaseUrl: host.databaseUrl,
+    identityConfiguration: { ...host.identity, environment: host.environment },
+    mailConfiguration: host.mail,
+    moduleDiscovery: {
+      moduleSdkVersion: metadata.moduleSdkVersion,
+      modulesDirectory: metadata.modulesDirectory,
+      platformVersion: metadata.platformVersion,
+    },
+    moduleSecrets: host.moduleSecrets,
+    runtimeRange: metadata.runtimeRange,
+    runtimeVersion: metadata.runtimeVersion,
+    storageConfiguration: host.storage,
   };
 }
 
@@ -81,40 +94,15 @@ export async function runDoctorCommand(repositoryRoot = process.cwd()): Promise<
   const rootPackage = rootPackageDocument(rootValue);
   const moduleSdkPackage = rootPackageDocument(moduleSdkValue);
 
-  const databaseEnvironment =
-    process.env.NODE_ENV === "development" ? ("development" as const) : ("production" as const);
-  const report = await diagnoseEkklesia({
-    clientAddress: readClientAddressFromEnvironment(),
-    databaseEnvironment,
-    databaseTransport: {
-      ...(process.env.EKKLESIA_DATABASE_CA === undefined
-        ? {}
-        : { certificateAuthority: process.env.EKKLESIA_DATABASE_CA }),
-      ...(process.env.EKKLESIA_DATABASE_TLS_MODE === undefined
-        ? {}
-        : { mode: process.env.EKKLESIA_DATABASE_TLS_MODE }),
-    },
-    databaseUrl: process.env.DATABASE_URL,
-    identityConfiguration: readIdentityConfigurationFromEnvironment(),
-    // Raw, exactly like the identity settings above: Doctor validates them and reports a sanitized
-    // code, so a malformed SMTP value appears in the report instead of crashing the command.
-    mailConfiguration: {
-      fromAddress: process.env.EKKLESIA_SMTP_FROM_ADDRESS,
-      fromName: process.env.EKKLESIA_SMTP_FROM_NAME,
-      host: process.env.EKKLESIA_SMTP_HOST,
-      password: process.env.EKKLESIA_SMTP_PASSWORD,
-      port: process.env.EKKLESIA_SMTP_PORT,
-      security: process.env.EKKLESIA_SMTP_SECURITY,
-      username: process.env.EKKLESIA_SMTP_USERNAME,
-    },
-    moduleDiscovery: {
+  const report = await diagnoseEkklesia(
+    createDoctorOptions(process.env, {
       moduleSdkVersion: requiredString(moduleSdkPackage.version),
       modulesDirectory: path.join(repositoryRoot, "modules"),
       platformVersion: requiredString(rootPackage.version),
-    },
-    runtimeRange: requiredString(rootPackage.engines?.node),
-    runtimeVersion: process.versions.node,
-  });
+      runtimeRange: requiredString(rootPackage.engines?.node),
+      runtimeVersion: process.versions.node,
+    }),
+  );
 
   console.log(formatDoctorReport(report).join("\n"));
   return doctorExitCode(report);