@kindgi/env-schema 0.1.1 → 0.1.3

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { ENV_GROUPS, type EnvTarget, type EnvVarSpec, KINDGI_ENV_SCHEMA, envVarsForTarget, renderEnvExample, validateEnvForTarget, } from './schema.js';
-export { CORS_ORIGINS_VAR, LICENSE_KEY_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, } from './values.js';
+export { CORS_ORIGINS_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePackServiceToken, } from './values.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
 export { ENV_GROUPS, KINDGI_ENV_SCHEMA, envVarsForTarget, renderEnvExample, validateEnvForTarget, } from './schema.js';
-export { CORS_ORIGINS_VAR, LICENSE_KEY_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, } from './values.js';
+export { CORS_ORIGINS_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePackServiceToken, } from './values.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,UAAU,EAGV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,UAAU,EAGV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/schema.d.ts

@@ -95,6 +95,7 @@ export declare const ENV_GROUPS: {
     readonly core: "Core server config";
     readonly secrets: "Secrets backend selection";
     readonly gcp: "GCP vendor config (postgres + gcp KMS)";
+    readonly 'local-key': "Local key (postgres + libsodium: a key this runtime holds, single-node)";
     readonly 'pack-service': "Pack service (runs the pack code: tools and guardrail checks)";
     readonly 'image-registry': "Image registry (where deployments' images are read from)";
     readonly dev: "Development (`kindgi dev`; each needs `KINDGI_DEV=true`)";

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAMD,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAC;AAwBX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EA8YlD,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD,SAAS,UAAU,EAAE,CAEvB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CA8CpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAYrF"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAMD,eAAO,MAAM,UAAU;;;;;;;;CAQb,CAAC;AA2BX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EAublD,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD,SAAS,UAAU,EAAE,CAEvB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CA8CpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAYrF"}

package/dist/schema.js

@@ -7,6 +7,7 @@ export const ENV_GROUPS = {
     core: 'Core server config',
     secrets: 'Secrets backend selection',
     gcp: 'GCP vendor config (postgres + gcp KMS)',
+    'local-key': 'Local key (postgres + libsodium: a key this runtime holds, single-node)',
     'pack-service': 'Pack service (runs the pack code: tools and guardrail checks)',
     'image-registry': "Image registry (where deployments' images are read from)",
     dev: 'Development (`kindgi dev`; each needs `KINDGI_DEV=true`)',
@@ -19,6 +20,7 @@ const appliesToServer = (t) => t.component !== 'pack-service';
 const appliesToPostgresBackend = (t) => appliesToServer(t) && t.secretsBackend === 'postgres';
 const appliesToDotenvBackend = (t) => appliesToServer(t) && t.secretsBackend === 'dotenv';
 const appliesToPostgresGcp = (t) => appliesToPostgresBackend(t) && t.secretsBackendKms === 'gcp';
+const appliesToPostgresLocalKey = (t) => appliesToPostgresBackend(t) && t.secretsBackendKms === 'libsodium';
 const appliesToPackService = (t) => t.component === 'pack-service';
 /** The server, calling a pack service over HTTP. */
 const appliesToServerHttpPackTransport = (t) => appliesToServer(t) && t.packTransport === 'http';
@@ -31,7 +33,7 @@ export const KINDGI_ENV_SCHEMA = [
     // ---- core server ------------------------------------------------
     {
         name: 'KINDGI_API_PORT',
-        description: 'HTTP port the Kindgi API server listens on. Default 4000.',
+        description: "HTTP port the Kindgi API server listens on. The first that's set wins: the `--port` flag, `KINDGI_API_PORT`, the platform's `PORT` (Cloud Run, Render, Heroku and Fly set it and send traffic only there), the config file's `port`, then 4000.",
         example: '4000',
         required: false,
         appliesTo: appliesToServer,
@@ -112,6 +114,15 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'core',
         allowedValues: ['local', 'deployed'],
     },
+    {
+        name: 'KINDGI_WEBHOOK_PRIVATE_NETWORKS',
+        description: 'Whether a webhook may go to a private network address: for a receiver on the same VPC or compose network as a self-hosted server. `allow` accepts a receiver whose host resolves to a private address: RFC 1918, CGNAT (100.64.0.0/10) or IPv6 unique-local. Loopback, link-local (the cloud metadata endpoints) and unroutable addresses stay refused, and webhooks stay https only. Unset or `deny`: public addresses only. Development mode (`KINDGI_DEV`) allows http and every address anyway.',
+        example: 'allow',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+        allowedValues: ['allow', 'deny'],
+    },
     {
         name: 'KINDGI_LICENSE_KEY',
         description: 'The commercial license key (`kgi_lk_...`) Kindgi issues: signed, checked offline at startup, with no call to Kindgi. Required outside development mode: without a valid key the server refuses to start, naming this variable. `KINDGI_DEV=true` needs none. A production key comes with a commercial license; a free non-production key covers staging and CI. A secret: give it from your secrets store.',
@@ -196,7 +207,7 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_SECRETS_BACKEND_KMS',
-        description: 'Which KMS vendor wraps DEKs (postgres backend only). Currently supported: `gcp`. Reserved: `aws`, `libsodium`.',
+        description: 'Which KMS wraps DEKs (postgres backend only): `gcp` (Google Cloud KMS), or `libsodium`, a key this runtime holds (see `KINDGI_SECRETS_LOCAL_KEY_PATH`). Reserved: `aws`.',
         example: 'gcp',
         required: true,
         appliesTo: appliesToPostgresBackend,
@@ -252,6 +263,32 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToPostgresGcp,
         group: 'gcp',
     },
+    // ---- local key (libsodium) --------------------------------------
+    {
+        name: 'KINDGI_SECRETS_LOCAL_KEY_PATH',
+        description: "Absolute path to the local key: a file of 32 random bytes (`openssl rand 32`, mode 0600), for `KINDGI_SECRETS_BACKEND_KMS=libsodium`. It wraps every secret's data key, and it's held on this host, next to the database: back it up apart from the database, since a lost key loses every secret. Replicas mount the same file. Starting with a different key than the secrets were stored under is refused. This or `KINDGI_SECRETS_LOCAL_KEY`, not both.",
+        example: '/etc/kindgi/secrets-local.key',
+        required: false,
+        appliesTo: appliesToPostgresLocalKey,
+        group: 'local-key',
+    },
+    {
+        name: 'KINDGI_SECRETS_LOCAL_KEY',
+        description: 'The local key itself, base64 (32 bytes; `openssl rand -base64 32`): for platforms that give secrets as environment variables. This or `KINDGI_SECRETS_LOCAL_KEY_PATH`, not both.',
+        example: '',
+        required: false,
+        appliesTo: appliesToPostgresLocalKey,
+        group: 'local-key',
+    },
+    {
+        name: 'KINDGI_SECRETS_LOCAL_KEY_ACK',
+        description: "Exactly `single-node`: the operator's acknowledgement that the secrets' key is held on this host, next to the database, not in a cloud KMS. Not FIPS 140-3; for regulated workloads, use a cloud KMS. Required with `KINDGI_SECRETS_BACKEND_KMS=libsodium`.",
+        example: 'single-node',
+        required: true,
+        appliesTo: appliesToPostgresLocalKey,
+        group: 'local-key',
+        allowedValues: ['single-node'],
+    },
     // ---- pack service -----------------------------------------------
     // The server's side: where the pack service is, and how long a call
     // may take.
@@ -283,7 +320,7 @@ export const KINDGI_ENV_SCHEMA = [
     // Both sides: the shared token.
     {
         name: 'KINDGI_PACK_SERVICE_TOKEN',
-        description: 'Shared secret between the server and the pack service. The pack service refuses any call without it, and the server sends it with every call. Required by the pack service, and by the server when `KINDGI_PACK_SERVICE_URL` is set. Use a long random value (`openssl rand -base64 32`). The pack service removes it from its environment before it loads the pack code.',
+        description: 'Shared secret between the server and the pack service. The pack service refuses any call without it, and the server sends it with every call. Required by the pack service, and by the server when `KINDGI_PACK_SERVICE_URL` is set. Use a long random value (`openssl rand -base64 32`). Both sides drop surrounding whitespace (such as the trailing newline of a stored secret), and refuse whitespace or control characters inside: the token travels in an HTTP header. The pack service removes it from its environment before it loads the pack code.',
         example: '',
         required: true,
         appliesTo: (t) => appliesToPackService(t) || appliesToServerHttpPackTransport(t),

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkGjC,wEAAwE;AACxE,yDAAyD;AACzD,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,2BAA2B;IACpC,GAAG,EAAE,wCAAwC;IAC7C,cAAc,EAAE,+DAA+D;IAC/E,gBAAgB,EAAE,0DAA0D;IAC5E,GAAG,EAAE,0DAA0D;CACvD,CAAC;AAEX,wEAAwE;AACxE,gBAAgB;AAChB,wEAAwE;AAExE,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAElF,MAAM,wBAAwB,GAAG,CAAC,CAAY,EAAW,EAAE,CACzD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CACrD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAE/D,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAEvF,oDAAoD;AACpD,MAAM,gCAAgC,GAAG,CAAC,CAAY,EAAW,EAAE,CACjE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wOAAwO;QAC1O,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,oFAAoF;QACtF,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,uFAAuF;QACzF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oPAAoP;QACtP,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,wsBAAwsB;QAC1sB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KACrC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,4YAA4Y;QAC9Y,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,uQAAuQ;QACzQ,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,0XAA0X;QAC5X,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,0NAA0N;QAC5N,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,idAAid;QACnd,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,kSAAkS;QACpS,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,yQAAyQ;QAC3Q,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yKAAyK;QAC3K,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,gHAAgH;QAClH,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,uPAAuP;QACzP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IAED,oEAAoE;IACpE,oEAAoE;IACpE,YAAY;IACZ;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,6LAA6L;QAC/L,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ydAAyd;QAC3d,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC5C;IACD,gCAAgC;IAChC;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,2WAA2W;QAC7W,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,cAAc;KACtB;IACD,qEAAqE;IACrE,2DAA2D;IAC3D;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,wJAAwJ;QAC1J,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,8SAA8S;QAChT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAClC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,2DAA2D;IAC3D;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,6JAA6J;QAC/J,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+FAA+F;QACjG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2JAA2J;QAC7J,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,wUAAwU;QAC1U,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACpC;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yUAAyU;QAC3U,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,wbAAwb;QAC1b,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;KACH,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAE,OAA8B,EAAQ,EAAE;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAgC,CAAC,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiD,EACjD,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkGjC,wEAAwE;AACxE,yDAAyD;AACzD,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,2BAA2B;IACpC,GAAG,EAAE,wCAAwC;IAC7C,WAAW,EAAE,yEAAyE;IACtF,cAAc,EAAE,+DAA+D;IAC/E,gBAAgB,EAAE,0DAA0D;IAC5E,GAAG,EAAE,0DAA0D;CACvD,CAAC;AAEX,wEAAwE;AACxE,gBAAgB;AAChB,wEAAwE;AAExE,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAElF,MAAM,wBAAwB,GAAG,CAAC,CAAY,EAAW,EAAE,CACzD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CACrD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAE/D,MAAM,yBAAyB,GAAG,CAAC,CAAY,EAAW,EAAE,CAC1D,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,WAAW,CAAC;AAErE,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAEvF,oDAAoD;AACpD,MAAM,gCAAgC,GAAG,CAAC,CAAY,EAAW,EAAE,CACjE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wOAAwO;QAC1O,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,oFAAoF;QACtF,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,uFAAuF;QACzF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oPAAoP;QACtP,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,wsBAAwsB;QAC1sB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KACrC;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,qeAAqe;QACve,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACjC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,4YAA4Y;QAC9Y,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,uQAAuQ;QACzQ,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,0XAA0X;QAC5X,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,0NAA0N;QAC5N,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,idAAid;QACnd,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,kSAAkS;QACpS,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,yQAAyQ;QAC3Q,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yKAAyK;QAC3K,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,0KAA0K;QAC5K,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,uPAAuP;QACzP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,6bAA6b;QAC/b,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,kLAAkL;QACpL,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6PAA6P;QAC/P,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,CAAC,aAAa,CAAC;KAC/B;IAED,oEAAoE;IACpE,oEAAoE;IACpE,YAAY;IACZ;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,6LAA6L;QAC/L,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ydAAyd;QAC3d,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC5C;IACD,gCAAgC;IAChC;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,8hBAA8hB;QAChiB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,cAAc;KACtB;IACD,qEAAqE;IACrE,2DAA2D;IAC3D;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,wJAAwJ;QAC1J,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,8SAA8S;QAChT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAClC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,2DAA2D;IAC3D;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,6JAA6J;QAC/J,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+FAA+F;QACjG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2JAA2J;QAC7J,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,wUAAwU;QAC1U,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACpC;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yUAAyU;QAC3U,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,wbAAwb;QAC1b,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;KACH,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAE,OAA8B,EAAQ,EAAE;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAgC,CAAC,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiD,EACjD,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/dist/values.d.ts

@@ -12,6 +12,18 @@ export declare const PUBLIC_TOKEN_KEY_VAR = "KINDGI_PUBLIC_TOKEN_SIGNING_KEY";
 export declare const LICENSE_KEY_VAR = "KINDGI_LICENSE_KEY";
 /** The browser origins allowed on the routes a public run token opens. */
 export declare const CORS_ORIGINS_VAR = "KINDGI_CORS_ORIGINS";
+/** The shared secret between the server and the pack service. */
+export declare const PACK_SERVICE_TOKEN_VAR = "KINDGI_PACK_SERVICE_TOKEN";
+/**
+ * `KINDGI_PACK_SERVICE_TOKEN` as both sides use it, without its
+ * surrounding whitespace. The token travels in an HTTP header, which never
+ * carries surrounding whitespace, so a secret stored with a trailing
+ * newline (`openssl rand -hex 32 | gcloud secrets versions add …`) would
+ * otherwise never match the one the other side compares it with. Unset or
+ * blank: `undefined`. Throws on a token with whitespace, a control
+ * character or a non-ASCII character inside, which a header can't carry.
+ */
+export declare function parsePackServiceToken(raw: string | undefined): string | undefined;
 /**
  * Parse `KINDGI_CORS_ORIGINS`: comma-separated exact origins
  * (`https://app.example.com`, `http://localhost:3000`): a scheme, a host

package/dist/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAEhF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAc3E"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAEhF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASjF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAc3E"}

package/dist/values.js

@@ -14,6 +14,26 @@ export const PUBLIC_TOKEN_KEY_VAR = 'KINDGI_PUBLIC_TOKEN_SIGNING_KEY';
 export const LICENSE_KEY_VAR = 'KINDGI_LICENSE_KEY';
 /** The browser origins allowed on the routes a public run token opens. */
 export const CORS_ORIGINS_VAR = 'KINDGI_CORS_ORIGINS';
+/** The shared secret between the server and the pack service. */
+export const PACK_SERVICE_TOKEN_VAR = 'KINDGI_PACK_SERVICE_TOKEN';
+/**
+ * `KINDGI_PACK_SERVICE_TOKEN` as both sides use it, without its
+ * surrounding whitespace. The token travels in an HTTP header, which never
+ * carries surrounding whitespace, so a secret stored with a trailing
+ * newline (`openssl rand -hex 32 | gcloud secrets versions add …`) would
+ * otherwise never match the one the other side compares it with. Unset or
+ * blank: `undefined`. Throws on a token with whitespace, a control
+ * character or a non-ASCII character inside, which a header can't carry.
+ */
+export function parsePackServiceToken(raw) {
+    const token = raw?.trim();
+    if (token === undefined || token === '')
+        return undefined;
+    if (!/^[\x21-\x7e]+$/.test(token)) {
+        throw new Error(`${PACK_SERVICE_TOKEN_VAR} may hold only printable ASCII without spaces (it travels in an HTTP header). Use a random value such as \`openssl rand -hex 32\`.`);
+    }
+    return token;
+}
 /**
  * Parse `KINDGI_CORS_ORIGINS`: comma-separated exact origins
  * (`https://app.example.com`, `http://localhost:3000`): a scheme, a host

package/dist/values.js.map

@@ -1 +1 @@
-{"version":3,"file":"values.js","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,8DAA8D;YAC/E,4DAA4D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,sBAAsB,oIAAoI,CAC9J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,8DAA8D;YAC/E,4DAA4D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/env-schema",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Machine-readable registry of the Kindgi runtime's operator-facing env vars. Single source of truth for boot-time validation (validateEnvForTarget), .env.example scaffolding (renderEnvExample), and tools or coding agents introspecting deployment config. Adding a new env var means adding one entry here — no drift between validation, docs, and .env.example generation.",
   "license": "Apache-2.0",
   "repository": {
@@ -18,7 +18,8 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "files": [
@@ -32,7 +33,7 @@
     "vitest": "^2.1.8"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.12.0"
   },
   "publishConfig": {
     "access": "public",

package/src/index.ts

@@ -13,7 +13,9 @@ export {
 export {
   CORS_ORIGINS_VAR,
   LICENSE_KEY_VAR,
+  PACK_SERVICE_TOKEN_VAR,
   PUBLIC_TOKEN_KEY_PATH_VAR,
   PUBLIC_TOKEN_KEY_VAR,
   parseCorsOrigins,
+  parsePackServiceToken,
 } from './values.js';

package/src/schema.ts

@@ -105,6 +105,7 @@ export const ENV_GROUPS = {
   core: 'Core server config',
   secrets: 'Secrets backend selection',
   gcp: 'GCP vendor config (postgres + gcp KMS)',
+  'local-key': 'Local key (postgres + libsodium: a key this runtime holds, single-node)',
   'pack-service': 'Pack service (runs the pack code: tools and guardrail checks)',
   'image-registry': "Image registry (where deployments' images are read from)",
   dev: 'Development (`kindgi dev`; each needs `KINDGI_DEV=true`)',
@@ -126,6 +127,9 @@ const appliesToDotenvBackend = (t: EnvTarget): boolean =>
 const appliesToPostgresGcp = (t: EnvTarget): boolean =>
   appliesToPostgresBackend(t) && t.secretsBackendKms === 'gcp';
 
+const appliesToPostgresLocalKey = (t: EnvTarget): boolean =>
+  appliesToPostgresBackend(t) && t.secretsBackendKms === 'libsodium';
+
 const appliesToPackService = (t: EnvTarget): boolean => t.component === 'pack-service';
 
 /** The server, calling a pack service over HTTP. */
@@ -141,7 +145,8 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   // ---- core server ------------------------------------------------
   {
     name: 'KINDGI_API_PORT',
-    description: 'HTTP port the Kindgi API server listens on. Default 4000.',
+    description:
+      "HTTP port the Kindgi API server listens on. The first that's set wins: the `--port` flag, `KINDGI_API_PORT`, the platform's `PORT` (Cloud Run, Render, Heroku and Fly set it and send traffic only there), the config file's `port`, then 4000.",
     example: '4000',
     required: false,
     appliesTo: appliesToServer,
@@ -228,6 +233,16 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'core',
     allowedValues: ['local', 'deployed'],
   },
+  {
+    name: 'KINDGI_WEBHOOK_PRIVATE_NETWORKS',
+    description:
+      'Whether a webhook may go to a private network address: for a receiver on the same VPC or compose network as a self-hosted server. `allow` accepts a receiver whose host resolves to a private address: RFC 1918, CGNAT (100.64.0.0/10) or IPv6 unique-local. Loopback, link-local (the cloud metadata endpoints) and unroutable addresses stay refused, and webhooks stay https only. Unset or `deny`: public addresses only. Development mode (`KINDGI_DEV`) allows http and every address anyway.',
+    example: 'allow',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+    allowedValues: ['allow', 'deny'],
+  },
   {
     name: 'KINDGI_LICENSE_KEY',
     description:
@@ -324,7 +339,7 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_SECRETS_BACKEND_KMS',
     description:
-      'Which KMS vendor wraps DEKs (postgres backend only). Currently supported: `gcp`. Reserved: `aws`, `libsodium`.',
+      'Which KMS wraps DEKs (postgres backend only): `gcp` (Google Cloud KMS), or `libsodium`, a key this runtime holds (see `KINDGI_SECRETS_LOCAL_KEY_PATH`). Reserved: `aws`.',
     example: 'gcp',
     required: true,
     appliesTo: appliesToPostgresBackend,
@@ -384,6 +399,36 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'gcp',
   },
 
+  // ---- local key (libsodium) --------------------------------------
+  {
+    name: 'KINDGI_SECRETS_LOCAL_KEY_PATH',
+    description:
+      "Absolute path to the local key: a file of 32 random bytes (`openssl rand 32`, mode 0600), for `KINDGI_SECRETS_BACKEND_KMS=libsodium`. It wraps every secret's data key, and it's held on this host, next to the database: back it up apart from the database, since a lost key loses every secret. Replicas mount the same file. Starting with a different key than the secrets were stored under is refused. This or `KINDGI_SECRETS_LOCAL_KEY`, not both.",
+    example: '/etc/kindgi/secrets-local.key',
+    required: false,
+    appliesTo: appliesToPostgresLocalKey,
+    group: 'local-key',
+  },
+  {
+    name: 'KINDGI_SECRETS_LOCAL_KEY',
+    description:
+      'The local key itself, base64 (32 bytes; `openssl rand -base64 32`): for platforms that give secrets as environment variables. This or `KINDGI_SECRETS_LOCAL_KEY_PATH`, not both.',
+    example: '',
+    required: false,
+    appliesTo: appliesToPostgresLocalKey,
+    group: 'local-key',
+  },
+  {
+    name: 'KINDGI_SECRETS_LOCAL_KEY_ACK',
+    description:
+      "Exactly `single-node`: the operator's acknowledgement that the secrets' key is held on this host, next to the database, not in a cloud KMS. Not FIPS 140-3; for regulated workloads, use a cloud KMS. Required with `KINDGI_SECRETS_BACKEND_KMS=libsodium`.",
+    example: 'single-node',
+    required: true,
+    appliesTo: appliesToPostgresLocalKey,
+    group: 'local-key',
+    allowedValues: ['single-node'],
+  },
+
   // ---- pack service -----------------------------------------------
   // The server's side: where the pack service is, and how long a call
   // may take.
@@ -419,7 +464,7 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_PACK_SERVICE_TOKEN',
     description:
-      'Shared secret between the server and the pack service. The pack service refuses any call without it, and the server sends it with every call. Required by the pack service, and by the server when `KINDGI_PACK_SERVICE_URL` is set. Use a long random value (`openssl rand -base64 32`). The pack service removes it from its environment before it loads the pack code.',
+      'Shared secret between the server and the pack service. The pack service refuses any call without it, and the server sends it with every call. Required by the pack service, and by the server when `KINDGI_PACK_SERVICE_URL` is set. Use a long random value (`openssl rand -base64 32`). Both sides drop surrounding whitespace (such as the trailing newline of a stored secret), and refuse whitespace or control characters inside: the token travels in an HTTP header. The pack service removes it from its environment before it loads the pack code.',
     example: '',
     required: true,
     appliesTo: (t) => appliesToPackService(t) || appliesToServerHttpPackTransport(t),

package/src/values.ts

@@ -20,6 +20,29 @@ export const LICENSE_KEY_VAR = 'KINDGI_LICENSE_KEY';
 /** The browser origins allowed on the routes a public run token opens. */
 export const CORS_ORIGINS_VAR = 'KINDGI_CORS_ORIGINS';
 
+/** The shared secret between the server and the pack service. */
+export const PACK_SERVICE_TOKEN_VAR = 'KINDGI_PACK_SERVICE_TOKEN';
+
+/**
+ * `KINDGI_PACK_SERVICE_TOKEN` as both sides use it, without its
+ * surrounding whitespace. The token travels in an HTTP header, which never
+ * carries surrounding whitespace, so a secret stored with a trailing
+ * newline (`openssl rand -hex 32 | gcloud secrets versions add …`) would
+ * otherwise never match the one the other side compares it with. Unset or
+ * blank: `undefined`. Throws on a token with whitespace, a control
+ * character or a non-ASCII character inside, which a header can't carry.
+ */
+export function parsePackServiceToken(raw: string | undefined): string | undefined {
+  const token = raw?.trim();
+  if (token === undefined || token === '') return undefined;
+  if (!/^[\x21-\x7e]+$/.test(token)) {
+    throw new Error(
+      `${PACK_SERVICE_TOKEN_VAR} may hold only printable ASCII without spaces (it travels in an HTTP header). Use a random value such as \`openssl rand -hex 32\`.`,
+    );
+  }
+  return token;
+}
+
 /**
  * Parse `KINDGI_CORS_ORIGINS`: comma-separated exact origins
  * (`https://app.example.com`, `http://localhost:3000`): a scheme, a host