@kindgi/env-schema 0.1.4 → 0.1.5

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { ENV_GROUPS, type EnvTarget, type EnvVarSpec, KINDGI_ENV_SCHEMA, envVarsForTarget, renderEnvExample, validateEnvForTarget, } from './schema.js';
-export { CORS_ORIGINS_VAR, PUBLIC_URL_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
+export { AUTH_EMAIL_FROM_VAR, AUTH_EMAIL_LINK_DAILY_CAP_VAR, AUTH_EMAIL_SMTP_URL_PATH_VAR, AUTH_EMAIL_SMTP_URL_VAR, AUTH_GITHUB_CLIENT_ID_VAR, AUTH_GITHUB_CLIENT_SECRET_PATH_VAR, AUTH_GITHUB_CLIENT_SECRET_VAR, AUTH_GOOGLE_CLIENT_ID_VAR, AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR, AUTH_GOOGLE_CLIENT_SECRET_VAR, AUTH_MICROSOFT_CLIENT_ID_VAR, AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR, AUTH_MICROSOFT_CLIENT_SECRET_VAR, AUTH_PRIVATE_IDP_ORIGINS_VAR, AUTH_SECRET_PATH_VAR, AUTH_SECRET_VAR, AUTH_TURNSTILE_SECRET_PATH_VAR, AUTH_TURNSTILE_SECRET_VAR, AUTH_TURNSTILE_SITE_KEY_VAR, AUTH_VERIFIED_DOMAINS_VAR, CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, EXPORT_SIGNING_KEY_VAR, EXPORT_SIGNING_KMS_KEY_VAR, PUBLIC_URL_VAR, SESSION_IDLE_TIMEOUT_MS_VAR, CONSOLE_TOKEN_SIGN_IN_VAR, SESSION_TTL_MS_VAR, TRUSTED_PROXIES_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,qCAAqC,EACrC,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
 export { ENV_GROUPS, KINDGI_ENV_SCHEMA, envVarsForTarget, renderEnvExample, validateEnvForTarget, } from './schema.js';
-export { CORS_ORIGINS_VAR, PUBLIC_URL_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
+export { AUTH_EMAIL_FROM_VAR, AUTH_EMAIL_LINK_DAILY_CAP_VAR, AUTH_EMAIL_SMTP_URL_PATH_VAR, AUTH_EMAIL_SMTP_URL_VAR, AUTH_GITHUB_CLIENT_ID_VAR, AUTH_GITHUB_CLIENT_SECRET_PATH_VAR, AUTH_GITHUB_CLIENT_SECRET_VAR, AUTH_GOOGLE_CLIENT_ID_VAR, AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR, AUTH_GOOGLE_CLIENT_SECRET_VAR, AUTH_MICROSOFT_CLIENT_ID_VAR, AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR, AUTH_MICROSOFT_CLIENT_SECRET_VAR, AUTH_PRIVATE_IDP_ORIGINS_VAR, AUTH_SECRET_PATH_VAR, AUTH_SECRET_VAR, AUTH_TURNSTILE_SECRET_PATH_VAR, AUTH_TURNSTILE_SECRET_VAR, AUTH_TURNSTILE_SITE_KEY_VAR, AUTH_VERIFIED_DOMAINS_VAR, CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, EXPORT_SIGNING_KEY_VAR, EXPORT_SIGNING_KMS_KEY_VAR, PUBLIC_URL_VAR, SESSION_IDLE_TIMEOUT_MS_VAR, CONSOLE_TOKEN_SIGN_IN_VAR, SESSION_TTL_MS_VAR, TRUSTED_PROXIES_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,UAAU,EAGV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,UAAU,EAGV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,qCAAqC,EACrC,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAMD,eAAO,MAAM,UAAU;;;;;;;;;CASb,CAAC;AA2BX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EAoflD,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD,SAAS,UAAU,EAAE,CAEvB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CA8CpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAYrF"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAMD,eAAO,MAAM,UAAU;;;;;;;;;CASb,CAAC;AA2BX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EAoyBlD,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD,SAAS,UAAU,EAAE,CAEvB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CA8CpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAYrF"}

package/dist/schema.js

@@ -90,7 +90,7 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_SEED_USER_ID',
-        description: 'Seed user UUID. Pinning this across restarts keeps the FGA admin@tenant tuple stable.',
+        description: "The user the runtime's API token (`KINDGI_API_TOKEN`) acts as, made a tenant admin at every boot. Unset: the user that token had at an earlier boot (kept by the token's hash), or a new one the first time a token is used. Set it to keep one user across token changes.",
         example: '00000000-0000-4000-8000-000000000002',
         required: false,
         appliesTo: appliesToServer,
@@ -142,7 +142,7 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_ENV',
-        description: 'The env this runtime serves. Secrets a tool declares by name (`needsSpec.secrets`) resolve under this env name. Unset: `local` in development mode (the `.env` and `.env.local` files); otherwise a tool that declares secrets fails its calls, naming this variable.',
+        description: 'The env this runtime serves. The secrets and env values a tool declares by name (`needsSpec.secrets`, `needsSpec.env`) resolve under this env name. Unset: `local` in development mode (secrets from the `.env` and `.env.local` files, env values from `/v1/env`); otherwise a tool that declares either fails its calls, naming this variable.',
         example: 'production',
         required: false,
         appliesTo: appliesToServer,
@@ -164,6 +164,222 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_AUTH_SECRET_PATH',
+        description: 'Turns on sign-in with identity providers (OIDC, SAML): absolute path to a 32-byte random key (mode 0600) the browser sign-in flow signs its state with (`openssl rand 32 > auth-secret`). Needs `KINDGI_PUBLIC_URL`: identity providers send people back there. Unset (with `KINDGI_AUTH_SECRET` unset too): sign-in is off, and the API takes only API keys.',
+        example: '/etc/kindgi/auth-secret',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_SECRET',
+        description: "The same key, base64 (`base64 < auth-secret`): for platforms that give secrets as environment variables (Cloud Run with Secret Manager), where a key file's mode can't be 0600. Set this or `KINDGI_AUTH_SECRET_PATH`, not both.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_PRIVATE_IDP_ORIGINS',
+        description: "Comma-separated origins of identity providers on a private network (a self-hosted Keycloak or AD FS behind a VPN, e.g. `https://sso.corp.internal`) that tenants may register. Only public HTTPS identity providers are allowed otherwise: a tenant admin can't point the runtime at the deployment's own network.",
+        example: 'https://sso.corp.internal',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_VERIFIED_DOMAINS',
+        description: "Comma-separated `domain:tenant` pairs (the tenant by id, or by a unique slug): email domains whose sign-in routes to that tenant's identity providers. A runtime that serves one tenant routes that tenant's domains without this. One that serves several routes a domain only once it's listed here: otherwise a tenant could list another company's domain and catch its people. An unlisted domain's people can still use their provider's own sign-in link (`kindgi sso providers test` prints it). A malformed entry, or a tenant this runtime doesn't serve, stops the runtime at start.",
+        example: 'acme.com:3f8e2c1a-0b7d-4e9a-9c5f-2d1e6b8a7c40',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_GOOGLE_CLIENT_ID',
+        description: "Turns on \"Continue with Google\": the client id of the deployment's own Google app (an OAuth client (Web application)). People who've been added to a workspace sign in with their Google account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/google`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_GOOGLE_CLIENT_SECRET` or `…_SECRET_PATH`).",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET',
+        description: "The Google app's client secret, for platforms that give secrets as environment variables. Set this or `KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH`, not both.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH',
+        description: "A file (mode 0600) holding the Google app's client secret. Set this or `KINDGI_AUTH_GOOGLE_CLIENT_SECRET`, not both.",
+        example: '/etc/kindgi/google-client-secret',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_MICROSOFT_CLIENT_ID',
+        description: "Turns on \"Continue with Microsoft\": the client id of the deployment's own Microsoft app (an app registration (multitenant, with the ID-token optional claims `email` and `xms_edov`)). People who've been added to a workspace sign in with their Microsoft account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/microsoft`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_MICROSOFT_CLIENT_SECRET` or `…_SECRET_PATH`).",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET',
+        description: "The Microsoft app's client secret, for platforms that give secrets as environment variables. Set this or `KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH`, not both.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH',
+        description: "A file (mode 0600) holding the Microsoft app's client secret. Set this or `KINDGI_AUTH_MICROSOFT_CLIENT_SECRET`, not both.",
+        example: '/etc/kindgi/microsoft-client-secret',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_GITHUB_CLIENT_ID',
+        description: "Turns on \"Continue with GitHub\": the client id of the deployment's own GitHub app (an OAuth App). People who've been added to a workspace sign in with their GitHub account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/github`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_GITHUB_CLIENT_SECRET` or `…_SECRET_PATH`).",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_GITHUB_CLIENT_SECRET',
+        description: "The GitHub app's client secret, for platforms that give secrets as environment variables. Set this or `KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH`, not both.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH',
+        description: "A file (mode 0600) holding the GitHub app's client secret. Set this or `KINDGI_AUTH_GITHUB_CLIENT_SECRET`, not both.",
+        example: '/etc/kindgi/github-client-secret',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_EMAIL_SMTP_URL',
+        description: "Turns on the emailed sign-in link: people who've been added to a workspace can ask for a one-time link (ten minutes) by email. The SMTP server to send it through, with its credentials: `smtps://user:password@smtp.example.com:465`. Any provider works (Resend, Postmark, Amazon SES, your own relay). Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and `KINDGI_AUTH_EMAIL_FROM`. Set this or `KINDGI_AUTH_EMAIL_SMTP_URL_PATH`, not both.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_EMAIL_SMTP_URL_PATH',
+        description: 'A file (mode 0600) holding the SMTP URL with its credentials. Set this or `KINDGI_AUTH_EMAIL_SMTP_URL`, not both.',
+        example: '/etc/kindgi/smtp-url',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_EMAIL_FROM',
+        description: "The emailed sign-in link's From address, on a domain your SMTP provider may send for (SPF and DKIM set up): `Kindgi <sign-in@acme.com>`.",
+        example: 'Kindgi <sign-in@acme.com>',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_EMAIL_LINK_DAILY_CAP',
+        description: "The emailed sign-in link's backstop: at most this many links a day to one address from one client network (IPv4 /24, IPv6 /64). Default 20. Before it: one a minute and 3 per 15 minutes to an address, except for the browser that already got a link for it, so someone else's requests can't keep its person out. At a limit the request answers as usual, and nothing is sent.",
+        example: '20',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_TURNSTILE_SECRET',
+        description: "A Cloudflare Turnstile secret key: asking for an emailed link then needs the widget's token, checked with Cloudflare. Required when the runtime serves several tenants. Without it (one tenant), the link is still sent only to people who can sign in, within the per-address limits (see `KINDGI_AUTH_EMAIL_LINK_DAILY_CAP`), and requests are rate-limited per client. Set this or `KINDGI_AUTH_TURNSTILE_SECRET_PATH`, not both, with `KINDGI_AUTH_TURNSTILE_SITE_KEY`.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_TURNSTILE_SECRET_PATH',
+        description: 'A file (mode 0600) holding the Turnstile secret key. Set this or `KINDGI_AUTH_TURNSTILE_SECRET`, not both.',
+        example: '/etc/kindgi/turnstile-secret',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_AUTH_TURNSTILE_SITE_KEY',
+        description: 'The Turnstile site key the sign-in page shows the widget with (public). Set with the secret.',
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_TRUSTED_PROXIES',
+        description: "Which proxies in front of the runtime to trust for the client's address, which rate limits and audit records use. Unset: the connection's peer, and `X-Forwarded-For` is ignored (anyone can send it). A hop count (`1` behind one proxy such as a cloud load balancer or ingress, `2` behind two) or comma-separated IPs/CIDR ranges of your proxies: the client is the first `X-Forwarded-For` hop, from the right, that isn't one of them; never the leftmost on its own. Behind a proxy without this, every client counts as the proxy, so rate limits are shared by everyone.",
+        example: '1',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_SESSION_TTL_MS',
+        description: "A browser session's absolute lifetime, in milliseconds: the person signs in again after it. Default 43200000 (12 hours); at least 60000.",
+        example: '43200000',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_SESSION_IDLE_TIMEOUT_MS',
+        description: 'How long a browser session may sit idle before it ends, in milliseconds. Default 3600000 (60 minutes); at least 60000, and no longer than `KINDGI_SESSION_TTL_MS`.',
+        example: '3600000',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_CONSOLE_TOKEN_SIGN_IN',
+        description: "Whether a person may sign in to the console with an API token: `on` or `off`. Default `off`, and `on` in local development (`kindgi dev`). The token is exchanged once for a browser session (the same cookie as sign-in with an identity provider) and never kept in the browser. Only a person's full key opens a session, never a service account's or a narrowed key. API tokens work for the API, CLI and SDKs either way. Set `on` to keep signing in to the console by pasting a token when it has no identity provider.",
+        example: 'on',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_EXPORT_SIGNING_KEY_PATH',
+        description: 'Absolute path to the private key (PKCS#8 PEM, mode 0600) that signs exports: approval audit bundles, run provenance and compliance evidence. An Ed25519 key signs `ed25519` (`openssl genpkey -algorithm ed25519`); an EC P-256 key signs `ecdsa-p256-sha256`. Use a key for this alone; `GET /v1/export-signing-keys` publishes its public half. Set one of this, `KINDGI_EXPORT_SIGNING_KEY` or `KINDGI_EXPORT_SIGNING_KMS_KEY`. None: in development mode the server signs with a key generated at startup; otherwise exports answer `404 signing-not-configured`.',
+        example: '/etc/kindgi/export-signing.pem',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_EXPORT_SIGNING_KEY',
+        description: "The same key's PEM file, base64 (`base64 < key.pem`): for platforms that give secrets as environment variables, such as Cloud Run with Secret Manager. A production path in its own right.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_EXPORT_SIGNING_KMS_KEY',
+        description: "Optional: a Cloud KMS key version that signs exports, so the private key never leaves KMS: `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>/cryptoKeyVersions/<n>`. It must be an `EC_SIGN_ED25519` key (it signs `ed25519`) or an `EC_SIGN_P256_SHA256` key (`ecdsa-p256-sha256`), and the server's service account needs `roles/cloudkms.signerVerifier` on it (and `roles/cloudkms.publicKeyViewer`, to read its public key at boot).",
+        example: 'projects/acme/locations/global/keyRings/kindgi/cryptoKeys/exports/cryptoKeyVersions/1',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_CORS_ORIGINS',
         description: 'Comma-separated browser origins allowed to call, cross-origin, the routes a public run token can use (`GET /v1/runs/{runId}/progress` and its stream). Exact origins, no wildcards. Unset: no CORS headers on any route.',
@@ -188,14 +404,70 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_MEMORY_EMBEDDINGS',
+        description: "Turns on memory search by meaning, with the embedding provider: `openai-compat`, an embeddings endpoint that speaks OpenAI's `POST /embeddings` (OpenAI, Ollama, vLLM, Hugging Face TEI, LM Studio; set `KINDGI_MEMORY_EMBEDDINGS_URL` and `KINDGI_MEMORY_EMBEDDINGS_MODEL`), or `local:<model>`, a model run inside the server (`bge-small-en-v1.5`, `nomic-embed-text-v1.5` or `mxbai-embed-large-v1`; only for a server run from source on macOS or glibc Linux: the runtime image can't load it, and the server refuses to start there). Facts are embedded when written, and a background job embeds the ones already there; agents' `semantic` and `both` retrieval and `/v1/memory/retrieve` then search by meaning. Unset (the default): keyword search only; a `semantic` intent fails its turn with `semantic-unavailable`, `both` runs its keyword half, and publishing such an agent warns. An endpoint that doesn't answer yet doesn't stop the server: it is retried in the background (its first answer gives the dimensions), search by meaning waits for it (`semantic-unavailable` meanwhile, writes kept without a vector until then), and `/ready` says `memoryEmbeddings: unavailable (retrying)`.",
+        example: 'openai-compat',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_MEMORY_EMBEDDINGS_URL',
+        description: "With `KINDGI_MEMORY_EMBEDDINGS=openai-compat`: the endpoint's base URL, with its `/v1` (`http://localhost:11434/v1` for Ollama, `https://api.openai.com/v1`). Required then.",
+        example: 'http://localhost:11434/v1',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_MEMORY_EMBEDDINGS_MODEL',
+        description: 'With `KINDGI_MEMORY_EMBEDDINGS=openai-compat`: the embedding model the endpoint serves (`nomic-embed-text`, `text-embedding-3-small`). Required then. A different model means a new vector space: the background job re-embeds every fact in it.',
+        example: 'nomic-embed-text',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_MEMORY_EMBEDDINGS_API_KEY',
+        description: "With `KINDGI_MEMORY_EMBEDDINGS=openai-compat`: the endpoint's key, mapped into the environment from your secret store; Kindgi never stores it. Optional: Ollama and a local TEI take none.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_RETENTION_SWEEP_INTERVAL_MS',
-        description: "How often the server purges deleted rows on its own, in milliseconds: in every tenant it serves, it purges for good the tombstones past their retention policy's grace, as `POST /v1/retention/sweep` does, holds (`graceSeconds: -1`) kept, and logs what it purged. Unset (the default): nothing purges on its own; sweep with `POST /v1/retention/sweep` or the console. At least 60000, or the server refuses to start.",
+        description: "How often the server purges deleted rows on its own, in milliseconds: in every tenant it serves, it purges for good the tombstones past their retention policy's grace, as `POST /v1/retention/sweep` does, holds (`graceSeconds: -1`) kept, and logs what it purged. Memory facts and conversations purge only under a policy naming their domain (`memory`, `conversation`), never under a `*` policy. Unset (the default): nothing purges on its own; sweep with `POST /v1/retention/sweep` or the console. At least 60000, or the server refuses to start.",
         example: '3600000',
         required: false,
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_ERASURE_SHARED_WAIT_MS',
+        description: "How long an erasure waits for a turn of the person's that sits in a flow serving other people (cancelling it now could end their work), in milliseconds. The erasure shows `waiting-on-run`, naming the run, until then; at the deadline it cancels the run and goes on, and a tenant admin can stop the wait sooner (`kindgi memory erasures resume <id> --force`). Default 604800000 (7 days).",
+        example: '604800000',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_ERASURE_LEDGER_KEY_PATH',
+        description: "Absolute path to the erasure ledger's 32-byte key file (mode 0600), the same on every replica, whatever the secrets backend. The ledger keeps a keyed hash of whom each erasure erased, so after a backup restore `kindgi memory erasures replay` finds them again. Unset (and no `KINDGI_ERASURE_LEDGER_KEY`): erasures still run, but can't be replayed after a restore. Losing the key means losing replay. This or `KINDGI_ERASURE_LEDGER_KEY`, not both.",
+        example: '/etc/kindgi/erasure-ledger.key',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_ERASURE_LEDGER_KEY',
+        description: "The erasure ledger's 32-byte key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager), where a key file's mode can't be 0600. See `KINDGI_ERASURE_LEDGER_KEY_PATH`; this or that, not both.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_COMPLIANCE_CLASSIFIER',
         description: "Turns on the audit trail's compliance features: `shipped` uses the classifier the runtime ships; or give the absolute path of your own classifier JSON. When set, the server serves `/v1/compliance/*` (audit events as compliance evidence, and their signed export) and **purges audit events by kind, as the classifier says**. With `shipped`: authorization decisions after 90 days (denials after 365), run outcomes and guardrail violations after 730 days; secret changes and approval decisions are kept (legal hold), and so are kinds the classifier doesn't list. Unset (the default): no `/v1/compliance/*`, and no audit event is ever purged.",
@@ -204,7 +476,22 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
-    // ---- logging ----------------------------------------------------
+    {
+        name: 'KINDGI_ARTIFACTS',
+        description: "Where artifacts' files go, which turns on `/v1/artifacts`: `local:<absolute dir>` (a directory on this machine) or `gcs:<bucket>[/<prefix>]` (a Google Cloud Storage bucket, through Application Default Credentials: workload identity on GCP, no keys to store). Metadata is in Postgres; a deleted artifact is purged under the `artifact` retention policy. Unset (the default): no `/v1/artifacts`. `kindgi dev` sets it to the pack's `.kindgi/dev/artifacts`.",
+        example: 'gcs:acme-artifacts/prod',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_ARTIFACT_MAX_BYTES',
+        description: 'The most bytes one artifact upload may carry, the whole request body; more is `413 artifact-too-large`. Default 104857600 (100 MB).',
+        example: '104857600',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_LOG_LEVEL',
         description: 'The lowest level written: `error`, `warn`, `info` (default), `debug` or `trace`. At `info` an idle runtime writes nothing after its boot record but background work that did something. An unknown level stops the server at boot, naming this variable (exit code 2).',
@@ -234,7 +521,6 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'logging',
         allowedValues: ['auto', 'json', 'pretty'],
     },
-    // ---- secrets backend --------------------------------------------
     {
         name: 'KINDGI_SECRETS_BACKEND',
         description: 'Where secret bytes live. `none` (default; /v1/secrets/* unmounted) | `postgres` (envelope-encrypted, needs KMS) | `dotenv` (`.env` files in a directory; development only, needs `KINDGI_DEV=true`) | `secret-manager` (reserved; not supported through this variable).',
@@ -285,7 +571,6 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToPostgresBackend,
         group: 'secrets',
     },
-    // ---- GCP vendor -------------------------------------------------
     {
         name: 'KINDGI_SECRETS_GCP_PROJECT_ID',
         description: 'GCP project id owning the KMS keyring + key.',
@@ -318,7 +603,6 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToPostgresGcp,
         group: 'gcp',
     },
-    // ---- local key (libsodium) --------------------------------------
     {
         name: 'KINDGI_SECRETS_LOCAL_KEY_PATH',
         description: "Absolute path to the local key: a file of 32 random bytes (`openssl rand 32`, mode 0600), for `KINDGI_SECRETS_BACKEND_KMS=libsodium`. It wraps every secret's data key, and it's held on this host, next to the database: back it up apart from the database, since a lost key loses every secret. Replicas mount the same file. Starting with a different key than the secrets were stored under is refused. This or `KINDGI_SECRETS_LOCAL_KEY`, not both.",
@@ -344,9 +628,6 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'local-key',
         allowedValues: ['single-node'],
     },
-    // ---- pack service -----------------------------------------------
-    // The server's side: where the pack service is, and how long a call
-    // may take.
     {
         name: 'KINDGI_PACK_SERVICE_URL',
         description: 'Base URL of the pack service, the separate process that runs the pack code (its tools and guardrail checks), e.g. `http://pack-service:8080` or its internal Cloud Run URL. Set: the server calls it over HTTP for every pack tool and check, and needs `KINDGI_PACK_SERVICE_TOKEN`. Unset: no pack code runs, and a pack tool fails saying no pack service is wired. `kindgi dev` runs its own.',
@@ -372,7 +653,6 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'pack-service',
         allowedValues: ['token', 'google-id-token'],
     },
-    // Both sides: the shared token.
     {
         name: 'KINDGI_PACK_SERVICE_TOKEN',
         description: 'Shared secret between the server and the pack service. The pack service refuses any call without it, and the server sends it with every call. Required by the pack service, and by the server when `KINDGI_PACK_SERVICE_URL` is set. Use a long random value (`openssl rand -base64 32`). Both sides drop surrounding whitespace (such as the trailing newline of a stored secret), and refuse whitespace or control characters inside: the token travels in an HTTP header. The pack service removes it from its environment before it loads the pack code.',
@@ -381,8 +661,6 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: (t) => appliesToPackService(t) || appliesToServerHttpPackTransport(t),
         group: 'pack-service',
     },
-    // The pack service's side. It also listens on `PORT` (default 8080),
-    // the platform convention, which is not a Kindgi variable.
     {
         name: 'KINDGI_PACK_INDEX',
         description: "Path of the pack's `index.json` in the pack service's image. Default `/app/index.json`, where `kindgi build` puts it; the `--index` flag overrides it.",
@@ -408,9 +686,6 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'pack-service',
         allowedValues: ['strict', 'warn'],
     },
-    // ---- image registry ---------------------------------------------
-    // How the server reads a deployment's image to verify it (`POST
-    // /v1/deployments`): anonymous unless credentials are set.
     {
         name: 'KINDGI_IMAGE_REGISTRY_HOST',
         description: 'The registry host the credentials below are for, with its port when it has one (e.g. `registry.example`, `ghcr.io`). Other registries are read anonymously.',
@@ -452,7 +727,6 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'image-registry',
         allowedValues: ['static', 'google'],
     },
-    // ---- development (`kindgi dev`) ---------------------------------
     {
         name: 'KINDGI_PACK_DIR',
         description: "Development only: the pack directory `kindgi dev` runs. The server reads the pack's tools, guardrails, agents and flows from the index `kindgi dev` writes there (`.kindgi/dev/index.json`), on every change, instead of from Postgres; signed deployments are off. Mount the directory, not the file: the index is replaced by rename.",

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkGjC,wEAAwE;AACxE,yDAAyD;AACzD,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,2BAA2B;IACpC,GAAG,EAAE,wCAAwC;IAC7C,WAAW,EAAE,yEAAyE;IACtF,cAAc,EAAE,+DAA+D;IAC/E,gBAAgB,EAAE,0DAA0D;IAC5E,GAAG,EAAE,0DAA0D;CACvD,CAAC;AAEX,wEAAwE;AACxE,gBAAgB;AAChB,wEAAwE;AAExE,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAElF,MAAM,wBAAwB,GAAG,CAAC,CAAY,EAAW,EAAE,CACzD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CACrD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAE/D,MAAM,yBAAyB,GAAG,CAAC,CAAY,EAAW,EAAE,CAC1D,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,WAAW,CAAC;AAErE,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAEvF,oDAAoD;AACpD,MAAM,gCAAgC,GAAG,CAAC,CAAY,EAAW,EAAE,CACjE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wOAAwO;QAC1O,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,yVAAyV;QAC3V,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,oFAAoF;QACtF,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,uFAAuF;QACzF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oPAAoP;QACtP,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,wsBAAwsB;QAC1sB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KACrC;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,qeAAqe;QACve,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACjC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,4YAA4Y;QAC9Y,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,uQAAuQ;QACzQ,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,0XAA0X;QAC5X,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,0NAA0N;QAC5N,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,sjBAAsjB;QACxjB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4TAA4T;QAC9T,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,6ZAA6Z;QAC/Z,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,+nBAA+nB;QACjoB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,wQAAwQ;QAC1Q,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;KAC3D;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,0TAA0T;QAC5T,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,kRAAkR;QACpR,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC1C;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,yQAAyQ;QAC3Q,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yKAAyK;QAC3K,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,0KAA0K;QAC5K,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,uPAAuP;QACzP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,6bAA6b;QAC/b,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,kLAAkL;QACpL,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6PAA6P;QAC/P,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,CAAC,aAAa,CAAC;KAC/B;IAED,oEAAoE;IACpE,oEAAoE;IACpE,YAAY;IACZ;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,6LAA6L;QAC/L,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ydAAyd;QAC3d,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC5C;IACD,gCAAgC;IAChC;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,8hBAA8hB;QAChiB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,cAAc;KACtB;IACD,qEAAqE;IACrE,2DAA2D;IAC3D;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,wJAAwJ;QAC1J,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,8SAA8S;QAChT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAClC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,2DAA2D;IAC3D;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,6JAA6J;QAC/J,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+FAA+F;QACjG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2JAA2J;QAC7J,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,wUAAwU;QAC1U,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACpC;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yUAAyU;QAC3U,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,wbAAwb;QAC1b,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;KACH,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAE,OAA8B,EAAQ,EAAE;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAgC,CAAC,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiD,EACjD,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkGjC,wEAAwE;AACxE,yDAAyD;AACzD,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,2BAA2B;IACpC,GAAG,EAAE,wCAAwC;IAC7C,WAAW,EAAE,yEAAyE;IACtF,cAAc,EAAE,+DAA+D;IAC/E,gBAAgB,EAAE,0DAA0D;IAC5E,GAAG,EAAE,0DAA0D;CACvD,CAAC;AAEX,wEAAwE;AACxE,gBAAgB;AAChB,wEAAwE;AAExE,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAElF,MAAM,wBAAwB,GAAG,CAAC,CAAY,EAAW,EAAE,CACzD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CACrD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAE/D,MAAM,yBAAyB,GAAG,CAAC,CAAY,EAAW,EAAE,CAC1D,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,WAAW,CAAC;AAErE,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAEvF,oDAAoD;AACpD,MAAM,gCAAgC,GAAG,CAAC,CAAY,EAAW,EAAE,CACjE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wOAAwO;QAC1O,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,yVAAyV;QAC3V,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,oFAAoF;QACtF,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,4QAA4Q;QAC9Q,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oPAAoP;QACtP,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,wsBAAwsB;QAC1sB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KACrC;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,qeAAqe;QACve,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACjC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,4YAA4Y;QAC9Y,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,kVAAkV;QACpV,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,0XAA0X;QAC5X,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,+VAA+V;QACjW,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,kOAAkO;QACpO,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,oTAAoT;QACtT,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ikBAAikB;QACnkB,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ibAAib;QACnb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,0JAA0J;QAC5J,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EACT,sHAAsH;QACxH,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,0fAA0f;QAC5f,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,0CAA0C;QAChD,WAAW,EACT,4HAA4H;QAC9H,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4ZAA4Z;QAC9Z,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,0JAA0J;QAC5J,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EACT,sHAAsH;QACxH,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,+aAA+a;QACjb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,mHAAmH;QACrH,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,0IAA0I;QAC5I,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,oXAAoX;QACtX,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6cAA6c;QAC/c,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,4GAA4G;QAC9G,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,8FAA8F;QAChG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,ojBAAojB;QACtjB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,0IAA0I;QAC5I,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,oKAAoK;QACtK,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,igBAAigB;QACngB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,uiBAAuiB;QACziB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,ibAAib;QACnb,OAAO,EACL,uFAAuF;QACzF,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,0NAA0N;QAC5N,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,sjBAAsjB;QACxjB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4TAA4T;QAC9T,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ypCAAypC;QAC3pC,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,8KAA8K;QAChL,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kPAAkP;QACpP,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,giBAAgiB;QACliB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+bAA+b;QACjc,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,+nBAA+nB;QACjoB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,scAAsc;QACxc,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,qIAAqI;QACvI,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,wQAAwQ;QAC1Q,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;KAC3D;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,0TAA0T;QAC5T,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,kRAAkR;QACpR,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,yQAAyQ;QAC3Q,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yKAAyK;QAC3K,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,0KAA0K;QAC5K,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,uPAAuP;QACzP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,6bAA6b;QAC/b,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,kLAAkL;QACpL,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6PAA6P;QAC/P,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,CAAC,aAAa,CAAC;KAC/B;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,6LAA6L;QAC/L,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ydAAyd;QAC3d,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC5C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,8hBAA8hB;QAChiB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,wJAAwJ;QAC1J,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,8SAA8S;QAChT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAClC;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,6JAA6J;QAC/J,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+FAA+F;QACjG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2JAA2J;QAC7J,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,wUAAwU;QAC1U,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACpC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yUAAyU;QAC3U,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,wbAAwb;QAC1b,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;KACH,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAE,OAA8B,EAAQ,EAAE;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAgC,CAAC,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiD,EACjD,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/dist/values.d.ts

@@ -8,12 +8,58 @@
 export declare const PUBLIC_TOKEN_KEY_PATH_VAR = "KINDGI_PUBLIC_TOKEN_SIGNING_KEY_PATH";
 /** The same key's PEM file, base64: the alternative to the path. */
 export declare const PUBLIC_TOKEN_KEY_VAR = "KINDGI_PUBLIC_TOKEN_SIGNING_KEY";
+/** The export signing key's PEM file (an absolute path), its base64 value, or a Cloud KMS key version: exactly one. */
+export declare const EXPORT_SIGNING_KEY_PATH_VAR = "KINDGI_EXPORT_SIGNING_KEY_PATH";
+export declare const EXPORT_SIGNING_KEY_VAR = "KINDGI_EXPORT_SIGNING_KEY";
+export declare const EXPORT_SIGNING_KMS_KEY_VAR = "KINDGI_EXPORT_SIGNING_KMS_KEY";
 /** The license key the server checks at startup outside development mode. */
 export declare const LICENSE_KEY_VAR = "KINDGI_LICENSE_KEY";
 /** The browser origins allowed on the routes a public run token opens. */
 export declare const CORS_ORIGINS_VAR = "KINDGI_CORS_ORIGINS";
 /** The URL clients reach the runtime at, when it isn't the address it binds. */
 export declare const PUBLIC_URL_VAR = "KINDGI_PUBLIC_URL";
+/** Sign-in with identity providers: the secret its browser flow signs with (a file). */
+export declare const AUTH_SECRET_PATH_VAR = "KINDGI_AUTH_SECRET_PATH";
+/** The same secret, base64. */
+export declare const AUTH_SECRET_VAR = "KINDGI_AUTH_SECRET";
+/** Identity provider origins on a private network the operator allows. */
+export declare const AUTH_PRIVATE_IDP_ORIGINS_VAR = "KINDGI_AUTH_PRIVATE_IDP_ORIGINS";
+/** Email domains the operator verified, each for one tenant: `domain:tenant,…`. */
+export declare const AUTH_VERIFIED_DOMAINS_VAR = "KINDGI_AUTH_VERIFIED_DOMAINS";
+/** "Continue with Google": the deployment's own app's client id. */
+export declare const AUTH_GOOGLE_CLIENT_ID_VAR = "KINDGI_AUTH_GOOGLE_CLIENT_ID";
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export declare const AUTH_GOOGLE_CLIENT_SECRET_VAR = "KINDGI_AUTH_GOOGLE_CLIENT_SECRET";
+export declare const AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR = "KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH";
+/** "Continue with Microsoft": the deployment's own app's client id. */
+export declare const AUTH_MICROSOFT_CLIENT_ID_VAR = "KINDGI_AUTH_MICROSOFT_CLIENT_ID";
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export declare const AUTH_MICROSOFT_CLIENT_SECRET_VAR = "KINDGI_AUTH_MICROSOFT_CLIENT_SECRET";
+export declare const AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR = "KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH";
+/** "Continue with GitHub": the deployment's own app's client id. */
+export declare const AUTH_GITHUB_CLIENT_ID_VAR = "KINDGI_AUTH_GITHUB_CLIENT_ID";
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export declare const AUTH_GITHUB_CLIENT_SECRET_VAR = "KINDGI_AUTH_GITHUB_CLIENT_SECRET";
+export declare const AUTH_GITHUB_CLIENT_SECRET_PATH_VAR = "KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH";
+/** The emailed sign-in link: the SMTP server to send it through (a URL with its credentials), or a file holding it. */
+export declare const AUTH_EMAIL_SMTP_URL_VAR = "KINDGI_AUTH_EMAIL_SMTP_URL";
+export declare const AUTH_EMAIL_SMTP_URL_PATH_VAR = "KINDGI_AUTH_EMAIL_SMTP_URL_PATH";
+/** The emailed sign-in link's From address. */
+export declare const AUTH_EMAIL_FROM_VAR = "KINDGI_AUTH_EMAIL_FROM";
+/** At most this many emailed links to one address in 24 hours. Default 10. */
+export declare const AUTH_EMAIL_LINK_DAILY_CAP_VAR = "KINDGI_AUTH_EMAIL_LINK_DAILY_CAP";
+/** Cloudflare Turnstile on asking for an emailed link: its secret (or a file holding it) and its site key. */
+export declare const AUTH_TURNSTILE_SECRET_VAR = "KINDGI_AUTH_TURNSTILE_SECRET";
+export declare const AUTH_TURNSTILE_SECRET_PATH_VAR = "KINDGI_AUTH_TURNSTILE_SECRET_PATH";
+export declare const AUTH_TURNSTILE_SITE_KEY_VAR = "KINDGI_AUTH_TURNSTILE_SITE_KEY";
+/** Which hops in front of the runtime to trust for the client's address: a hop count, or IPs/CIDRs. */
+export declare const TRUSTED_PROXIES_VAR = "KINDGI_TRUSTED_PROXIES";
+/** A browser session's absolute lifetime, in milliseconds. */
+export declare const SESSION_TTL_MS_VAR = "KINDGI_SESSION_TTL_MS";
+/** How long a browser session may sit idle, in milliseconds. */
+export declare const SESSION_IDLE_TIMEOUT_MS_VAR = "KINDGI_SESSION_IDLE_TIMEOUT_MS";
+/** Whether a person may sign in to the console with an API token (`on` / `off`). */
+export declare const CONSOLE_TOKEN_SIGN_IN_VAR = "KINDGI_CONSOLE_TOKEN_SIGN_IN";
 /** The shared secret between the server and the pack service. */
 export declare const PACK_SERVICE_TOKEN_VAR = "KINDGI_PACK_SERVICE_TOKEN";
 /**

package/dist/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAEhF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,gFAAgF;AAChF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASjF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAc3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsB1E"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAEhF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AAEtE,uHAAuH;AACvH,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E,6EAA6E;AAC7E,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,gFAAgF;AAChF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,+BAA+B;AAC/B,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAE1F,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,iEAAiE;AACjE,eAAO,MAAM,gCAAgC,wCAAwC,CAAC;AACtF,eAAO,MAAM,qCAAqC,6CAA6C,CAAC;AAEhG,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAE1F,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AACpE,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAEhF,8GAA8G;AAC9G,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAClF,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,uGAAuG;AACvG,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASjF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAc3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsB1E"}

package/dist/values.js

@@ -10,12 +10,58 @@
 export const PUBLIC_TOKEN_KEY_PATH_VAR = 'KINDGI_PUBLIC_TOKEN_SIGNING_KEY_PATH';
 /** The same key's PEM file, base64: the alternative to the path. */
 export const PUBLIC_TOKEN_KEY_VAR = 'KINDGI_PUBLIC_TOKEN_SIGNING_KEY';
+/** The export signing key's PEM file (an absolute path), its base64 value, or a Cloud KMS key version: exactly one. */
+export const EXPORT_SIGNING_KEY_PATH_VAR = 'KINDGI_EXPORT_SIGNING_KEY_PATH';
+export const EXPORT_SIGNING_KEY_VAR = 'KINDGI_EXPORT_SIGNING_KEY';
+export const EXPORT_SIGNING_KMS_KEY_VAR = 'KINDGI_EXPORT_SIGNING_KMS_KEY';
 /** The license key the server checks at startup outside development mode. */
 export const LICENSE_KEY_VAR = 'KINDGI_LICENSE_KEY';
 /** The browser origins allowed on the routes a public run token opens. */
 export const CORS_ORIGINS_VAR = 'KINDGI_CORS_ORIGINS';
 /** The URL clients reach the runtime at, when it isn't the address it binds. */
 export const PUBLIC_URL_VAR = 'KINDGI_PUBLIC_URL';
+/** Sign-in with identity providers: the secret its browser flow signs with (a file). */
+export const AUTH_SECRET_PATH_VAR = 'KINDGI_AUTH_SECRET_PATH';
+/** The same secret, base64. */
+export const AUTH_SECRET_VAR = 'KINDGI_AUTH_SECRET';
+/** Identity provider origins on a private network the operator allows. */
+export const AUTH_PRIVATE_IDP_ORIGINS_VAR = 'KINDGI_AUTH_PRIVATE_IDP_ORIGINS';
+/** Email domains the operator verified, each for one tenant: `domain:tenant,…`. */
+export const AUTH_VERIFIED_DOMAINS_VAR = 'KINDGI_AUTH_VERIFIED_DOMAINS';
+/** "Continue with Google": the deployment's own app's client id. */
+export const AUTH_GOOGLE_CLIENT_ID_VAR = 'KINDGI_AUTH_GOOGLE_CLIENT_ID';
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export const AUTH_GOOGLE_CLIENT_SECRET_VAR = 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET';
+export const AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR = 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH';
+/** "Continue with Microsoft": the deployment's own app's client id. */
+export const AUTH_MICROSOFT_CLIENT_ID_VAR = 'KINDGI_AUTH_MICROSOFT_CLIENT_ID';
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export const AUTH_MICROSOFT_CLIENT_SECRET_VAR = 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET';
+export const AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR = 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH';
+/** "Continue with GitHub": the deployment's own app's client id. */
+export const AUTH_GITHUB_CLIENT_ID_VAR = 'KINDGI_AUTH_GITHUB_CLIENT_ID';
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export const AUTH_GITHUB_CLIENT_SECRET_VAR = 'KINDGI_AUTH_GITHUB_CLIENT_SECRET';
+export const AUTH_GITHUB_CLIENT_SECRET_PATH_VAR = 'KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH';
+/** The emailed sign-in link: the SMTP server to send it through (a URL with its credentials), or a file holding it. */
+export const AUTH_EMAIL_SMTP_URL_VAR = 'KINDGI_AUTH_EMAIL_SMTP_URL';
+export const AUTH_EMAIL_SMTP_URL_PATH_VAR = 'KINDGI_AUTH_EMAIL_SMTP_URL_PATH';
+/** The emailed sign-in link's From address. */
+export const AUTH_EMAIL_FROM_VAR = 'KINDGI_AUTH_EMAIL_FROM';
+/** At most this many emailed links to one address in 24 hours. Default 10. */
+export const AUTH_EMAIL_LINK_DAILY_CAP_VAR = 'KINDGI_AUTH_EMAIL_LINK_DAILY_CAP';
+/** Cloudflare Turnstile on asking for an emailed link: its secret (or a file holding it) and its site key. */
+export const AUTH_TURNSTILE_SECRET_VAR = 'KINDGI_AUTH_TURNSTILE_SECRET';
+export const AUTH_TURNSTILE_SECRET_PATH_VAR = 'KINDGI_AUTH_TURNSTILE_SECRET_PATH';
+export const AUTH_TURNSTILE_SITE_KEY_VAR = 'KINDGI_AUTH_TURNSTILE_SITE_KEY';
+/** Which hops in front of the runtime to trust for the client's address: a hop count, or IPs/CIDRs. */
+export const TRUSTED_PROXIES_VAR = 'KINDGI_TRUSTED_PROXIES';
+/** A browser session's absolute lifetime, in milliseconds. */
+export const SESSION_TTL_MS_VAR = 'KINDGI_SESSION_TTL_MS';
+/** How long a browser session may sit idle, in milliseconds. */
+export const SESSION_IDLE_TIMEOUT_MS_VAR = 'KINDGI_SESSION_IDLE_TIMEOUT_MS';
+/** Whether a person may sign in to the console with an API token (`on` / `off`). */
+export const CONSOLE_TOKEN_SIGN_IN_VAR = 'KINDGI_CONSOLE_TOKEN_SIGN_IN';
 /** The shared secret between the server and the pack service. */
 export const PACK_SERVICE_TOKEN_VAR = 'KINDGI_PACK_SERVICE_TOKEN';
 /**

package/dist/values.js.map

@@ -1 +1 @@
-{"version":3,"file":"values.js","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,sBAAsB,oIAAoI,CAC9J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,8DAA8D;YAC/E,4DAA4D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IACE,GAAG,KAAK,SAAS;QACjB,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,yGAAyG,KAAK,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,uHAAuH;AACvH,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAE1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,qCAAqC,CAAC;AACtF,MAAM,CAAC,MAAM,qCAAqC,GAAG,0CAA0C,CAAC;AAEhG,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAEhF,8GAA8G;AAC9G,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,uGAAuG;AACvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,sBAAsB,oIAAoI,CAC9J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,8DAA8D;YAC/E,4DAA4D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IACE,GAAG,KAAK,SAAS;QACjB,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,yGAAyG,KAAK,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/env-schema",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Machine-readable registry of the Kindgi runtime's operator-facing env vars. Single source of truth for boot-time validation (validateEnvForTarget), .env.example scaffolding (renderEnvExample), and tools or coding agents introspecting deployment config. Adding a new env var means adding one entry here — no drift between validation, docs, and .env.example generation.",
   "license": "Apache-2.0",
   "repository": {

package/src/index.ts

@@ -11,8 +11,35 @@ export {
   validateEnvForTarget,
 } from './schema.js';
 export {
+  AUTH_EMAIL_FROM_VAR,
+  AUTH_EMAIL_LINK_DAILY_CAP_VAR,
+  AUTH_EMAIL_SMTP_URL_PATH_VAR,
+  AUTH_EMAIL_SMTP_URL_VAR,
+  AUTH_GITHUB_CLIENT_ID_VAR,
+  AUTH_GITHUB_CLIENT_SECRET_PATH_VAR,
+  AUTH_GITHUB_CLIENT_SECRET_VAR,
+  AUTH_GOOGLE_CLIENT_ID_VAR,
+  AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR,
+  AUTH_GOOGLE_CLIENT_SECRET_VAR,
+  AUTH_MICROSOFT_CLIENT_ID_VAR,
+  AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR,
+  AUTH_MICROSOFT_CLIENT_SECRET_VAR,
+  AUTH_PRIVATE_IDP_ORIGINS_VAR,
+  AUTH_SECRET_PATH_VAR,
+  AUTH_SECRET_VAR,
+  AUTH_TURNSTILE_SECRET_PATH_VAR,
+  AUTH_TURNSTILE_SECRET_VAR,
+  AUTH_TURNSTILE_SITE_KEY_VAR,
+  AUTH_VERIFIED_DOMAINS_VAR,
   CORS_ORIGINS_VAR,
+  EXPORT_SIGNING_KEY_PATH_VAR,
+  EXPORT_SIGNING_KEY_VAR,
+  EXPORT_SIGNING_KMS_KEY_VAR,
   PUBLIC_URL_VAR,
+  SESSION_IDLE_TIMEOUT_MS_VAR,
+  CONSOLE_TOKEN_SIGN_IN_VAR,
+  SESSION_TTL_MS_VAR,
+  TRUSTED_PROXIES_VAR,
   LICENSE_KEY_VAR,
   PACK_SERVICE_TOKEN_VAR,
   PUBLIC_TOKEN_KEY_PATH_VAR,

package/src/schema.ts

@@ -208,7 +208,7 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_SEED_USER_ID',
     description:
-      'Seed user UUID. Pinning this across restarts keeps the FGA admin@tenant tuple stable.',
+      "The user the runtime's API token (`KINDGI_API_TOKEN`) acts as, made a tenant admin at every boot. Unset: the user that token had at an earlier boot (kept by the token's hash), or a new one the first time a token is used. Set it to keep one user across token changes.",
     example: '00000000-0000-4000-8000-000000000002',
     required: false,
     appliesTo: appliesToServer,
@@ -265,7 +265,7 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_ENV',
     description:
-      'The env this runtime serves. Secrets a tool declares by name (`needsSpec.secrets`) resolve under this env name. Unset: `local` in development mode (the `.env` and `.env.local` files); otherwise a tool that declares secrets fails its calls, naming this variable.',
+      'The env this runtime serves. The secrets and env values a tool declares by name (`needsSpec.secrets`, `needsSpec.env`) resolve under this env name. Unset: `local` in development mode (secrets from the `.env` and `.env.local` files, env values from `/v1/env`); otherwise a tool that declares either fails its calls, naming this variable.',
     example: 'production',
     required: false,
     appliesTo: appliesToServer,
@@ -289,6 +289,250 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_AUTH_SECRET_PATH',
+    description:
+      'Turns on sign-in with identity providers (OIDC, SAML): absolute path to a 32-byte random key (mode 0600) the browser sign-in flow signs its state with (`openssl rand 32 > auth-secret`). Needs `KINDGI_PUBLIC_URL`: identity providers send people back there. Unset (with `KINDGI_AUTH_SECRET` unset too): sign-in is off, and the API takes only API keys.',
+    example: '/etc/kindgi/auth-secret',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_SECRET',
+    description:
+      "The same key, base64 (`base64 < auth-secret`): for platforms that give secrets as environment variables (Cloud Run with Secret Manager), where a key file's mode can't be 0600. Set this or `KINDGI_AUTH_SECRET_PATH`, not both.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_PRIVATE_IDP_ORIGINS',
+    description:
+      "Comma-separated origins of identity providers on a private network (a self-hosted Keycloak or AD FS behind a VPN, e.g. `https://sso.corp.internal`) that tenants may register. Only public HTTPS identity providers are allowed otherwise: a tenant admin can't point the runtime at the deployment's own network.",
+    example: 'https://sso.corp.internal',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_VERIFIED_DOMAINS',
+    description:
+      "Comma-separated `domain:tenant` pairs (the tenant by id, or by a unique slug): email domains whose sign-in routes to that tenant's identity providers. A runtime that serves one tenant routes that tenant's domains without this. One that serves several routes a domain only once it's listed here: otherwise a tenant could list another company's domain and catch its people. An unlisted domain's people can still use their provider's own sign-in link (`kindgi sso providers test` prints it). A malformed entry, or a tenant this runtime doesn't serve, stops the runtime at start.",
+    example: 'acme.com:3f8e2c1a-0b7d-4e9a-9c5f-2d1e6b8a7c40',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_GOOGLE_CLIENT_ID',
+    description:
+      "Turns on \"Continue with Google\": the client id of the deployment's own Google app (an OAuth client (Web application)). People who've been added to a workspace sign in with their Google account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/google`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_GOOGLE_CLIENT_SECRET` or `…_SECRET_PATH`).",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET',
+    description:
+      "The Google app's client secret, for platforms that give secrets as environment variables. Set this or `KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH`, not both.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH',
+    description:
+      "A file (mode 0600) holding the Google app's client secret. Set this or `KINDGI_AUTH_GOOGLE_CLIENT_SECRET`, not both.",
+    example: '/etc/kindgi/google-client-secret',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_MICROSOFT_CLIENT_ID',
+    description:
+      "Turns on \"Continue with Microsoft\": the client id of the deployment's own Microsoft app (an app registration (multitenant, with the ID-token optional claims `email` and `xms_edov`)). People who've been added to a workspace sign in with their Microsoft account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/microsoft`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_MICROSOFT_CLIENT_SECRET` or `…_SECRET_PATH`).",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET',
+    description:
+      "The Microsoft app's client secret, for platforms that give secrets as environment variables. Set this or `KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH`, not both.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH',
+    description:
+      "A file (mode 0600) holding the Microsoft app's client secret. Set this or `KINDGI_AUTH_MICROSOFT_CLIENT_SECRET`, not both.",
+    example: '/etc/kindgi/microsoft-client-secret',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_GITHUB_CLIENT_ID',
+    description:
+      "Turns on \"Continue with GitHub\": the client id of the deployment's own GitHub app (an OAuth App). People who've been added to a workspace sign in with their GitHub account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/github`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_GITHUB_CLIENT_SECRET` or `…_SECRET_PATH`).",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_GITHUB_CLIENT_SECRET',
+    description:
+      "The GitHub app's client secret, for platforms that give secrets as environment variables. Set this or `KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH`, not both.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH',
+    description:
+      "A file (mode 0600) holding the GitHub app's client secret. Set this or `KINDGI_AUTH_GITHUB_CLIENT_SECRET`, not both.",
+    example: '/etc/kindgi/github-client-secret',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_EMAIL_SMTP_URL',
+    description:
+      "Turns on the emailed sign-in link: people who've been added to a workspace can ask for a one-time link (ten minutes) by email. The SMTP server to send it through, with its credentials: `smtps://user:password@smtp.example.com:465`. Any provider works (Resend, Postmark, Amazon SES, your own relay). Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and `KINDGI_AUTH_EMAIL_FROM`. Set this or `KINDGI_AUTH_EMAIL_SMTP_URL_PATH`, not both.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_EMAIL_SMTP_URL_PATH',
+    description:
+      'A file (mode 0600) holding the SMTP URL with its credentials. Set this or `KINDGI_AUTH_EMAIL_SMTP_URL`, not both.',
+    example: '/etc/kindgi/smtp-url',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_EMAIL_FROM',
+    description:
+      "The emailed sign-in link's From address, on a domain your SMTP provider may send for (SPF and DKIM set up): `Kindgi <sign-in@acme.com>`.",
+    example: 'Kindgi <sign-in@acme.com>',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_EMAIL_LINK_DAILY_CAP',
+    description:
+      "The emailed sign-in link's backstop: at most this many links a day to one address from one client network (IPv4 /24, IPv6 /64). Default 20. Before it: one a minute and 3 per 15 minutes to an address, except for the browser that already got a link for it, so someone else's requests can't keep its person out. At a limit the request answers as usual, and nothing is sent.",
+    example: '20',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_TURNSTILE_SECRET',
+    description:
+      "A Cloudflare Turnstile secret key: asking for an emailed link then needs the widget's token, checked with Cloudflare. Required when the runtime serves several tenants. Without it (one tenant), the link is still sent only to people who can sign in, within the per-address limits (see `KINDGI_AUTH_EMAIL_LINK_DAILY_CAP`), and requests are rate-limited per client. Set this or `KINDGI_AUTH_TURNSTILE_SECRET_PATH`, not both, with `KINDGI_AUTH_TURNSTILE_SITE_KEY`.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_TURNSTILE_SECRET_PATH',
+    description:
+      'A file (mode 0600) holding the Turnstile secret key. Set this or `KINDGI_AUTH_TURNSTILE_SECRET`, not both.',
+    example: '/etc/kindgi/turnstile-secret',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_AUTH_TURNSTILE_SITE_KEY',
+    description:
+      'The Turnstile site key the sign-in page shows the widget with (public). Set with the secret.',
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_TRUSTED_PROXIES',
+    description:
+      "Which proxies in front of the runtime to trust for the client's address, which rate limits and audit records use. Unset: the connection's peer, and `X-Forwarded-For` is ignored (anyone can send it). A hop count (`1` behind one proxy such as a cloud load balancer or ingress, `2` behind two) or comma-separated IPs/CIDR ranges of your proxies: the client is the first `X-Forwarded-For` hop, from the right, that isn't one of them; never the leftmost on its own. Behind a proxy without this, every client counts as the proxy, so rate limits are shared by everyone.",
+    example: '1',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_SESSION_TTL_MS',
+    description:
+      "A browser session's absolute lifetime, in milliseconds: the person signs in again after it. Default 43200000 (12 hours); at least 60000.",
+    example: '43200000',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_SESSION_IDLE_TIMEOUT_MS',
+    description:
+      'How long a browser session may sit idle before it ends, in milliseconds. Default 3600000 (60 minutes); at least 60000, and no longer than `KINDGI_SESSION_TTL_MS`.',
+    example: '3600000',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_CONSOLE_TOKEN_SIGN_IN',
+    description:
+      "Whether a person may sign in to the console with an API token: `on` or `off`. Default `off`, and `on` in local development (`kindgi dev`). The token is exchanged once for a browser session (the same cookie as sign-in with an identity provider) and never kept in the browser. Only a person's full key opens a session, never a service account's or a narrowed key. API tokens work for the API, CLI and SDKs either way. Set `on` to keep signing in to the console by pasting a token when it has no identity provider.",
+    example: 'on',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_EXPORT_SIGNING_KEY_PATH',
+    description:
+      'Absolute path to the private key (PKCS#8 PEM, mode 0600) that signs exports: approval audit bundles, run provenance and compliance evidence. An Ed25519 key signs `ed25519` (`openssl genpkey -algorithm ed25519`); an EC P-256 key signs `ecdsa-p256-sha256`. Use a key for this alone; `GET /v1/export-signing-keys` publishes its public half. Set one of this, `KINDGI_EXPORT_SIGNING_KEY` or `KINDGI_EXPORT_SIGNING_KMS_KEY`. None: in development mode the server signs with a key generated at startup; otherwise exports answer `404 signing-not-configured`.',
+    example: '/etc/kindgi/export-signing.pem',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_EXPORT_SIGNING_KEY',
+    description:
+      "The same key's PEM file, base64 (`base64 < key.pem`): for platforms that give secrets as environment variables, such as Cloud Run with Secret Manager. A production path in its own right.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_EXPORT_SIGNING_KMS_KEY',
+    description:
+      "Optional: a Cloud KMS key version that signs exports, so the private key never leaves KMS: `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>/cryptoKeyVersions/<n>`. It must be an `EC_SIGN_ED25519` key (it signs `ed25519`) or an `EC_SIGN_P256_SHA256` key (`ecdsa-p256-sha256`), and the server's service account needs `roles/cloudkms.signerVerifier` on it (and `roles/cloudkms.publicKeyViewer`, to read its public key at boot).",
+    example:
+      'projects/acme/locations/global/keyRings/kindgi/cryptoKeys/exports/cryptoKeyVersions/1',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_CORS_ORIGINS',
     description:
@@ -316,15 +560,78 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_MEMORY_EMBEDDINGS',
+    description:
+      "Turns on memory search by meaning, with the embedding provider: `openai-compat`, an embeddings endpoint that speaks OpenAI's `POST /embeddings` (OpenAI, Ollama, vLLM, Hugging Face TEI, LM Studio; set `KINDGI_MEMORY_EMBEDDINGS_URL` and `KINDGI_MEMORY_EMBEDDINGS_MODEL`), or `local:<model>`, a model run inside the server (`bge-small-en-v1.5`, `nomic-embed-text-v1.5` or `mxbai-embed-large-v1`; only for a server run from source on macOS or glibc Linux: the runtime image can't load it, and the server refuses to start there). Facts are embedded when written, and a background job embeds the ones already there; agents' `semantic` and `both` retrieval and `/v1/memory/retrieve` then search by meaning. Unset (the default): keyword search only; a `semantic` intent fails its turn with `semantic-unavailable`, `both` runs its keyword half, and publishing such an agent warns. An endpoint that doesn't answer yet doesn't stop the server: it is retried in the background (its first answer gives the dimensions), search by meaning waits for it (`semantic-unavailable` meanwhile, writes kept without a vector until then), and `/ready` says `memoryEmbeddings: unavailable (retrying)`.",
+    example: 'openai-compat',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_MEMORY_EMBEDDINGS_URL',
+    description:
+      "With `KINDGI_MEMORY_EMBEDDINGS=openai-compat`: the endpoint's base URL, with its `/v1` (`http://localhost:11434/v1` for Ollama, `https://api.openai.com/v1`). Required then.",
+    example: 'http://localhost:11434/v1',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_MEMORY_EMBEDDINGS_MODEL',
+    description:
+      'With `KINDGI_MEMORY_EMBEDDINGS=openai-compat`: the embedding model the endpoint serves (`nomic-embed-text`, `text-embedding-3-small`). Required then. A different model means a new vector space: the background job re-embeds every fact in it.',
+    example: 'nomic-embed-text',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_MEMORY_EMBEDDINGS_API_KEY',
+    description:
+      "With `KINDGI_MEMORY_EMBEDDINGS=openai-compat`: the endpoint's key, mapped into the environment from your secret store; Kindgi never stores it. Optional: Ollama and a local TEI take none.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_RETENTION_SWEEP_INTERVAL_MS',
     description:
-      "How often the server purges deleted rows on its own, in milliseconds: in every tenant it serves, it purges for good the tombstones past their retention policy's grace, as `POST /v1/retention/sweep` does, holds (`graceSeconds: -1`) kept, and logs what it purged. Unset (the default): nothing purges on its own; sweep with `POST /v1/retention/sweep` or the console. At least 60000, or the server refuses to start.",
+      "How often the server purges deleted rows on its own, in milliseconds: in every tenant it serves, it purges for good the tombstones past their retention policy's grace, as `POST /v1/retention/sweep` does, holds (`graceSeconds: -1`) kept, and logs what it purged. Memory facts and conversations purge only under a policy naming their domain (`memory`, `conversation`), never under a `*` policy. Unset (the default): nothing purges on its own; sweep with `POST /v1/retention/sweep` or the console. At least 60000, or the server refuses to start.",
     example: '3600000',
     required: false,
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_ERASURE_SHARED_WAIT_MS',
+    description:
+      "How long an erasure waits for a turn of the person's that sits in a flow serving other people (cancelling it now could end their work), in milliseconds. The erasure shows `waiting-on-run`, naming the run, until then; at the deadline it cancels the run and goes on, and a tenant admin can stop the wait sooner (`kindgi memory erasures resume <id> --force`). Default 604800000 (7 days).",
+    example: '604800000',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_ERASURE_LEDGER_KEY_PATH',
+    description:
+      "Absolute path to the erasure ledger's 32-byte key file (mode 0600), the same on every replica, whatever the secrets backend. The ledger keeps a keyed hash of whom each erasure erased, so after a backup restore `kindgi memory erasures replay` finds them again. Unset (and no `KINDGI_ERASURE_LEDGER_KEY`): erasures still run, but can't be replayed after a restore. Losing the key means losing replay. This or `KINDGI_ERASURE_LEDGER_KEY`, not both.",
+    example: '/etc/kindgi/erasure-ledger.key',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_ERASURE_LEDGER_KEY',
+    description:
+      "The erasure ledger's 32-byte key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager), where a key file's mode can't be 0600. See `KINDGI_ERASURE_LEDGER_KEY_PATH`; this or that, not both.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_COMPLIANCE_CLASSIFIER',
     description:
@@ -334,8 +641,24 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
-
-  // ---- logging ----------------------------------------------------
+  {
+    name: 'KINDGI_ARTIFACTS',
+    description:
+      "Where artifacts' files go, which turns on `/v1/artifacts`: `local:<absolute dir>` (a directory on this machine) or `gcs:<bucket>[/<prefix>]` (a Google Cloud Storage bucket, through Application Default Credentials: workload identity on GCP, no keys to store). Metadata is in Postgres; a deleted artifact is purged under the `artifact` retention policy. Unset (the default): no `/v1/artifacts`. `kindgi dev` sets it to the pack's `.kindgi/dev/artifacts`.",
+    example: 'gcs:acme-artifacts/prod',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_ARTIFACT_MAX_BYTES',
+    description:
+      'The most bytes one artifact upload may carry, the whole request body; more is `413 artifact-too-large`. Default 104857600 (100 MB).',
+    example: '104857600',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_LOG_LEVEL',
     description:
@@ -368,8 +691,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'logging',
     allowedValues: ['auto', 'json', 'pretty'],
   },
-
-  // ---- secrets backend --------------------------------------------
   {
     name: 'KINDGI_SECRETS_BACKEND',
     description:
@@ -426,8 +747,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToPostgresBackend,
     group: 'secrets',
   },
-
-  // ---- GCP vendor -------------------------------------------------
   {
     name: 'KINDGI_SECRETS_GCP_PROJECT_ID',
     description: 'GCP project id owning the KMS keyring + key.',
@@ -460,8 +779,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToPostgresGcp,
     group: 'gcp',
   },
-
-  // ---- local key (libsodium) --------------------------------------
   {
     name: 'KINDGI_SECRETS_LOCAL_KEY_PATH',
     description:
@@ -490,10 +807,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'local-key',
     allowedValues: ['single-node'],
   },
-
-  // ---- pack service -----------------------------------------------
-  // The server's side: where the pack service is, and how long a call
-  // may take.
   {
     name: 'KINDGI_PACK_SERVICE_URL',
     description:
@@ -522,7 +835,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'pack-service',
     allowedValues: ['token', 'google-id-token'],
   },
-  // Both sides: the shared token.
   {
     name: 'KINDGI_PACK_SERVICE_TOKEN',
     description:
@@ -532,8 +844,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: (t) => appliesToPackService(t) || appliesToServerHttpPackTransport(t),
     group: 'pack-service',
   },
-  // The pack service's side. It also listens on `PORT` (default 8080),
-  // the platform convention, which is not a Kindgi variable.
   {
     name: 'KINDGI_PACK_INDEX',
     description:
@@ -562,10 +872,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'pack-service',
     allowedValues: ['strict', 'warn'],
   },
-
-  // ---- image registry ---------------------------------------------
-  // How the server reads a deployment's image to verify it (`POST
-  // /v1/deployments`): anonymous unless credentials are set.
   {
     name: 'KINDGI_IMAGE_REGISTRY_HOST',
     description:
@@ -612,8 +918,6 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'image-registry',
     allowedValues: ['static', 'google'],
   },
-
-  // ---- development (`kindgi dev`) ---------------------------------
   {
     name: 'KINDGI_PACK_DIR',
     description:

package/src/values.ts

@@ -14,6 +14,11 @@ export const PUBLIC_TOKEN_KEY_PATH_VAR = 'KINDGI_PUBLIC_TOKEN_SIGNING_KEY_PATH';
 /** The same key's PEM file, base64: the alternative to the path. */
 export const PUBLIC_TOKEN_KEY_VAR = 'KINDGI_PUBLIC_TOKEN_SIGNING_KEY';
 
+/** The export signing key's PEM file (an absolute path), its base64 value, or a Cloud KMS key version: exactly one. */
+export const EXPORT_SIGNING_KEY_PATH_VAR = 'KINDGI_EXPORT_SIGNING_KEY_PATH';
+export const EXPORT_SIGNING_KEY_VAR = 'KINDGI_EXPORT_SIGNING_KEY';
+export const EXPORT_SIGNING_KMS_KEY_VAR = 'KINDGI_EXPORT_SIGNING_KMS_KEY';
+
 /** The license key the server checks at startup outside development mode. */
 export const LICENSE_KEY_VAR = 'KINDGI_LICENSE_KEY';
 
@@ -23,6 +28,66 @@ export const CORS_ORIGINS_VAR = 'KINDGI_CORS_ORIGINS';
 /** The URL clients reach the runtime at, when it isn't the address it binds. */
 export const PUBLIC_URL_VAR = 'KINDGI_PUBLIC_URL';
 
+/** Sign-in with identity providers: the secret its browser flow signs with (a file). */
+export const AUTH_SECRET_PATH_VAR = 'KINDGI_AUTH_SECRET_PATH';
+
+/** The same secret, base64. */
+export const AUTH_SECRET_VAR = 'KINDGI_AUTH_SECRET';
+
+/** Identity provider origins on a private network the operator allows. */
+export const AUTH_PRIVATE_IDP_ORIGINS_VAR = 'KINDGI_AUTH_PRIVATE_IDP_ORIGINS';
+
+/** Email domains the operator verified, each for one tenant: `domain:tenant,…`. */
+export const AUTH_VERIFIED_DOMAINS_VAR = 'KINDGI_AUTH_VERIFIED_DOMAINS';
+
+/** "Continue with Google": the deployment's own app's client id. */
+export const AUTH_GOOGLE_CLIENT_ID_VAR = 'KINDGI_AUTH_GOOGLE_CLIENT_ID';
+
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export const AUTH_GOOGLE_CLIENT_SECRET_VAR = 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET';
+export const AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR = 'KINDGI_AUTH_GOOGLE_CLIENT_SECRET_PATH';
+
+/** "Continue with Microsoft": the deployment's own app's client id. */
+export const AUTH_MICROSOFT_CLIENT_ID_VAR = 'KINDGI_AUTH_MICROSOFT_CLIENT_ID';
+
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export const AUTH_MICROSOFT_CLIENT_SECRET_VAR = 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET';
+export const AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR = 'KINDGI_AUTH_MICROSOFT_CLIENT_SECRET_PATH';
+
+/** "Continue with GitHub": the deployment's own app's client id. */
+export const AUTH_GITHUB_CLIENT_ID_VAR = 'KINDGI_AUTH_GITHUB_CLIENT_ID';
+
+/** Its client secret, or a file holding it (`…_SECRET_PATH`). */
+export const AUTH_GITHUB_CLIENT_SECRET_VAR = 'KINDGI_AUTH_GITHUB_CLIENT_SECRET';
+export const AUTH_GITHUB_CLIENT_SECRET_PATH_VAR = 'KINDGI_AUTH_GITHUB_CLIENT_SECRET_PATH';
+
+/** The emailed sign-in link: the SMTP server to send it through (a URL with its credentials), or a file holding it. */
+export const AUTH_EMAIL_SMTP_URL_VAR = 'KINDGI_AUTH_EMAIL_SMTP_URL';
+export const AUTH_EMAIL_SMTP_URL_PATH_VAR = 'KINDGI_AUTH_EMAIL_SMTP_URL_PATH';
+
+/** The emailed sign-in link's From address. */
+export const AUTH_EMAIL_FROM_VAR = 'KINDGI_AUTH_EMAIL_FROM';
+
+/** At most this many emailed links to one address in 24 hours. Default 10. */
+export const AUTH_EMAIL_LINK_DAILY_CAP_VAR = 'KINDGI_AUTH_EMAIL_LINK_DAILY_CAP';
+
+/** Cloudflare Turnstile on asking for an emailed link: its secret (or a file holding it) and its site key. */
+export const AUTH_TURNSTILE_SECRET_VAR = 'KINDGI_AUTH_TURNSTILE_SECRET';
+export const AUTH_TURNSTILE_SECRET_PATH_VAR = 'KINDGI_AUTH_TURNSTILE_SECRET_PATH';
+export const AUTH_TURNSTILE_SITE_KEY_VAR = 'KINDGI_AUTH_TURNSTILE_SITE_KEY';
+
+/** Which hops in front of the runtime to trust for the client's address: a hop count, or IPs/CIDRs. */
+export const TRUSTED_PROXIES_VAR = 'KINDGI_TRUSTED_PROXIES';
+
+/** A browser session's absolute lifetime, in milliseconds. */
+export const SESSION_TTL_MS_VAR = 'KINDGI_SESSION_TTL_MS';
+
+/** How long a browser session may sit idle, in milliseconds. */
+export const SESSION_IDLE_TIMEOUT_MS_VAR = 'KINDGI_SESSION_IDLE_TIMEOUT_MS';
+
+/** Whether a person may sign in to the console with an API token (`on` / `off`). */
+export const CONSOLE_TOKEN_SIGN_IN_VAR = 'KINDGI_CONSOLE_TOKEN_SIGN_IN';
+
 /** The shared secret between the server and the pack service. */
 export const PACK_SERVICE_TOKEN_VAR = 'KINDGI_PACK_SERVICE_TOKEN';