@kindgi/env-schema 0.1.5 → 0.1.6

package/README.md

@@ -38,8 +38,9 @@ field is optional:
   (the default) or the `pack-service`, the separate process that runs
   a pack's code (its tools and guardrail checks). The pack service's
   target lists `KINDGI_PACK_SERVICE_TOKEN`, `KINDGI_PACK_INDEX`,
-  `KINDGI_PACK_SERVICE_MAX_CONCURRENCY` and `KINDGI_PACK_ENV_CHECK`, and
-  none of the server's vars.
+  `KINDGI_PACK_SERVICE_MAX_CONCURRENCY`, `KINDGI_PACK_ENV_CHECK`,
+  `KINDGI_PACK_ENV_FILTER` and `KINDGI_PACK_ENV_DECLARED`, and none of the
+  server's vars.
   It also listens on `PORT` (default 8080), the platform convention,
   which isn't a Kindgi variable.
 - **`secretsBackend`**, **`secretsBackendKms`**: the server's secrets

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { ENV_GROUPS, type EnvTarget, type EnvVarSpec, KINDGI_ENV_SCHEMA, envVarsForTarget, renderEnvExample, validateEnvForTarget, } from './schema.js';
-export { AUTH_EMAIL_FROM_VAR, AUTH_EMAIL_LINK_DAILY_CAP_VAR, AUTH_EMAIL_SMTP_URL_PATH_VAR, AUTH_EMAIL_SMTP_URL_VAR, AUTH_GITHUB_CLIENT_ID_VAR, AUTH_GITHUB_CLIENT_SECRET_PATH_VAR, AUTH_GITHUB_CLIENT_SECRET_VAR, AUTH_GOOGLE_CLIENT_ID_VAR, AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR, AUTH_GOOGLE_CLIENT_SECRET_VAR, AUTH_MICROSOFT_CLIENT_ID_VAR, AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR, AUTH_MICROSOFT_CLIENT_SECRET_VAR, AUTH_PRIVATE_IDP_ORIGINS_VAR, AUTH_SECRET_PATH_VAR, AUTH_SECRET_VAR, AUTH_TURNSTILE_SECRET_PATH_VAR, AUTH_TURNSTILE_SECRET_VAR, AUTH_TURNSTILE_SITE_KEY_VAR, AUTH_VERIFIED_DOMAINS_VAR, CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, EXPORT_SIGNING_KEY_VAR, EXPORT_SIGNING_KMS_KEY_VAR, PUBLIC_URL_VAR, SESSION_IDLE_TIMEOUT_MS_VAR, CONSOLE_TOKEN_SIGN_IN_VAR, SESSION_TTL_MS_VAR, TRUSTED_PROXIES_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
+export { AUTH_EMAIL_FROM_VAR, AUTH_EMAIL_LINK_DAILY_CAP_VAR, AUTH_EMAIL_SMTP_URL_PATH_VAR, AUTH_EMAIL_SMTP_URL_VAR, AUTH_GITHUB_CLIENT_ID_VAR, AUTH_GITHUB_CLIENT_SECRET_PATH_VAR, AUTH_GITHUB_CLIENT_SECRET_VAR, AUTH_GOOGLE_CLIENT_ID_VAR, AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR, AUTH_GOOGLE_CLIENT_SECRET_VAR, AUTH_MICROSOFT_CLIENT_ID_VAR, AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR, AUTH_MICROSOFT_CLIENT_SECRET_VAR, AUTH_PRIVATE_IDP_ORIGINS_VAR, AUTH_SECRET_PATH_VAR, AUTH_SECRET_VAR, AUTH_TENANT_PROVIDERS_VAR, AZURE_KEY_ID_VAR, AZURE_VAULT_URL_VAR, type AzureKeyId, AUTH_TURNSTILE_SECRET_PATH_VAR, AUTH_TURNSTILE_SECRET_VAR, AUTH_TURNSTILE_SITE_KEY_VAR, AUTH_VERIFIED_DOMAINS_VAR, CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, EXPORT_SIGNING_KEY_VAR, EXPORT_SIGNING_KMS_KEY_VAR, EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH_VAR, EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_VAR, PUBLIC_URL_VAR, SESSION_IDLE_TIMEOUT_MS_VAR, CONSOLE_TOKEN_SIGN_IN_VAR, SESSION_TTL_MS_VAR, TRUSTED_PROXIES_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseAzureKeyId, parseAzureVaultUrl, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,qCAAqC,EACrC,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,qCAAqC,EACrC,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,UAAU,EACf,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,2CAA2C,EAC3C,sCAAsC,EACtC,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
 export { ENV_GROUPS, KINDGI_ENV_SCHEMA, envVarsForTarget, renderEnvExample, validateEnvForTarget, } from './schema.js';
-export { AUTH_EMAIL_FROM_VAR, AUTH_EMAIL_LINK_DAILY_CAP_VAR, AUTH_EMAIL_SMTP_URL_PATH_VAR, AUTH_EMAIL_SMTP_URL_VAR, AUTH_GITHUB_CLIENT_ID_VAR, AUTH_GITHUB_CLIENT_SECRET_PATH_VAR, AUTH_GITHUB_CLIENT_SECRET_VAR, AUTH_GOOGLE_CLIENT_ID_VAR, AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR, AUTH_GOOGLE_CLIENT_SECRET_VAR, AUTH_MICROSOFT_CLIENT_ID_VAR, AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR, AUTH_MICROSOFT_CLIENT_SECRET_VAR, AUTH_PRIVATE_IDP_ORIGINS_VAR, AUTH_SECRET_PATH_VAR, AUTH_SECRET_VAR, AUTH_TURNSTILE_SECRET_PATH_VAR, AUTH_TURNSTILE_SECRET_VAR, AUTH_TURNSTILE_SITE_KEY_VAR, AUTH_VERIFIED_DOMAINS_VAR, CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, EXPORT_SIGNING_KEY_VAR, EXPORT_SIGNING_KMS_KEY_VAR, PUBLIC_URL_VAR, SESSION_IDLE_TIMEOUT_MS_VAR, CONSOLE_TOKEN_SIGN_IN_VAR, SESSION_TTL_MS_VAR, TRUSTED_PROXIES_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
+export { AUTH_EMAIL_FROM_VAR, AUTH_EMAIL_LINK_DAILY_CAP_VAR, AUTH_EMAIL_SMTP_URL_PATH_VAR, AUTH_EMAIL_SMTP_URL_VAR, AUTH_GITHUB_CLIENT_ID_VAR, AUTH_GITHUB_CLIENT_SECRET_PATH_VAR, AUTH_GITHUB_CLIENT_SECRET_VAR, AUTH_GOOGLE_CLIENT_ID_VAR, AUTH_GOOGLE_CLIENT_SECRET_PATH_VAR, AUTH_GOOGLE_CLIENT_SECRET_VAR, AUTH_MICROSOFT_CLIENT_ID_VAR, AUTH_MICROSOFT_CLIENT_SECRET_PATH_VAR, AUTH_MICROSOFT_CLIENT_SECRET_VAR, AUTH_PRIVATE_IDP_ORIGINS_VAR, AUTH_SECRET_PATH_VAR, AUTH_SECRET_VAR, AUTH_TENANT_PROVIDERS_VAR, AZURE_KEY_ID_VAR, AZURE_VAULT_URL_VAR, AUTH_TURNSTILE_SECRET_PATH_VAR, AUTH_TURNSTILE_SECRET_VAR, AUTH_TURNSTILE_SITE_KEY_VAR, AUTH_VERIFIED_DOMAINS_VAR, CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, EXPORT_SIGNING_KEY_VAR, EXPORT_SIGNING_KMS_KEY_VAR, EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH_VAR, EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_VAR, PUBLIC_URL_VAR, SESSION_IDLE_TIMEOUT_MS_VAR, CONSOLE_TOKEN_SIGN_IN_VAR, SESSION_TTL_MS_VAR, TRUSTED_PROXIES_VAR, LICENSE_KEY_VAR, PACK_SERVICE_TOKEN_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_VAR, parseAzureKeyId, parseAzureVaultUrl, parseCorsOrigins, parsePublicUrl, parsePackServiceToken, } from './values.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,UAAU,EAGV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,qCAAqC,EACrC,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EACL,UAAU,EAGV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,qCAAqC,EACrC,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EAEnB,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,2CAA2C,EAC3C,sCAAsC,EACtC,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/schema.d.ts

@@ -41,7 +41,12 @@ export interface EnvTarget {
      */
     readonly component?: 'server' | 'pack-service';
     readonly secretsBackend?: 'none' | 'postgres' | 'secret-manager' | 'dotenv';
-    readonly secretsBackendKms?: 'gcp' | 'aws' | 'libsodium' | 'vault';
+    readonly secretsBackendKms?: 'gcp' | 'azure' | 'aws' | 'libsodium' | 'vault';
+    /**
+     * The secret manager the `secret-manager` backend keeps secrets in
+     * (`KINDGI_SECRETS_MANAGER`). Absent: not chosen yet.
+     */
+    readonly secretsManager?: 'azure' | 'gcp' | 'aws' | 'vault';
     /**
      * How the server reaches the pack service: `http` when
      * `KINDGI_PACK_SERVICE_URL` is set. Absent: the server has no pack
@@ -95,7 +100,10 @@ export declare const ENV_GROUPS: {
     readonly core: "Core server config";
     readonly logging: "Logging";
     readonly secrets: "Secrets backend selection";
-    readonly gcp: "GCP vendor config (postgres + gcp KMS)";
+    readonly gcp: "GCP vendor config (postgres + gcp KMS; secret-manager + gcp)";
+    readonly aws: "AWS vendor config (the server's AWS identity; secret-manager + aws)";
+    readonly azure: "Azure vendor config (the server's managed identity; postgres + azure KMS; secret-manager + azure)";
+    readonly vault: "HashiCorp Vault / OpenBao (secret-manager + vault)";
     readonly 'local-key': "Local key (postgres + libsodium: a key this runtime holds, single-node)";
     readonly 'pack-service': "Pack service (runs the pack code: tools and guardrail checks)";
     readonly 'image-registry': "Image registry (where deployments' images are read from)";

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAMD,eAAO,MAAM,UAAU;;;;;;;;;CASb,CAAC;AA2BX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EAoyBlD,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD,SAAS,UAAU,EAAE,CAEvB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CA8CpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAYrF"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAMD,eAAO,MAAM,UAAU;;;;;;;;;;;;CAab,CAAC;AAsCX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,UAAU,EAmjClD,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD,SAAS,UAAU,EAAE,CAEvB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CA8CpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,SAAS,UAAU,EAAsB,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAYrF"}

package/dist/schema.js

@@ -7,7 +7,10 @@ export const ENV_GROUPS = {
     core: 'Core server config',
     logging: 'Logging',
     secrets: 'Secrets backend selection',
-    gcp: 'GCP vendor config (postgres + gcp KMS)',
+    gcp: 'GCP vendor config (postgres + gcp KMS; secret-manager + gcp)',
+    aws: "AWS vendor config (the server's AWS identity; secret-manager + aws)",
+    azure: "Azure vendor config (the server's managed identity; postgres + azure KMS; secret-manager + azure)",
+    vault: 'HashiCorp Vault / OpenBao (secret-manager + vault)',
     'local-key': 'Local key (postgres + libsodium: a key this runtime holds, single-node)',
     'pack-service': 'Pack service (runs the pack code: tools and guardrail checks)',
     'image-registry': "Image registry (where deployments' images are read from)",
@@ -21,7 +24,10 @@ const appliesToServer = (t) => t.component !== 'pack-service';
 const appliesToPostgresBackend = (t) => appliesToServer(t) && t.secretsBackend === 'postgres';
 const appliesToDotenvBackend = (t) => appliesToServer(t) && t.secretsBackend === 'dotenv';
 const appliesToPostgresGcp = (t) => appliesToPostgresBackend(t) && t.secretsBackendKms === 'gcp';
+const appliesToPostgresAzure = (t) => appliesToPostgresBackend(t) && t.secretsBackendKms === 'azure';
 const appliesToPostgresLocalKey = (t) => appliesToPostgresBackend(t) && t.secretsBackendKms === 'libsodium';
+const appliesToSecretManagerBackend = (t) => appliesToServer(t) && t.secretsBackend === 'secret-manager';
+const appliesToSecretManager = (manager) => (t) => appliesToSecretManagerBackend(t) && t.secretsManager === manager;
 const appliesToPackService = (t) => t.component === 'pack-service';
 /** The server, calling a pack service over HTTP. */
 const appliesToServerHttpPackTransport = (t) => appliesToServer(t) && t.packTransport === 'http';
@@ -196,6 +202,14 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_AUTH_TENANT_PROVIDERS',
+        description: "Whether a tenant's admins may add, change and remove its identity providers: `on` or `off`. Default `on`. `off` when the operator manages sign-in: then only the deployment's own token (`KINDGI_API_TOKEN`) can, and a tenant's change answers `403 identity-providers-operator-managed`. The providers already there keep signing people in either way, and anyone may still read them.",
+        example: 'off',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_AUTH_GOOGLE_CLIENT_ID',
         description: "Turns on \"Continue with Google\": the client id of the deployment's own Google app (an OAuth client (Web application)). People who've been added to a workspace sign in with their Google account, by its verified email. The app allows the redirect URI `<KINDGI_PUBLIC_URL>/auth/kindgi/social/callback/google`. Needs sign-in on (`KINDGI_AUTH_SECRET_PATH`) and the app's secret (`KINDGI_AUTH_GOOGLE_CLIENT_SECRET` or `…_SECRET_PATH`).",
@@ -284,6 +298,14 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_REVIEWER_EMAIL',
+        description: "`on` emails reviewers when an approval waits for them: the people the approvals inbox would show it to (its assigned reviewer, else every active reviewer of its required role or above), and only those who may read its project. The first email goes at once; anything more for the same person within five minutes comes as one digest. Each email has the approval's title, project, required role and a link, never what it's about (that stays behind sign-in). Sent through the emailed sign-in link's server, so it needs `KINDGI_AUTH_EMAIL_SMTP_URL` (or `_PATH`) and `KINDGI_AUTH_EMAIL_FROM`; turned on without them, the runtime refuses to start. Off by default: emailing people is the operator's choice.",
+        example: 'on',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_AUTH_EMAIL_FROM',
         description: "The emailed sign-in link's From address, on a domain your SMTP provider may send for (SPF and DKIM set up): `Kindgi <sign-in@acme.com>`.",
@@ -374,12 +396,28 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_EXPORT_SIGNING_KMS_KEY',
-        description: "Optional: a Cloud KMS key version that signs exports, so the private key never leaves KMS: `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>/cryptoKeyVersions/<n>`. It must be an `EC_SIGN_ED25519` key (it signs `ed25519`) or an `EC_SIGN_P256_SHA256` key (`ecdsa-p256-sha256`), and the server's service account needs `roles/cloudkms.signerVerifier` on it (and `roles/cloudkms.publicKeyViewer`, to read its public key at boot).",
+        description: "Optional: a KMS key version that signs exports, so the private key never leaves the KMS. Its shape picks the KMS. **Cloud KMS:** `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>/cryptoKeyVersions/<n>`, an `EC_SIGN_ED25519` key (it signs `ed25519`) or an `EC_SIGN_P256_SHA256` key (`ecdsa-p256-sha256`); the server's service account needs `roles/cloudkms.signerVerifier` on it (and `roles/cloudkms.publicKeyViewer`, to read its public key at boot). **Azure Key Vault:** `https://<vault>.vault.azure.net/keys/<name>/<version>`, with its version, an EC P-256 key allowed to sign (`ecdsa-p256-sha256`: Key Vault has no Ed25519); the server's identity needs Key Vault Crypto User on it. Any other value stops the server at boot, naming both shapes.",
         example: 'projects/acme/locations/global/keyRings/kindgi/cryptoKeys/exports/cryptoKeyVersions/1',
         required: false,
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH',
+        description: 'Absolute path to a file of one or more PEM public keys (`-----BEGIN PUBLIC KEY-----`, concatenated): export keys this deployment signed with before a rotation. `GET /v1/export-signing-keys` lists them after the active key, with `active: false`, so `kindgi exports verify --from-runtime` still trusts what they signed; they never sign. Ed25519 or EC P-256 keys, public halves only: a private key in the file stops the server at boot. Works with any signing key, file or KMS. Set this or `KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS`, not both.',
+        example: '/etc/kindgi/export-signing-retired.pem',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS',
+        description: "The same file's content, base64 (`base64 < retired.pem`): for platforms that give settings as environment variables, such as Cloud Run.",
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_CORS_ORIGINS',
         description: 'Comma-separated browser origins allowed to call, cross-origin, the routes a public run token can use (`GET /v1/runs/{runId}/progress` and its stream). Exact origins, no wildcards. Unset: no CORS headers on any route.',
@@ -404,6 +442,14 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_RUN_ENDED_CHECK_MS',
+        description: 'How often each server stops the runs it executes that were ended from outside (cancelled, on this server or another), in milliseconds. A run stops starting steps at its next write either way; this also stops a step that writes nothing for a while, such as a long model call, within this time of a cancel. Default 5000; at least 1000, or the server refuses to start.',
+        example: '5000',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_MEMORY_EMBEDDINGS',
         description: "Turns on memory search by meaning, with the embedding provider: `openai-compat`, an embeddings endpoint that speaks OpenAI's `POST /embeddings` (OpenAI, Ollama, vLLM, Hugging Face TEI, LM Studio; set `KINDGI_MEMORY_EMBEDDINGS_URL` and `KINDGI_MEMORY_EMBEDDINGS_MODEL`), or `local:<model>`, a model run inside the server (`bge-small-en-v1.5`, `nomic-embed-text-v1.5` or `mxbai-embed-large-v1`; only for a server run from source on macOS or glibc Linux: the runtime image can't load it, and the server refuses to start there). Facts are embedded when written, and a background job embeds the ones already there; agents' `semantic` and `both` retrieval and `/v1/memory/retrieve` then search by meaning. Unset (the default): keyword search only; a `semantic` intent fails its turn with `semantic-unavailable`, `both` runs its keyword half, and publishing such an agent warns. An endpoint that doesn't answer yet doesn't stop the server: it is retried in the background (its first answer gives the dimensions), search by meaning waits for it (`semantic-unavailable` meanwhile, writes kept without a vector until then), and `/ready` says `memoryEmbeddings: unavailable (retrying)`.",
@@ -468,6 +514,38 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToServer,
         group: 'core',
     },
+    {
+        name: 'KINDGI_PAGINATION_KEY_PATH',
+        description: "Absolute path to the 32-byte key (mode 0600) every list's page cursors are sealed with, so a cursor never shows the row it points after; the same on every instance. Unset (and no `KINDGI_PAGINATION_KEY`): a key made at boot and kept nowhere, so a cursor handed out before a restart answers 400 after it, and more than one instance behind one address needs the key set. Rotate it yearly (each cursor is sealed with a random nonce): the new key here, the old one in `KINDGI_PAGINATION_PREVIOUS_KEY_PATH` for at least a day. Its own key: never the erasure ledger's or the secrets AAD key. This or `KINDGI_PAGINATION_KEY`, not both.",
+        example: '/etc/kindgi/pagination.key',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_PAGINATION_KEY',
+        description: 'The page-cursor key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager). See `KINDGI_PAGINATION_KEY_PATH`; this or that, not both.',
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_PAGINATION_PREVIOUS_KEY_PATH',
+        description: "While the page-cursor key rotates, the key before it (a 32-byte file, mode 0600): it still opens the cursors it sealed. Keep it at least a day (a cursor's life) after rotating, then remove it. Needs `KINDGI_PAGINATION_KEY(_PATH)`, and must differ from it. This or `KINDGI_PAGINATION_PREVIOUS_KEY`, not both.",
+        example: '/etc/kindgi/pagination.previous.key',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
+    {
+        name: 'KINDGI_PAGINATION_PREVIOUS_KEY',
+        description: 'The previous page-cursor key itself, base64. See `KINDGI_PAGINATION_PREVIOUS_KEY_PATH`; this or that, not both.',
+        example: '',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'core',
+    },
     {
         name: 'KINDGI_COMPLIANCE_CLASSIFIER',
         description: "Turns on the audit trail's compliance features: `shipped` uses the classifier the runtime ships; or give the absolute path of your own classifier JSON. When set, the server serves `/v1/compliance/*` (audit events as compliance evidence, and their signed export) and **purges audit events by kind, as the classifier says**. With `shipped`: authorization decisions after 90 days (denials after 365), run outcomes and guardrail violations after 730 days; secret changes and approval decisions are kept (legal hold), and so are kinds the classifier doesn't list. Unset (the default): no `/v1/compliance/*`, and no audit event is ever purged.",
@@ -523,13 +601,22 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_SECRETS_BACKEND',
-        description: 'Where secret bytes live. `none` (default; /v1/secrets/* unmounted) | `postgres` (envelope-encrypted, needs KMS) | `dotenv` (`.env` files in a directory; development only, needs `KINDGI_DEV=true`) | `secret-manager` (reserved; not supported through this variable).',
+        description: 'Where secret bytes live. `none` (default; /v1/secrets/* unmounted) | `postgres` (envelope-encrypted, needs KMS) | `dotenv` (`.env` files in a directory; development only, needs `KINDGI_DEV=true`) | `secret-manager` (your own secret manager holds the bytes; pick it with `KINDGI_SECRETS_MANAGER`).',
         example: 'postgres',
         required: false,
         appliesTo: appliesToServer,
         group: 'secrets',
         allowedValues: ['none', 'postgres', 'dotenv', 'secret-manager'],
     },
+    {
+        name: 'KINDGI_SECRETS_MANAGER',
+        description: "Which secret manager the `secret-manager` backend keeps secrets in: `azure` (Azure Key Vault, see `KINDGI_SECRETS_AZURE_VAULT_URL`), `gcp` (Google Secret Manager, in the project `KINDGI_SECRETS_GCP_PROJECT_ID` names; the server's service account needs roles/secretmanager.admin there), `vault` (HashiCorp Vault or OpenBao, see `KINDGI_SECRETS_VAULT_ADDR`) or `aws` (AWS Secrets Manager, used from runtime 0.1.7: in the region `KINDGI_SECRETS_AWS_REGION` names, signed in as the server's AWS identity, `KINDGI_AWS_IDENTITY`; runtime 0.1.6 refuses it at startup). Kindgi reads and writes them with the server's own identity and keeps only their names and version numbers in its database.",
+        example: 'azure',
+        required: true,
+        appliesTo: appliesToSecretManagerBackend,
+        group: 'secrets',
+        allowedValues: ['azure', 'gcp', 'aws', 'vault'],
+    },
     {
         name: 'KINDGI_SECRETS_DOTENV_DIR',
         description: 'Absolute path of the directory whose `.env` files hold secrets (`dotenv` backend). Mount the project directory here; secrets written through the API land in its files.',
@@ -548,12 +635,12 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_SECRETS_BACKEND_KMS',
-        description: 'Which KMS wraps DEKs (postgres backend only): `gcp` (Google Cloud KMS), or `libsodium`, a key this runtime holds (see `KINDGI_SECRETS_LOCAL_KEY_PATH`). Reserved: `aws`.',
+        description: 'Which KMS wraps DEKs (postgres backend only): `gcp` (Google Cloud KMS), `azure` (an Azure Key Vault key, see `KINDGI_SECRETS_AZURE_KEY_ID`), or `libsodium`, a key this runtime holds (see `KINDGI_SECRETS_LOCAL_KEY_PATH`). Reserved: `aws`.',
         example: 'gcp',
         required: true,
         appliesTo: appliesToPostgresBackend,
         group: 'secrets',
-        allowedValues: ['gcp', 'aws', 'libsodium'],
+        allowedValues: ['gcp', 'azure', 'aws', 'libsodium'],
     },
     {
         name: 'KINDGI_SECRETS_AAD_KEY_PATH',
@@ -565,7 +652,7 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_SECRETS_AAD_KEY',
-        description: "The 32-byte AAD/HMAC key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager), where a key file's mode can't be 0600. The postgres backend needs this or `KINDGI_SECRETS_AAD_KEY_PATH`, not both.",
+        description: "The 32-byte AAD/HMAC key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager, Container Apps with Key Vault), where a key file's mode can't be 0600. Reference one fixed version of it, never the latest: a new version would make every stored secret unreadable. The postgres backend needs this or `KINDGI_SECRETS_AAD_KEY_PATH`, not both.",
         example: '',
         required: false,
         appliesTo: appliesToPostgresBackend,
@@ -573,10 +660,10 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_SECRETS_GCP_PROJECT_ID',
-        description: 'GCP project id owning the KMS keyring + key.',
+        description: "GCP project id owning the KMS keyring + key (postgres backend, KMS `gcp`), or holding the secrets in its Secret Manager (`secret-manager` backend, manager `gcp`; the server's service account needs to create, add versions to and disable them, e.g. Secret Manager Admin, in a project used for Kindgi's secrets alone).",
         example: 'my-proj',
         required: true,
-        appliesTo: appliesToPostgresGcp,
+        appliesTo: (t) => appliesToPostgresGcp(t) || appliesToSecretManager('gcp')(t),
         group: 'gcp',
     },
     {
@@ -603,6 +690,146 @@ export const KINDGI_ENV_SCHEMA = [
         appliesTo: appliesToPostgresGcp,
         group: 'gcp',
     },
+    {
+        name: 'KINDGI_AWS_IDENTITY',
+        description: "Used from runtime 0.1.7; runtime 0.1.6 ignores it. Where the server's AWS credentials come from, for the settings that sign in as it (such as the Bedrock adapter's `auth: aws-identity`). `container`: the task's or pod's role from the container credentials endpoint (ECS and Fargate, and EKS Pod Identity). `instance`: the EC2 instance profile, IMDSv2 only (in a container on EC2, raise the IMDS hop limit to 2, or use `container`). `web-identity`: EKS IRSA, from the projected token file and `AWS_ROLE_ARN`, which the platform sets. `profile`: development only (`KINDGI_DEV=true`), a named profile from `~/.aws` as `aws login` or SSO makes it (`KINDGI_AWS_PROFILE`). Unset: the server has no AWS identity, and a registration that needs one is refused. Never the AWS SDK's default chain or keys in the environment; Kindgi keeps no key.",
+        example: 'container',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'aws',
+        allowedValues: ['container', 'instance', 'web-identity', 'profile'],
+    },
+    {
+        name: 'KINDGI_AWS_PROFILE',
+        description: 'Used from runtime 0.1.7; runtime 0.1.6 ignores it. With `KINDGI_AWS_IDENTITY=profile` (development only): the profile in `~/.aws/config` the server signs in as. Default: `default`.',
+        example: 'kindgi-dev',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'aws',
+    },
+    {
+        name: 'KINDGI_AWS_ROLE_ARN',
+        description: "Used from runtime 0.1.7; runtime 0.1.6 ignores it. An IAM role the server assumes on top of its AWS identity (STS, 1-hour sessions renewed before they expire): least privilege, or a role in another account. An IAM role's ARN, `arn:aws:iam::<account>:role/<name>`. Unset: the identity's own permissions.",
+        example: 'arn:aws:iam::123456789012:role/kindgi-bedrock',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'aws',
+    },
+    {
+        name: 'KINDGI_AWS_ROLE_SESSION_NAME',
+        description: "Used from runtime 0.1.7; runtime 0.1.6 ignores it. With `KINDGI_AWS_ROLE_ARN`: the role session's name, as CloudTrail shows it. Default: `kindgi-runtime`.",
+        example: 'kindgi-runtime',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'aws',
+    },
+    {
+        name: 'KINDGI_AWS_STS_REGION',
+        description: 'Used from runtime 0.1.7; runtime 0.1.6 ignores it. With `KINDGI_AWS_ROLE_ARN` or `KINDGI_AWS_IDENTITY=web-identity`: the region whose STS endpoint is used (regional STS, never the global endpoint). Default: `AWS_REGION`. Neither: the server refuses to start.',
+        example: 'us-east-2',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'aws',
+    },
+    {
+        name: 'KINDGI_AZURE_CLIENT_ID',
+        description: "Client id of the user-assigned managed identity the server signs in to Azure with, for its Azure settings (`KINDGI_SECRETS_BACKEND_KMS=azure`, `KINDGI_SECRETS_MANAGER=azure`, `KINDGI_IMAGE_REGISTRY_AUTH=azure`). Unset: the service's system-assigned identity. With `KINDGI_DEV=true` (a laptop), the Azure CLI's sign-in (`az login`) first, then the managed identity. Kindgi keeps no key or secret for it.",
+        example: '11111111-2222-3333-4444-555555555555',
+        required: false,
+        appliesTo: appliesToServer,
+        group: 'azure',
+    },
+    {
+        name: 'KINDGI_SECRETS_AZURE_KEY_ID',
+        description: "The Azure Key Vault key that wraps DEKs (postgres backend, KMS `azure`): its URL without a version, `https://<vault>.vault.azure.net/keys/<name>`. New secrets are wrapped with the key's current version and remember it, so rotating the key needs no rewrite. A URL with a version is refused. The server's identity needs wrap and unwrap on the key (the Key Vault Crypto Service Encryption User role).",
+        example: 'https://my-vault.vault.azure.net/keys/kindgi-secrets',
+        required: true,
+        appliesTo: appliesToPostgresAzure,
+        group: 'azure',
+    },
+    {
+        name: 'KINDGI_SECRETS_AZURE_VAULT_URL',
+        description: "The Azure Key Vault that holds the secrets set through Kindgi's API (`secret-manager` backend, manager `azure`): its URL, `https://<vault>.vault.azure.net`. Use a vault for these alone, not the one your deployment's own secrets are in: the server's identity needs the Key Vault Secrets Officer role on it, to create, version, disable and recover secrets.",
+        example: 'https://my-kindgi-secrets.vault.azure.net',
+        required: true,
+        appliesTo: appliesToSecretManager('azure'),
+        group: 'azure',
+    },
+    // ---- HashiCorp Vault / OpenBao (`KINDGI_SECRETS_MANAGER=vault`) ----
+    {
+        name: 'KINDGI_SECRETS_VAULT_ADDR',
+        description: "The Vault (or OpenBao) that holds the secrets set through Kindgi's API (`secret-manager` backend, manager `vault`): its address. `https://`, or plain `http://` only to a Vault Agent on the same machine (`http://127.0.0.1:8100`) or in development. The server's token needs, on its kv version 2 mount (`KINDGI_SECRETS_VAULT_MOUNT`): `create`, `read`, `update` on `<mount>/data/*`; `read`, `delete`, `list` on `<mount>/metadata/*`; `update` on `<mount>/delete/*` and `<mount>/destroy/*`. A custom CA: `NODE_EXTRA_CA_CERTS`.",
+        example: 'https://vault.example.com:8200',
+        required: true,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    {
+        name: 'KINDGI_SECRETS_VAULT_MOUNT',
+        description: 'The kv version 2 mount Kindgi keeps its secrets in. Use one for these alone. Default `secret`.',
+        example: 'kindgi',
+        required: false,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    {
+        name: 'KINDGI_SECRETS_VAULT_NAMESPACE',
+        description: 'The Vault Enterprise or HCP Vault namespace (`admin`, `admin/team`). Unset: none.',
+        example: 'admin',
+        required: false,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    {
+        name: 'KINDGI_SECRETS_VAULT_TOKEN_FILE',
+        description: "A file holding the server's Vault token, kept fresh by the platform: Vault Agent's sink, or a mounted secret. Read again every minute, and when Vault refuses the token. Set this or `KINDGI_SECRETS_VAULT_K8S_ROLE`. Kindgi never reads `VAULT_TOKEN` or `~/.vault-token`.",
+        example: '/vault/secrets/token',
+        required: false,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    {
+        name: 'KINDGI_SECRETS_VAULT_K8S_ROLE',
+        description: "The role of Vault's Kubernetes auth method the server logs in with, using its pod's service account token. Its token is renewed by logging in again before its lease ends. Set this or `KINDGI_SECRETS_VAULT_TOKEN_FILE`.",
+        example: 'kindgi-runtime',
+        required: false,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    {
+        name: 'KINDGI_SECRETS_VAULT_K8S_MOUNT',
+        description: "Where Vault's Kubernetes auth method is mounted, with `KINDGI_SECRETS_VAULT_K8S_ROLE`. Default `kubernetes`.",
+        example: 'kubernetes-prod',
+        required: false,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    {
+        name: 'KINDGI_SECRETS_VAULT_K8S_TOKEN_FILE',
+        description: 'The service account token the Kubernetes login sends, with `KINDGI_SECRETS_VAULT_K8S_ROLE`. Default `/var/run/secrets/kubernetes.io/serviceaccount/token`; set it for a projected token with its own audience.',
+        example: '/var/run/secrets/vault/token',
+        required: false,
+        appliesTo: appliesToSecretManager('vault'),
+        group: 'vault',
+    },
+    // ---- AWS vendor -------------------------------------------------
+    {
+        name: 'KINDGI_SECRETS_AWS_REGION',
+        description: "Used from runtime 0.1.7 (0.1.6 refuses `KINDGI_SECRETS_MANAGER=aws` at startup). The AWS region whose Secrets Manager holds the secrets set through Kindgi's API (`secret-manager` backend, manager `aws`). The server signs in as its AWS identity (`KINDGI_AWS_IDENTITY`), never with `AWS_*` keys or the SDK's default chain. That identity needs, on `arn:aws:secretsmanager:<region>:<account>:secret:kindgi/*` only: `secretsmanager:CreateSecret`, `TagResource`, `PutSecretValue`, `GetSecretValue`, `DescribeSecret` and `DeleteSecret`. Secrets are named `kindgi/<hash>`, with the scope in their tags.",
+        example: 'ca-central-1',
+        required: true,
+        appliesTo: appliesToSecretManager('aws'),
+        group: 'aws',
+    },
+    {
+        name: 'KINDGI_SECRETS_AWS_KMS_KEY_ID',
+        description: "Used from runtime 0.1.7 (0.1.6 refuses `KINDGI_SECRETS_MANAGER=aws` at startup). The KMS key AWS Secrets Manager encrypts Kindgi's secrets with (`secret-manager` backend, manager `aws`): a key ARN, key id or `alias/…`. The server's AWS identity then needs `kms:GenerateDataKey` and `kms:Decrypt` on it. Unset: AWS's own `aws/secretsmanager` key.",
+        example: 'alias/kindgi-secrets',
+        required: false,
+        appliesTo: appliesToSecretManager('aws'),
+        group: 'aws',
+    },
+    // ---- local key (libsodium) --------------------------------------
     {
         name: 'KINDGI_SECRETS_LOCAL_KEY_PATH',
         description: "Absolute path to the local key: a file of 32 random bytes (`openssl rand 32`, mode 0600), for `KINDGI_SECRETS_BACKEND_KMS=libsodium`. It wraps every secret's data key, and it's held on this host, next to the database: back it up apart from the database, since a lost key loses every secret. Replicas mount the same file. Starting with a different key than the secrets were stored under is refused. This or `KINDGI_SECRETS_LOCAL_KEY`, not both.",
@@ -686,6 +913,23 @@ export const KINDGI_ENV_SCHEMA = [
         group: 'pack-service',
         allowedValues: ['strict', 'warn'],
     },
+    {
+        name: 'KINDGI_PACK_ENV_FILTER',
+        description: "Whether the pack service keeps only the names its pack declares (`env.required`, `env.optional`). `on` (default): before the pack's code loads, it drops every other variable from its environment but `KINDGI_*` and the platform's own (the process's basics, the language runtime's settings, `PORT`, proxies and certificates, and Cloud Run's, AWS's and Azure's workload identity and metadata), and logs the dropped names, never their values (`WARN env-dropped`). `off`: every variable reaches the pack's code. `kindgi dev` uses `off`.",
+        example: 'on',
+        required: false,
+        appliesTo: appliesToPackService,
+        group: 'pack-service',
+        allowedValues: ['on', 'off'],
+    },
+    {
+        name: 'KINDGI_PACK_ENV_DECLARED',
+        description: "A Java or Scala pack service's declared names, comma-separated: the ones its launcher (`kindgi-pack-java`) keeps when `KINDGI_PACK_ENV_FILTER` is on, since a JVM can't drop a variable from its own environment. `kindgi build` sets it in the image from the pack's index; the service won't start when it differs from the index's `env`. Without it, the launcher drops nothing, and the service won't start while a name the pack doesn't declare reaches it.",
+        example: 'DATABASE_URL,CACHE_DIR',
+        required: false,
+        appliesTo: appliesToPackService,
+        group: 'pack-service',
+    },
     {
         name: 'KINDGI_IMAGE_REGISTRY_HOST',
         description: 'The registry host the credentials below are for, with its port when it has one (e.g. `registry.example`, `ghcr.io`). Other registries are read anonymously.',
@@ -720,12 +964,12 @@ export const KINDGI_ENV_SCHEMA = [
     },
     {
         name: 'KINDGI_IMAGE_REGISTRY_AUTH',
-        description: "How the server signs in to `KINDGI_IMAGE_REGISTRY_HOST`. `static` (default): `KINDGI_IMAGE_REGISTRY_USERNAME` and `_PASSWORD`. `google`: the server's own Google identity (Application Default Credentials: the service's identity on Cloud Run), for Artifact Registry; no username or password is set, and Kindgi keeps no key file.",
+        description: "How the server signs in to `KINDGI_IMAGE_REGISTRY_HOST`. `static` (default): `KINDGI_IMAGE_REGISTRY_USERNAME` and `_PASSWORD`. `google`: the server's own Google identity (Application Default Credentials: the service's identity on Cloud Run), for Artifact Registry; no username or password is set, and Kindgi keeps no key file. `azure`: the server's own managed identity (see `KINDGI_AZURE_CLIENT_ID`), for Azure Container Registry, where it needs the AcrPull role; no username or password is set either.",
         example: 'static',
         required: false,
         appliesTo: appliesToServer,
         group: 'image-registry',
-        allowedValues: ['static', 'google'],
+        allowedValues: ['static', 'google', 'azure'],
     },
     {
         name: 'KINDGI_PACK_DIR',

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkGjC,wEAAwE;AACxE,yDAAyD;AACzD,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,2BAA2B;IACpC,GAAG,EAAE,wCAAwC;IAC7C,WAAW,EAAE,yEAAyE;IACtF,cAAc,EAAE,+DAA+D;IAC/E,gBAAgB,EAAE,0DAA0D;IAC5E,GAAG,EAAE,0DAA0D;CACvD,CAAC;AAEX,wEAAwE;AACxE,gBAAgB;AAChB,wEAAwE;AAExE,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAElF,MAAM,wBAAwB,GAAG,CAAC,CAAY,EAAW,EAAE,CACzD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CACrD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAE/D,MAAM,yBAAyB,GAAG,CAAC,CAAY,EAAW,EAAE,CAC1D,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,WAAW,CAAC;AAErE,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAEvF,oDAAoD;AACpD,MAAM,gCAAgC,GAAG,CAAC,CAAY,EAAW,EAAE,CACjE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wOAAwO;QAC1O,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,yVAAyV;QAC3V,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,oFAAoF;QACtF,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,4QAA4Q;QAC9Q,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oPAAoP;QACtP,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,wsBAAwsB;QAC1sB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KACrC;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,qeAAqe;QACve,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACjC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,4YAA4Y;QAC9Y,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,kVAAkV;QACpV,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,0XAA0X;QAC5X,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,+VAA+V;QACjW,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,kOAAkO;QACpO,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,oTAAoT;QACtT,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ikBAAikB;QACnkB,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ibAAib;QACnb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,0JAA0J;QAC5J,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EACT,sHAAsH;QACxH,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,0fAA0f;QAC5f,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,0CAA0C;QAChD,WAAW,EACT,4HAA4H;QAC9H,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4ZAA4Z;QAC9Z,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,0JAA0J;QAC5J,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EACT,sHAAsH;QACxH,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,+aAA+a;QACjb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,mHAAmH;QACrH,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,0IAA0I;QAC5I,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,oXAAoX;QACtX,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6cAA6c;QAC/c,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,4GAA4G;QAC9G,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,8FAA8F;QAChG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,ojBAAojB;QACtjB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,0IAA0I;QAC5I,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,oKAAoK;QACtK,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,igBAAigB;QACngB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,uiBAAuiB;QACziB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,ibAAib;QACnb,OAAO,EACL,uFAAuF;QACzF,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,0NAA0N;QAC5N,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,sjBAAsjB;QACxjB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4TAA4T;QAC9T,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ypCAAypC;QAC3pC,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,8KAA8K;QAChL,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kPAAkP;QACpP,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,giBAAgiB;QACliB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+bAA+b;QACjc,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,+nBAA+nB;QACjoB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,scAAsc;QACxc,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,qIAAqI;QACvI,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,wQAAwQ;QAC1Q,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;KAC3D;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,0TAA0T;QAC5T,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,kRAAkR;QACpR,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,yQAAyQ;QAC3Q,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yKAAyK;QAC3K,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,0KAA0K;QAC5K,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,uPAAuP;QACzP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,6bAA6b;QAC/b,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,kLAAkL;QACpL,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6PAA6P;QAC/P,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,CAAC,aAAa,CAAC;KAC/B;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,6LAA6L;QAC/L,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ydAAyd;QAC3d,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC5C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,8hBAA8hB;QAChiB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,wJAAwJ;QAC1J,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,8SAA8S;QAChT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAClC;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,6JAA6J;QAC/J,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+FAA+F;QACjG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2JAA2J;QAC7J,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,wUAAwU;QAC1U,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACpC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yUAAyU;QAC3U,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,wbAAwb;QAC1b,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;KACH,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAE,OAA8B,EAAQ,EAAE;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAgC,CAAC,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiD,EACjD,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAuGjC,wEAAwE;AACxE,yDAAyD;AACzD,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,2BAA2B;IACpC,GAAG,EAAE,8DAA8D;IACnE,GAAG,EAAE,qEAAqE;IAC1E,KAAK,EACH,mGAAmG;IACrG,KAAK,EAAE,oDAAoD;IAC3D,WAAW,EAAE,yEAAyE;IACtF,cAAc,EAAE,+DAA+D;IAC/E,gBAAgB,EAAE,0DAA0D;IAC5E,GAAG,EAAE,0DAA0D;CACvD,CAAC;AAEX,wEAAwE;AACxE,gBAAgB;AAChB,wEAAwE;AAExE,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAElF,MAAM,wBAAwB,GAAG,CAAC,CAAY,EAAW,EAAE,CACzD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,UAAU,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CACrD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAE/D,MAAM,sBAAsB,GAAG,CAAC,CAAY,EAAW,EAAE,CACvD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,OAAO,CAAC;AAEjE,MAAM,yBAAyB,GAAG,CAAC,CAAY,EAAW,EAAE,CAC1D,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,WAAW,CAAC;AAErE,MAAM,6BAA6B,GAAG,CAAC,CAAY,EAAW,EAAE,CAC9D,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,gBAAgB,CAAC;AAE9D,MAAM,sBAAsB,GAC1B,CAAC,OAAiD,EAAE,EAAE,CACtD,CAAC,CAAY,EAAW,EAAE,CACxB,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC;AAErE,MAAM,oBAAoB,GAAG,CAAC,CAAY,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC;AAEvF,oDAAoD;AACpD,MAAM,gCAAgC,GAAG,CAAC,CAAY,EAAW,EAAE,CACjE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,oEAAoE;IACpE;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wOAAwO;QAC1O,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,yVAAyV;QAC3V,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,oFAAoF;QACtF,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gLAAgL;QAClL,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,4QAA4Q;QAC9Q,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oPAAoP;QACtP,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,wsBAAwsB;QAC1sB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;KACrC;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,qeAAqe;QACve,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;QACb,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACjC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,4YAA4Y;QAC9Y,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,kVAAkV;QACpV,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,0XAA0X;QAC5X,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,+VAA+V;QACjW,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,kOAAkO;QACpO,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,oTAAoT;QACtT,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ikBAAikB;QACnkB,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,2XAA2X;QAC7X,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ibAAib;QACnb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,0JAA0J;QAC5J,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EACT,sHAAsH;QACxH,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,0fAA0f;QAC5f,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,0CAA0C;QAChD,WAAW,EACT,4HAA4H;QAC9H,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4ZAA4Z;QAC9Z,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,0JAA0J;QAC5J,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EACT,sHAAsH;QACxH,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,+aAA+a;QACjb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,mHAAmH;QACrH,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,4rBAA4rB;QAC9rB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,0IAA0I;QAC5I,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,oXAAoX;QACtX,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6cAA6c;QAC/c,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,4GAA4G;QAC9G,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,8FAA8F;QAChG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,ojBAAojB;QACtjB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,0IAA0I;QAC5I,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,oKAAoK;QACtK,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,igBAAigB;QACngB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,uiBAAuiB;QACziB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,gvBAAgvB;QAClvB,OAAO,EACL,uFAAuF;QACzF,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gDAAgD;QACtD,WAAW,EACT,8hBAA8hB;QAChiB,OAAO,EAAE,wCAAwC;QACjD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,WAAW,EACT,yIAAyI;QAC3I,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,0NAA0N;QAC5N,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,sjBAAsjB;QACxjB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4TAA4T;QAC9T,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,+WAA+W;QACjX,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ypCAAypC;QAC3pC,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,8KAA8K;QAChL,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kPAAkP;QACpP,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,giBAAgiB;QACliB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+bAA+b;QACjc,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,iPAAiP;QACnP,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,snBAAsnB;QACxnB,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,yLAAyL;QAC3L,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,qTAAqT;QACvT,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,iHAAiH;QACnH,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,+nBAA+nB;QACjoB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,scAAsc;QACxc,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,qIAAqI;QACvI,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,wQAAwQ;QAC1Q,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;KAC3D;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,0TAA0T;QAC5T,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,kRAAkR;QACpR,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,8DAA8D;QAC9D,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,0SAA0S;QAC5S,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC;KAChE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,+qBAA+qB;QACjrB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,6BAA6B;QACxC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC;KAChD;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,yKAAyK;QAC3K,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,gKAAgK;QAClK,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,+OAA+O;QACjP,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC;KACpD;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,oYAAoY;QACtY,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,wBAAwB;QACnC,KAAK,EAAE,SAAS;KACjB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,6TAA6T;QAC/T,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,o0BAAo0B;QACt0B,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC;KACpE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,sLAAsL;QACxL,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,gTAAgT;QAClT,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,4JAA4J;QAC9J,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,oQAAoQ;QACtQ,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,oZAAoZ;QACtZ,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,+YAA+Y;QACjZ,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB;QACjC,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,oWAAoW;QACtW,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IAED,uEAAuE;IACvE;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,0gBAA0gB;QAC5gB,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,gGAAgG;QAClG,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,mFAAmF;QACrF,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,6QAA6Q;QAC/Q,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,2NAA2N;QAC7N,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,8GAA8G;QAChH,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,gNAAgN;QAClN,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,KAAK,EAAE,OAAO;KACf;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,olBAAolB;QACtlB,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,2VAA2V;QAC7V,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,KAAK;KACb;IAED,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,6bAA6b;QAC/b,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,kLAAkL;QACpL,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,6PAA6P;QAC/P,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,CAAC,aAAa,CAAC;KAC/B;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,kYAAkY;QACpY,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,6LAA6L;QAC/L,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ydAAyd;QAC3d,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC5C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,8hBAA8hB;QAChiB,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,wJAAwJ;QAC1J,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,4LAA4L;QAC9L,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,8SAA8S;QAChT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KAClC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,qhBAAqhB;QACvhB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,ocAAoc;QACtc,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,cAAc;KACtB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,6JAA6J;QAC/J,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,+FAA+F;QACjG,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2JAA2J;QAC7J,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,yfAAyf;QAC3f,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,gBAAgB;QACvB,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yUAAyU;QAC3U,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,sNAAsN;QACxN,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,wbAAwb;QAC1b,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,KAAK;KACb;CACF,CAAC;AAEF,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,gEAAgE;QAChE,mDAAmD;QACnD,EAAE;KACH,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAE,OAA8B,EAAQ,EAAE;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAgC,CAAC,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiD,EACjD,MAAiB,EACjB,SAAgC,iBAAiB;IAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/dist/values.d.ts

@@ -12,6 +12,9 @@ export declare const PUBLIC_TOKEN_KEY_VAR = "KINDGI_PUBLIC_TOKEN_SIGNING_KEY";
 export declare const EXPORT_SIGNING_KEY_PATH_VAR = "KINDGI_EXPORT_SIGNING_KEY_PATH";
 export declare const EXPORT_SIGNING_KEY_VAR = "KINDGI_EXPORT_SIGNING_KEY";
 export declare const EXPORT_SIGNING_KMS_KEY_VAR = "KINDGI_EXPORT_SIGNING_KMS_KEY";
+/** Retired export public keys (PEM, concatenated): a file's absolute path, or its base64 value; at most one. */
+export declare const EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH_VAR = "KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH";
+export declare const EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_VAR = "KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS";
 /** The license key the server checks at startup outside development mode. */
 export declare const LICENSE_KEY_VAR = "KINDGI_LICENSE_KEY";
 /** The browser origins allowed on the routes a public run token opens. */
@@ -54,6 +57,8 @@ export declare const AUTH_TURNSTILE_SECRET_PATH_VAR = "KINDGI_AUTH_TURNSTILE_SEC
 export declare const AUTH_TURNSTILE_SITE_KEY_VAR = "KINDGI_AUTH_TURNSTILE_SITE_KEY";
 /** Which hops in front of the runtime to trust for the client's address: a hop count, or IPs/CIDRs. */
 export declare const TRUSTED_PROXIES_VAR = "KINDGI_TRUSTED_PROXIES";
+/** Whether a tenant's admins may change its identity providers (`on` / `off`). */
+export declare const AUTH_TENANT_PROVIDERS_VAR = "KINDGI_AUTH_TENANT_PROVIDERS";
 /** A browser session's absolute lifetime, in milliseconds. */
 export declare const SESSION_TTL_MS_VAR = "KINDGI_SESSION_TTL_MS";
 /** How long a browser session may sit idle, in milliseconds. */
@@ -85,4 +90,32 @@ export declare function parseCorsOrigins(raw: string | undefined): readonly stri
  * fragment, without a trailing slash; `undefined` when unset.
  */
 export declare function parsePublicUrl(raw: string | undefined): string | undefined;
+/** The Azure Key Vault key that wraps DEKs (postgres backend, KMS `azure`). */
+export declare const AZURE_KEY_ID_VAR = "KINDGI_SECRETS_AZURE_KEY_ID";
+/** A Key Vault key, as `KINDGI_SECRETS_AZURE_KEY_ID` names it. */
+export interface AzureKeyId {
+    /** `https://<vault>.vault.azure.net/keys/<name>`, without a version or trailing slash. */
+    readonly keyUrl: string;
+    /** The vault's origin, `https://<vault>.vault.azure.net`. */
+    readonly vaultUrl: string;
+    readonly keyName: string;
+}
+/**
+ * `KINDGI_SECRETS_AZURE_KEY_ID`: a Key Vault key's https URL **without a
+ * version** (`https://<vault>.vault.azure.net/keys/<name>`, any Azure
+ * cloud's vault or Managed HSM host). New DEKs are wrapped with the
+ * key's current version, and each records the version it used, so a URL
+ * pinned to one version is refused: it would outlive the key's rotation.
+ * Unset or blank: `undefined`.
+ */
+export declare function parseAzureKeyId(raw: string | undefined): AzureKeyId | undefined;
+/** The Azure Key Vault the `secret-manager` backend keeps secrets in (manager `azure`). */
+export declare const AZURE_VAULT_URL_VAR = "KINDGI_SECRETS_AZURE_VAULT_URL";
+/**
+ * `KINDGI_SECRETS_AZURE_VAULT_URL`: a vault's https origin
+ * (`https://<vault>.vault.azure.net`, any Azure cloud's vault host), with
+ * nothing after it but an optional `/`. Returns the origin. Unset or
+ * blank: `undefined`.
+ */
+export declare function parseAzureVaultUrl(raw: string | undefined): string | undefined;
 //# sourceMappingURL=values.d.ts.map