@kindgi/env-schema 0.1.5 → 0.1.6

package/dist/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAEhF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AAEtE,uHAAuH;AACvH,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E,6EAA6E;AAC7E,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,gFAAgF;AAChF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,+BAA+B;AAC/B,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAE1F,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,iEAAiE;AACjE,eAAO,MAAM,gCAAgC,wCAAwC,CAAC;AACtF,eAAO,MAAM,qCAAqC,6CAA6C,CAAC;AAEhG,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAE1F,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AACpE,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAEhF,8GAA8G;AAC9G,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAClF,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,uGAAuG;AACvG,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASjF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAc3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsB1E"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAEhF,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AAEtE,uHAAuH;AACvH,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E,gHAAgH;AAChH,eAAO,MAAM,2CAA2C,mDACN,CAAC;AACnD,eAAO,MAAM,sCAAsC,8CAA8C,CAAC;AAElG,6EAA6E;AAC7E,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,gFAAgF;AAChF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,+BAA+B;AAC/B,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAE1F,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,iEAAiE;AACjE,eAAO,MAAM,gCAAgC,wCAAwC,CAAC;AACtF,eAAO,MAAM,qCAAqC,6CAA6C,CAAC;AAEhG,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAChF,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAE1F,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AACpE,eAAO,MAAM,4BAA4B,oCAAoC,CAAC;AAE9E,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,qCAAqC,CAAC;AAEhF,8GAA8G;AAC9G,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AACxE,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAClF,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,uGAAuG;AACvG,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,mCAAmC,CAAC;AAE5E,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASjF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAc3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsB1E;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,gCAAgC,CAAC;AAE9D,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAiC/E;AAED,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,mCAAmC,CAAC;AAEpE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAuB9E"}

package/dist/values.js

@@ -14,6 +14,9 @@ export const PUBLIC_TOKEN_KEY_VAR = 'KINDGI_PUBLIC_TOKEN_SIGNING_KEY';
 export const EXPORT_SIGNING_KEY_PATH_VAR = 'KINDGI_EXPORT_SIGNING_KEY_PATH';
 export const EXPORT_SIGNING_KEY_VAR = 'KINDGI_EXPORT_SIGNING_KEY';
 export const EXPORT_SIGNING_KMS_KEY_VAR = 'KINDGI_EXPORT_SIGNING_KMS_KEY';
+/** Retired export public keys (PEM, concatenated): a file's absolute path, or its base64 value; at most one. */
+export const EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH_VAR = 'KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH';
+export const EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_VAR = 'KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS';
 /** The license key the server checks at startup outside development mode. */
 export const LICENSE_KEY_VAR = 'KINDGI_LICENSE_KEY';
 /** The browser origins allowed on the routes a public run token opens. */
@@ -56,6 +59,8 @@ export const AUTH_TURNSTILE_SECRET_PATH_VAR = 'KINDGI_AUTH_TURNSTILE_SECRET_PATH
 export const AUTH_TURNSTILE_SITE_KEY_VAR = 'KINDGI_AUTH_TURNSTILE_SITE_KEY';
 /** Which hops in front of the runtime to trust for the client's address: a hop count, or IPs/CIDRs. */
 export const TRUSTED_PROXIES_VAR = 'KINDGI_TRUSTED_PROXIES';
+/** Whether a tenant's admins may change its identity providers (`on` / `off`). */
+export const AUTH_TENANT_PROVIDERS_VAR = 'KINDGI_AUTH_TENANT_PROVIDERS';
 /** A browser session's absolute lifetime, in milliseconds. */
 export const SESSION_TTL_MS_VAR = 'KINDGI_SESSION_TTL_MS';
 /** How long a browser session may sit idle, in milliseconds. */
@@ -128,6 +133,76 @@ export function parsePublicUrl(raw) {
     }
     return url.href.replace(/\/+$/, '');
 }
+/** The Azure Key Vault key that wraps DEKs (postgres backend, KMS `azure`). */
+export const AZURE_KEY_ID_VAR = 'KINDGI_SECRETS_AZURE_KEY_ID';
+/**
+ * `KINDGI_SECRETS_AZURE_KEY_ID`: a Key Vault key's https URL **without a
+ * version** (`https://<vault>.vault.azure.net/keys/<name>`, any Azure
+ * cloud's vault or Managed HSM host). New DEKs are wrapped with the
+ * key's current version, and each records the version it used, so a URL
+ * pinned to one version is refused: it would outlive the key's rotation.
+ * Unset or blank: `undefined`.
+ */
+export function parseAzureKeyId(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const value = raw.trim();
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        url = undefined;
+    }
+    const path = url?.pathname.match(/^\/keys\/([^/]+)(?:\/([^/]*))?\/?$/);
+    if (url === undefined ||
+        path === null ||
+        path === undefined ||
+        url.protocol !== 'https:' ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        !/^[0-9A-Za-z-]{1,127}$/.test(path[1] ?? '')) {
+        throw new Error(`${AZURE_KEY_ID_VAR} must be a Key Vault key's URL without a version, like https://my-vault.vault.azure.net/keys/kindgi-secrets. Got: ${value}.`);
+    }
+    const version = path[2];
+    if (version !== undefined && version !== '') {
+        throw new Error(`${AZURE_KEY_ID_VAR} names one version of the key (${version}). Give the key without it, ${url.origin}/keys/${path[1]}: new secrets are wrapped with the key's current version, so a pinned version would outlive the key's rotation.`);
+    }
+    const keyName = path[1];
+    return { keyUrl: `${url.origin}/keys/${keyName}`, vaultUrl: url.origin, keyName };
+}
+/** The Azure Key Vault the `secret-manager` backend keeps secrets in (manager `azure`). */
+export const AZURE_VAULT_URL_VAR = 'KINDGI_SECRETS_AZURE_VAULT_URL';
+/**
+ * `KINDGI_SECRETS_AZURE_VAULT_URL`: a vault's https origin
+ * (`https://<vault>.vault.azure.net`, any Azure cloud's vault host), with
+ * nothing after it but an optional `/`. Returns the origin. Unset or
+ * blank: `undefined`.
+ */
+export function parseAzureVaultUrl(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const value = raw.trim();
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        url = undefined;
+    }
+    if (url === undefined ||
+        url.protocol !== 'https:' ||
+        (url.pathname !== '/' && url.pathname !== '') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.search !== '' ||
+        url.hash !== '') {
+        throw new Error(`${AZURE_VAULT_URL_VAR} must be a Key Vault's URL with nothing after the host, like https://my-kindgi-secrets.vault.azure.net. Got: ${value}.`);
+    }
+    return url.origin;
+}
 function isExactOrigin(value) {
     let url;
     try {

package/dist/values.js.map

@@ -1 +1 @@
-{"version":3,"file":"values.js","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,uHAAuH;AACvH,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAE1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,qCAAqC,CAAC;AACtF,MAAM,CAAC,MAAM,qCAAqC,GAAG,0CAA0C,CAAC;AAEhG,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAEhF,8GAA8G;AAC9G,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,uGAAuG;AACvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,sBAAsB,oIAAoI,CAC9J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,8DAA8D;YAC/E,4DAA4D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IACE,GAAG,KAAK,SAAS;QACjB,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,yGAAyG,KAAK,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,uHAAuH;AACvH,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAE1E,gHAAgH;AAChH,MAAM,CAAC,MAAM,2CAA2C,GACtD,gDAAgD,CAAC;AACnD,MAAM,CAAC,MAAM,sCAAsC,GAAG,2CAA2C,CAAC;AAElG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,qCAAqC,CAAC;AACtF,MAAM,CAAC,MAAM,qCAAqC,GAAG,0CAA0C,CAAC;AAEhG,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAE9E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kCAAkC,CAAC;AAEhF,8GAA8G;AAC9G,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,uGAAuG;AACvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,sBAAsB,oIAAoI,CAC9J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,8DAA8D;YAC/E,4DAA4D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IACE,GAAG,KAAK,SAAS;QACjB,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,yGAAyG,KAAK,GAAG,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAW9D;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvE,IACE,GAAG,KAAK,SAAS;QACjB,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,SAAS;QAClB,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,qHAAqH,KAAK,GAAG,CACjJ,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,GAAG,gBAAgB,kCAAkC,OAAO,+BAA+B,GAAG,CAAC,MAAM,SAAS,IAAI,CAAC,CAAC,CAAC,iHAAiH,CACvO,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,SAAS,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACpF,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,GAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IACE,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,mBAAmB,gHAAgH,KAAK,GAAG,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/env-schema",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Machine-readable registry of the Kindgi runtime's operator-facing env vars. Single source of truth for boot-time validation (validateEnvForTarget), .env.example scaffolding (renderEnvExample), and tools or coding agents introspecting deployment config. Adding a new env var means adding one entry here — no drift between validation, docs, and .env.example generation.",
   "license": "Apache-2.0",
   "repository": {

package/src/index.ts

@@ -27,6 +27,10 @@ export {
   AUTH_PRIVATE_IDP_ORIGINS_VAR,
   AUTH_SECRET_PATH_VAR,
   AUTH_SECRET_VAR,
+  AUTH_TENANT_PROVIDERS_VAR,
+  AZURE_KEY_ID_VAR,
+  AZURE_VAULT_URL_VAR,
+  type AzureKeyId,
   AUTH_TURNSTILE_SECRET_PATH_VAR,
   AUTH_TURNSTILE_SECRET_VAR,
   AUTH_TURNSTILE_SITE_KEY_VAR,
@@ -35,6 +39,8 @@ export {
   EXPORT_SIGNING_KEY_PATH_VAR,
   EXPORT_SIGNING_KEY_VAR,
   EXPORT_SIGNING_KMS_KEY_VAR,
+  EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH_VAR,
+  EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_VAR,
   PUBLIC_URL_VAR,
   SESSION_IDLE_TIMEOUT_MS_VAR,
   CONSOLE_TOKEN_SIGN_IN_VAR,
@@ -44,6 +50,8 @@ export {
   PACK_SERVICE_TOKEN_VAR,
   PUBLIC_TOKEN_KEY_PATH_VAR,
   PUBLIC_TOKEN_KEY_VAR,
+  parseAzureKeyId,
+  parseAzureVaultUrl,
   parseCorsOrigins,
   parsePublicUrl,
   parsePackServiceToken,

package/src/schema.ts

@@ -45,7 +45,12 @@ export interface EnvTarget {
    */
   readonly component?: 'server' | 'pack-service';
   readonly secretsBackend?: 'none' | 'postgres' | 'secret-manager' | 'dotenv';
-  readonly secretsBackendKms?: 'gcp' | 'aws' | 'libsodium' | 'vault';
+  readonly secretsBackendKms?: 'gcp' | 'azure' | 'aws' | 'libsodium' | 'vault';
+  /**
+   * The secret manager the `secret-manager` backend keeps secrets in
+   * (`KINDGI_SECRETS_MANAGER`). Absent: not chosen yet.
+   */
+  readonly secretsManager?: 'azure' | 'gcp' | 'aws' | 'vault';
   /**
    * How the server reaches the pack service: `http` when
    * `KINDGI_PACK_SERVICE_URL` is set. Absent: the server has no pack
@@ -105,7 +110,11 @@ export const ENV_GROUPS = {
   core: 'Core server config',
   logging: 'Logging',
   secrets: 'Secrets backend selection',
-  gcp: 'GCP vendor config (postgres + gcp KMS)',
+  gcp: 'GCP vendor config (postgres + gcp KMS; secret-manager + gcp)',
+  aws: "AWS vendor config (the server's AWS identity; secret-manager + aws)",
+  azure:
+    "Azure vendor config (the server's managed identity; postgres + azure KMS; secret-manager + azure)",
+  vault: 'HashiCorp Vault / OpenBao (secret-manager + vault)',
   'local-key': 'Local key (postgres + libsodium: a key this runtime holds, single-node)',
   'pack-service': 'Pack service (runs the pack code: tools and guardrail checks)',
   'image-registry': "Image registry (where deployments' images are read from)",
@@ -128,9 +137,20 @@ const appliesToDotenvBackend = (t: EnvTarget): boolean =>
 const appliesToPostgresGcp = (t: EnvTarget): boolean =>
   appliesToPostgresBackend(t) && t.secretsBackendKms === 'gcp';
 
+const appliesToPostgresAzure = (t: EnvTarget): boolean =>
+  appliesToPostgresBackend(t) && t.secretsBackendKms === 'azure';
+
 const appliesToPostgresLocalKey = (t: EnvTarget): boolean =>
   appliesToPostgresBackend(t) && t.secretsBackendKms === 'libsodium';
 
+const appliesToSecretManagerBackend = (t: EnvTarget): boolean =>
+  appliesToServer(t) && t.secretsBackend === 'secret-manager';
+
+const appliesToSecretManager =
+  (manager: NonNullable<EnvTarget['secretsManager']>) =>
+  (t: EnvTarget): boolean =>
+    appliesToSecretManagerBackend(t) && t.secretsManager === manager;
+
 const appliesToPackService = (t: EnvTarget): boolean => t.component === 'pack-service';
 
 /** The server, calling a pack service over HTTP. */
@@ -325,6 +345,15 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_AUTH_TENANT_PROVIDERS',
+    description:
+      "Whether a tenant's admins may add, change and remove its identity providers: `on` or `off`. Default `on`. `off` when the operator manages sign-in: then only the deployment's own token (`KINDGI_API_TOKEN`) can, and a tenant's change answers `403 identity-providers-operator-managed`. The providers already there keep signing people in either way, and anyone may still read them.",
+    example: 'off',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_AUTH_GOOGLE_CLIENT_ID',
     description:
@@ -424,6 +453,15 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_REVIEWER_EMAIL',
+    description:
+      "`on` emails reviewers when an approval waits for them: the people the approvals inbox would show it to (its assigned reviewer, else every active reviewer of its required role or above), and only those who may read its project. The first email goes at once; anything more for the same person within five minutes comes as one digest. Each email has the approval's title, project, required role and a link, never what it's about (that stays behind sign-in). Sent through the emailed sign-in link's server, so it needs `KINDGI_AUTH_EMAIL_SMTP_URL` (or `_PATH`) and `KINDGI_AUTH_EMAIL_FROM`; turned on without them, the runtime refuses to start. Off by default: emailing people is the operator's choice.",
+    example: 'on',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_AUTH_EMAIL_FROM',
     description:
@@ -526,13 +564,31 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_EXPORT_SIGNING_KMS_KEY',
     description:
-      "Optional: a Cloud KMS key version that signs exports, so the private key never leaves KMS: `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>/cryptoKeyVersions/<n>`. It must be an `EC_SIGN_ED25519` key (it signs `ed25519`) or an `EC_SIGN_P256_SHA256` key (`ecdsa-p256-sha256`), and the server's service account needs `roles/cloudkms.signerVerifier` on it (and `roles/cloudkms.publicKeyViewer`, to read its public key at boot).",
+      "Optional: a KMS key version that signs exports, so the private key never leaves the KMS. Its shape picks the KMS. **Cloud KMS:** `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>/cryptoKeyVersions/<n>`, an `EC_SIGN_ED25519` key (it signs `ed25519`) or an `EC_SIGN_P256_SHA256` key (`ecdsa-p256-sha256`); the server's service account needs `roles/cloudkms.signerVerifier` on it (and `roles/cloudkms.publicKeyViewer`, to read its public key at boot). **Azure Key Vault:** `https://<vault>.vault.azure.net/keys/<name>/<version>`, with its version, an EC P-256 key allowed to sign (`ecdsa-p256-sha256`: Key Vault has no Ed25519); the server's identity needs Key Vault Crypto User on it. Any other value stops the server at boot, naming both shapes.",
     example:
       'projects/acme/locations/global/keyRings/kindgi/cryptoKeys/exports/cryptoKeyVersions/1',
     required: false,
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS_PATH',
+    description:
+      'Absolute path to a file of one or more PEM public keys (`-----BEGIN PUBLIC KEY-----`, concatenated): export keys this deployment signed with before a rotation. `GET /v1/export-signing-keys` lists them after the active key, with `active: false`, so `kindgi exports verify --from-runtime` still trusts what they signed; they never sign. Ed25519 or EC P-256 keys, public halves only: a private key in the file stops the server at boot. Works with any signing key, file or KMS. Set this or `KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS`, not both.',
+    example: '/etc/kindgi/export-signing-retired.pem',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_EXPORT_SIGNING_RETIRED_PUBLIC_KEYS',
+    description:
+      "The same file's content, base64 (`base64 < retired.pem`): for platforms that give settings as environment variables, such as Cloud Run.",
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_CORS_ORIGINS',
     description:
@@ -560,6 +616,15 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_RUN_ENDED_CHECK_MS',
+    description:
+      'How often each server stops the runs it executes that were ended from outside (cancelled, on this server or another), in milliseconds. A run stops starting steps at its next write either way; this also stops a step that writes nothing for a while, such as a long model call, within this time of a cancel. Default 5000; at least 1000, or the server refuses to start.',
+    example: '5000',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_MEMORY_EMBEDDINGS',
     description:
@@ -632,6 +697,42 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToServer,
     group: 'core',
   },
+  {
+    name: 'KINDGI_PAGINATION_KEY_PATH',
+    description:
+      "Absolute path to the 32-byte key (mode 0600) every list's page cursors are sealed with, so a cursor never shows the row it points after; the same on every instance. Unset (and no `KINDGI_PAGINATION_KEY`): a key made at boot and kept nowhere, so a cursor handed out before a restart answers 400 after it, and more than one instance behind one address needs the key set. Rotate it yearly (each cursor is sealed with a random nonce): the new key here, the old one in `KINDGI_PAGINATION_PREVIOUS_KEY_PATH` for at least a day. Its own key: never the erasure ledger's or the secrets AAD key. This or `KINDGI_PAGINATION_KEY`, not both.",
+    example: '/etc/kindgi/pagination.key',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_PAGINATION_KEY',
+    description:
+      'The page-cursor key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager). See `KINDGI_PAGINATION_KEY_PATH`; this or that, not both.',
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_PAGINATION_PREVIOUS_KEY_PATH',
+    description:
+      "While the page-cursor key rotates, the key before it (a 32-byte file, mode 0600): it still opens the cursors it sealed. Keep it at least a day (a cursor's life) after rotating, then remove it. Needs `KINDGI_PAGINATION_KEY(_PATH)`, and must differ from it. This or `KINDGI_PAGINATION_PREVIOUS_KEY`, not both.",
+    example: '/etc/kindgi/pagination.previous.key',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
+  {
+    name: 'KINDGI_PAGINATION_PREVIOUS_KEY',
+    description:
+      'The previous page-cursor key itself, base64. See `KINDGI_PAGINATION_PREVIOUS_KEY_PATH`; this or that, not both.',
+    example: '',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'core',
+  },
   {
     name: 'KINDGI_COMPLIANCE_CLASSIFIER',
     description:
@@ -694,13 +795,23 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_SECRETS_BACKEND',
     description:
-      'Where secret bytes live. `none` (default; /v1/secrets/* unmounted) | `postgres` (envelope-encrypted, needs KMS) | `dotenv` (`.env` files in a directory; development only, needs `KINDGI_DEV=true`) | `secret-manager` (reserved; not supported through this variable).',
+      'Where secret bytes live. `none` (default; /v1/secrets/* unmounted) | `postgres` (envelope-encrypted, needs KMS) | `dotenv` (`.env` files in a directory; development only, needs `KINDGI_DEV=true`) | `secret-manager` (your own secret manager holds the bytes; pick it with `KINDGI_SECRETS_MANAGER`).',
     example: 'postgres',
     required: false,
     appliesTo: appliesToServer,
     group: 'secrets',
     allowedValues: ['none', 'postgres', 'dotenv', 'secret-manager'],
   },
+  {
+    name: 'KINDGI_SECRETS_MANAGER',
+    description:
+      "Which secret manager the `secret-manager` backend keeps secrets in: `azure` (Azure Key Vault, see `KINDGI_SECRETS_AZURE_VAULT_URL`), `gcp` (Google Secret Manager, in the project `KINDGI_SECRETS_GCP_PROJECT_ID` names; the server's service account needs roles/secretmanager.admin there), `vault` (HashiCorp Vault or OpenBao, see `KINDGI_SECRETS_VAULT_ADDR`) or `aws` (AWS Secrets Manager, used from runtime 0.1.7: in the region `KINDGI_SECRETS_AWS_REGION` names, signed in as the server's AWS identity, `KINDGI_AWS_IDENTITY`; runtime 0.1.6 refuses it at startup). Kindgi reads and writes them with the server's own identity and keeps only their names and version numbers in its database.",
+    example: 'azure',
+    required: true,
+    appliesTo: appliesToSecretManagerBackend,
+    group: 'secrets',
+    allowedValues: ['azure', 'gcp', 'aws', 'vault'],
+  },
   {
     name: 'KINDGI_SECRETS_DOTENV_DIR',
     description:
@@ -722,12 +833,12 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_SECRETS_BACKEND_KMS',
     description:
-      'Which KMS wraps DEKs (postgres backend only): `gcp` (Google Cloud KMS), or `libsodium`, a key this runtime holds (see `KINDGI_SECRETS_LOCAL_KEY_PATH`). Reserved: `aws`.',
+      'Which KMS wraps DEKs (postgres backend only): `gcp` (Google Cloud KMS), `azure` (an Azure Key Vault key, see `KINDGI_SECRETS_AZURE_KEY_ID`), or `libsodium`, a key this runtime holds (see `KINDGI_SECRETS_LOCAL_KEY_PATH`). Reserved: `aws`.',
     example: 'gcp',
     required: true,
     appliesTo: appliesToPostgresBackend,
     group: 'secrets',
-    allowedValues: ['gcp', 'aws', 'libsodium'],
+    allowedValues: ['gcp', 'azure', 'aws', 'libsodium'],
   },
   {
     name: 'KINDGI_SECRETS_AAD_KEY_PATH',
@@ -741,7 +852,7 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_SECRETS_AAD_KEY',
     description:
-      "The 32-byte AAD/HMAC key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager), where a key file's mode can't be 0600. The postgres backend needs this or `KINDGI_SECRETS_AAD_KEY_PATH`, not both.",
+      "The 32-byte AAD/HMAC key itself, base64: for platforms that give secrets as environment variables (Cloud Run with Secret Manager, Container Apps with Key Vault), where a key file's mode can't be 0600. Reference one fixed version of it, never the latest: a new version would make every stored secret unreadable. The postgres backend needs this or `KINDGI_SECRETS_AAD_KEY_PATH`, not both.",
     example: '',
     required: false,
     appliesTo: appliesToPostgresBackend,
@@ -749,10 +860,11 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   },
   {
     name: 'KINDGI_SECRETS_GCP_PROJECT_ID',
-    description: 'GCP project id owning the KMS keyring + key.',
+    description:
+      "GCP project id owning the KMS keyring + key (postgres backend, KMS `gcp`), or holding the secrets in its Secret Manager (`secret-manager` backend, manager `gcp`; the server's service account needs to create, add versions to and disable them, e.g. Secret Manager Admin, in a project used for Kindgi's secrets alone).",
     example: 'my-proj',
     required: true,
-    appliesTo: appliesToPostgresGcp,
+    appliesTo: (t) => appliesToPostgresGcp(t) || appliesToSecretManager('gcp')(t),
     group: 'gcp',
   },
   {
@@ -779,6 +891,166 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     appliesTo: appliesToPostgresGcp,
     group: 'gcp',
   },
+  {
+    name: 'KINDGI_AWS_IDENTITY',
+    description:
+      "Used from runtime 0.1.7; runtime 0.1.6 ignores it. Where the server's AWS credentials come from, for the settings that sign in as it (such as the Bedrock adapter's `auth: aws-identity`). `container`: the task's or pod's role from the container credentials endpoint (ECS and Fargate, and EKS Pod Identity). `instance`: the EC2 instance profile, IMDSv2 only (in a container on EC2, raise the IMDS hop limit to 2, or use `container`). `web-identity`: EKS IRSA, from the projected token file and `AWS_ROLE_ARN`, which the platform sets. `profile`: development only (`KINDGI_DEV=true`), a named profile from `~/.aws` as `aws login` or SSO makes it (`KINDGI_AWS_PROFILE`). Unset: the server has no AWS identity, and a registration that needs one is refused. Never the AWS SDK's default chain or keys in the environment; Kindgi keeps no key.",
+    example: 'container',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'aws',
+    allowedValues: ['container', 'instance', 'web-identity', 'profile'],
+  },
+  {
+    name: 'KINDGI_AWS_PROFILE',
+    description:
+      'Used from runtime 0.1.7; runtime 0.1.6 ignores it. With `KINDGI_AWS_IDENTITY=profile` (development only): the profile in `~/.aws/config` the server signs in as. Default: `default`.',
+    example: 'kindgi-dev',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'aws',
+  },
+  {
+    name: 'KINDGI_AWS_ROLE_ARN',
+    description:
+      "Used from runtime 0.1.7; runtime 0.1.6 ignores it. An IAM role the server assumes on top of its AWS identity (STS, 1-hour sessions renewed before they expire): least privilege, or a role in another account. An IAM role's ARN, `arn:aws:iam::<account>:role/<name>`. Unset: the identity's own permissions.",
+    example: 'arn:aws:iam::123456789012:role/kindgi-bedrock',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'aws',
+  },
+  {
+    name: 'KINDGI_AWS_ROLE_SESSION_NAME',
+    description:
+      "Used from runtime 0.1.7; runtime 0.1.6 ignores it. With `KINDGI_AWS_ROLE_ARN`: the role session's name, as CloudTrail shows it. Default: `kindgi-runtime`.",
+    example: 'kindgi-runtime',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'aws',
+  },
+  {
+    name: 'KINDGI_AWS_STS_REGION',
+    description:
+      'Used from runtime 0.1.7; runtime 0.1.6 ignores it. With `KINDGI_AWS_ROLE_ARN` or `KINDGI_AWS_IDENTITY=web-identity`: the region whose STS endpoint is used (regional STS, never the global endpoint). Default: `AWS_REGION`. Neither: the server refuses to start.',
+    example: 'us-east-2',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'aws',
+  },
+  {
+    name: 'KINDGI_AZURE_CLIENT_ID',
+    description:
+      "Client id of the user-assigned managed identity the server signs in to Azure with, for its Azure settings (`KINDGI_SECRETS_BACKEND_KMS=azure`, `KINDGI_SECRETS_MANAGER=azure`, `KINDGI_IMAGE_REGISTRY_AUTH=azure`). Unset: the service's system-assigned identity. With `KINDGI_DEV=true` (a laptop), the Azure CLI's sign-in (`az login`) first, then the managed identity. Kindgi keeps no key or secret for it.",
+    example: '11111111-2222-3333-4444-555555555555',
+    required: false,
+    appliesTo: appliesToServer,
+    group: 'azure',
+  },
+  {
+    name: 'KINDGI_SECRETS_AZURE_KEY_ID',
+    description:
+      "The Azure Key Vault key that wraps DEKs (postgres backend, KMS `azure`): its URL without a version, `https://<vault>.vault.azure.net/keys/<name>`. New secrets are wrapped with the key's current version and remember it, so rotating the key needs no rewrite. A URL with a version is refused. The server's identity needs wrap and unwrap on the key (the Key Vault Crypto Service Encryption User role).",
+    example: 'https://my-vault.vault.azure.net/keys/kindgi-secrets',
+    required: true,
+    appliesTo: appliesToPostgresAzure,
+    group: 'azure',
+  },
+  {
+    name: 'KINDGI_SECRETS_AZURE_VAULT_URL',
+    description:
+      "The Azure Key Vault that holds the secrets set through Kindgi's API (`secret-manager` backend, manager `azure`): its URL, `https://<vault>.vault.azure.net`. Use a vault for these alone, not the one your deployment's own secrets are in: the server's identity needs the Key Vault Secrets Officer role on it, to create, version, disable and recover secrets.",
+    example: 'https://my-kindgi-secrets.vault.azure.net',
+    required: true,
+    appliesTo: appliesToSecretManager('azure'),
+    group: 'azure',
+  },
+
+  // ---- HashiCorp Vault / OpenBao (`KINDGI_SECRETS_MANAGER=vault`) ----
+  {
+    name: 'KINDGI_SECRETS_VAULT_ADDR',
+    description:
+      "The Vault (or OpenBao) that holds the secrets set through Kindgi's API (`secret-manager` backend, manager `vault`): its address. `https://`, or plain `http://` only to a Vault Agent on the same machine (`http://127.0.0.1:8100`) or in development. The server's token needs, on its kv version 2 mount (`KINDGI_SECRETS_VAULT_MOUNT`): `create`, `read`, `update` on `<mount>/data/*`; `read`, `delete`, `list` on `<mount>/metadata/*`; `update` on `<mount>/delete/*` and `<mount>/destroy/*`. A custom CA: `NODE_EXTRA_CA_CERTS`.",
+    example: 'https://vault.example.com:8200',
+    required: true,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+  {
+    name: 'KINDGI_SECRETS_VAULT_MOUNT',
+    description:
+      'The kv version 2 mount Kindgi keeps its secrets in. Use one for these alone. Default `secret`.',
+    example: 'kindgi',
+    required: false,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+  {
+    name: 'KINDGI_SECRETS_VAULT_NAMESPACE',
+    description:
+      'The Vault Enterprise or HCP Vault namespace (`admin`, `admin/team`). Unset: none.',
+    example: 'admin',
+    required: false,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+  {
+    name: 'KINDGI_SECRETS_VAULT_TOKEN_FILE',
+    description:
+      "A file holding the server's Vault token, kept fresh by the platform: Vault Agent's sink, or a mounted secret. Read again every minute, and when Vault refuses the token. Set this or `KINDGI_SECRETS_VAULT_K8S_ROLE`. Kindgi never reads `VAULT_TOKEN` or `~/.vault-token`.",
+    example: '/vault/secrets/token',
+    required: false,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+  {
+    name: 'KINDGI_SECRETS_VAULT_K8S_ROLE',
+    description:
+      "The role of Vault's Kubernetes auth method the server logs in with, using its pod's service account token. Its token is renewed by logging in again before its lease ends. Set this or `KINDGI_SECRETS_VAULT_TOKEN_FILE`.",
+    example: 'kindgi-runtime',
+    required: false,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+  {
+    name: 'KINDGI_SECRETS_VAULT_K8S_MOUNT',
+    description:
+      "Where Vault's Kubernetes auth method is mounted, with `KINDGI_SECRETS_VAULT_K8S_ROLE`. Default `kubernetes`.",
+    example: 'kubernetes-prod',
+    required: false,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+  {
+    name: 'KINDGI_SECRETS_VAULT_K8S_TOKEN_FILE',
+    description:
+      'The service account token the Kubernetes login sends, with `KINDGI_SECRETS_VAULT_K8S_ROLE`. Default `/var/run/secrets/kubernetes.io/serviceaccount/token`; set it for a projected token with its own audience.',
+    example: '/var/run/secrets/vault/token',
+    required: false,
+    appliesTo: appliesToSecretManager('vault'),
+    group: 'vault',
+  },
+
+  // ---- AWS vendor -------------------------------------------------
+  {
+    name: 'KINDGI_SECRETS_AWS_REGION',
+    description:
+      "Used from runtime 0.1.7 (0.1.6 refuses `KINDGI_SECRETS_MANAGER=aws` at startup). The AWS region whose Secrets Manager holds the secrets set through Kindgi's API (`secret-manager` backend, manager `aws`). The server signs in as its AWS identity (`KINDGI_AWS_IDENTITY`), never with `AWS_*` keys or the SDK's default chain. That identity needs, on `arn:aws:secretsmanager:<region>:<account>:secret:kindgi/*` only: `secretsmanager:CreateSecret`, `TagResource`, `PutSecretValue`, `GetSecretValue`, `DescribeSecret` and `DeleteSecret`. Secrets are named `kindgi/<hash>`, with the scope in their tags.",
+    example: 'ca-central-1',
+    required: true,
+    appliesTo: appliesToSecretManager('aws'),
+    group: 'aws',
+  },
+  {
+    name: 'KINDGI_SECRETS_AWS_KMS_KEY_ID',
+    description:
+      "Used from runtime 0.1.7 (0.1.6 refuses `KINDGI_SECRETS_MANAGER=aws` at startup). The KMS key AWS Secrets Manager encrypts Kindgi's secrets with (`secret-manager` backend, manager `aws`): a key ARN, key id or `alias/…`. The server's AWS identity then needs `kms:GenerateDataKey` and `kms:Decrypt` on it. Unset: AWS's own `aws/secretsmanager` key.",
+    example: 'alias/kindgi-secrets',
+    required: false,
+    appliesTo: appliesToSecretManager('aws'),
+    group: 'aws',
+  },
+
+  // ---- local key (libsodium) --------------------------------------
   {
     name: 'KINDGI_SECRETS_LOCAL_KEY_PATH',
     description:
@@ -872,6 +1144,25 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
     group: 'pack-service',
     allowedValues: ['strict', 'warn'],
   },
+  {
+    name: 'KINDGI_PACK_ENV_FILTER',
+    description:
+      "Whether the pack service keeps only the names its pack declares (`env.required`, `env.optional`). `on` (default): before the pack's code loads, it drops every other variable from its environment but `KINDGI_*` and the platform's own (the process's basics, the language runtime's settings, `PORT`, proxies and certificates, and Cloud Run's, AWS's and Azure's workload identity and metadata), and logs the dropped names, never their values (`WARN env-dropped`). `off`: every variable reaches the pack's code. `kindgi dev` uses `off`.",
+    example: 'on',
+    required: false,
+    appliesTo: appliesToPackService,
+    group: 'pack-service',
+    allowedValues: ['on', 'off'],
+  },
+  {
+    name: 'KINDGI_PACK_ENV_DECLARED',
+    description:
+      "A Java or Scala pack service's declared names, comma-separated: the ones its launcher (`kindgi-pack-java`) keeps when `KINDGI_PACK_ENV_FILTER` is on, since a JVM can't drop a variable from its own environment. `kindgi build` sets it in the image from the pack's index; the service won't start when it differs from the index's `env`. Without it, the launcher drops nothing, and the service won't start while a name the pack doesn't declare reaches it.",
+    example: 'DATABASE_URL,CACHE_DIR',
+    required: false,
+    appliesTo: appliesToPackService,
+    group: 'pack-service',
+  },
   {
     name: 'KINDGI_IMAGE_REGISTRY_HOST',
     description:
@@ -911,12 +1202,12 @@ export const KINDGI_ENV_SCHEMA: readonly EnvVarSpec[] = [
   {
     name: 'KINDGI_IMAGE_REGISTRY_AUTH',
     description:
-      "How the server signs in to `KINDGI_IMAGE_REGISTRY_HOST`. `static` (default): `KINDGI_IMAGE_REGISTRY_USERNAME` and `_PASSWORD`. `google`: the server's own Google identity (Application Default Credentials: the service's identity on Cloud Run), for Artifact Registry; no username or password is set, and Kindgi keeps no key file.",
+      "How the server signs in to `KINDGI_IMAGE_REGISTRY_HOST`. `static` (default): `KINDGI_IMAGE_REGISTRY_USERNAME` and `_PASSWORD`. `google`: the server's own Google identity (Application Default Credentials: the service's identity on Cloud Run), for Artifact Registry; no username or password is set, and Kindgi keeps no key file. `azure`: the server's own managed identity (see `KINDGI_AZURE_CLIENT_ID`), for Azure Container Registry, where it needs the AcrPull role; no username or password is set either.",
     example: 'static',
     required: false,
     appliesTo: appliesToServer,
     group: 'image-registry',
-    allowedValues: ['static', 'google'],
+    allowedValues: ['static', 'google', 'azure'],
   },
   {
     name: 'KINDGI_PACK_DIR',