@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra/types.js

@@ -1,44 +1,441 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REQUIRED_CREDENTIAL_KEYS = exports.WorkerSchema = exports.InfraConfigSchema = exports.AppSchema = void 0;
+exports.REQUIRED_CREDENTIAL_KEYS = exports.AZURE_REQUIRED_CREDENTIAL_KEYS = exports.AWS_REQUIRED_CREDENTIAL_KEYS = exports.WorkerSchema = exports.InfraConfigSchema = exports.AzureInfraConfigSchema = exports.AzureAppSchema = exports.EcsInfraConfigSchema = exports.AppSchema = void 0;
+exports.requiredCredentialKeysFor = requiredCredentialKeysFor;
 const zod_1 = require("zod");
-const WorkerSchema = zod_1.z.object({
-    name: zod_1.z.string().min(1),
-    dockerfile: zod_1.z.string().min(1),
-});
+const azure_defaults_1 = require("./azure-defaults");
+// AWS resource naming: lowercase letters, numbers, and hyphens only; must start and
+// end with an alphanumeric character. This is the strictest common denominator among
+// the AWS resources these names flow into (S3 bucket names, ALB/target group names).
+const AWS_NAME_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const AWS_NAME_MESSAGE = 'must contain only lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen';
+// "<name>-TargetGroup" must fit AWS's 32-character ALB target group name limit.
+const PROJECT_NAME_MAX_LENGTH = 20;
+// Per-app ALB target group names use the app name literally, with no suffix — also capped at 32 by AWS.
+const APP_NAME_MAX_LENGTH = 32;
+// Azure Container App naming: 2-32 characters, must start with a letter, contain only
+// lowercase letters, numbers, and hyphens, end with an alphanumeric character, and never
+// contain consecutive hyphens.
+const AZURE_APP_NAME_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const AZURE_APP_NAME_MESSAGE = 'must start with a letter, contain only lowercase letters, numbers, and hyphens, end with an alphanumeric character, and not contain consecutive hyphens';
+const AZURE_APP_NAME_MIN_LENGTH = 2;
+const AZURE_APP_NAME_MAX_LENGTH = 32;
+const WorkerSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(1)
+        .max(APP_NAME_MAX_LENGTH, `worker name must be ${APP_NAME_MAX_LENGTH} characters or fewer (AWS resource naming limit)`)
+        .regex(AWS_NAME_PATTERN, `worker name ${AWS_NAME_MESSAGE}`)
+        .describe('Worker name. Used as the ECS service name.'),
+    dockerfile: zod_1.z
+        .string()
+        .min(1)
+        .describe("Path to the worker's Dockerfile relative to the project root.")
+})
+    .passthrough()
+    .meta({ id: 'worker' });
 exports.WorkerSchema = WorkerSchema;
-exports.AppSchema = zod_1.z.object({
-    name: zod_1.z.string().min(1),
-    technology: zod_1.z.enum(['nest', 'react']),
+exports.AppSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(1)
+        .max(APP_NAME_MAX_LENGTH, `app name must be ${APP_NAME_MAX_LENGTH} characters or fewer (AWS ALB target group name limit)`)
+        .regex(AWS_NAME_PATTERN, `app name ${AWS_NAME_MESSAGE}`),
+    technology: zod_1.z
+        .string()
+        .min(1)
+        .describe("Application role/framework. 'nest' and 'react' get framework-specific env var injection (see docs); any other value deploys as a plain container with no extra env vars — pass everything explicitly via variables/build_env."),
     dockerfile: zod_1.z.string().min(1),
     health_check_path: zod_1.z.string().min(1),
     domain: zod_1.z.string().min(1),
     port: zod_1.z.number().int().positive(),
     branch: zod_1.z.string().default('main'),
     template_repo_branch: zod_1.z.string().default('main'),
-    postgres: zod_1.z.boolean().optional().default(false),
-    redis: zod_1.z.boolean().optional().default(false),
+    postgres: zod_1.z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe('Provision an RDS PostgreSQL instance for this app.'),
+    redis: zod_1.z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe('Provision an ElastiCache Redis instance for this app.'),
     variables: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional().default({}),
     build_env: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional().default({}),
     workers: zod_1.z.array(WorkerSchema).optional().default([]),
-    cpu_units: zod_1.z.number().int().positive().optional().default(1024),
-    memory_units: zod_1.z.number().int().positive().optional().default(2048),
-    db_instance_type: zod_1.z.string().optional(),
-    db_allocated_storage: zod_1.z.number().int().positive().optional(),
-    redis_instance_type: zod_1.z.string().optional(),
-});
-exports.InfraConfigSchema = zod_1.z.object({
-    name: zod_1.z.string().min(1),
+    cpu_units: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .default(1024)
+        .describe('ECS task CPU units (1024 = 1 vCPU).'),
+    memory_units: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .default(2048)
+        .describe('ECS task memory in MB.'),
+    db_instance_type: zod_1.z
+        .string()
+        .optional()
+        .describe('RDS instance type, e.g. db.t3.small. Only used when postgres is true.'),
+    db_allocated_storage: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('RDS allocated storage in GB. Only used when postgres is true.'),
+    redis_instance_type: zod_1.z
+        .string()
+        .optional()
+        .describe('ElastiCache node type, e.g. cache.t3.small. Only used when redis is true.')
+})
+    .passthrough()
+    .meta({ id: 'ecsApp' });
+exports.EcsInfraConfigSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(1)
+        .max(PROJECT_NAME_MAX_LENGTH, `name must be ${PROJECT_NAME_MAX_LENGTH} characters or fewer — AWS caps the "<name>-TargetGroup" load balancer resource name at 32 characters`)
+        .regex(AWS_NAME_PATTERN, `name ${AWS_NAME_MESSAGE}`),
+    slack_webhook_url: zod_1.z.string().optional(),
+    github_repo_name: zod_1.z
+        .string()
+        .optional()
+        .describe('Name of the GitHub repository to create/use. Defaults to "${name}-monorepo". Set this ' +
+        'explicitly when this fuel.yml should target a repo already used by another environment ' +
+        '(e.g. a separate prod fuel.yml with its own `name` pointing at the same repo as dev).'),
     deployment: zod_1.z.literal('ecs'),
-    ssl: zod_1.z.string().min(1),
-    apps: zod_1.z.array(exports.AppSchema).min(1),
+    ssl: zod_1.z
+        .string()
+        .min(1)
+        .describe('ACM certificate ARN attached to the ALB HTTPS listener, e.g. arn:aws:acm:us-east-1:ACCOUNT_ID:certificate/CERTIFICATE_ID.'),
+    apps: zod_1.z.array(exports.AppSchema).min(1)
+})
+    .passthrough()
+    .meta({ id: 'ecsConfig' })
+    .superRefine((config, ctx) => {
+    const names = config.apps.map((app) => app.name);
+    const duplicates = [
+        ...new Set(names.filter((name, i) => names.indexOf(name) !== i))
+    ];
+    if (duplicates.length > 0) {
+        ctx.addIssue({
+            code: 'custom',
+            message: `app.name must be unique — duplicate: ${duplicates.join(', ')}`,
+            path: ['apps']
+        });
+    }
 });
-exports.REQUIRED_CREDENTIAL_KEYS = [
+// --- Azure ---
+const AzureDatabaseSchema = zod_1.z
+    .object({
+    enabled: zod_1.z.boolean().optional().default(false),
+    engine: zod_1.z
+        .enum(['mssql', 'postgres'])
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.database.engine)
+        .describe("Database engine: 'mssql' provisions Azure SQL Database, 'postgres' provisions Azure Database for PostgreSQL Flexible Server."),
+    sku_name: zod_1.z
+        .string()
+        .optional()
+        .describe('SKU name — e.g. GP_S_Gen5_4 for mssql, GP_Standard_D4s_v3 for postgres.'),
+    storage_account_type: zod_1.z
+        .enum(['Local', 'Zone', 'Geo', 'GeoZone'])
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.database.storageAccountType)
+        .describe('Backup storage redundancy (mssql only).'),
+    pitr_retention_days: zod_1.z
+        .number()
+        .int()
+        .min(1)
+        .max(35)
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.database.pitrRetentionDays)
+        .describe('Point-in-time restore retention in days (mssql only).'),
+    ltr_weekly_retention: zod_1.z
+        .string()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.database.ltrWeeklyRetention)
+        .describe('Long-term retention ISO 8601 duration, e.g. P21W (mssql only).'),
+    allocated_storage_mb: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('Allocated storage in MB (postgres only).')
+})
+    .passthrough();
+const AzureRedisSchema = zod_1.z
+    .object({
+    enabled: zod_1.z.boolean().optional().default(false),
+    sku_name: zod_1.z
+        .string()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.redis.skuName)
+        .describe("Azure Managed Redis 'Balanced' tier SKU, e.g. Balanced_B0, Balanced_B1, Balanced_B5.")
+})
+    .passthrough();
+const AzureContainerAppSchema = zod_1.z
+    .object({
+    cpu: zod_1.z
+        .number()
+        .positive()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.containerApp.cpu),
+    memory: zod_1.z
+        .string()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.containerApp.memory)
+        .describe('CPU:memory ratio is fixed at 1:2 by the platform.'),
+    concurrent_requests: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.containerApp.concurrentRequests)
+        .describe('HTTP concurrency threshold that triggers scale-out.'),
+    min_replicas: zod_1.z
+        .number()
+        .int()
+        .nonnegative()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.containerApp.minReplicas),
+    max_replicas: zod_1.z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.containerApp.maxReplicas)
+})
+    .passthrough();
+const AzureWorkerSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(AZURE_APP_NAME_MIN_LENGTH, `worker name must be at least ${AZURE_APP_NAME_MIN_LENGTH} characters (Azure Container App naming requirement)`)
+        .max(AZURE_APP_NAME_MAX_LENGTH, `worker name must be ${AZURE_APP_NAME_MAX_LENGTH} characters or fewer (Azure Container App naming limit)`)
+        .regex(AZURE_APP_NAME_PATTERN, `worker name ${AZURE_APP_NAME_MESSAGE}`)
+        .describe('Worker name. Used as the Container App name.'),
+    dockerfile: zod_1.z
+        .string()
+        .min(1)
+        .describe("Path to the worker's Dockerfile relative to the project root.")
+})
+    .passthrough()
+    .meta({ id: 'azureWorker' });
+exports.AzureAppSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(AZURE_APP_NAME_MIN_LENGTH, `app name must be at least ${AZURE_APP_NAME_MIN_LENGTH} characters (Azure Container App naming requirement)`)
+        .max(AZURE_APP_NAME_MAX_LENGTH, `app name must be ${AZURE_APP_NAME_MAX_LENGTH} characters or fewer (Azure Container App naming limit)`)
+        .regex(AZURE_APP_NAME_PATTERN, `app name ${AZURE_APP_NAME_MESSAGE}`),
+    technology: zod_1.z
+        .string()
+        .min(1)
+        .describe("Application role/framework. 'nest' and 'react' get framework-specific env var injection (see docs); any other value deploys as a plain Container App with no extra env vars — pass everything explicitly via variables/build_env."),
+    dockerfile: zod_1.z.string().min(1),
+    health_check_path: zod_1.z.string().min(1),
+    domain: zod_1.z
+        .string()
+        .min(1)
+        .describe('Custom domain for this app. A managed TLS certificate is issued automatically via Front Door once DNS validation completes (see the custom_domain_validation deploy output).'),
+    port: zod_1.z.number().int().positive(),
+    branch: zod_1.z.string().default('main'),
+    template_repo_branch: zod_1.z.string().default('main'),
+    variables: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional().default({}),
+    build_env: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional().default({}),
+    workers: zod_1.z.array(AzureWorkerSchema).optional().default([]),
+    database: AzureDatabaseSchema.default({
+        enabled: false,
+        engine: azure_defaults_1.AZURE_DEFAULTS.database.engine,
+        storage_account_type: azure_defaults_1.AZURE_DEFAULTS.database.storageAccountType,
+        pitr_retention_days: azure_defaults_1.AZURE_DEFAULTS.database.pitrRetentionDays,
+        ltr_weekly_retention: azure_defaults_1.AZURE_DEFAULTS.database.ltrWeeklyRetention
+    }).describe('Azure SQL Database or PostgreSQL Flexible Server for this app.'),
+    redis: AzureRedisSchema.default({
+        enabled: false,
+        sku_name: azure_defaults_1.AZURE_DEFAULTS.redis.skuName
+    }).describe('Azure Managed Redis for this app.'),
+    container_app: AzureContainerAppSchema.default({
+        cpu: azure_defaults_1.AZURE_DEFAULTS.containerApp.cpu,
+        memory: azure_defaults_1.AZURE_DEFAULTS.containerApp.memory,
+        concurrent_requests: azure_defaults_1.AZURE_DEFAULTS.containerApp.concurrentRequests,
+        min_replicas: azure_defaults_1.AZURE_DEFAULTS.containerApp.minReplicas,
+        max_replicas: azure_defaults_1.AZURE_DEFAULTS.containerApp.maxReplicas
+    }).describe('Azure Container Apps (Consumption plan) sizing. Every app runs as a Container App.')
+})
+    .passthrough()
+    .meta({ id: 'azureApp' });
+exports.AzureInfraConfigSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    slack_webhook_url: zod_1.z.string().optional(),
+    github_repo_name: zod_1.z
+        .string()
+        .optional()
+        .describe('Name of the GitHub repository to create/use. Defaults to "${name}-monorepo". Set this ' +
+        'explicitly when this fuel.yml should target a repo already used by another environment ' +
+        '(e.g. a separate prod fuel.yml with its own `name` pointing at the same repo as dev).'),
+    deployment: zod_1.z.literal('azure'),
+    location: zod_1.z
+        .string()
+        .optional()
+        .default(azure_defaults_1.AZURE_DEFAULTS.location)
+        .describe('Azure region for all resources.'),
+    monitor: zod_1.z
+        .object({
+        daily_data_cap_gb: zod_1.z
+            .number()
+            .positive()
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.monitor.dailyDataCapGb),
+        retention_days: zod_1.z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.monitor.retentionDays),
+        dashboard_count: zod_1.z
+            .number()
+            .int()
+            .nonnegative()
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.monitor.dashboardCount)
+    })
+        .passthrough()
+        .default({
+        daily_data_cap_gb: azure_defaults_1.AZURE_DEFAULTS.monitor.dailyDataCapGb,
+        retention_days: azure_defaults_1.AZURE_DEFAULTS.monitor.retentionDays,
+        dashboard_count: azure_defaults_1.AZURE_DEFAULTS.monitor.dashboardCount
+    })
+        .describe('Application Insights / Log Analytics settings shared across all apps.'),
+    front_door: zod_1.z
+        .object({
+        sku_name: zod_1.z
+            .literal('Standard_AzureFrontDoor')
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.frontDoor.skuName)
+    })
+        .passthrough()
+        .default({ sku_name: azure_defaults_1.AZURE_DEFAULTS.frontDoor.skuName }),
+    storage_account: zod_1.z
+        .object({
+        account_kind: zod_1.z
+            .literal('BlockBlobStorage')
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.storageAccount.accountKind),
+        account_tier: zod_1.z
+            .literal('Premium')
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.storageAccount.accountTier),
+        account_replication_type: zod_1.z
+            .literal('LRS')
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.storageAccount.accountReplicationType),
+        access_tier: zod_1.z
+            .literal('Hot')
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.storageAccount.accessTier)
+    })
+        .passthrough()
+        .default({
+        account_kind: azure_defaults_1.AZURE_DEFAULTS.storageAccount.accountKind,
+        account_tier: azure_defaults_1.AZURE_DEFAULTS.storageAccount.accountTier,
+        account_replication_type: azure_defaults_1.AZURE_DEFAULTS.storageAccount.accountReplicationType,
+        access_tier: azure_defaults_1.AZURE_DEFAULTS.storageAccount.accessTier
+    })
+        .describe('Shared app storage account, used for app file uploads (not the Terraform state storage account).'),
+    key_vault: zod_1.z
+        .object({
+        sku_name: zod_1.z
+            .literal('standard')
+            .optional()
+            .default(azure_defaults_1.AZURE_DEFAULTS.keyVault.skuName)
+    })
+        .passthrough()
+        .default({ sku_name: azure_defaults_1.AZURE_DEFAULTS.keyVault.skuName }),
+    github_oidc: zod_1.z
+        .object({
+        enabled: zod_1.z
+            .boolean()
+            .optional()
+            .default(true)
+            .describe('Set to false to skip GitHub Actions OIDC entirely — no app registration, no role assignment ' +
+            'for CI. Use this to unblock testing the rest of the stack while waiting on a tenant admin.'),
+        existing_client_id: zod_1.z
+            .string()
+            .optional()
+            .describe('Client ID of an app registration + service principal + federated identity credential(s) already ' +
+            'created out-of-band by a tenant admin. Set this when the deploying SP lacks the Entra ID ' +
+            '"Application Administrator" role (creating an app registration requires it, regardless of ' +
+            'subscription-level RBAC) — the module then reuses that identity instead of creating a new one. ' +
+            'The Contributor role assignment is still managed by Terraform either way, since that only needs ' +
+            '"User Access Administrator" on the subscription.'),
+        existing_principal_id: zod_1.z
+            .string()
+            .optional()
+            .describe('Object ID (principal ID) of the service principal identified by existing_client_id, when ' +
+            'already known. Strongly recommended whenever existing_client_id is set: without it, ' +
+            'Terraform looks the object ID up via Microsoft Graph, which needs Directory.Read.All or ' +
+            "Application.Read.All on the deploying SP — permissions many tenant admins won't grant just " +
+            'to resolve one known object. Whoever created the app out-of-band can get this by running ' +
+            '`az ad sp show --id <existing_client_id> --query id -o tsv`.'),
+        manage_role_assignment: zod_1.z
+            .boolean()
+            .optional()
+            .default(true)
+            .describe('Whether Terraform should create/manage the Contributor role assignment for this identity. ' +
+            'Set to false when it was already granted out-of-band alongside existing_client_id (e.g. a ' +
+            "tenant admin's onboarding runbook already ran the role assignment) — otherwise Terraform " +
+            'tries to create it again on every apply and fails with RoleAssignmentExists.')
+    })
+        .passthrough()
+        .optional()
+        .default({ enabled: true, manage_role_assignment: true })
+        .describe('GitHub Actions OIDC identity used to push images and redeploy Container Apps.'),
+    apps: zod_1.z.array(exports.AzureAppSchema).min(1)
+})
+    .passthrough()
+    .meta({ id: 'azureConfig' });
+exports.InfraConfigSchema = zod_1.z.discriminatedUnion('deployment', [
+    exports.EcsInfraConfigSchema,
+    exports.AzureInfraConfigSchema
+]);
+exports.AWS_REQUIRED_CREDENTIAL_KEYS = [
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
     'AWS_REGION',
     'GITHUB_TOKEN',
     'GITHUB_USERNAME',
-    'GITHUB_ORGANIZATION',
+    'GITHUB_ORGANIZATION'
+];
+exports.AZURE_REQUIRED_CREDENTIAL_KEYS = [
+    'AZURE_SUBSCRIPTION_ID',
+    'AZURE_TENANT_ID',
+    'AZURE_CLIENT_ID',
+    'AZURE_CLIENT_SECRET',
+    'GITHUB_TOKEN',
+    'GITHUB_USERNAME',
+    'GITHUB_ORGANIZATION'
+];
+// Union of every credential key across providers — `resolveCredentials` only
+// requires the subset matching the target deployment, but the type covers both
+// so a single Credentials object can be read/written regardless of provider.
+exports.REQUIRED_CREDENTIAL_KEYS = [
+    ...exports.AWS_REQUIRED_CREDENTIAL_KEYS,
+    ...exports.AZURE_REQUIRED_CREDENTIAL_KEYS
 ];
+function requiredCredentialKeysFor(deployment) {
+    return deployment === 'azure'
+        ? exports.AZURE_REQUIRED_CREDENTIAL_KEYS
+        : exports.AWS_REQUIRED_CREDENTIAL_KEYS;
+}
 //# sourceMappingURL=types.js.map

package/dist/infra/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/infra/types.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAA;AAgCO,oCAAY;AA9BR,QAAA,SAAS,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClE,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAA;AAEW,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AAMW,QAAA,wBAAwB,GAAG;IACtC,mBAAmB;IACnB,uBAAuB;IACvB,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,qBAAqB;CACb,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/infra/types.ts"],"names":[],"mappings":";;;AA+gBA,8DAMC;AArhBD,6BAAuB;AACvB,qDAAiD;AAEjD,oFAAoF;AACpF,qFAAqF;AACrF,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,iCAAiC,CAAA;AAC1D,MAAM,gBAAgB,GACpB,kGAAkG,CAAA;AAEpG,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAClC,wGAAwG;AACxG,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,sFAAsF;AACtF,yFAAyF;AACzF,+BAA+B;AAC/B,MAAM,sBAAsB,GAAG,+BAA+B,CAAA;AAC9D,MAAM,sBAAsB,GAC1B,yJAAyJ,CAAA;AAC3J,MAAM,yBAAyB,GAAG,CAAC,CAAA;AACnC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAEpC,MAAM,YAAY,GAAG,OAAC;KACnB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CACF,mBAAmB,EACnB,uBAAuB,mBAAmB,kDAAkD,CAC7F;SACA,KAAK,CAAC,gBAAgB,EAAE,eAAe,gBAAgB,EAAE,CAAC;SAC1D,QAAQ,CAAC,4CAA4C,CAAC;IACzD,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,+DAA+D,CAAC;CAC7E,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;AAschB,oCAAY;AApcR,QAAA,SAAS,GAAG,OAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CACF,mBAAmB,EACnB,oBAAoB,mBAAmB,wDAAwD,CAChG;SACA,KAAK,CAAC,gBAAgB,EAAE,YAAY,gBAAgB,EAAE,CAAC;IAC1D,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,+NAA+N,CAChO;IACH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,OAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,oDAAoD,CAAC;IACjE,KAAK,EAAE,OAAC;SACL,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,uDAAuD,CAAC;IACpE,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,qCAAqC,CAAC;IAClD,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,wBAAwB,CAAC;IACrC,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uEAAuE,CACxE;IACH,oBAAoB,EAAE,OAAC;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,+DAA+D,CAChE;IACH,mBAAmB,EAAE,OAAC;SACnB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,2EAA2E,CAC5E;CACJ,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;AAEZ,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CACF,uBAAuB,EACvB,gBAAgB,uBAAuB,uGAAuG,CAC/I;SACA,KAAK,CAAC,gBAAgB,EAAE,QAAQ,gBAAgB,EAAE,CAAC;IACtD,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,yFAAyF;QACzF,uFAAuF,CAC1F;IACH,UAAU,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5B,GAAG,EAAE,OAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,2HAA2H,CAC5H;IACH,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;KACzB,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;KACjE,CAAA;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,wCAAwC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACxE,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,gBAAgB;AAEhB,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,MAAM,EAAE,OAAC;SACN,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;SAC3B,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;SACvC,QAAQ,CACP,8HAA8H,CAC/H;IACH,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yEAAyE,CAC1E;IACH,oBAAoB,EAAE,OAAC;SACpB,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;SACzC,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC;SACnD,QAAQ,CAAC,yCAAyC,CAAC;IACtD,mBAAmB,EAAE,OAAC;SACnB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SAClD,QAAQ,CAAC,uDAAuD,CAAC;IACpE,oBAAoB,EAAE,OAAC;SACpB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC;SACnD,QAAQ,CACP,gEAAgE,CACjE;IACH,oBAAoB,EAAE,OAAC;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CAAC,0CAA0C,CAAC;CACxD,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,gBAAgB,GAAG,OAAC;KACvB,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,KAAK,CAAC,OAAO,CAAC;SACrC,QAAQ,CACP,sFAAsF,CACvF;CACJ,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,uBAAuB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,GAAG,EAAE,OAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,YAAY,CAAC,GAAG,CAAC;IAC3C,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,YAAY,CAAC,MAAM,CAAC;SAC3C,QAAQ,CAAC,mDAAmD,CAAC;IAChE,mBAAmB,EAAE,OAAC;SACnB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,YAAY,CAAC,kBAAkB,CAAC;SACvD,QAAQ,CAAC,qDAAqD,CAAC;IAClE,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,WAAW,EAAE;SACb,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,YAAY,CAAC,WAAW,CAAC;IACnD,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,YAAY,CAAC,WAAW,CAAC;CACpD,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,iBAAiB,GAAG,OAAC;KACxB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CACF,yBAAyB,EACzB,gCAAgC,yBAAyB,sDAAsD,CAChH;SACA,GAAG,CACF,yBAAyB,EACzB,uBAAuB,yBAAyB,yDAAyD,CAC1G;SACA,KAAK,CAAC,sBAAsB,EAAE,eAAe,sBAAsB,EAAE,CAAC;SACtE,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,+DAA+D,CAAC;CAC7E,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAA;AAEjB,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CACF,yBAAyB,EACzB,6BAA6B,yBAAyB,sDAAsD,CAC7G;SACA,GAAG,CACF,yBAAyB,EACzB,oBAAoB,yBAAyB,yDAAyD,CACvG;SACA,KAAK,CAAC,sBAAsB,EAAE,YAAY,sBAAsB,EAAE,CAAC;IACtE,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,mOAAmO,CACpO;IACH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,8KAA8K,CAC/K;IACH,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC;QACpC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,+BAAc,CAAC,QAAQ,CAAC,MAAM;QACtC,oBAAoB,EAAE,+BAAc,CAAC,QAAQ,CAAC,kBAAkB;QAChE,mBAAmB,EAAE,+BAAc,CAAC,QAAQ,CAAC,iBAAiB;QAC9D,oBAAoB,EAAE,+BAAc,CAAC,QAAQ,CAAC,kBAAkB;KACjE,CAAC,CAAC,QAAQ,CACT,gEAAgE,CACjE;IACD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,+BAAc,CAAC,KAAK,CAAC,OAAO;KACvC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAChD,aAAa,EAAE,uBAAuB,CAAC,OAAO,CAAC;QAC7C,GAAG,EAAE,+BAAc,CAAC,YAAY,CAAC,GAAG;QACpC,MAAM,EAAE,+BAAc,CAAC,YAAY,CAAC,MAAM;QAC1C,mBAAmB,EAAE,+BAAc,CAAC,YAAY,CAAC,kBAAkB;QACnE,YAAY,EAAE,+BAAc,CAAC,YAAY,CAAC,WAAW;QACrD,YAAY,EAAE,+BAAc,CAAC,YAAY,CAAC,WAAW;KACtD,CAAC,CAAC,QAAQ,CACT,oFAAoF,CACrF;CACF,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;AAEd,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,OAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,yFAAyF;QACzF,uFAAuF,CAC1F;IACH,UAAU,EAAE,OAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,+BAAc,CAAC,QAAQ,CAAC;SAChC,QAAQ,CAAC,iCAAiC,CAAC;IAC9C,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,iBAAiB,EAAE,OAAC;aACjB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,OAAO,CAAC,cAAc,CAAC;QACjD,cAAc,EAAE,OAAC;aACd,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,eAAe,EAAE,OAAC;aACf,MAAM,EAAE;aACR,GAAG,EAAE;aACL,WAAW,EAAE;aACb,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,OAAO,CAAC,cAAc,CAAC;KAClD,CAAC;SACD,WAAW,EAAE;SACb,OAAO,CAAC;QACP,iBAAiB,EAAE,+BAAc,CAAC,OAAO,CAAC,cAAc;QACxD,cAAc,EAAE,+BAAc,CAAC,OAAO,CAAC,aAAa;QACpD,eAAe,EAAE,+BAAc,CAAC,OAAO,CAAC,cAAc;KACvD,CAAC;SACD,QAAQ,CACP,uEAAuE,CACxE;IACH,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC;aACR,OAAO,CAAC,yBAAyB,CAAC;aAClC,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7C,CAAC;SACD,WAAW,EAAE;SACb,OAAO,CAAC,EAAE,QAAQ,EAAE,+BAAc,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,eAAe,EAAE,OAAC;SACf,MAAM,CAAC;QACN,YAAY,EAAE,OAAC;aACZ,OAAO,CAAC,kBAAkB,CAAC;aAC3B,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,cAAc,CAAC,WAAW,CAAC;QACrD,YAAY,EAAE,OAAC;aACZ,OAAO,CAAC,SAAS,CAAC;aAClB,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,cAAc,CAAC,WAAW,CAAC;QACrD,wBAAwB,EAAE,OAAC;aACxB,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,cAAc,CAAC,sBAAsB,CAAC;QAChE,WAAW,EAAE,OAAC;aACX,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,cAAc,CAAC,UAAU,CAAC;KACrD,CAAC;SACD,WAAW,EAAE;SACb,OAAO,CAAC;QACP,YAAY,EAAE,+BAAc,CAAC,cAAc,CAAC,WAAW;QACvD,YAAY,EAAE,+BAAc,CAAC,cAAc,CAAC,WAAW;QACvD,wBAAwB,EACtB,+BAAc,CAAC,cAAc,CAAC,sBAAsB;QACtD,WAAW,EAAE,+BAAc,CAAC,cAAc,CAAC,UAAU;KACtD,CAAC;SACD,QAAQ,CACP,kGAAkG,CACnG;IACH,SAAS,EAAE,OAAC;SACT,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC;aACR,OAAO,CAAC,UAAU,CAAC;aACnB,QAAQ,EAAE;aACV,OAAO,CAAC,+BAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;KAC5C,CAAC;SACD,WAAW,EAAE;SACb,OAAO,CAAC,EAAE,QAAQ,EAAE,+BAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzD,WAAW,EAAE,OAAC;SACX,MAAM,CAAC;QACN,OAAO,EAAE,OAAC;aACP,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,8FAA8F;YAC5F,4FAA4F,CAC/F;QACH,kBAAkB,EAAE,OAAC;aAClB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,kGAAkG;YAChG,2FAA2F;YAC3F,4FAA4F;YAC5F,iGAAiG;YACjG,kGAAkG;YAClG,kDAAkD,CACrD;QACH,qBAAqB,EAAE,OAAC;aACrB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,2FAA2F;YACzF,sFAAsF;YACtF,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,8DAA8D,CACjE;QACH,sBAAsB,EAAE,OAAC;aACtB,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,4FAA4F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,8EAA8E,CACjF;KACJ,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;SACxD,QAAQ,CACP,+EAA+E,CAChF;IACH,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,sBAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAA;AAEjB,QAAA,iBAAiB,GAAG,OAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAClE,4BAAoB;IACpB,8BAAsB;CACvB,CAAC,CAAA;AAUW,QAAA,4BAA4B,GAAG;IAC1C,mBAAmB;IACnB,uBAAuB;IACvB,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,qBAAqB;CACb,CAAA;AAEG,QAAA,8BAA8B,GAAG;IAC5C,uBAAuB;IACvB,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;IACrB,cAAc;IACd,iBAAiB;IACjB,qBAAqB;CACb,CAAA;AAEV,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAChE,QAAA,wBAAwB,GAAG;IACtC,GAAG,oCAA4B;IAC/B,GAAG,sCAA8B;CACzB,CAAA;AAKV,SAAgB,yBAAyB,CACvC,UAAsB;IAEtB,OAAO,UAAU,KAAK,OAAO;QAC3B,CAAC,CAAC,sCAA8B;QAChC,CAAC,CAAC,oCAA4B,CAAA;AAClC,CAAC"}

package/dist/infra-templates/TODO-azure-prod.md

@@ -0,0 +1,127 @@
+# Azure prod isolation — pending points
+
+Context: expanding to a fully isolated `infra-prod` (separate RG, separate
+tfstate, separate Key Vault/OIDC identity from dev/stg) with heavier prod
+specs (SQL 6 vCore GP zone-redundant, Front Door Premium+WAF, Container
+Apps Dedicated D4x2, Defender for Cloud, etc).
+
+## Done — Key Vault per-app secrets pre-populated (closed on feature/azure-provider-support)
+
+Each app's vault now gets an `azurerm_key_vault_secret` named `app-variables`
+holding `jsonencode(local.app_variables[app])` — one JSON blob per app,
+mirroring ECS's `modules/secret` (which also stores all of an app's
+`variables:` as one JSON blob, not one secret per key).
+
+Two blockers closed:
+
+- **RBAC** (data-plane `Key Vault Secrets Officer`, which `Contributor` doesn't
+  cover): resolved _without_ the Graph-lookup problem the github_oidc
+  `existing_principal_id` escape hatch needed — `data.azurerm_client_config.current.object_id`
+  resolves the _running_ SP's own object_id purely via ARM, no
+  `Application.Read.All` required.
+- **Network** (found while implementing, wasn't in this doc before): the vault
+  defaults to `public_network_access_enabled = false`, so `network_acls` never
+  even applies — writing a secret from a local machine (not a VNet-joined
+  identity) 403s regardless of RBAC. Fixed via `modules/azure-key-vault`'s new
+  `ip_rules` var: `data.http.tofu_operator_ip` auto-detects the operator's
+  current public IP (`api.ipify.org`) each apply and allowlists just that /32,
+  flipping `public_network_access_enabled` on only when `ip_rules` is non-empty.
+  A `time_sleep` (30s) sits between the role assignment and the secret write —
+  Azure RBAC propagation isn't instant, so writing in the same apply that
+  grants the role can otherwise 403 intermittently.
+
+Not addressed: this doesn't give the _app itself_ read access over the network
+at runtime (Container Apps egress via the NAT Gateway's public IP, which isn't
+on the allowlist and isn't covered by `bypass = "AzureServices"`). Today no app
+code actually reads from Key Vault via SDK — `KEY_VAULT_URI` is informational
+and env vars are still delivered as plaintext Container App `env_vars`/`secrets`
+(see "Decided, not implemented yet" below for that separate gap). If an app
+ever needs to read its vault directly, this'll need a private endpoint or a
+broader firewall rule for the Container Apps subnet's egress IP.
+
+## Already fixed (committed on feature/azure-provider-support)
+
+- `github_oidc.enabled` sensitivity leak (`for_each`/output error) — fixed via
+  `nonsensitive()` in `templates/azure/locals.tf` (`local.github_oidc_enabled`).
+- Orphan private DNS zones in `modules/azure-network` (e.g. postgres zone
+  created even when only mssql is used) — gated behind `postgres_needed`/
+  `mssql_needed`/`redis_needed` flags computed from `local.app_list`.
+- Container App `secret` block used the raw (unsanitized) secret key as the
+  Azure secret name — fixed to reuse `local.secret_names`.
+- SQL LTR + auto-pause both enabled by default, which Azure rejects on a
+  serverless database — LTR now only applies when `auto_pause_delay_in_minutes
+== -1` (i.e. provisioned/prod databases).
+- `packages/infra` was left behind in every scaffolded project (only
+  `packages/cli` was cleaned up) — now removed the same way. `templates/azure`
+  had no `.gitignore` (unlike `templates/ecs`) — added one.
+- `fuel infra:deploy --regenerate` never resolved a template source (no
+  `--source`, no GitHub-token download) — wired through `resolveSourceRoot()`.
+- Subscription missing required resource provider registrations (`Microsoft.App`
+  409 mid-apply) — `providers.tf` now explicitly registers everything this
+  template set needs via `resource_providers_to_register` (azurerm >= 4.0).
+- Container Apps referenced `${acr}/${app}:latest` from creation, but that tag
+  never exists yet (CI depends on this same apply having run first) — seeded
+  with a public placeholder image + `ignore_changes` so CI's first real push
+  takes over permanently.
+- Container Apps subnet had no NAT Gateway/route table — Azure's "default
+  outbound access" retirement means no reliable egress for image pulls
+  without one. Added a Standard NAT Gateway to the subnet.
+- `azurerm_container_app` always declared a `registry` block pointing at the
+  ACR, but the AcrPull role assignment for that identity is necessarily
+  created _after_ the container app — Azure hung validating an unauthorized
+  credential on first create regardless of which image was pulled. Dropped
+  the `registry` block; CI now configures it via `az containerapp registry
+set` once the role assignment already exists.
+- Every Front Door route also set `link_to_default_domain = true`, so the
+  second app's route collided with the first on the shared `*.azurefd.net`
+  hostname/path. Now only links the default domain when an app has no custom
+  domain (which, since `domain` is required, is never in practice).
+- `github_repo_name` as explicit field — done, see below.
+
+## Decided, not implemented yet
+
+1. **Multi-environment pipelines.** `templates/azure/workflows/build_and_deploy.yml`
+   uses repo-wide secrets (`AZURE_CLIENT_ID`/`TENANT_ID`/`SUBSCRIPTION_ID`/
+   `ACR_LOGIN_SERVER`, no `environment:` on the job) and bakes
+   `RESOURCE_GROUP`/`ACR_NAME`/`CONTAINER_APP_NAME` as literal strings at
+   generation time (`copyAzureWorkflows` in `template-engine.ts`). Need to
+   move to GitHub Environments (per-env secrets/vars + protection rules for
+   prod) before generating a prod workflow in the same repo as dev — same
+   app name today would silently overwrite the dev workflow file.
+2. **Front Door Premium + WAF** (OWASP 3.2 + bot protection). Schema
+   (`fuel.schema.json` → `azureConfig.front_door.sku_name`) hardcodes
+   `Standard_AzureFrontDoor` as a `const`. Module
+   `modules/azure-front-door` has no `azurerm_cdn_frontdoor_security_policy`/
+   WAF policy resource at all. Since prod gets its own Terraform state this
+   no longer conflicts with dev/stg — just needs the schema const relaxed
+   and the WAF resource added.
+3. **Container Apps Dedicated plan** (D4 x2). `modules/azure-container-apps-environment`
+   is Consumption-only _by design_ (explicit comment in `main.tf`). Needs a
+   `workload_profile` block + a way to select Dedicated per-app/per-env.
+
+## No Terraform module exists (infra gap, not config gap)
+
+- Microsoft Defender for Cloud (Containers/SQL/Storage/Key Vault plans)
+- Static Web Apps
+- Azure DevOps pipelines (stack uses GitHub Actions instead — confirm this
+  is acceptable for prod or if Azure DevOps is a hard requirement)
+- Support plan (subscription-level purchase, not a Terraform resource —
+  won't ever be a fuel.yml field)
+
+## Still need to verify
+
+- Count actual `azurerm_private_endpoint`-equivalent resources created
+  today (SQL, Redis) vs. the prod spec line "5 private endpoints x 730h,
+  100GB in/out" — only confirmed the network _structure_ (subnets/DNS
+  zones) exists, not an exact endpoint count against spec.
+
+## Action not yet taken
+
+- No one has actually scaffolded `infra-prod` yet (new `fuel.yml` + running
+  the CLI generation into a separate target dir). Isolation is designed but
+  not yet real until that runs.
+
+## Suggested next pick (unresolved — pick one to start)
+
+- GitHub Environments wiring (workflow template + docs)
+- Front Door WAF (schema + module)