@vibesdotdev/infra-core 0.0.1 → 1.0.0-rc.4

package/dist/kinds/drift.kind.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Kind: infra/drift
+ *
+ * Generic drift descriptor. Reports differences between declared infra
+ * descriptors and the live provider state. Drift entries cover missing
+ * resources, unmanaged resources, stale resources, unsafe public exposure,
+ * and unexpected cost drivers.
+ */
+import * as z from 'zod/v4';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+export declare const DriftKindSchema: z.ZodEnum<{
+    missing: "missing";
+    unmanaged: "unmanaged";
+    stale: "stale";
+    "unsafe-public": "unsafe-public";
+    "cost-driver": "cost-driver";
+    "config-drift": "config-drift";
+}>;
+export type DriftKind = z.infer<typeof DriftKindSchema>;
+export declare const DriftSeveritySchema: z.ZodEnum<{
+    info: "info";
+    critical: "critical";
+    warning: "warning";
+}>;
+export type DriftSeverity = z.infer<typeof DriftSeveritySchema>;
+export declare const DriftEntrySchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        missing: "missing";
+        unmanaged: "unmanaged";
+        stale: "stale";
+        "unsafe-public": "unsafe-public";
+        "cost-driver": "cost-driver";
+        "config-drift": "config-drift";
+    }>;
+    severity: z.ZodDefault<z.ZodEnum<{
+        info: "info";
+        critical: "critical";
+        warning: "warning";
+    }>>;
+    resourceKind: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodString>;
+    resourceName: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+    expected: z.ZodOptional<z.ZodUnknown>;
+    actual: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type DriftEntry = z.infer<typeof DriftEntrySchema>;
+export declare const DriftReportSchema: z.ZodObject<{
+    provider: z.ZodString;
+    collectedAt: z.ZodString;
+    entries: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            missing: "missing";
+            unmanaged: "unmanaged";
+            stale: "stale";
+            "unsafe-public": "unsafe-public";
+            "cost-driver": "cost-driver";
+            "config-drift": "config-drift";
+        }>;
+        severity: z.ZodDefault<z.ZodEnum<{
+            info: "info";
+            critical: "critical";
+            warning: "warning";
+        }>>;
+        resourceKind: z.ZodString;
+        resourceId: z.ZodOptional<z.ZodString>;
+        resourceName: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+        expected: z.ZodOptional<z.ZodUnknown>;
+        actual: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DriftReport = z.infer<typeof DriftReportSchema>;
+export declare const DriftDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/drift">;
+    provider: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DriftDescriptor = z.infer<typeof DriftDescriptorSchema>;
+export interface DriftImplementation {
+    /** Compute drift between declared and live resources. */
+    detect(opts?: {
+        kinds?: string[];
+    }): Promise<DriftReport>;
+}
+declare class DefaultDriftImplementation {
+    readonly descriptor: RuntimeDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: DriftDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export declare const driftKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultDriftImplementation>;
+export {};
+//# sourceMappingURL=drift.kind.d.ts.map

package/dist/kinds/drift.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/drift.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAIpE,eAAO,MAAM,eAAe;;;;;;;EAO1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,mBAAmB;;;;EAA0C,CAAC;AAC3E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAAkB,CAAC;AACrD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1D;AAED,cAAM,0BAA0B;aAId,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAEhB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,SAAS,uFAKpB,CAAC"}

package/dist/kinds/drift.kind.js

@@ -0,0 +1,60 @@
+/**
+ * Kind: infra/drift
+ *
+ * Generic drift descriptor. Reports differences between declared infra
+ * descriptors and the live provider state. Drift entries cover missing
+ * resources, unmanaged resources, stale resources, unsafe public exposure,
+ * and unexpected cost drivers.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+export const DriftKindSchema = z.enum([
+    'missing',
+    'unmanaged',
+    'stale',
+    'unsafe-public',
+    'cost-driver',
+    'config-drift'
+]);
+export const DriftSeveritySchema = z.enum(['info', 'warning', 'critical']);
+export const DriftEntrySchema = z.object({
+    kind: DriftKindSchema,
+    severity: DriftSeveritySchema.default('warning'),
+    resourceKind: z.string(),
+    resourceId: z.string().optional(),
+    resourceName: z.string().optional(),
+    message: z.string(),
+    expected: z.unknown().optional(),
+    actual: z.unknown().optional()
+});
+export const DriftReportSchema = z.object({
+    provider: z.string(),
+    collectedAt: z.string(),
+    entries: z.array(DriftEntrySchema)
+});
+const DriftBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/drift'),
+    provider: z.string().min(1).optional()
+});
+export const DriftDescriptorSchema = DriftBaseSchema;
+class DefaultDriftImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(DriftDescriptorSchema, descriptor);
+    }
+}
+export const driftKind = createRuntimeKind({
+    id: 'infra/drift',
+    descriptorSchema: DriftDescriptorSchema,
+    defaultImplementation: DefaultDriftImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=drift.kind.js.map

package/dist/kinds/drift.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.kind.js","sourceRoot":"","sources":["../../src/kinds/drift.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,SAAS;IACT,WAAW;IACX,OAAO;IACP,eAAe;IACf,aAAa;IACb,cAAc;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAQrD,MAAM,0BAA0B;IAId;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAkB;IACjC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;CAED;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAA8C;IACvF,EAAE,EAAE,aAAa;IACjB,gBAAgB,EAAE,qBAAqB;IACvC,qBAAqB,EAAE,0BAA0B;IACjD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}

package/dist/kinds/edge-tls.kind.d.ts

@@ -0,0 +1,194 @@
+/**
+ * Infra Edge TLS Kind
+ *
+ * Provider-agnostic schema for the TLS policy an edge/CDN uses when it
+ * connects to an origin. This governs the edge→origin leg only; the
+ * browser→edge leg is certificate and hostname configuration, not this kind.
+ *
+ * The policy is modeled per hostname rather than per zone because a zone
+ * routinely fronts origins with different certificate maturity: a hardened
+ * origin needs `verified`, while a legacy origin with a self-signed or
+ * expired certificate still answers only under `opportunistic`. A zone-wide
+ * value forces the weakest origin's policy onto every hostname.
+ *
+ * `opportunistic` is a loop hazard, not merely weak: when the edge speaks
+ * plaintext to an origin that redirects to HTTPS, a same-zone subrequest
+ * bounces between edge and origin until the edge gives up. Any hostname whose
+ * origin redirects HTTP to HTTPS must be `verified` or `encrypted`.
+ */
+import * as z from 'zod/v4';
+import type { InfraAuthorityFingerprint } from './inventory.kind.ts';
+/**
+ * - `verified`: encrypt and require a valid certificate for the origin hostname.
+ * - `encrypted`: encrypt without validating the origin certificate.
+ * - `opportunistic`: connect in plaintext when the origin allows it.
+ * - `off`: never encrypt the edge→origin leg.
+ */
+declare const OriginTlsPolicySchema: z.ZodEnum<{
+    off: "off";
+    verified: "verified";
+    encrypted: "encrypted";
+    opportunistic: "opportunistic";
+}>;
+export type OriginTlsPolicy = z.infer<typeof OriginTlsPolicySchema>;
+declare const EdgeTlsPolicySchema: z.ZodObject<{
+    hostnames: z.ZodArray<z.ZodString>;
+    policy: z.ZodEnum<{
+        off: "off";
+        verified: "verified";
+        encrypted: "encrypted";
+        opportunistic: "opportunistic";
+    }>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type EdgeTlsPolicy = z.infer<typeof EdgeTlsPolicySchema>;
+export type EdgeTlsPolicyInput = z.input<typeof EdgeTlsPolicySchema>;
+declare const EdgeTlsBaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/edge-tls">;
+    adapter: z.ZodString;
+    adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    zone: z.ZodOptional<z.ZodString>;
+    environment: z.ZodDefault<z.ZodString>;
+    policies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        hostnames: z.ZodArray<z.ZodString>;
+        policy: z.ZodEnum<{
+            off: "off";
+            verified: "verified";
+            encrypted: "encrypted";
+            opportunistic: "opportunistic";
+        }>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type InfraEdgeTlsDescriptor = z.infer<typeof EdgeTlsBaseSchema>;
+export type InfraEdgeTlsDescriptorInput = z.input<typeof EdgeTlsBaseSchema>;
+/** A policy as it exists on the provider, carrying provider-assigned identity. */
+export interface LiveEdgeTlsPolicy {
+    providerId: string;
+    zone: string;
+    hostnames: string[];
+    /** Null when the provider reports a value outside this kind's enum. */
+    policy: OriginTlsPolicy | null;
+    /** Raw provider value, kept so unmapped policies stay visible as evidence. */
+    providerValue: string;
+    /** Provider-native match condition, kept as evidence of what really matches. */
+    expression: string;
+    enabled: boolean;
+    description?: string;
+    /**
+     * False when the live shape is outside what this kind writes — a compound
+     * rule, or a condition that is not a plain hostname set. Unmanaged policies
+     * are reported but never rewritten.
+     */
+    managed: boolean;
+}
+export interface EdgeTlsZoneDefault {
+    zone: string;
+    /** Null when the provider reports a value outside this kind's enum. */
+    policy: OriginTlsPolicy | null;
+    providerValue: string;
+    /** False when the provider forbids changing the default on this plan. */
+    editable: boolean;
+}
+export interface EdgeTlsSnapshot {
+    zone: string;
+    default: EdgeTlsZoneDefault;
+    policies: LiveEdgeTlsPolicy[];
+    /**
+     * Configuration a co-tenant owns in the same provider container, which a
+     * write must carry forward untouched. Non-zero here means this kind is not
+     * the only author, so a full-replacement write would destroy work.
+     */
+    coTenantRules: number;
+}
+export interface EdgeTlsWriteResult {
+    providerId: string;
+    created: boolean;
+    /** Co-tenant configuration re-sent verbatim by this write. */
+    preservedRules: number;
+    /** Total entries in the provider container after the write. */
+    totalRules: number;
+}
+export interface EdgeTlsDeleteResult {
+    /** Policies removed outright because the hostname was their only member. */
+    removed: string[];
+    /** Policies kept but narrowed because they also covered other hostnames. */
+    narrowed: string[];
+    preservedRules: number;
+    totalRules: number;
+}
+export interface EdgeTlsZoneDefaultChange {
+    zone: string;
+    from: OriginTlsPolicy | null;
+    to: OriginTlsPolicy;
+}
+/**
+ * Implementation contract every provider implements.
+ *
+ * `setPolicy` is idempotent on the hostname set: it updates the live policy
+ * for exactly those hostnames rather than adding a second policy that would
+ * race it. Providers that store policies in a shared, wholesale-replaced
+ * container must merge co-tenant entries forward; the reported
+ * `preservedRules` is the evidence that they did.
+ */
+export interface EdgeTlsImplementation {
+    /** Redacted authority used by the latest provider request. */
+    getAuthority?(): Promise<InfraAuthorityFingerprint>;
+    /** Live per-hostname policies plus the zone default, optionally narrowed. */
+    read(filter?: {
+        hostname?: string;
+    }): Promise<EdgeTlsSnapshot>;
+    setPolicy(policy: EdgeTlsPolicyInput): Promise<EdgeTlsWriteResult>;
+    /** Drop one hostname's policy. Absence is not an error. */
+    deletePolicy(filter: {
+        hostname: string;
+    }): Promise<EdgeTlsDeleteResult>;
+    /**
+     * Change the zone-wide default. `verified` breaks every hostname whose
+     * origin does not serve a valid certificate for its own name, including
+     * hostnames with no per-hostname policy of their own, so implementations
+     * refuse the call until the caller acknowledges that blast radius.
+     */
+    setZoneDefault(policy: OriginTlsPolicy, options: {
+        acknowledgeOriginBreakage: boolean;
+    }): Promise<EdgeTlsZoneDefaultChange>;
+    /**
+     * Diff desired against live for the hostname sets in `desired`. Policies
+     * outside those sets are never reported for deletion — this kind is
+     * additive by default so it can coexist with co-tenant policies.
+     */
+    diff(desired: EdgeTlsPolicyInput[]): Promise<{
+        create: EdgeTlsPolicy[];
+        update: Array<{
+            providerId: string;
+            from: LiveEdgeTlsPolicy;
+            to: EdgeTlsPolicy;
+        }>;
+        unchanged: LiveEdgeTlsPolicy[];
+    }>;
+}
+export declare const edgeTlsKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<EdgeTlsImplementation>;
+export type InfraEdgeTlsKind = InfraEdgeTlsDescriptor;
+export type InfraEdgeTlsKindInput = InfraEdgeTlsDescriptorInput;
+export { EdgeTlsBaseSchema as InfraEdgeTlsDescriptorSchema, EdgeTlsPolicySchema, OriginTlsPolicySchema };
+//# sourceMappingURL=edge-tls.kind.d.ts.map

package/dist/kinds/edge-tls.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tls.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/edge-tls.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,QAAA,MAAM,qBAAqB;;;;;EAA4D,CAAC;AAExF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,QAAA,MAAM,mBAAmB;;;;;;;;;iBAUvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACvE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5E,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,eAAe,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACrC,8DAA8D;IAC9D,YAAY,CAAC,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,6EAA6E;IAC7E,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,SAAS,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnE,2DAA2D;IAC3D,YAAY,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzE;;;;;OAKG;IACH,cAAc,CACb,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE;QAAE,yBAAyB,EAAE,OAAO,CAAA;KAAE,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,aAAa,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,iBAAiB,CAAC;YAAC,EAAE,EAAE,aAAa,CAAA;SAAE,CAAC,CAAC;QAClF,SAAS,EAAE,iBAAiB,EAAE,CAAC;KAC/B,CAAC,CAAC;CACH;AAED,eAAO,MAAM,WAAW,kFAItB,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACtD,MAAM,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEhE,OAAO,EACN,iBAAiB,IAAI,4BAA4B,EACjD,mBAAmB,EACnB,qBAAqB,EACrB,CAAC"}

package/dist/kinds/edge-tls.kind.js

@@ -0,0 +1,58 @@
+/**
+ * Infra Edge TLS Kind
+ *
+ * Provider-agnostic schema for the TLS policy an edge/CDN uses when it
+ * connects to an origin. This governs the edge→origin leg only; the
+ * browser→edge leg is certificate and hostname configuration, not this kind.
+ *
+ * The policy is modeled per hostname rather than per zone because a zone
+ * routinely fronts origins with different certificate maturity: a hardened
+ * origin needs `verified`, while a legacy origin with a self-signed or
+ * expired certificate still answers only under `opportunistic`. A zone-wide
+ * value forces the weakest origin's policy onto every hostname.
+ *
+ * `opportunistic` is a loop hazard, not merely weak: when the edge speaks
+ * plaintext to an origin that redirects to HTTPS, a same-zone subrequest
+ * bounces between edge and origin until the edge gives up. Any hostname whose
+ * origin redirects HTTP to HTTPS must be `verified` or `encrypted`.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+/**
+ * - `verified`: encrypt and require a valid certificate for the origin hostname.
+ * - `encrypted`: encrypt without validating the origin certificate.
+ * - `opportunistic`: connect in plaintext when the origin allows it.
+ * - `off`: never encrypt the edge→origin leg.
+ */
+const OriginTlsPolicySchema = z.enum(['verified', 'encrypted', 'opportunistic', 'off']);
+const EdgeTlsPolicySchema = z.object({
+    /**
+     * Hostnames this policy applies to. Treated as a set: order and case do
+     * not change identity, so an equivalent declaration resolves to the same
+     * live policy instead of adding a second one.
+     */
+    hostnames: z.array(z.string().min(1)).min(1),
+    policy: OriginTlsPolicySchema,
+    /** Operator note stored with the policy where the provider supports it. */
+    description: z.string().optional()
+});
+const EdgeTlsBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/edge-tls'),
+    /** Adapter id (e.g. 'cloudflare-edge-tls'). */
+    adapter: z.string().min(1),
+    adapterConfig: z.record(z.string(), z.unknown()).optional(),
+    /** Apex zone this descriptor is authoritative for (e.g. `vibes.dev`). */
+    zone: z.string().min(1).optional(),
+    /** Environment name for credential resolution via `vibes secrets`. */
+    environment: z.string().default('local'),
+    policies: z.array(EdgeTlsPolicySchema).default([])
+});
+export const edgeTlsKind = createRuntimeKind({
+    id: 'infra/edge-tls',
+    descriptorSchema: EdgeTlsBaseSchema,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+export { EdgeTlsBaseSchema as InfraEdgeTlsDescriptorSchema, EdgeTlsPolicySchema, OriginTlsPolicySchema };
+//# sourceMappingURL=edge-tls.kind.js.map

package/dist/kinds/edge-tls.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tls.kind.js","sourceRoot":"","sources":["../../src/kinds/edge-tls.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG1D;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAIxF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,qBAAqB;IAC7B,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAKH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,yEAAyE;IACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AA8GH,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAgD;IAC3F,EAAE,EAAE,gBAAgB;IACpB,gBAAgB,EAAE,iBAAiB;IACnC,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC;AAKH,OAAO,EACN,iBAAiB,IAAI,4BAA4B,EACjD,mBAAmB,EACnB,qBAAqB,EACrB,CAAC"}

package/dist/kinds/firewall.kind.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Kind: infra/firewall
+ *
+ * Provider-neutral firewall descriptor. Used both for compute-level firewalls
+ * (e.g., DigitalOcean cloud firewall, attached to droplets) and the DOKS
+ * control-plane firewall.
+ *
+ * `config` is an open, adapter-keyed shape (DigitalOcean's firewall config
+ * lives in `@vibesdotdev/integrations-digitalocean`); this kind names no
+ * provider, so a config for any adapter parses here and the adapter
+ * validates its own grammar.
+ */
+import * as z from 'zod/v4';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+export declare const FirewallRuleSchema: z.ZodObject<{
+    protocol: z.ZodEnum<{
+        tcp: "tcp";
+        udp: "udp";
+        icmp: "icmp";
+    }>;
+    ports: z.ZodOptional<z.ZodString>;
+    sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type FirewallRule = z.infer<typeof FirewallRuleSchema>;
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export declare const FirewallConfigSchema: z.ZodObject<{
+    adapter: z.ZodString;
+}, z.core.$loose>;
+export type FirewallConfig = z.infer<typeof FirewallConfigSchema>;
+export declare const FirewallDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/firewall">;
+    inboundRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+            icmp: "icmp";
+        }>;
+        ports: z.ZodOptional<z.ZodString>;
+        sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    outboundRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+            icmp: "icmp";
+        }>;
+        ports: z.ZodOptional<z.ZodString>;
+        sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        destinations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    config: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodString;
+    }, z.core.$loose>>;
+}, z.core.$strip>;
+export type FirewallDescriptor = z.infer<typeof FirewallDescriptorSchema>;
+declare class DefaultFirewallImplementation {
+    readonly descriptor: RuntimeDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: FirewallDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export declare const firewallKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultFirewallImplementation>;
+export {};
+//# sourceMappingURL=firewall.kind.d.ts.map

package/dist/kinds/firewall.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/firewall.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAIpE,eAAO,MAAM,kBAAkB;;;;;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAQ9D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,cAAM,6BAA6B;aAIjB,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAEnB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,YAAY,0FAKvB,CAAC"}

package/dist/kinds/firewall.kind.js

@@ -0,0 +1,59 @@
+/**
+ * Kind: infra/firewall
+ *
+ * Provider-neutral firewall descriptor. Used both for compute-level firewalls
+ * (e.g., DigitalOcean cloud firewall, attached to droplets) and the DOKS
+ * control-plane firewall.
+ *
+ * `config` is an open, adapter-keyed shape (DigitalOcean's firewall config
+ * lives in `@vibesdotdev/integrations-digitalocean`); this kind names no
+ * provider, so a config for any adapter parses here and the adapter
+ * validates its own grammar.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+export const FirewallRuleSchema = z.object({
+    protocol: z.enum(['tcp', 'udp', 'icmp']),
+    ports: z.string().optional(),
+    sources: z.array(z.string()).optional(),
+    destinations: z.array(z.string()).optional()
+});
+const FirewallBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/firewall'),
+    inboundRules: z.array(FirewallRuleSchema).optional(),
+    outboundRules: z.array(FirewallRuleSchema).optional()
+});
+/**
+ * Adapter-specific configuration: the adapter id plus its own fields. Each
+ * adapter package defines and parses its own config schema; this kind names
+ * no provider, so a config for any adapter — including one contributed by a
+ * user plugin — parses here, and the adapter validates its own grammar.
+ */
+export const FirewallConfigSchema = z.looseObject({
+    adapter: z.string().min(1)
+});
+export const FirewallDescriptorSchema = FirewallBaseSchema.extend({
+    /** Adapter-specific configuration, parsed by the adapter that owns it. */
+    config: FirewallConfigSchema.optional()
+});
+class DefaultFirewallImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(FirewallDescriptorSchema, descriptor);
+    }
+}
+export const firewallKind = createRuntimeKind({
+    id: 'infra/firewall',
+    descriptorSchema: FirewallDescriptorSchema,
+    defaultImplementation: DefaultFirewallImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=firewall.kind.js.map

package/dist/kinds/firewall.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.kind.js","sourceRoot":"","sources":["../../src/kinds/firewall.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACpD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACjE,0EAA0E;IAC1E,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH,MAAM,6BAA6B;IAIjB;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAqB;IACpC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;CAED;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAoD;IAChG,EAAE,EAAE,gBAAgB;IACpB,gBAAgB,EAAE,wBAAwB;IAC1C,qBAAqB,EAAE,6BAA6B;IACpD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}