@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.5

package/dist/kinds/dns.kind.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Infra DNS Kind
+ *
+ * Provider-agnostic schema for authoritative DNS records. Per-provider
+ * implementations (cloudflare-dns, do-domains, route53) map this shape
+ * onto the native API.
+ *
+ * `proxied` is modeled here rather than in the Cloudflare adapter because
+ * whether a hostname is served through a reverse proxy is a product
+ * decision with protocol consequences, not a vendor detail. Git over HTTP
+ * requires a direct origin; a proxied record silently breaks smart-HTTP
+ * pack negotiation. Providers without a proxy layer reject `proxied: true`
+ * as unsupported rather than accepting and ignoring it.
+ */
+import * as z from 'zod/v4';
+import type { InfraAuthorityFingerprint } from './inventory.kind.ts';
+declare const DnsRecordTypeSchema: z.ZodEnum<{
+    A: "A";
+    AAAA: "AAAA";
+    CNAME: "CNAME";
+    TXT: "TXT";
+    MX: "MX";
+    SRV: "SRV";
+    CAA: "CAA";
+    NS: "NS";
+}>;
+export type DnsRecordType = z.infer<typeof DnsRecordTypeSchema>;
+declare const DnsRecordSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodEnum<{
+        A: "A";
+        AAAA: "AAAA";
+        CNAME: "CNAME";
+        TXT: "TXT";
+        MX: "MX";
+        SRV: "SRV";
+        CAA: "CAA";
+        NS: "NS";
+    }>;
+    content: z.ZodString;
+    ttl: z.ZodDefault<z.ZodNumber>;
+    proxied: z.ZodDefault<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    comment: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DnsRecord = z.infer<typeof DnsRecordSchema>;
+export type DnsRecordInput = z.input<typeof DnsRecordSchema>;
+declare const DnsBaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/dns">;
+    adapter: z.ZodString;
+    adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    zone: z.ZodOptional<z.ZodString>;
+    environment: z.ZodDefault<z.ZodString>;
+    records: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            A: "A";
+            AAAA: "AAAA";
+            CNAME: "CNAME";
+            TXT: "TXT";
+            MX: "MX";
+            SRV: "SRV";
+            CAA: "CAA";
+            NS: "NS";
+        }>;
+        content: z.ZodString;
+        ttl: z.ZodDefault<z.ZodNumber>;
+        proxied: z.ZodDefault<z.ZodBoolean>;
+        priority: z.ZodOptional<z.ZodNumber>;
+        comment: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type InfraDnsDescriptor = z.infer<typeof DnsBaseSchema>;
+export type InfraDnsDescriptorInput = z.input<typeof DnsBaseSchema>;
+/** A record as it exists on the provider, carrying the provider-assigned id. */
+export type LiveDnsRecord = DnsRecord & {
+    providerId: string;
+    zone: string;
+};
+export interface DnsZoneStatus {
+    zone: string;
+    status: string;
+    nameservers: string[];
+    activatedOn?: string;
+    modifiedOn?: string;
+}
+export interface DnsZoneActivationResult {
+    requested: boolean;
+    status: DnsZoneStatus;
+}
+/**
+ * Implementation contract every provider implements. `upsertRecord` is
+ * idempotent on (name, type): it updates the existing record in place
+ * rather than creating a duplicate RRset entry. Opt-in matchContent selects by
+ * exact content as well, creating a sibling when that value is absent. Callers
+ * must check supportsContentMatch before using this mode.
+ */
+export interface DnsImplementation {
+    /** Whether diff/upsert support preserving siblings by matching exact content. */
+    supportsContentMatch?: boolean;
+    /** Redacted authority used by the latest provider request. */
+    getAuthority?(): Promise<InfraAuthorityFingerprint>;
+    /** List records, optionally narrowed by exact name and/or type. */
+    listRecords(filter?: {
+        name?: string;
+        type?: DnsRecordType;
+    }): Promise<LiveDnsRecord[]>;
+    /** Create or update a record by (name, type). Returns the provider id. */
+    upsertRecord(record: DnsRecordInput, options?: {
+        matchContent?: boolean;
+    }): Promise<{
+        providerId: string;
+        created: boolean;
+    }>;
+    /** Delete by provider id. Absence is not an error. */
+    deleteRecord(providerId: string): Promise<boolean>;
+    /**
+     * Diff desired against live for the names in `desired`. Records outside
+     * that set are never reported for deletion — this kind is additive by
+     * default so it can coexist with records owned elsewhere.
+     */
+    diff(desired: DnsRecordInput[], options?: {
+        matchContent?: boolean;
+    }): Promise<{
+        create: DnsRecord[];
+        update: Array<{
+            providerId: string;
+            from: LiveDnsRecord;
+            to: DnsRecord;
+        }>;
+        unchanged: LiveDnsRecord[];
+    }>;
+    /** Read the authoritative zone's provider activation state. */
+    getZoneStatus?(): Promise<DnsZoneStatus>;
+    /** Request an immediate provider activation check for a pending zone. */
+    requestZoneActivation?(): Promise<DnsZoneActivationResult>;
+}
+export declare const dnsKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DnsImplementation>;
+export type InfraDnsKind = InfraDnsDescriptor;
+export type InfraDnsKindInput = InfraDnsDescriptorInput;
+export { DnsBaseSchema as InfraDnsDescriptorSchema, DnsRecordSchema, DnsRecordTypeSchema };
+//# sourceMappingURL=dns.kind.d.ts.map

package/dist/kinds/dns.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/dns.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE,QAAA,MAAM,mBAAmB;;;;;;;;;EAAkE,CAAC;AAE5F,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;iBAgBnB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE7D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUjB,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpE,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IACjC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8DAA8D;IAC9D,YAAY,CAAC,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,mEAAmE;IACnE,WAAW,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,0EAA0E;IAC1E,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9H,sDAAsD;IACtD,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC;QAC9E,MAAM,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,CAAC;YAAC,EAAE,EAAE,SAAS,CAAA;SAAE,CAAC,CAAC;QAC1E,SAAS,EAAE,aAAa,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,+DAA+D;IAC/D,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,yEAAyE;IACzE,qBAAqB,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC3D;AAED,eAAO,MAAM,OAAO,8EAIlB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC9C,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAExD,OAAO,EAAE,aAAa,IAAI,wBAAwB,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/kinds/dns.kind.js

@@ -0,0 +1,54 @@
+/**
+ * Infra DNS Kind
+ *
+ * Provider-agnostic schema for authoritative DNS records. Per-provider
+ * implementations (cloudflare-dns, do-domains, route53) map this shape
+ * onto the native API.
+ *
+ * `proxied` is modeled here rather than in the Cloudflare adapter because
+ * whether a hostname is served through a reverse proxy is a product
+ * decision with protocol consequences, not a vendor detail. Git over HTTP
+ * requires a direct origin; a proxied record silently breaks smart-HTTP
+ * pack negotiation. Providers without a proxy layer reject `proxied: true`
+ * as unsupported rather than accepting and ignoring it.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+const DnsRecordTypeSchema = z.enum(['A', 'AAAA', 'CNAME', 'TXT', 'MX', 'SRV', 'CAA', 'NS']);
+const DnsRecordSchema = z.object({
+    /** Fully-qualified record name (e.g. `git.vibes.dev`). */
+    name: z.string().min(1),
+    type: DnsRecordTypeSchema,
+    /** Record value: IP for A/AAAA, target for CNAME, payload for TXT. */
+    content: z.string().min(1),
+    /** TTL in seconds. `1` means "provider automatic" where supported. */
+    ttl: z.number().int().positive().default(1),
+    /**
+     * Serve through the provider's reverse proxy when true. Must be false
+     * for protocols the proxy cannot carry (git smart-HTTP, raw SSH).
+     */
+    proxied: z.boolean().default(false),
+    /** Priority for MX/SRV. */
+    priority: z.number().int().nonnegative().optional(),
+    comment: z.string().optional()
+});
+const DnsBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/dns'),
+    /** Adapter id (e.g. 'cloudflare-dns', 'do-domains'). */
+    adapter: z.string().min(1),
+    adapterConfig: z.record(z.string(), z.unknown()).optional(),
+    /** Apex zone this descriptor is authoritative for (e.g. `vibes.dev`). */
+    zone: z.string().min(1).optional(),
+    /** Environment name for credential resolution via `vibes secrets`. */
+    environment: z.string().default('local'),
+    records: z.array(DnsRecordSchema).default([])
+});
+export const dnsKind = createRuntimeKind({
+    id: 'infra/dns',
+    descriptorSchema: DnsBaseSchema,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+export { DnsBaseSchema as InfraDnsDescriptorSchema, DnsRecordSchema, DnsRecordTypeSchema };
+//# sourceMappingURL=dns.kind.js.map

package/dist/kinds/dns.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns.kind.js","sourceRoot":"","sources":["../../src/kinds/dns.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAI5F,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,0DAA0D;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,mBAAmB;IACzB,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,sEAAsE;IACtE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,2BAA2B;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAKH,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,yEAAyE;IACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC,CAAC;AAuDH,MAAM,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAwC;IAC/E,EAAE,EAAE,WAAW;IACf,gBAAgB,EAAE,aAAa;IAC/B,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC;AAKH,OAAO,EAAE,aAAa,IAAI,wBAAwB,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/kinds/drift.kind.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Kind: infra/drift
+ *
+ * Generic drift descriptor. Reports differences between declared infra
+ * descriptors and the live provider state. Drift entries cover missing
+ * resources, unmanaged resources, stale resources, unsafe public exposure,
+ * and unexpected cost drivers.
+ */
+import * as z from 'zod/v4';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+export declare const DriftKindSchema: z.ZodEnum<{
+    missing: "missing";
+    unmanaged: "unmanaged";
+    stale: "stale";
+    "unsafe-public": "unsafe-public";
+    "cost-driver": "cost-driver";
+    "config-drift": "config-drift";
+}>;
+export type DriftKind = z.infer<typeof DriftKindSchema>;
+export declare const DriftSeveritySchema: z.ZodEnum<{
+    info: "info";
+    critical: "critical";
+    warning: "warning";
+}>;
+export type DriftSeverity = z.infer<typeof DriftSeveritySchema>;
+export declare const DriftEntrySchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        missing: "missing";
+        unmanaged: "unmanaged";
+        stale: "stale";
+        "unsafe-public": "unsafe-public";
+        "cost-driver": "cost-driver";
+        "config-drift": "config-drift";
+    }>;
+    severity: z.ZodDefault<z.ZodEnum<{
+        info: "info";
+        critical: "critical";
+        warning: "warning";
+    }>>;
+    resourceKind: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodString>;
+    resourceName: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+    expected: z.ZodOptional<z.ZodUnknown>;
+    actual: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type DriftEntry = z.infer<typeof DriftEntrySchema>;
+export declare const DriftReportSchema: z.ZodObject<{
+    provider: z.ZodString;
+    collectedAt: z.ZodString;
+    entries: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            missing: "missing";
+            unmanaged: "unmanaged";
+            stale: "stale";
+            "unsafe-public": "unsafe-public";
+            "cost-driver": "cost-driver";
+            "config-drift": "config-drift";
+        }>;
+        severity: z.ZodDefault<z.ZodEnum<{
+            info: "info";
+            critical: "critical";
+            warning: "warning";
+        }>>;
+        resourceKind: z.ZodString;
+        resourceId: z.ZodOptional<z.ZodString>;
+        resourceName: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+        expected: z.ZodOptional<z.ZodUnknown>;
+        actual: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DriftReport = z.infer<typeof DriftReportSchema>;
+export declare const DriftDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/drift">;
+    provider: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DriftDescriptor = z.infer<typeof DriftDescriptorSchema>;
+export interface DriftImplementation {
+    /** Compute drift between declared and live resources. */
+    detect(opts?: {
+        kinds?: string[];
+    }): Promise<DriftReport>;
+}
+declare class DefaultDriftImplementation {
+    readonly descriptor: RuntimeDescriptor;
+    readonly context: KindContext;
+    /** The descriptor as this kind's schema reads it. */
+    readonly config: DriftDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export declare const driftKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<DefaultDriftImplementation>;
+export {};
+//# sourceMappingURL=drift.kind.d.ts.map

package/dist/kinds/drift.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/drift.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAIpE,eAAO,MAAM,eAAe;;;;;;;EAO1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,mBAAmB;;;;EAA0C,CAAC;AAC3E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAAkB,CAAC;AACrD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1D;AAED,cAAM,0BAA0B;aAId,UAAU,EAAE,iBAAiB;aAC7B,OAAO,EAAE,WAAW;IAJrC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAEhB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,WAAW;CAKrC;AAED,eAAO,MAAM,SAAS,uFAKpB,CAAC"}

package/dist/kinds/drift.kind.js

@@ -0,0 +1,60 @@
+/**
+ * Kind: infra/drift
+ *
+ * Generic drift descriptor. Reports differences between declared infra
+ * descriptors and the live provider state. Drift entries cover missing
+ * resources, unmanaged resources, stale resources, unsafe public exposure,
+ * and unexpected cost drivers.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { readKindDescriptor } from "./read-descriptor.js";
+import { INFRA_DISCOVERY_PATTERNS } from "./discovery.js";
+export const DriftKindSchema = z.enum([
+    'missing',
+    'unmanaged',
+    'stale',
+    'unsafe-public',
+    'cost-driver',
+    'config-drift'
+]);
+export const DriftSeveritySchema = z.enum(['info', 'warning', 'critical']);
+export const DriftEntrySchema = z.object({
+    kind: DriftKindSchema,
+    severity: DriftSeveritySchema.default('warning'),
+    resourceKind: z.string(),
+    resourceId: z.string().optional(),
+    resourceName: z.string().optional(),
+    message: z.string(),
+    expected: z.unknown().optional(),
+    actual: z.unknown().optional()
+});
+export const DriftReportSchema = z.object({
+    provider: z.string(),
+    collectedAt: z.string(),
+    entries: z.array(DriftEntrySchema)
+});
+const DriftBaseSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('infra/drift'),
+    provider: z.string().min(1).optional()
+});
+export const DriftDescriptorSchema = DriftBaseSchema;
+class DefaultDriftImplementation {
+    descriptor;
+    context;
+    /** The descriptor as this kind's schema reads it. */
+    config;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+        this.config = readKindDescriptor(DriftDescriptorSchema, descriptor);
+    }
+}
+export const driftKind = createRuntimeKind({
+    id: 'infra/drift',
+    descriptorSchema: DriftDescriptorSchema,
+    defaultImplementation: DefaultDriftImplementation,
+    discoveryPatterns: INFRA_DISCOVERY_PATTERNS
+});
+//# sourceMappingURL=drift.kind.js.map

package/dist/kinds/drift.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.kind.js","sourceRoot":"","sources":["../../src/kinds/drift.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,SAAS;IACT,WAAW;IACX,OAAO;IACP,eAAe;IACf,aAAa;IACb,cAAc;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAQrD,MAAM,0BAA0B;IAId;IACA;IAJjB,qDAAqD;IAC5C,MAAM,CAAkB;IACjC,YACiB,UAA6B,EAC7B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAa;QAEpC,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;CAED;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAA8C;IACvF,EAAE,EAAE,aAAa;IACjB,gBAAgB,EAAE,qBAAqB;IACvC,qBAAqB,EAAE,0BAA0B;IACjD,iBAAiB,EAAE,wBAAwB;CAC3C,CAAC,CAAC"}

package/dist/kinds/edge-tls.kind.d.ts

@@ -0,0 +1,194 @@
+/**
+ * Infra Edge TLS Kind
+ *
+ * Provider-agnostic schema for the TLS policy an edge/CDN uses when it
+ * connects to an origin. This governs the edge→origin leg only; the
+ * browser→edge leg is certificate and hostname configuration, not this kind.
+ *
+ * The policy is modeled per hostname rather than per zone because a zone
+ * routinely fronts origins with different certificate maturity: a hardened
+ * origin needs `verified`, while a legacy origin with a self-signed or
+ * expired certificate still answers only under `opportunistic`. A zone-wide
+ * value forces the weakest origin's policy onto every hostname.
+ *
+ * `opportunistic` is a loop hazard, not merely weak: when the edge speaks
+ * plaintext to an origin that redirects to HTTPS, a same-zone subrequest
+ * bounces between edge and origin until the edge gives up. Any hostname whose
+ * origin redirects HTTP to HTTPS must be `verified` or `encrypted`.
+ */
+import * as z from 'zod/v4';
+import type { InfraAuthorityFingerprint } from './inventory.kind.ts';
+/**
+ * - `verified`: encrypt and require a valid certificate for the origin hostname.
+ * - `encrypted`: encrypt without validating the origin certificate.
+ * - `opportunistic`: connect in plaintext when the origin allows it.
+ * - `off`: never encrypt the edge→origin leg.
+ */
+declare const OriginTlsPolicySchema: z.ZodEnum<{
+    off: "off";
+    verified: "verified";
+    encrypted: "encrypted";
+    opportunistic: "opportunistic";
+}>;
+export type OriginTlsPolicy = z.infer<typeof OriginTlsPolicySchema>;
+declare const EdgeTlsPolicySchema: z.ZodObject<{
+    hostnames: z.ZodArray<z.ZodString>;
+    policy: z.ZodEnum<{
+        off: "off";
+        verified: "verified";
+        encrypted: "encrypted";
+        opportunistic: "opportunistic";
+    }>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type EdgeTlsPolicy = z.infer<typeof EdgeTlsPolicySchema>;
+export type EdgeTlsPolicyInput = z.input<typeof EdgeTlsPolicySchema>;
+declare const EdgeTlsBaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"infra/edge-tls">;
+    adapter: z.ZodString;
+    adapterConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    zone: z.ZodOptional<z.ZodString>;
+    environment: z.ZodDefault<z.ZodString>;
+    policies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        hostnames: z.ZodArray<z.ZodString>;
+        policy: z.ZodEnum<{
+            off: "off";
+            verified: "verified";
+            encrypted: "encrypted";
+            opportunistic: "opportunistic";
+        }>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type InfraEdgeTlsDescriptor = z.infer<typeof EdgeTlsBaseSchema>;
+export type InfraEdgeTlsDescriptorInput = z.input<typeof EdgeTlsBaseSchema>;
+/** A policy as it exists on the provider, carrying provider-assigned identity. */
+export interface LiveEdgeTlsPolicy {
+    providerId: string;
+    zone: string;
+    hostnames: string[];
+    /** Null when the provider reports a value outside this kind's enum. */
+    policy: OriginTlsPolicy | null;
+    /** Raw provider value, kept so unmapped policies stay visible as evidence. */
+    providerValue: string;
+    /** Provider-native match condition, kept as evidence of what really matches. */
+    expression: string;
+    enabled: boolean;
+    description?: string;
+    /**
+     * False when the live shape is outside what this kind writes — a compound
+     * rule, or a condition that is not a plain hostname set. Unmanaged policies
+     * are reported but never rewritten.
+     */
+    managed: boolean;
+}
+export interface EdgeTlsZoneDefault {
+    zone: string;
+    /** Null when the provider reports a value outside this kind's enum. */
+    policy: OriginTlsPolicy | null;
+    providerValue: string;
+    /** False when the provider forbids changing the default on this plan. */
+    editable: boolean;
+}
+export interface EdgeTlsSnapshot {
+    zone: string;
+    default: EdgeTlsZoneDefault;
+    policies: LiveEdgeTlsPolicy[];
+    /**
+     * Configuration a co-tenant owns in the same provider container, which a
+     * write must carry forward untouched. Non-zero here means this kind is not
+     * the only author, so a full-replacement write would destroy work.
+     */
+    coTenantRules: number;
+}
+export interface EdgeTlsWriteResult {
+    providerId: string;
+    created: boolean;
+    /** Co-tenant configuration re-sent verbatim by this write. */
+    preservedRules: number;
+    /** Total entries in the provider container after the write. */
+    totalRules: number;
+}
+export interface EdgeTlsDeleteResult {
+    /** Policies removed outright because the hostname was their only member. */
+    removed: string[];
+    /** Policies kept but narrowed because they also covered other hostnames. */
+    narrowed: string[];
+    preservedRules: number;
+    totalRules: number;
+}
+export interface EdgeTlsZoneDefaultChange {
+    zone: string;
+    from: OriginTlsPolicy | null;
+    to: OriginTlsPolicy;
+}
+/**
+ * Implementation contract every provider implements.
+ *
+ * `setPolicy` is idempotent on the hostname set: it updates the live policy
+ * for exactly those hostnames rather than adding a second policy that would
+ * race it. Providers that store policies in a shared, wholesale-replaced
+ * container must merge co-tenant entries forward; the reported
+ * `preservedRules` is the evidence that they did.
+ */
+export interface EdgeTlsImplementation {
+    /** Redacted authority used by the latest provider request. */
+    getAuthority?(): Promise<InfraAuthorityFingerprint>;
+    /** Live per-hostname policies plus the zone default, optionally narrowed. */
+    read(filter?: {
+        hostname?: string;
+    }): Promise<EdgeTlsSnapshot>;
+    setPolicy(policy: EdgeTlsPolicyInput): Promise<EdgeTlsWriteResult>;
+    /** Drop one hostname's policy. Absence is not an error. */
+    deletePolicy(filter: {
+        hostname: string;
+    }): Promise<EdgeTlsDeleteResult>;
+    /**
+     * Change the zone-wide default. `verified` breaks every hostname whose
+     * origin does not serve a valid certificate for its own name, including
+     * hostnames with no per-hostname policy of their own, so implementations
+     * refuse the call until the caller acknowledges that blast radius.
+     */
+    setZoneDefault(policy: OriginTlsPolicy, options: {
+        acknowledgeOriginBreakage: boolean;
+    }): Promise<EdgeTlsZoneDefaultChange>;
+    /**
+     * Diff desired against live for the hostname sets in `desired`. Policies
+     * outside those sets are never reported for deletion — this kind is
+     * additive by default so it can coexist with co-tenant policies.
+     */
+    diff(desired: EdgeTlsPolicyInput[]): Promise<{
+        create: EdgeTlsPolicy[];
+        update: Array<{
+            providerId: string;
+            from: LiveEdgeTlsPolicy;
+            to: EdgeTlsPolicy;
+        }>;
+        unchanged: LiveEdgeTlsPolicy[];
+    }>;
+}
+export declare const edgeTlsKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<EdgeTlsImplementation>;
+export type InfraEdgeTlsKind = InfraEdgeTlsDescriptor;
+export type InfraEdgeTlsKindInput = InfraEdgeTlsDescriptorInput;
+export { EdgeTlsBaseSchema as InfraEdgeTlsDescriptorSchema, EdgeTlsPolicySchema, OriginTlsPolicySchema };
+//# sourceMappingURL=edge-tls.kind.d.ts.map

package/dist/kinds/edge-tls.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-tls.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/edge-tls.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,QAAA,MAAM,qBAAqB;;;;;EAA4D,CAAC;AAExF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,QAAA,MAAM,mBAAmB;;;;;;;;;iBAUvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACvE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5E,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,eAAe,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACrC,8DAA8D;IAC9D,YAAY,CAAC,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACpD,6EAA6E;IAC7E,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,SAAS,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnE,2DAA2D;IAC3D,YAAY,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzE;;;;;OAKG;IACH,cAAc,CACb,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE;QAAE,yBAAyB,EAAE,OAAO,CAAA;KAAE,GAC7C,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,aAAa,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,iBAAiB,CAAC;YAAC,EAAE,EAAE,aAAa,CAAA;SAAE,CAAC,CAAC;QAClF,SAAS,EAAE,iBAAiB,EAAE,CAAC;KAC/B,CAAC,CAAC;CACH;AAED,eAAO,MAAM,WAAW,kFAItB,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACtD,MAAM,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEhE,OAAO,EACN,iBAAiB,IAAI,4BAA4B,EACjD,mBAAmB,EACnB,qBAAqB,EACrB,CAAC"}