@vibesdotdev/infra-core 0.0.1 → 1.0.0-rc.11

package/dist/credentials/resolve.d.ts

@@ -5,10 +5,11 @@
  * (alerts, RUM, observability, …) reads from the same credential chain
  * the rest of the platform uses. The chain (highest precedence first):
  *
- *   1. process.env (CI / explicit overrides)
- *   2. The tier-resolved secrets/store implementation
+ *   1. The tier-resolved secrets/store implementation
  *      - local tier   → encrypted-local → env-file
  *      - production   → cloudflare-secrets-store → cloudflare-api
+ * There is no ambient-environment fallback: credentials resolve only through
+ * registered secrets stores, using the handed runtime (first argument).
  *
  * Adapters declare the secret KEY NAMES (e.g. CLOUDFLARE_API_TOKEN) on
  * their descriptor's `adapterConfig` and use this helper to resolve
@@ -16,15 +17,28 @@
  * (e.g. prefer a scoped CLOUDFLARE_NOTIFICATIONS_API_TOKEN, fall back
  * to the broad CLOUDFLARE_API_TOKEN).
  *
- * Why a helper instead of inlining the secrets/store query: provider
- * adapters live in different packages and shouldn't all duplicate the
- * tier-walk + env-overlay logic. Keeping it in infra-core makes the
- * abstraction explicit ("infra/* adapters route credentials through
- * vibes secrets") and gives us one place to evolve the chain (e.g.
- * adding 1Password CLI as a backend).
+ * Every refusal is a typed `CapabilityError` with a fixed message. What a
+ * backend threw is never repeated: each failing backend is carried as its
+ * value-free facts (`valueFreeFailure`) in the refusal's details. A walk in
+ * which any backend failed is `UNAVAILABLE credential-store-unavailable`,
+ * never absence; `NOT_FOUND credential-missing` (message prefix
+ * `Missing credential:`) means every backend answered and none held a candidate.
+ *
+ * Each store call is the work of a `runtime.lifecycle.wait`, so a call still
+ * running after its deadline is owned by the runtime and joined at disposal.
  */
-export type EnvironmentTier = 'local' | 'dev' | 'staging' | 'production';
+import * as z from 'zod/v4';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+declare const EnvironmentTierSchema: z.ZodEnum<{
+    local: "local";
+    dev: "dev";
+    staging: "staging";
+    production: "production";
+}>;
+export type EnvironmentTier = z.infer<typeof EnvironmentTierSchema>;
 export interface ResolveAdapterCredentialOptions {
+    /** Opaque Secrets-owned context; forward unchanged across backend bootstrap. */
+    operationContext?: unknown;
     /**
      * Ordered list of candidate keys. First one that resolves to a
      * non-empty value wins. Useful for scoped → fallback patterns:
@@ -43,38 +57,84 @@ export interface ResolveAdapterCredentialOptions {
      */
     tier?: EnvironmentTier;
     /**
-     * Whether to consult process.env first. Defaults true — CI/CD and
-     * explicit shell overrides should win. Pass false to force
-     * store-only resolution.
+     * When true, search every registered secrets/store backend by priority
+     * instead of only the backend matching the target tier. This is useful for
+     * operator control-plane credentials, which may be stored in an encrypted
+     * local backend even when the target environment is production.
+     */
+    includeAllStoreBackends?: boolean;
+    /**
+     * Additional environment names to check after `environment`. Values are
+     * tried against each candidate backend in order.
      */
-    includeProcessEnv?: boolean;
+    fallbackEnvironments?: readonly string[];
     /**
-     * Optional human-readable name for the credential, used in error
-     * messages when no candidate resolves (e.g. "Cloudflare API token").
+     * Optional human-readable name for the credential. Refusals are fixed
+     * text, so it is carried in their details, never in a message.
      */
     humanName?: string;
+    /** Maximum time allowed for each backend resolve/get attempt. Defaults to 15s. */
+    backendTimeoutMs?: number;
+    /** Total deadline for the complete backend walk. Defaults to 90s. */
+    resolutionTimeoutMs?: number;
 }
 export interface ResolvedAdapterCredential {
     /** The KEY that resolved (one of keyCandidates). Useful for audit. */
     key: string;
     /** The resolved secret value. Never logged. */
     value: string;
-    /** Where the value came from: 'process.env' or the store backend id. */
+    /** Where the value came from: the store backend id. */
+    source: string;
+    /** Environment requested by the operator-facing command. */
+    requestedEnvironment: string;
+    /** Actual environment containing the value. */
+    resolvedEnvironment: string;
+}
+/**
+ * Operator control-plane credentials are resolved on the consumer machine even
+ * when they target staging or production. Every infra inventory/audit adapter
+ * must use this narrower contract so one surface cannot silently select a
+ * different secrets backend than another.
+ *
+ * The policy is fixed: every registered store backend is eligible by
+ * priority, and non-local targets may fall back to the operator's local
+ * secrets environment. Callers still own key candidates, human-readable
+ * labels, and bounded resolution deadlines.
+ */
+export interface ResolveOperatorCredentialOptions extends Omit<ResolveAdapterCredentialOptions, 'tier' | 'includeAllStoreBackends' | 'fallbackEnvironments'> {
+    environment: string;
+}
+export type OperatorCredentialResolutionPolicy = Pick<ResolveAdapterCredentialOptions, 'environment' | 'includeAllStoreBackends' | 'fallbackEnvironments'>;
+/** Safe-to-log selection metadata. Deliberately excludes the credential value. */
+export interface AdapterCredentialSelection {
+    requestedEnvironment: string;
+    resolvedEnvironment: string;
+    key: string;
     source: string;
 }
+export declare function operatorCredentialResolutionPolicy(environment: string): OperatorCredentialResolutionPolicy;
+export declare function adapterCredentialSelection(credential: ResolvedAdapterCredential): AdapterCredentialSelection;
 /**
  * Resolve a single credential by walking the candidate keys against
- * process.env then the active secrets store. Returns the first match.
+ * the active secrets store. Returns the first match.
  *
- * Throws when no candidate resolves — adapters should let this bubble
- * up so the CLI surfaces a clean "missing credentials" message rather
- * than a vague "401 Unauthorized" downstream.
+ * Refuses typed when no candidate resolves — adapters should let this
+ * bubble up so the CLI surfaces a clean "missing credentials" message
+ * rather than a vague "401 Unauthorized" downstream.
  */
-export declare function resolveAdapterCredential(options: ResolveAdapterCredentialOptions): Promise<ResolvedAdapterCredential>;
+export declare function resolveAdapterCredential(runtime: VibesRuntime, options: ResolveAdapterCredentialOptions): Promise<ResolvedAdapterCredential>;
 /**
  * Convenience wrapper for resolving multiple credentials at once.
  * Each key gets a candidate list of one (the key itself). Use the
  * single-credential form when you need fallback chains.
  */
-export declare function resolveAdapterCredentials(keys: readonly string[], options?: Omit<ResolveAdapterCredentialOptions, 'keyCandidates' | 'humanName'>): Promise<Record<string, ResolvedAdapterCredential>>;
+export declare function resolveAdapterCredentials(runtime: VibesRuntime, keys: readonly string[], options?: Omit<ResolveAdapterCredentialOptions, 'keyCandidates' | 'humanName'>): Promise<Record<string, ResolvedAdapterCredential>>;
+/**
+ * Resolve an operator credential with the shared inventory/audit policy.
+ * Use `resolveAdapterCredential` directly only when a non-operator workflow
+ * intentionally needs a different selection policy (for example, store-only
+ * recovery validation).
+ */
+export declare function resolveOperatorCredential(runtime: VibesRuntime, options: ResolveOperatorCredentialOptions): Promise<ResolvedAdapterCredential>;
+export {};
 //# sourceMappingURL=resolve.d.ts.map

package/dist/credentials/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAEzE,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACzC,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CACf;AAqCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,+BAA+B,GACtC,OAAO,CAAC,yBAAyB,CAAC,CAsEpC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,IAAI,CAAC,+BAA+B,EAAE,eAAe,GAAG,WAAW,CAAC,GAC5E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CASpD"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAS7B,QAAA,MAAM,qBAAqB;;;;;EAAoD,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,+BAA+B;IAC/C,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAqBD,MAAM,WAAW,yBAAyB;IACzC,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,mBAAmB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gCAAiC,SAAQ,IAAI,CAC7D,+BAA+B,EAC/B,MAAM,GAAG,yBAAyB,GAAG,sBAAsB,CAC3D;IACA,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,kCAAkC,GAAG,IAAI,CACpD,+BAA+B,EAC/B,aAAa,GAAG,yBAAyB,GAAG,sBAAsB,CAClE,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IAC1C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kCAAkC,CACjD,WAAW,EAAE,MAAM,GACjB,kCAAkC,CAMpC;AAED,wBAAgB,0BAA0B,CACzC,UAAU,EAAE,yBAAyB,GACnC,0BAA0B,CAO5B;AA0JD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,+BAA+B,GACtC,OAAO,CAAC,yBAAyB,CAAC,CA+EpC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,IAAI,CAAC,+BAA+B,EAAE,eAAe,GAAG,WAAW,CAAC,GAC5E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAUpD;AAaD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,gCAAgC,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAMpC"}

package/dist/credentials/resolve.js

@@ -5,10 +5,11 @@
  * (alerts, RUM, observability, …) reads from the same credential chain
  * the rest of the platform uses. The chain (highest precedence first):
  *
- *   1. process.env (CI / explicit overrides)
- *   2. The tier-resolved secrets/store implementation
+ *   1. The tier-resolved secrets/store implementation
  *      - local tier   → encrypted-local → env-file
  *      - production   → cloudflare-secrets-store → cloudflare-api
+ * There is no ambient-environment fallback: credentials resolve only through
+ * registered secrets stores, using the handed runtime (first argument).
  *
  * Adapters declare the secret KEY NAMES (e.g. CLOUDFLARE_API_TOKEN) on
  * their descriptor's `adapterConfig` and use this helper to resolve
@@ -16,113 +17,286 @@
  * (e.g. prefer a scoped CLOUDFLARE_NOTIFICATIONS_API_TOKEN, fall back
  * to the broad CLOUDFLARE_API_TOKEN).
  *
- * Why a helper instead of inlining the secrets/store query: provider
- * adapters live in different packages and shouldn't all duplicate the
- * tier-walk + env-overlay logic. Keeping it in infra-core makes the
- * abstraction explicit ("infra/* adapters route credentials through
- * vibes secrets") and gives us one place to evolve the chain (e.g.
- * adding 1Password CLI as a backend).
+ * Every refusal is a typed `CapabilityError` with a fixed message. What a
+ * backend threw is never repeated: each failing backend is carried as its
+ * value-free facts (`valueFreeFailure`) in the refusal's details. A walk in
+ * which any backend failed is `UNAVAILABLE credential-store-unavailable`,
+ * never absence; `NOT_FOUND credential-missing` (message prefix
+ * `Missing credential:`) means every backend answered and none held a candidate.
+ *
+ * Each store call is the work of a `runtime.lifecycle.wait`, so a call still
+ * running after its deadline is owned by the runtime and joined at disposal.
  */
-import { getVibesRuntime } from '@vibesdotdev/runtime';
+import * as z from 'zod/v4';
+import { readUntrusted, settleUntrusted } from '@vibesdotdev/config/manifest/read-untrusted';
+import { getLogger } from '@vibesdotdev/logging';
+import { CapabilityError, isCapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { settleWork } from "../settle-work.js";
+/** The logger the opt-in `VIBES_DEBUG_SECRETS=1` trace writes to, on the handed runtime. */
+const DEBUG_LOGGER_ID = 'infra.credentials';
+const secretsDebugEnabled = (runtime) => runtime.getEnv('VIBES_DEBUG_SECRETS') === '1';
+const EnvironmentTierSchema = z.enum(['local', 'dev', 'staging', 'production']);
+/** The options as read once at the boundary: every field parsed independently, the context forwarded as given. */
+const ResolveOptionsSchema = z.object({
+    operationContext: z.unknown().optional(),
+    keyCandidates: z.array(z.string().min(1)).min(1),
+    environment: z.string().min(1).optional(),
+    tier: EnvironmentTierSchema.optional(),
+    includeAllStoreBackends: z.boolean().optional(),
+    fallbackEnvironments: z.array(z.string()).optional(),
+    humanName: z.string().optional(),
+    backendTimeoutMs: z.number().positive().optional(),
+    resolutionTimeoutMs: z.number().positive().optional()
+});
+const OPTIONS_INVALID = {
+    code: 'INVALID_INPUT',
+    reason: 'credential-options-invalid',
+    message: () => 'Credential resolution options are invalid.'
+};
+export function operatorCredentialResolutionPolicy(environment) {
+    return {
+        environment,
+        includeAllStoreBackends: true,
+        fallbackEnvironments: environment === 'local' ? [] : ['local']
+    };
+}
+export function adapterCredentialSelection(credential) {
+    return {
+        requestedEnvironment: credential.requestedEnvironment,
+        resolvedEnvironment: credential.resolvedEnvironment,
+        key: credential.key,
+        source: credential.source
+    };
+}
+/** A resolved store that offers `get`, kept as the original object (its methods use `this`). */
+const SecretsStoreReadsSchema = z.object({ get: z.function() });
+const SecretsStoreReaderSchema = z.custom((value) => SecretsStoreReadsSchema.safeParse(value).success);
+/** What a store answered for one key: a string value, or nothing. */
+const StoredValueSchema = z.string().optional();
+/** The selection facts of one registered store descriptor. */
+const SecretsStoreSelectionSchema = z.looseObject({
+    id: z.string().min(1),
+    priority: z.number().optional(),
+    tiers: z.array(EnvironmentTierSchema).optional()
+});
+const STORE_UNREADABLE = {
+    code: 'UNAVAILABLE',
+    reason: 'secrets-store-unreadable',
+    message: () => 'A secrets store did not answer in its declared shape.'
+};
+/** A failed attempt, by the value-free facts `settleWork` read from what the backend threw. */
+function backendFailure(store, failure, at = {}) {
+    return { store, ...at, failure };
+}
+/** The failures as JSON details: names, codes and reasons only. */
+function failureDetails(failures) {
+    return failures.map(({ store, environment, key, failure }) => {
+        const detail = { store, name: failure.name };
+        if (environment !== undefined)
+            detail.environment = environment;
+        if (key !== undefined)
+            detail.key = key;
+        if (failure.code !== undefined)
+            detail.code = failure.code;
+        if (failure.reason !== undefined)
+            detail.reason = failure.reason;
+        return detail;
+    });
+}
 /**
  * Tier-aware backend selection. Mirrors the secrets/store kind's own
- * resolver (`packages/secrets/src/kinds/store.kind.ts`) so callers
+ * resolver (`secrets/src/kinds/store.kind.ts`) so callers
  * don't need to import internal helpers.
  */
-function pickBackend(descriptors, tier) {
+function pickBackends(descriptors, tier, includeAllStoreBackends = false) {
     if (descriptors.length === 0)
-        return undefined;
-    const matches = descriptors.filter((d) => (d.tiers ?? []).includes(tier));
-    const pool = matches.length > 0 ? matches : descriptors;
-    pool.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-    return pool[0];
+        return [];
+    const pool = includeAllStoreBackends
+        ? descriptors
+        : descriptors.filter((d) => (d.tiers ?? []).includes(tier));
+    const candidates = pool.length > 0 ? pool : descriptors;
+    return [...candidates].sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
 }
 function inferTier(environment, override) {
     if (override)
         return override;
-    if (environment === 'local' || environment === 'dev' || environment === 'staging' || environment === 'production') {
-        return environment;
+    const known = EnvironmentTierSchema.safeParse(environment);
+    return known.success ? known.data : 'local';
+}
+/** Every registered store's selection facts; one that does not read is a carried failure, never dropped. */
+function storeSelections(runtime, failures) {
+    const selections = [];
+    for (const [index, descriptor] of runtime.assets('secrets/store').descriptors().entries()) {
+        const read = settleUntrusted(SecretsStoreSelectionSchema, () => descriptor, STORE_UNREADABLE);
+        if (read.ok)
+            selections.push(read.data);
+        else
+            failures.push(backendFailure(`#${index + 1}`, valueFreeFailure(read.error)));
+    }
+    return selections;
+}
+/** Walk the backends in priority order under the resolution deadline's `signal`; never reads past it. */
+async function walkBackends(runtime, plan, failures, signal) {
+    const debug = secretsDebugEnabled(runtime) ? getLogger(DEBUG_LOGGER_ID, runtime) : undefined;
+    for (const target of plan.targets) {
+        if (signal.aborted)
+            return { kind: 'aborted' };
+        const opened = await settleWork(async () => {
+            const resolved = await runtime.lifecycle.wait(() => runtime.query('secrets/store').withId(target.id).resolve(), { timeoutMs: plan.backendTimeoutMs, reason: `secrets-store-${target.id}-resolution`, signal });
+            return readUntrusted(SecretsStoreReaderSchema, () => resolved, STORE_UNREADABLE);
+        });
+        if (!opened.ok) {
+            failures.push(backendFailure(target.id, opened.failure));
+            continue;
+        }
+        const store = opened.value;
+        for (const environment of plan.environments) {
+            for (const key of plan.keys) {
+                if (signal.aborted)
+                    return { kind: 'aborted' };
+                const read = await settleWork(async () => {
+                    const stored = await runtime.lifecycle.wait(() => store.get(environment, key, plan.operationContext), { timeoutMs: plan.backendTimeoutMs, reason: `secrets-store-${target.id}-read`, signal });
+                    return readUntrusted(StoredValueSchema, () => stored, STORE_UNREADABLE);
+                });
+                if (!read.ok) {
+                    failures.push(backendFailure(target.id, read.failure, { environment, key }));
+                }
+                else if (read.value !== undefined && read.value.length > 0) {
+                    debug?.info('secrets debug: credential resolved', { key, store: target.id, environment });
+                    return {
+                        kind: 'resolved',
+                        credential: { key, value: read.value, source: target.id, requestedEnvironment: plan.requestedEnvironment, resolvedEnvironment: environment }
+                    };
+                }
+            }
+        }
     }
-    return 'local';
+    return { kind: 'exhausted' };
 }
 /**
  * Resolve a single credential by walking the candidate keys against
- * process.env then the active secrets store. Returns the first match.
+ * the active secrets store. Returns the first match.
  *
- * Throws when no candidate resolves — adapters should let this bubble
- * up so the CLI surfaces a clean "missing credentials" message rather
- * than a vague "401 Unauthorized" downstream.
+ * Refuses typed when no candidate resolves — adapters should let this
+ * bubble up so the CLI surfaces a clean "missing credentials" message
+ * rather than a vague "401 Unauthorized" downstream.
  */
-export async function resolveAdapterCredential(options) {
-    const env = options.environment ?? 'local';
-    const tier = inferTier(env, options.tier);
-    const includeEnv = options.includeProcessEnv ?? true;
-    // 1. process.env (CI / shell override)
-    if (includeEnv) {
-        for (const key of options.keyCandidates) {
-            const v = process.env[key];
-            if (v && v.length > 0) {
-                return { key, value: v, source: 'process.env' };
-            }
-        }
-    }
-    // 2. secrets/store runtime resolution (tier-aware, priority-ordered)
-    const runtime = getVibesRuntime();
+export async function resolveAdapterCredential(runtime, options) {
+    const input = readUntrusted(ResolveOptionsSchema, () => options, OPTIONS_INVALID);
+    const env = input.environment ?? 'local';
+    const tier = inferTier(env, input.tier);
+    // Ceilings sized for the MEASURED store path, not the hoped-for one: a
+    // resolution walks the key-candidate list serially, and each miss is a
+    // full secrets-store roundtrip (Cloudflare-backed; observed 5-15s per read
+    // under load, 2026-08-18). Five candidates at 20s total aborted a healthy
+    // resolution mid-walk — the operator saw "timed out" while the store was
+    // merely slow, and worked around the blessed path by hand.
+    const backendTimeoutMs = input.backendTimeoutMs ?? 15_000;
+    const resolutionTimeoutMs = input.resolutionTimeoutMs ?? 90_000;
+    const keys = input.keyCandidates;
+    const subject = { keys: [...keys], environment: env, tier };
+    if (input.humanName !== undefined)
+        subject.humanName = input.humanName;
     if (!runtime.hasKind('secrets/store')) {
-        throw new Error(`No secrets/store kind registered; cannot resolve ${options.humanName ?? options.keyCandidates[0]}. ` +
-            'Load the secrets plugin (and a backend like encrypted-local) before calling this adapter.');
-    }
-    const descriptors = runtime
-        .assets('secrets/store')
-        .descriptors();
-    // `VIBES_DEBUG_SECRETS=1` dumps the visible descriptor pool when
-    // you're tracing why a credential is missing or getting misrouted.
-    if (process.env.VIBES_DEBUG_SECRETS === '1') {
-        console.error(`[secrets-debug] descriptors visible at tier=${tier}:`);
-        for (const d of descriptors) {
-            console.error(`  - id=${d.id} priority=${d.priority ?? '-'} tiers=${JSON.stringify(d.tiers)}`);
-        }
+        throw new CapabilityError('No secrets/store kind is registered; the credential cannot resolve.', 'UNAVAILABLE', {
+            reason: 'secrets-store-unregistered',
+            details: subject,
+            recoveryHint: 'Load the secrets plugin (and a backend like encrypted-local) before calling this adapter.'
+        });
     }
-    const target = pickBackend(descriptors, tier);
-    if (!target) {
-        throw new Error(`No secrets/store backend available for tier=${tier}. Register a backend ` +
-            '(encrypted-local for local, cloudflare-secrets-store for production) before calling this adapter.');
+    const failures = [];
+    const selections = storeSelections(runtime, failures);
+    const debug = secretsDebugEnabled(runtime) ? getLogger(DEBUG_LOGGER_ID, runtime) : undefined;
+    // `VIBES_DEBUG_SECRETS=1` traces the visible descriptor pool (ids, priorities, tiers; never a value).
+    debug?.info('secrets debug: stores visible', {
+        tier,
+        stores: selections.map((s) => ({ id: s.id, priority: s.priority ?? null, tiers: s.tiers ?? null }))
+    });
+    const targets = pickBackends(selections, tier, input.includeAllStoreBackends);
+    if (targets.length === 0) {
+        throw new CapabilityError('No secrets/store backend is available for this tier.', 'UNAVAILABLE', {
+            reason: 'secrets-store-backend-unavailable',
+            details: { ...subject, failures: failureDetails(failures) },
+            recoveryHint: 'Register a backend (encrypted-local for local, cloudflare-secrets-store for production).'
+        });
     }
-    const store = (await runtime
-        .query('secrets/store')
-        .withId(target.id)
-        .resolve());
-    if (!store || typeof store.get !== 'function') {
-        throw new Error(`Resolved secrets/store '${target.id}' has no get() method for ${options.humanName ?? options.keyCandidates[0]}.`);
+    const plan = {
+        targets,
+        environments: [env, ...(input.fallbackEnvironments ?? []).filter((candidate) => candidate && candidate !== env)],
+        keys,
+        requestedEnvironment: env,
+        backendTimeoutMs,
+        operationContext: input.operationContext
+    };
+    let outcome;
+    try {
+        outcome = await runtime.lifecycle.wait((signal) => walkBackends(runtime, plan, failures, signal), {
+            timeoutMs: resolutionTimeoutMs,
+            reason: 'credential-resolution'
+        });
     }
-    for (const key of options.keyCandidates) {
-        try {
-            const v = await store.get(env, key);
-            if (v && v.length > 0) {
-                return { key, value: v, source: target.id };
-            }
-        }
-        catch {
-            // next candidate
+    catch (error) {
+        if (error instanceof Error && isCapabilityError(error) && error.reason === 'wait-timeout') {
+            throw new CapabilityError('Credential resolution timed out.', 'TIMEOUT', {
+                reason: 'credential-resolution-timeout',
+                details: { ...subject, timeoutMs: resolutionTimeoutMs, failures: failureDetails(failures) },
+                cause: valueFreeFailure(error)
+            });
         }
+        throw error;
+    }
+    if (outcome.kind === 'resolved')
+        return outcome.credential;
+    const stores = targets.map((d) => d.id);
+    // Absence only when every backend answered: one failed store may hold the credential.
+    if (outcome.kind === 'exhausted' && failures.length === 0) {
+        throw new CapabilityError('Missing credential: none of the candidate keys resolved from the secrets store.', 'NOT_FOUND', {
+            reason: 'credential-missing',
+            details: { ...subject, stores, failures: failureDetails(failures) },
+            recoveryHint: `Provision it through the configured Vibes secrets workflow for environment "${env}".`
+        });
     }
-    throw new Error(`Missing credential: none of [${options.keyCandidates.join(', ')}] resolved from process.env or ` +
-        `${target.id} (environment=${env}, tier=${tier}). ` +
-        `Set the value with \`vibes secrets set --environment ${env} ${options.keyCandidates[0]} <value>\`.`);
+    throw new CapabilityError('The secrets store could not be read for this credential.', 'UNAVAILABLE', {
+        reason: 'credential-store-unavailable',
+        details: { ...subject, stores, failures: failureDetails(failures) }
+    });
 }
 /**
  * Convenience wrapper for resolving multiple credentials at once.
  * Each key gets a candidate list of one (the key itself). Use the
  * single-credential form when you need fallback chains.
  */
-export async function resolveAdapterCredentials(keys, options) {
+export async function resolveAdapterCredentials(runtime, keys, options) {
+    const input = readUntrusted(PluralOptionsSchema, () => ({ keys, options }), OPTIONS_INVALID);
     const out = {};
-    for (const key of keys) {
-        out[key] = await resolveAdapterCredential({
+    for (const key of input.keys) {
+        out[key] = await resolveAdapterCredential(runtime, {
             keyCandidates: [key],
-            ...(options ?? {})
+            ...input.options
         });
     }
     return out;
 }
+/** The plural form's keys and shared options, read once at its boundary. */
+const PluralOptionsSchema = z.object({
+    keys: z.array(z.string().min(1)),
+    options: ResolveOptionsSchema.omit({ keyCandidates: true, humanName: true }).optional()
+});
+/** The operator form's options, read once at its boundary; the selection policy is fixed, never taken from the caller. */
+const OperatorOptionsSchema = ResolveOptionsSchema.omit({ tier: true, includeAllStoreBackends: true, fallbackEnvironments: true }).extend({
+    environment: z.string().min(1)
+});
+/**
+ * Resolve an operator credential with the shared inventory/audit policy.
+ * Use `resolveAdapterCredential` directly only when a non-operator workflow
+ * intentionally needs a different selection policy (for example, store-only
+ * recovery validation).
+ */
+export async function resolveOperatorCredential(runtime, options) {
+    const input = readUntrusted(OperatorOptionsSchema, () => options, OPTIONS_INVALID);
+    return resolveAdapterCredential(runtime, {
+        ...input,
+        ...operatorCredentialResolutionPolicy(input.environment)
+    });
+}
 //# sourceMappingURL=resolve.js.map

package/dist/credentials/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAuDvD;;;;GAIG;AACH,SAAS,WAAW,CACnB,WAA0C,EAC1C,IAAqB;IAErB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB,EAAE,QAA0B;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACnH,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAwC;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAErD,uCAAuC;IACvC,IAAI,UAAU,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACjD,CAAC;QACF,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACd,oDAAoD,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YACpG,2FAA2F,CAC5F,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACzB,MAAM,CAAC,eAAe,CAAC;SACvB,WAAW,EAAmC,CAAC;IACjD,iEAAiE;IACjE,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,+CAA+C,IAAI,GAAG,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,+CAA+C,IAAI,uBAAuB;YACzE,mGAAmG,CACpG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO;SAC1B,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SACjB,OAAO,EAAE,CAA0B,CAAC;IAEtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACd,2BAA2B,MAAM,CAAC,EAAE,6BAA6B,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CACjH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7C,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;IACF,CAAC;IAED,MAAM,IAAI,KAAK,CACd,gCAAgC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;QAChG,GAAG,MAAM,CAAC,EAAE,iBAAiB,GAAG,UAAU,IAAI,KAAK;QACnD,wDAAwD,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CACrG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAuB,EACvB,OAA8E;IAE9E,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,CAAC;YACzC,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,eAAe,EAA6B,MAAM,6CAA6C,CAAC;AACxH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EACN,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAGhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,4FAA4F;AAC5F,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,MAAM,mBAAmB,GAAG,CAAC,OAAqB,EAAW,EAAE,CAC9D,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,GAAG,CAAC;AAE/C,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AA8ChF,kHAAkH;AAClH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACtC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/C,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAyB;IAC7C,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,4BAA4B;IACpC,OAAO,EAAE,GAAG,EAAE,CAAC,4CAA4C;CAC3D,CAAC;AA8CF,MAAM,UAAU,kCAAkC,CACjD,WAAmB;IAEnB,OAAO;QACN,WAAW;QACX,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;KAC9D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,UAAqC;IAErC,OAAO;QACN,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,MAAM,EAAE,UAAU,CAAC,MAAM;KACzB,CAAC;AACH,CAAC;AAUD,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAChE,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;AAE3H,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAGH,MAAM,gBAAgB,GAAyB;IAC9C,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,0BAA0B;IAClC,OAAO,EAAE,GAAG,EAAE,CAAC,uDAAuD;CACtE,CAAC;AAUF,+FAA+F;AAC/F,SAAS,cAAc,CAAC,KAAa,EAAE,OAAyB,EAAE,KAA6C,EAAE;IAChH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAQD,mEAAmE;AACnE,SAAS,cAAc,CAAC,QAAmC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjE,OAAO,MAAM,CAAC;IACf,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CACpB,WAA6C,EAC7C,IAAqB,EACrB,uBAAuB,GAAG,KAAK;IAE/B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,uBAAuB;QACnC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB,EAAE,QAA0B;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,4GAA4G;AAC5G,SAAS,eAAe,CAAC,OAAqB,EAAE,QAA0B;IACzE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,EAAE;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAiBD,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,IAAc,EAAE,QAA0B,EAAE,MAAmB;IACjH,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAC5C,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,EAChE,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAC7F,CAAC;YACF,OAAO,aAAa,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACzD,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;oBACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAC1C,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACxD,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CACvF,CAAC;oBACF,OAAO,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACzE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACd,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;qBAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9D,KAAK,EAAE,IAAI,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC1F,OAAO;wBACN,IAAI,EAAE,UAAU;wBAChB,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,WAAW,EAAE;qBAC5I,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAqB,EACrB,OAAwC;IAExC,MAAM,KAAK,GAAG,aAAa,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1D,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,IAAI,MAAM,CAAC;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;IACjC,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAEvE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CAAC,qEAAqE,EAAE,aAAa,EAAE;YAC/G,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,2FAA2F;SACzG,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,sGAAsG;IACtG,KAAK,EAAE,IAAI,CAAC,+BAA+B,EAAE;QAC5C,IAAI;QACJ,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;KACnG,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,sDAAsD,EAAE,aAAa,EAAE;YAChG,MAAM,EAAE,mCAAmC;YAC3C,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YAC3D,YAAY,EAAE,0FAA0F;SACxG,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAa;QACtB,OAAO;QACP,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC;QAChH,IAAI;QACJ,oBAAoB,EAAE,GAAG;QACzB,gBAAgB;QAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACxC,CAAC;IACF,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YACjG,SAAS,EAAE,mBAAmB;YAC9B,MAAM,EAAE,uBAAuB;SAC/B,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAC3F,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,SAAS,EAAE;gBACxE,MAAM,EAAE,+BAA+B;gBACvC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;gBAC3F,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAC9B,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,sFAAsF;IACtF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,WAAW,EAAE;YACzH,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YACnE,YAAY,EAAE,+EAA+E,GAAG,IAAI;SACpG,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;QACpG,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;KACnE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,IAAuB,EACvB,OAA8E;IAE9E,MAAM,KAAK,GAAG,aAAa,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IAC7F,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE;YAClD,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,GAAG,KAAK,CAAC,OAAO;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvF,CAAC,CAAC;AAEH,0HAA0H;AAC1H,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzI,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,OAAyC;IAEzC,MAAM,KAAK,GAAG,aAAa,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACnF,OAAO,wBAAwB,CAAC,OAAO,EAAE;QACxC,GAAG,KAAK;QACR,GAAG,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC;KACxD,CAAC,CAAC;AACJ,CAAC"}