@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.11

package/dist/cli/generate/generate/generate.cli-command.descriptor.d.ts

@@ -0,0 +1,30 @@
+declare const _default: {
+    id: string;
+    kind: "cli/command";
+    group: string;
+    name: string;
+    description: string;
+    usage: string;
+    arguments: never[];
+    options: ({
+        flags: string;
+        description: string;
+        default: string;
+        multiple?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        default?: undefined;
+        multiple?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        multiple: boolean;
+        default?: undefined;
+    })[];
+    surfaces: string[];
+    hardware: string[];
+    enabled: true;
+};
+export default _default;
+//# sourceMappingURL=generate.cli-command.descriptor.d.ts.map

package/dist/cli/generate/generate/generate.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/generate/generate/generate.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,wBAmBG"}

package/dist/cli/generate/generate/generate.cli-command.descriptor.js

@@ -0,0 +1,25 @@
+/**
+ * CLI command: vibes infra generate
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    id: 'infra-generate.run',
+    kind: 'cli/command',
+    group: 'infra',
+    name: 'generate',
+    description: 'Generate infrastructure artifacts (K8s manifests, Helm charts, wrangler configs)',
+    usage: 'vibes infra generate [options]',
+    arguments: [],
+    options: [
+        { flags: '-o, --output <dir>', description: 'Output directory', default: './infra/generated' },
+        { flags: '-n, --dry-run', description: 'Print what would be generated without writing' },
+        { flags: '-t, --target <name>', description: 'Filter by artifact target', multiple: true },
+        { flags: '-r, --resource <id>', description: 'Filter by resource ID', multiple: true },
+        { flags: '-f, --format <format>', description: 'Filter by format (yaml|json|hcl|tar.gz)' },
+        { flags: '-v, --verbose', description: 'Verbose output' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+});
+//# sourceMappingURL=generate.cli-command.descriptor.js.map

package/dist/cli/generate/generate/generate.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/generate/generate/generate.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,kFAAkF;IAC/F,KAAK,EAAE,gCAAgC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAC9F,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,+CAA+C,EAAE;QACxF,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1F,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE;QACtF,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC1F,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE;KACzD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/generate/generate/generate.cli-command.impl.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Implementation: vibes infra generate
+ *
+ * Every `--resource` and the `--format` filter reach the generation core.
+ * A generator failure is printed value-free and the run refuses
+ * `INTERNAL infra-generate-failed`, which the CLI host maps to the exit code.
+ */
+import * as z from 'zod/v4';
+import { type CommandContext } from '../context.ts';
+declare const GenerateOptionsSchema: z.ZodObject<{
+    output: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"true">, z.ZodLiteral<"false">]>>;
+    target: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    format: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"true">, z.ZodLiteral<"false">]>>;
+}, z.core.$loose>;
+export type GenerateCommandOptions = z.input<typeof GenerateOptionsSchema>;
+declare const GenerateArgsSchema: z.ZodObject<{}, z.core.$loose>;
+export type GenerateCommandArgs = z.input<typeof GenerateArgsSchema>;
+declare const _default: {
+    execute(rawArgs: GenerateCommandArgs, rawOptions: GenerateCommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=generate.cli-command.impl.d.ts.map

package/dist/cli/generate/generate/generate.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/generate/generate/generate.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAKjF,QAAA,MAAM,qBAAqB;;;;;;;iBAOzB,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E,QAAA,MAAM,kBAAkB,gCAAoB,CAAC;AAC7C,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;;qBAO7C,mBAAmB,cAAc,sBAAsB,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADxH,wBAyCE"}

package/dist/cli/generate/generate/generate.cli-command.impl.js

@@ -0,0 +1,64 @@
+/**
+ * Implementation: vibes infra generate
+ *
+ * Every `--resource` and the `--format` filter reach the generation core.
+ * A generator failure is printed value-free and the run refuses
+ * `INTERNAL infra-generate-failed`, which the CLI host maps to the exit code.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { generateArtifacts } from "../generate-core.js";
+import { commandUi, readCommandInput } from "../context.js";
+const Flag = z.union([z.boolean(), z.literal('true'), z.literal('false')]).optional();
+const OneOrMany = z.union([z.string(), z.array(z.string())]).optional();
+const GenerateOptionsSchema = z.looseObject({
+    output: z.string().min(1).optional(),
+    dryRun: Flag,
+    target: OneOrMany,
+    resource: OneOrMany,
+    format: z.string().min(1).optional(),
+    verbose: Flag
+});
+const GenerateArgsSchema = z.looseObject({});
+function isOn(flag) {
+    return flag === true || flag === 'true';
+}
+export default {
+    async execute(rawArgs, rawOptions, context) {
+        const runtime = context.runtime;
+        readCommandInput(GenerateArgsSchema, rawArgs, 'infra-generate-input-invalid');
+        const opts = readCommandInput(GenerateOptionsSchema, rawOptions, 'infra-generate-input-invalid');
+        const ui = await commandUi(runtime);
+        const verbose = isOn(opts.verbose);
+        const result = await generateArtifacts(runtime, {
+            outputDir: opts.output ?? './infra/generated',
+            dryRun: isOn(opts.dryRun),
+            target: opts.target,
+            sourceId: opts.resource,
+            format: opts.format,
+            verbose,
+            report: (line) => ui.log(line)
+        });
+        // Print summary
+        ui.info(`\n=== Generation Summary ===`);
+        ui.info(`  Artifacts generated: ${result.count}`);
+        ui.info(`  Errors: ${result.errors.length}`);
+        if (verbose && result.artifacts.length > 0) {
+            ui.log('\n  Generated files:');
+            for (const artifact of result.artifacts) {
+                ui.log(`    - ${artifact.path} (${artifact.sourceKind ?? 'N/A'}/${artifact.sourceId ?? 'N/A'})`);
+            }
+        }
+        if (result.errors.length > 0) {
+            ui.log('\n  Errors:');
+            for (const error of result.errors) {
+                ui.error(`    - ${error.generatorId}: ${error.error}`);
+            }
+            throw new CapabilityError('Artifact generation failed for one or more generators.', 'INTERNAL', {
+                reason: 'infra-generate-failed',
+                details: { generators: result.errors.map((error) => error.generatorId) }
+            });
+        }
+    }
+};
+//# sourceMappingURL=generate.cli-command.impl.js.map

package/dist/cli/generate/generate/generate.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.cli-command.impl.js","sourceRoot":"","sources":["../../../../src/cli/generate/generate/generate.cli-command.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAuB,MAAM,eAAe,CAAC;AAEjF,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAExE,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAG7C,SAAS,IAAI,CAAC,IAA2B;IACxC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;AACzC,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,OAA4B,EAAE,UAAkC,EAAE,OAAuB;QACtG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,gBAAgB,CAAC,kBAAkB,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,UAAU,EAAE,8BAA8B,CAAC,CAAC;QACjG,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,mBAAmB;YAC7C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QAEH,gBAAgB;QAChB,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACxC,EAAE,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE7C,IAAI,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAC/B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACzC,EAAE,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,UAAU,IAAI,KAAK,IAAI,QAAQ,CAAC,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC;YAClG,CAAC;QACF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnC,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,wDAAwD,EAAE,UAAU,EAAE;gBAC/F,MAAM,EAAE,uBAAuB;gBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;aACxE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/generate/generate-core.d.ts

@@ -0,0 +1,51 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type ArtifactGenerationContext } from '../../kinds/artifact.kind.ts';
+export interface GenerateOptions {
+    /** Output directory (default: ./infra/generated), resolved against the host's working directory */
+    outputDir?: string;
+    /** Dry-run mode (report what would be written, write nothing) */
+    dryRun?: boolean;
+    /** Filter by artifact generator ID */
+    target?: string | string[];
+    /** Filter by output format (the generator's declared `format`, else its output's `metadata.format`) */
+    format?: string;
+    /** Filter by source resource kind */
+    sourceKind?: string;
+    /** Filter by source resource ID (every listed ID is kept) */
+    sourceId?: string | string[];
+    /** Verbose output */
+    verbose?: boolean;
+    /** Where progress lines go (the CLI passes its UI). Without it nothing is printed; the result carries everything. */
+    report?: (line: string) => void;
+}
+export interface GenerateResult {
+    /** Number of artifacts generated */
+    count: number;
+    /** Generated artifacts */
+    artifacts: Array<{
+        generatorId: string;
+        sourceKind?: string;
+        sourceId?: string;
+        path: string;
+    }>;
+    /**
+     * Generators that failed. `error` is value-free (the failure's class name,
+     * and its code and reason when typed): what a generator threw is never
+     * repeated, since it may echo a credential.
+     */
+    errors: Array<{
+        generatorId: string;
+        sourceKind?: string;
+        sourceId?: string;
+        error: string;
+        code?: string;
+        reason?: string;
+    }>;
+}
+/** Generation context passed to artifact generators. */
+export type GenerationContext = ArtifactGenerationContext;
+/**
+ * Generate artifacts from resource descriptors
+ */
+export declare function generateArtifacts(runtime: VibesRuntime, options?: GenerateOptions): Promise<GenerateResult>;
+//# sourceMappingURL=generate-core.d.ts.map

package/dist/cli/generate/generate-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-core.d.ts","sourceRoot":"","sources":["../../../src/cli/generate/generate-core.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAGN,KAAK,yBAAyB,EAE9B,MAAM,8BAA8B,CAAC;AAGtC,MAAM,WAAW,eAAe;IAC/B,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,qBAAqB;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qHAAqH;IACrH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC9B,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,KAAK,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH;;;;OAIG;IACH,MAAM,EAAE,KAAK,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACH;AAED,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AA6C1D;;GAEG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE,eAAoB,GAC3B,OAAO,CAAC,cAAc,CAAC,CA0GzB"}

package/dist/cli/generate/generate-core.js

@@ -0,0 +1,172 @@
+/**
+ * Core artifact generation logic.
+ *
+ * Orchestrates artifact generation by:
+ * 1. Querying runtime for artifact generators
+ * 2. Loading resource descriptors from runtime discovery
+ * 3. Calling generator.generate() for each resource
+ * 4. Writing output through the runtime's filesystem adapter, or reporting
+ *    it for a dry run
+ *
+ * This module is implementation-agnostic — it doesn't know what
+ * artifacts are being generated, only how to orchestrate generation. It
+ * prints nothing itself: progress goes to the caller's `report`, and the
+ * result carries every artifact and every failure (value-free).
+ */
+import * as z from 'zod/v4';
+import { readUntrusted } from '@vibesdotdev/config/manifest/read-untrusted';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem/client/resolve-adapter';
+import { requireRuntimeCwd } from '@vibesdotdev/kernel';
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+import { ArtifactDescriptorSchema, ArtifactOutputSchema } from "../../kinds/artifact.kind.js";
+import { failureText, settleWork } from "../../settle-work.js";
+/** A resolved generator offers `generate`; kept as the original object (its method may use `this`). */
+const GeneratorOperationsSchema = z.object({ generate: z.function() });
+const ArtifactGeneratorSchema = z.custom((value) => GeneratorOperationsSchema.safeParse(value).success);
+const GENERATOR_INVALID = {
+    code: 'INVALID_INPUT',
+    reason: 'artifact-generator-invalid',
+    message: () => 'The registered infra/artifact implementation offers no generate().'
+};
+const OUTPUT_INVALID = {
+    code: 'INTERNAL',
+    reason: 'artifact-output-invalid',
+    message: () => 'An artifact generator returned an output that does not read.'
+};
+/** The output metadata fields the result reports. */
+const OutputFactsSchema = z.looseObject({
+    sourceKind: z.string().optional().catch(undefined),
+    sourceId: z.string().optional().catch(undefined),
+    format: z.string().optional().catch(undefined)
+});
+/** The infra resource kinds a generator may read. */
+const RESOURCE_KINDS = [
+    'infra/worker',
+    'infra/web-app',
+    'infra/queue',
+    'infra/cache',
+    'infra/object-storage',
+    'infra/database',
+    'infra/git-hosting',
+    'infra/package-registry'
+];
+/** The longest content preview a verbose dry run reports, credential-redacted. */
+const PREVIEW_CHARS = 200;
+function listOf(value) {
+    if (value === undefined)
+        return undefined;
+    return Array.isArray(value) ? value : [value];
+}
+/**
+ * Generate artifacts from resource descriptors
+ */
+export async function generateArtifacts(runtime, options = {}) {
+    const { outputDir = './infra/generated', dryRun = false, format, sourceKind, verbose = false } = options;
+    const report = options.report ?? (() => undefined);
+    const targets = listOf(options.target);
+    const sourceIds = listOf(options.sourceId);
+    const result = {
+        count: 0,
+        artifacts: [],
+        errors: []
+    };
+    // Listed by descriptor; each implementation loads inside its own settled work, so one failing loader is one failure entry.
+    const generators = runtime.hasKind('infra/artifact') ? runtime.query('infra/artifact').descriptors() : [];
+    if (verbose) {
+        report(`Found ${generators.length} artifact generators`);
+    }
+    // Filter by target if specified
+    let filteredGenerators = generators;
+    if (targets) {
+        filteredGenerators = generators.filter((descriptor) => targets.includes(descriptor.id));
+        if (verbose) {
+            report(`Filtered to ${filteredGenerators.length} generators (targets: ${targets.join(', ')})`);
+        }
+    }
+    // Load resource descriptors from runtime discovery
+    const resources = loadResourceDescriptors(runtime);
+    if (verbose) {
+        report(`Loaded ${resources.length} resource descriptors`);
+    }
+    let filesystem;
+    // For each generator, resolve and call it
+    for (const descriptor of filteredGenerators) {
+        const generatorId = descriptor.id;
+        const declared = ArtifactDescriptorSchema.safeParse(descriptor);
+        const declaredFormat = declared.success ? declared.data.format : undefined;
+        // A generator that declares a different format is skipped before any work.
+        if (format !== undefined && declaredFormat !== undefined && declaredFormat !== format)
+            continue;
+        const outcome = await settleWork(async () => {
+            const impl = await runtime.query('infra/artifact').withId(generatorId).resolve();
+            const generator = readUntrusted(ArtifactGeneratorSchema, () => impl, GENERATOR_INVALID);
+            // Build generation context (implementation-specific)
+            const context = {
+                outputDir,
+                resources: resources.filter((r) => {
+                    // Apply source filters if specified
+                    if (sourceKind && r.kind !== sourceKind)
+                        return false;
+                    if (sourceIds && !sourceIds.includes(r.id))
+                        return false;
+                    return true;
+                }),
+                descriptor
+            };
+            const generated = await generator.generate(context);
+            const output = readUntrusted(ArtifactOutputSchema, () => generated, OUTPUT_INVALID);
+            const facts = OutputFactsSchema.parse(output.metadata ?? {});
+            // An undeclared generator is filtered by what its output says it is.
+            if (format !== undefined && declaredFormat === undefined && facts.format !== format)
+                return undefined;
+            if (dryRun) {
+                // Dry-run: report what would be generated
+                report(`[DRY-RUN] Would generate ${output.path}`);
+                const text = z.string().safeParse(output.content);
+                if (verbose && text.success) {
+                    report(`  Content preview: ${redactedExcerpt(text.data, { maxChars: PREVIEW_CHARS })}...`);
+                }
+            }
+            else {
+                // Write through the runtime's filesystem adapter, relative to the host's working directory
+                filesystem ??= await resolveFileSystemAdapter(runtime);
+                const target = filesystem.resolve(requireRuntimeCwd(runtime), output.path);
+                await filesystem.mkdir(filesystem.dirname(target), { recursive: true });
+                await filesystem.writeFile(target, output.content);
+                if (verbose) {
+                    report(`  wrote ${output.path}`);
+                }
+            }
+            return { generatorId, sourceKind: facts.sourceKind, sourceId: facts.sourceId, path: output.path };
+        });
+        if (!outcome.ok) {
+            const entry = { generatorId, error: failureText(outcome.failure) };
+            if (outcome.failure.code !== undefined)
+                entry.code = outcome.failure.code;
+            if (outcome.failure.reason !== undefined)
+                entry.reason = outcome.failure.reason;
+            result.errors.push(entry);
+            report(`Error generating artifact from ${generatorId}: ${entry.error}`);
+            continue;
+        }
+        if (outcome.value === undefined)
+            continue;
+        result.artifacts.push(outcome.value);
+        result.count++;
+    }
+    return result;
+}
+/**
+ * Load resource descriptors from runtime discovery; a kind this runtime does
+ * not register contributes none (declared absence, asked, never caught).
+ */
+function loadResourceDescriptors(runtime) {
+    const allDescriptors = [];
+    for (const kind of RESOURCE_KINDS) {
+        if (!runtime.hasKind(kind))
+            continue;
+        allDescriptors.push(...runtime.query(kind).descriptors());
+    }
+    return allDescriptors;
+}
+//# sourceMappingURL=generate-core.js.map

package/dist/cli/generate/generate-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-core.js","sourceRoot":"","sources":["../../../src/cli/generate/generate-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,aAAa,EAA6B,MAAM,6CAA6C,CAAC;AACvG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAE1F,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACN,wBAAwB,EACxB,oBAAoB,EAGpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAiD/D,uGAAuG;AACvG,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACvE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;AAE3H,MAAM,iBAAiB,GAAyB;IAC/C,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,4BAA4B;IACpC,OAAO,EAAE,GAAG,EAAE,CAAC,oEAAoE;CACnF,CAAC;AAEF,MAAM,cAAc,GAAyB;IAC5C,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,GAAG,EAAE,CAAC,8DAA8D;CAC7E,CAAC;AAEF,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC9C,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,cAAc,GAAG;IACtB,cAAc;IACd,eAAe;IACf,aAAa;IACb,aAAa;IACb,sBAAsB;IACtB,gBAAgB;IAChB,mBAAmB;IACnB,wBAAwB;CACf,CAAC;AAEX,kFAAkF;AAClF,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,SAAS,MAAM,CAAC,KAAoC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAqB,EACrB,UAA2B,EAAE;IAE7B,MAAM,EACL,SAAS,GAAG,mBAAmB,EAC/B,MAAM,GAAG,KAAK,EACd,MAAM,EACN,UAAU,EACV,OAAO,GAAG,KAAK,EACf,GAAG,OAAO,CAAC;IACZ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAmB;QAC9B,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE;KACV,CAAC;IAEF,2HAA2H;IAC3H,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1G,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,SAAS,UAAU,CAAC,MAAM,sBAAsB,CAAC,CAAC;IAC1D,CAAC;IAED,gCAAgC;IAChC,IAAI,kBAAkB,GAAG,UAAU,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACb,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,eAAe,kBAAkB,CAAC,MAAM,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChG,CAAC;IACF,CAAC;IAED,mDAAmD;IACnD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,UAAU,SAAS,CAAC,MAAM,uBAAuB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,UAAkD,CAAC;IAEvD,0CAA0C;IAC1C,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,2EAA2E;QAC3E,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,MAAM;YAAE,SAAS;QAEhG,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,IAA8D,EAAE;YACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,aAAa,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAExF,qDAAqD;YACrD,MAAM,OAAO,GAA8B;gBAC1C,SAAS;gBACT,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;oBACjC,oCAAoC;oBACpC,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;wBAAE,OAAO,KAAK,CAAC;oBACtD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;wBAAE,OAAO,KAAK,CAAC;oBACzD,OAAO,IAAI,CAAC;gBACb,CAAC,CAAC;gBACF,UAAU;aACV,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,aAAa,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC7D,qEAAqE;YACrE,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAC;YAEtG,IAAI,MAAM,EAAE,CAAC;gBACZ,0CAA0C;gBAC1C,MAAM,CAAC,4BAA4B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,sBAAsB,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC5F,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,2FAA2F;gBAC3F,UAAU,KAAK,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3E,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnD,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClC,CAAC;YACF,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACnG,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAqC,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrG,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1E,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,kCAAkC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxE,SAAS;QACV,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QAC1C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,OAAqB;IACrD,MAAM,cAAc,GAAwB,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC"}

package/dist/cli/generate/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CLI exports for infra-generate
+ */
+export { generateArtifacts, type GenerateOptions, type GenerateResult, type GenerationContext } from './generate-core.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/generate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/generate/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/cli/generate/index.js

@@ -0,0 +1,5 @@
+/**
+ * CLI exports for infra-generate
+ */
+export { generateArtifacts } from "./generate-core.js";
+//# sourceMappingURL=index.js.map

package/dist/cli/generate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/generate/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAqE,MAAM,oBAAoB,CAAC"}

package/dist/credentials/resolve.d.ts

@@ -5,10 +5,11 @@
  * (alerts, RUM, observability, …) reads from the same credential chain
  * the rest of the platform uses. The chain (highest precedence first):
  *
- *   1. process.env (CI / explicit overrides)
- *   2. The tier-resolved secrets/store implementation
+ *   1. The tier-resolved secrets/store implementation
  *      - local tier   → encrypted-local → env-file
  *      - production   → cloudflare-secrets-store → cloudflare-api
+ * There is no ambient-environment fallback: credentials resolve only through
+ * registered secrets stores, using the handed runtime (first argument).
  *
  * Adapters declare the secret KEY NAMES (e.g. CLOUDFLARE_API_TOKEN) on
  * their descriptor's `adapterConfig` and use this helper to resolve
@@ -16,15 +17,28 @@
  * (e.g. prefer a scoped CLOUDFLARE_NOTIFICATIONS_API_TOKEN, fall back
  * to the broad CLOUDFLARE_API_TOKEN).
  *
- * Why a helper instead of inlining the secrets/store query: provider
- * adapters live in different packages and shouldn't all duplicate the
- * tier-walk + env-overlay logic. Keeping it in infra-core makes the
- * abstraction explicit ("infra/* adapters route credentials through
- * vibes secrets") and gives us one place to evolve the chain (e.g.
- * adding 1Password CLI as a backend).
+ * Every refusal is a typed `CapabilityError` with a fixed message. What a
+ * backend threw is never repeated: each failing backend is carried as its
+ * value-free facts (`valueFreeFailure`) in the refusal's details. A walk in
+ * which any backend failed is `UNAVAILABLE credential-store-unavailable`,
+ * never absence; `NOT_FOUND credential-missing` (message prefix
+ * `Missing credential:`) means every backend answered and none held a candidate.
+ *
+ * Each store call is the work of a `runtime.lifecycle.wait`, so a call still
+ * running after its deadline is owned by the runtime and joined at disposal.
  */
-export type EnvironmentTier = 'local' | 'dev' | 'staging' | 'production';
+import * as z from 'zod/v4';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+declare const EnvironmentTierSchema: z.ZodEnum<{
+    local: "local";
+    dev: "dev";
+    staging: "staging";
+    production: "production";
+}>;
+export type EnvironmentTier = z.infer<typeof EnvironmentTierSchema>;
 export interface ResolveAdapterCredentialOptions {
+    /** Opaque Secrets-owned context; forward unchanged across backend bootstrap. */
+    operationContext?: unknown;
     /**
      * Ordered list of candidate keys. First one that resolves to a
      * non-empty value wins. Useful for scoped → fallback patterns:
@@ -43,38 +57,84 @@ export interface ResolveAdapterCredentialOptions {
      */
     tier?: EnvironmentTier;
     /**
-     * Whether to consult process.env first. Defaults true — CI/CD and
-     * explicit shell overrides should win. Pass false to force
-     * store-only resolution.
+     * When true, search every registered secrets/store backend by priority
+     * instead of only the backend matching the target tier. This is useful for
+     * operator control-plane credentials, which may be stored in an encrypted
+     * local backend even when the target environment is production.
+     */
+    includeAllStoreBackends?: boolean;
+    /**
+     * Additional environment names to check after `environment`. Values are
+     * tried against each candidate backend in order.
      */
-    includeProcessEnv?: boolean;
+    fallbackEnvironments?: readonly string[];
     /**
-     * Optional human-readable name for the credential, used in error
-     * messages when no candidate resolves (e.g. "Cloudflare API token").
+     * Optional human-readable name for the credential. Refusals are fixed
+     * text, so it is carried in their details, never in a message.
      */
     humanName?: string;
+    /** Maximum time allowed for each backend resolve/get attempt. Defaults to 15s. */
+    backendTimeoutMs?: number;
+    /** Total deadline for the complete backend walk. Defaults to 90s. */
+    resolutionTimeoutMs?: number;
 }
 export interface ResolvedAdapterCredential {
     /** The KEY that resolved (one of keyCandidates). Useful for audit. */
     key: string;
     /** The resolved secret value. Never logged. */
     value: string;
-    /** Where the value came from: 'process.env' or the store backend id. */
+    /** Where the value came from: the store backend id. */
+    source: string;
+    /** Environment requested by the operator-facing command. */
+    requestedEnvironment: string;
+    /** Actual environment containing the value. */
+    resolvedEnvironment: string;
+}
+/**
+ * Operator control-plane credentials are resolved on the consumer machine even
+ * when they target staging or production. Every infra inventory/audit adapter
+ * must use this narrower contract so one surface cannot silently select a
+ * different secrets backend than another.
+ *
+ * The policy is fixed: every registered store backend is eligible by
+ * priority, and non-local targets may fall back to the operator's local
+ * secrets environment. Callers still own key candidates, human-readable
+ * labels, and bounded resolution deadlines.
+ */
+export interface ResolveOperatorCredentialOptions extends Omit<ResolveAdapterCredentialOptions, 'tier' | 'includeAllStoreBackends' | 'fallbackEnvironments'> {
+    environment: string;
+}
+export type OperatorCredentialResolutionPolicy = Pick<ResolveAdapterCredentialOptions, 'environment' | 'includeAllStoreBackends' | 'fallbackEnvironments'>;
+/** Safe-to-log selection metadata. Deliberately excludes the credential value. */
+export interface AdapterCredentialSelection {
+    requestedEnvironment: string;
+    resolvedEnvironment: string;
+    key: string;
     source: string;
 }
+export declare function operatorCredentialResolutionPolicy(environment: string): OperatorCredentialResolutionPolicy;
+export declare function adapterCredentialSelection(credential: ResolvedAdapterCredential): AdapterCredentialSelection;
 /**
  * Resolve a single credential by walking the candidate keys against
- * process.env then the active secrets store. Returns the first match.
+ * the active secrets store. Returns the first match.
  *
- * Throws when no candidate resolves — adapters should let this bubble
- * up so the CLI surfaces a clean "missing credentials" message rather
- * than a vague "401 Unauthorized" downstream.
+ * Refuses typed when no candidate resolves — adapters should let this
+ * bubble up so the CLI surfaces a clean "missing credentials" message
+ * rather than a vague "401 Unauthorized" downstream.
  */
-export declare function resolveAdapterCredential(options: ResolveAdapterCredentialOptions): Promise<ResolvedAdapterCredential>;
+export declare function resolveAdapterCredential(runtime: VibesRuntime, options: ResolveAdapterCredentialOptions): Promise<ResolvedAdapterCredential>;
 /**
  * Convenience wrapper for resolving multiple credentials at once.
  * Each key gets a candidate list of one (the key itself). Use the
  * single-credential form when you need fallback chains.
  */
-export declare function resolveAdapterCredentials(keys: readonly string[], options?: Omit<ResolveAdapterCredentialOptions, 'keyCandidates' | 'humanName'>): Promise<Record<string, ResolvedAdapterCredential>>;
+export declare function resolveAdapterCredentials(runtime: VibesRuntime, keys: readonly string[], options?: Omit<ResolveAdapterCredentialOptions, 'keyCandidates' | 'humanName'>): Promise<Record<string, ResolvedAdapterCredential>>;
+/**
+ * Resolve an operator credential with the shared inventory/audit policy.
+ * Use `resolveAdapterCredential` directly only when a non-operator workflow
+ * intentionally needs a different selection policy (for example, store-only
+ * recovery validation).
+ */
+export declare function resolveOperatorCredential(runtime: VibesRuntime, options: ResolveOperatorCredentialOptions): Promise<ResolvedAdapterCredential>;
+export {};
 //# sourceMappingURL=resolve.d.ts.map

package/dist/credentials/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAEzE,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACzC,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CACf;AAqCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,+BAA+B,GACtC,OAAO,CAAC,yBAAyB,CAAC,CAsEpC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,IAAI,CAAC,+BAA+B,EAAE,eAAe,GAAG,WAAW,CAAC,GAC5E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CASpD"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAS7B,QAAA,MAAM,qBAAqB;;;;;EAAoD,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,+BAA+B;IAC/C,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAqBD,MAAM,WAAW,yBAAyB;IACzC,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,mBAAmB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gCAAiC,SAAQ,IAAI,CAC7D,+BAA+B,EAC/B,MAAM,GAAG,yBAAyB,GAAG,sBAAsB,CAC3D;IACA,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,kCAAkC,GAAG,IAAI,CACpD,+BAA+B,EAC/B,aAAa,GAAG,yBAAyB,GAAG,sBAAsB,CAClE,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IAC1C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kCAAkC,CACjD,WAAW,EAAE,MAAM,GACjB,kCAAkC,CAMpC;AAED,wBAAgB,0BAA0B,CACzC,UAAU,EAAE,yBAAyB,GACnC,0BAA0B,CAO5B;AA0JD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,+BAA+B,GACtC,OAAO,CAAC,yBAAyB,CAAC,CA+EpC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,IAAI,CAAC,+BAA+B,EAAE,eAAe,GAAG,WAAW,CAAC,GAC5E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAUpD;AAaD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,gCAAgC,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAMpC"}