@vibesdotdev/infra-core 0.0.2 → 1.0.0-rc.4

package/dist/credentials/resolve.js

@@ -5,10 +5,11 @@
  * (alerts, RUM, observability, …) reads from the same credential chain
  * the rest of the platform uses. The chain (highest precedence first):
  *
- *   1. process.env (CI / explicit overrides)
- *   2. The tier-resolved secrets/store implementation
+ *   1. The tier-resolved secrets/store implementation
  *      - local tier   → encrypted-local → env-file
  *      - production   → cloudflare-secrets-store → cloudflare-api
+ * There is no ambient-environment fallback: credentials resolve only through
+ * registered secrets stores, using the handed runtime (first argument).
  *
  * Adapters declare the secret KEY NAMES (e.g. CLOUDFLARE_API_TOKEN) on
  * their descriptor's `adapterConfig` and use this helper to resolve
@@ -16,113 +17,286 @@
  * (e.g. prefer a scoped CLOUDFLARE_NOTIFICATIONS_API_TOKEN, fall back
  * to the broad CLOUDFLARE_API_TOKEN).
  *
- * Why a helper instead of inlining the secrets/store query: provider
- * adapters live in different packages and shouldn't all duplicate the
- * tier-walk + env-overlay logic. Keeping it in infra-core makes the
- * abstraction explicit ("infra/* adapters route credentials through
- * vibes secrets") and gives us one place to evolve the chain (e.g.
- * adding 1Password CLI as a backend).
+ * Every refusal is a typed `CapabilityError` with a fixed message. What a
+ * backend threw is never repeated: each failing backend is carried as its
+ * value-free facts (`valueFreeFailure`) in the refusal's details. A walk in
+ * which any backend failed is `UNAVAILABLE credential-store-unavailable`,
+ * never absence; `NOT_FOUND credential-missing` (message prefix
+ * `Missing credential:`) means every backend answered and none held a candidate.
+ *
+ * Each store call is the work of a `runtime.lifecycle.wait`, so a call still
+ * running after its deadline is owned by the runtime and joined at disposal.
  */
-import { getVibesRuntime } from '@vibesdotdev/runtime';
+import * as z from 'zod/v4';
+import { readUntrusted, settleUntrusted } from '@vibesdotdev/config/manifest/read-untrusted';
+import { getLogger } from '@vibesdotdev/logging';
+import { CapabilityError, isCapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { settleWork } from "../settle-work.js";
+/** The logger the opt-in `VIBES_DEBUG_SECRETS=1` trace writes to, on the handed runtime. */
+const DEBUG_LOGGER_ID = 'infra.credentials';
+const secretsDebugEnabled = (runtime) => runtime.getEnv('VIBES_DEBUG_SECRETS') === '1';
+const EnvironmentTierSchema = z.enum(['local', 'dev', 'staging', 'production']);
+/** The options as read once at the boundary: every field parsed independently, the context forwarded as given. */
+const ResolveOptionsSchema = z.object({
+    operationContext: z.unknown().optional(),
+    keyCandidates: z.array(z.string().min(1)).min(1),
+    environment: z.string().min(1).optional(),
+    tier: EnvironmentTierSchema.optional(),
+    includeAllStoreBackends: z.boolean().optional(),
+    fallbackEnvironments: z.array(z.string()).optional(),
+    humanName: z.string().optional(),
+    backendTimeoutMs: z.number().positive().optional(),
+    resolutionTimeoutMs: z.number().positive().optional()
+});
+const OPTIONS_INVALID = {
+    code: 'INVALID_INPUT',
+    reason: 'credential-options-invalid',
+    message: () => 'Credential resolution options are invalid.'
+};
+export function operatorCredentialResolutionPolicy(environment) {
+    return {
+        environment,
+        includeAllStoreBackends: true,
+        fallbackEnvironments: environment === 'local' ? [] : ['local']
+    };
+}
+export function adapterCredentialSelection(credential) {
+    return {
+        requestedEnvironment: credential.requestedEnvironment,
+        resolvedEnvironment: credential.resolvedEnvironment,
+        key: credential.key,
+        source: credential.source
+    };
+}
+/** A resolved store that offers `get`, kept as the original object (its methods use `this`). */
+const SecretsStoreReadsSchema = z.object({ get: z.function() });
+const SecretsStoreReaderSchema = z.custom((value) => SecretsStoreReadsSchema.safeParse(value).success);
+/** What a store answered for one key: a string value, or nothing. */
+const StoredValueSchema = z.string().optional();
+/** The selection facts of one registered store descriptor. */
+const SecretsStoreSelectionSchema = z.looseObject({
+    id: z.string().min(1),
+    priority: z.number().optional(),
+    tiers: z.array(EnvironmentTierSchema).optional()
+});
+const STORE_UNREADABLE = {
+    code: 'UNAVAILABLE',
+    reason: 'secrets-store-unreadable',
+    message: () => 'A secrets store did not answer in its declared shape.'
+};
+/** A failed attempt, by the value-free facts `settleWork` read from what the backend threw. */
+function backendFailure(store, failure, at = {}) {
+    return { store, ...at, failure };
+}
+/** The failures as JSON details: names, codes and reasons only. */
+function failureDetails(failures) {
+    return failures.map(({ store, environment, key, failure }) => {
+        const detail = { store, name: failure.name };
+        if (environment !== undefined)
+            detail.environment = environment;
+        if (key !== undefined)
+            detail.key = key;
+        if (failure.code !== undefined)
+            detail.code = failure.code;
+        if (failure.reason !== undefined)
+            detail.reason = failure.reason;
+        return detail;
+    });
+}
 /**
  * Tier-aware backend selection. Mirrors the secrets/store kind's own
- * resolver (`packages/secrets/src/kinds/store.kind.ts`) so callers
+ * resolver (`secrets/src/kinds/store.kind.ts`) so callers
  * don't need to import internal helpers.
  */
-function pickBackend(descriptors, tier) {
+function pickBackends(descriptors, tier, includeAllStoreBackends = false) {
     if (descriptors.length === 0)
-        return undefined;
-    const matches = descriptors.filter((d) => (d.tiers ?? []).includes(tier));
-    const pool = matches.length > 0 ? matches : descriptors;
-    pool.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-    return pool[0];
+        return [];
+    const pool = includeAllStoreBackends
+        ? descriptors
+        : descriptors.filter((d) => (d.tiers ?? []).includes(tier));
+    const candidates = pool.length > 0 ? pool : descriptors;
+    return [...candidates].sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
 }
 function inferTier(environment, override) {
     if (override)
         return override;
-    if (environment === 'local' || environment === 'dev' || environment === 'staging' || environment === 'production') {
-        return environment;
+    const known = EnvironmentTierSchema.safeParse(environment);
+    return known.success ? known.data : 'local';
+}
+/** Every registered store's selection facts; one that does not read is a carried failure, never dropped. */
+function storeSelections(runtime, failures) {
+    const selections = [];
+    for (const [index, descriptor] of runtime.assets('secrets/store').descriptors().entries()) {
+        const read = settleUntrusted(SecretsStoreSelectionSchema, () => descriptor, STORE_UNREADABLE);
+        if (read.ok)
+            selections.push(read.data);
+        else
+            failures.push(backendFailure(`#${index + 1}`, valueFreeFailure(read.error)));
+    }
+    return selections;
+}
+/** Walk the backends in priority order under the resolution deadline's `signal`; never reads past it. */
+async function walkBackends(runtime, plan, failures, signal) {
+    const debug = secretsDebugEnabled(runtime) ? getLogger(DEBUG_LOGGER_ID, runtime) : undefined;
+    for (const target of plan.targets) {
+        if (signal.aborted)
+            return { kind: 'aborted' };
+        const opened = await settleWork(async () => {
+            const resolved = await runtime.lifecycle.wait(() => runtime.query('secrets/store').withId(target.id).resolve(), { timeoutMs: plan.backendTimeoutMs, reason: `secrets-store-${target.id}-resolution`, signal });
+            return readUntrusted(SecretsStoreReaderSchema, () => resolved, STORE_UNREADABLE);
+        });
+        if (!opened.ok) {
+            failures.push(backendFailure(target.id, opened.failure));
+            continue;
+        }
+        const store = opened.value;
+        for (const environment of plan.environments) {
+            for (const key of plan.keys) {
+                if (signal.aborted)
+                    return { kind: 'aborted' };
+                const read = await settleWork(async () => {
+                    const stored = await runtime.lifecycle.wait(() => store.get(environment, key, plan.operationContext), { timeoutMs: plan.backendTimeoutMs, reason: `secrets-store-${target.id}-read`, signal });
+                    return readUntrusted(StoredValueSchema, () => stored, STORE_UNREADABLE);
+                });
+                if (!read.ok) {
+                    failures.push(backendFailure(target.id, read.failure, { environment, key }));
+                }
+                else if (read.value !== undefined && read.value.length > 0) {
+                    debug?.info('secrets debug: credential resolved', { key, store: target.id, environment });
+                    return {
+                        kind: 'resolved',
+                        credential: { key, value: read.value, source: target.id, requestedEnvironment: plan.requestedEnvironment, resolvedEnvironment: environment }
+                    };
+                }
+            }
+        }
     }
-    return 'local';
+    return { kind: 'exhausted' };
 }
 /**
  * Resolve a single credential by walking the candidate keys against
- * process.env then the active secrets store. Returns the first match.
+ * the active secrets store. Returns the first match.
  *
- * Throws when no candidate resolves — adapters should let this bubble
- * up so the CLI surfaces a clean "missing credentials" message rather
- * than a vague "401 Unauthorized" downstream.
+ * Refuses typed when no candidate resolves — adapters should let this
+ * bubble up so the CLI surfaces a clean "missing credentials" message
+ * rather than a vague "401 Unauthorized" downstream.
  */
-export async function resolveAdapterCredential(options) {
-    const env = options.environment ?? 'local';
-    const tier = inferTier(env, options.tier);
-    const includeEnv = options.includeProcessEnv ?? true;
-    // 1. process.env (CI / shell override)
-    if (includeEnv) {
-        for (const key of options.keyCandidates) {
-            const v = process.env[key];
-            if (v && v.length > 0) {
-                return { key, value: v, source: 'process.env' };
-            }
-        }
-    }
-    // 2. secrets/store runtime resolution (tier-aware, priority-ordered)
-    const runtime = getVibesRuntime();
+export async function resolveAdapterCredential(runtime, options) {
+    const input = readUntrusted(ResolveOptionsSchema, () => options, OPTIONS_INVALID);
+    const env = input.environment ?? 'local';
+    const tier = inferTier(env, input.tier);
+    // Ceilings sized for the MEASURED store path, not the hoped-for one: a
+    // resolution walks the key-candidate list serially, and each miss is a
+    // full secrets-store roundtrip (Cloudflare-backed; observed 5-15s per read
+    // under load, 2026-08-18). Five candidates at 20s total aborted a healthy
+    // resolution mid-walk — the operator saw "timed out" while the store was
+    // merely slow, and worked around the blessed path by hand.
+    const backendTimeoutMs = input.backendTimeoutMs ?? 15_000;
+    const resolutionTimeoutMs = input.resolutionTimeoutMs ?? 90_000;
+    const keys = input.keyCandidates;
+    const subject = { keys: [...keys], environment: env, tier };
+    if (input.humanName !== undefined)
+        subject.humanName = input.humanName;
     if (!runtime.hasKind('secrets/store')) {
-        throw new Error(`No secrets/store kind registered; cannot resolve ${options.humanName ?? options.keyCandidates[0]}. ` +
-            'Load the secrets plugin (and a backend like encrypted-local) before calling this adapter.');
-    }
-    const descriptors = runtime
-        .assets('secrets/store')
-        .descriptors();
-    // `VIBES_DEBUG_SECRETS=1` dumps the visible descriptor pool when
-    // you're tracing why a credential is missing or getting misrouted.
-    if (process.env.VIBES_DEBUG_SECRETS === '1') {
-        console.error(`[secrets-debug] descriptors visible at tier=${tier}:`);
-        for (const d of descriptors) {
-            console.error(`  - id=${d.id} priority=${d.priority ?? '-'} tiers=${JSON.stringify(d.tiers)}`);
-        }
+        throw new CapabilityError('No secrets/store kind is registered; the credential cannot resolve.', 'UNAVAILABLE', {
+            reason: 'secrets-store-unregistered',
+            details: subject,
+            recoveryHint: 'Load the secrets plugin (and a backend like encrypted-local) before calling this adapter.'
+        });
     }
-    const target = pickBackend(descriptors, tier);
-    if (!target) {
-        throw new Error(`No secrets/store backend available for tier=${tier}. Register a backend ` +
-            '(encrypted-local for local, cloudflare-secrets-store for production) before calling this adapter.');
+    const failures = [];
+    const selections = storeSelections(runtime, failures);
+    const debug = secretsDebugEnabled(runtime) ? getLogger(DEBUG_LOGGER_ID, runtime) : undefined;
+    // `VIBES_DEBUG_SECRETS=1` traces the visible descriptor pool (ids, priorities, tiers; never a value).
+    debug?.info('secrets debug: stores visible', {
+        tier,
+        stores: selections.map((s) => ({ id: s.id, priority: s.priority ?? null, tiers: s.tiers ?? null }))
+    });
+    const targets = pickBackends(selections, tier, input.includeAllStoreBackends);
+    if (targets.length === 0) {
+        throw new CapabilityError('No secrets/store backend is available for this tier.', 'UNAVAILABLE', {
+            reason: 'secrets-store-backend-unavailable',
+            details: { ...subject, failures: failureDetails(failures) },
+            recoveryHint: 'Register a backend (encrypted-local for local, cloudflare-secrets-store for production).'
+        });
     }
-    const store = (await runtime
-        .query('secrets/store')
-        .withId(target.id)
-        .resolve());
-    if (!store || typeof store.get !== 'function') {
-        throw new Error(`Resolved secrets/store '${target.id}' has no get() method for ${options.humanName ?? options.keyCandidates[0]}.`);
+    const plan = {
+        targets,
+        environments: [env, ...(input.fallbackEnvironments ?? []).filter((candidate) => candidate && candidate !== env)],
+        keys,
+        requestedEnvironment: env,
+        backendTimeoutMs,
+        operationContext: input.operationContext
+    };
+    let outcome;
+    try {
+        outcome = await runtime.lifecycle.wait((signal) => walkBackends(runtime, plan, failures, signal), {
+            timeoutMs: resolutionTimeoutMs,
+            reason: 'credential-resolution'
+        });
     }
-    for (const key of options.keyCandidates) {
-        try {
-            const v = await store.get(env, key);
-            if (v && v.length > 0) {
-                return { key, value: v, source: target.id };
-            }
-        }
-        catch {
-            // next candidate
+    catch (error) {
+        if (error instanceof Error && isCapabilityError(error) && error.reason === 'wait-timeout') {
+            throw new CapabilityError('Credential resolution timed out.', 'TIMEOUT', {
+                reason: 'credential-resolution-timeout',
+                details: { ...subject, timeoutMs: resolutionTimeoutMs, failures: failureDetails(failures) },
+                cause: valueFreeFailure(error)
+            });
         }
+        throw error;
+    }
+    if (outcome.kind === 'resolved')
+        return outcome.credential;
+    const stores = targets.map((d) => d.id);
+    // Absence only when every backend answered: one failed store may hold the credential.
+    if (outcome.kind === 'exhausted' && failures.length === 0) {
+        throw new CapabilityError('Missing credential: none of the candidate keys resolved from the secrets store.', 'NOT_FOUND', {
+            reason: 'credential-missing',
+            details: { ...subject, stores, failures: failureDetails(failures) },
+            recoveryHint: `Provision it through the configured Vibes secrets workflow for environment "${env}".`
+        });
     }
-    throw new Error(`Missing credential: none of [${options.keyCandidates.join(', ')}] resolved from process.env or ` +
-        `${target.id} (environment=${env}, tier=${tier}). ` +
-        `Set the value with \`vibes secrets set --environment ${env} ${options.keyCandidates[0]} <value>\`.`);
+    throw new CapabilityError('The secrets store could not be read for this credential.', 'UNAVAILABLE', {
+        reason: 'credential-store-unavailable',
+        details: { ...subject, stores, failures: failureDetails(failures) }
+    });
 }
 /**
  * Convenience wrapper for resolving multiple credentials at once.
  * Each key gets a candidate list of one (the key itself). Use the
  * single-credential form when you need fallback chains.
  */
-export async function resolveAdapterCredentials(keys, options) {
+export async function resolveAdapterCredentials(runtime, keys, options) {
+    const input = readUntrusted(PluralOptionsSchema, () => ({ keys, options }), OPTIONS_INVALID);
     const out = {};
-    for (const key of keys) {
-        out[key] = await resolveAdapterCredential({
+    for (const key of input.keys) {
+        out[key] = await resolveAdapterCredential(runtime, {
             keyCandidates: [key],
-            ...(options ?? {})
+            ...input.options
         });
     }
     return out;
 }
+/** The plural form's keys and shared options, read once at its boundary. */
+const PluralOptionsSchema = z.object({
+    keys: z.array(z.string().min(1)),
+    options: ResolveOptionsSchema.omit({ keyCandidates: true, humanName: true }).optional()
+});
+/** The operator form's options, read once at its boundary; the selection policy is fixed, never taken from the caller. */
+const OperatorOptionsSchema = ResolveOptionsSchema.omit({ tier: true, includeAllStoreBackends: true, fallbackEnvironments: true }).extend({
+    environment: z.string().min(1)
+});
+/**
+ * Resolve an operator credential with the shared inventory/audit policy.
+ * Use `resolveAdapterCredential` directly only when a non-operator workflow
+ * intentionally needs a different selection policy (for example, store-only
+ * recovery validation).
+ */
+export async function resolveOperatorCredential(runtime, options) {
+    const input = readUntrusted(OperatorOptionsSchema, () => options, OPTIONS_INVALID);
+    return resolveAdapterCredential(runtime, {
+        ...input,
+        ...operatorCredentialResolutionPolicy(input.environment)
+    });
+}
 //# sourceMappingURL=resolve.js.map

package/dist/credentials/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAuDvD;;;;GAIG;AACH,SAAS,WAAW,CACnB,WAA0C,EAC1C,IAAqB;IAErB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB,EAAE,QAA0B;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACnH,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAwC;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAErD,uCAAuC;IACvC,IAAI,UAAU,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACjD,CAAC;QACF,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACd,oDAAoD,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YACpG,2FAA2F,CAC5F,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACzB,MAAM,CAAC,eAAe,CAAC;SACvB,WAAW,EAAmC,CAAC;IACjD,iEAAiE;IACjE,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,+CAA+C,IAAI,GAAG,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,+CAA+C,IAAI,uBAAuB;YACzE,mGAAmG,CACpG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO;SAC1B,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SACjB,OAAO,EAAE,CAA0B,CAAC;IAEtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACd,2BAA2B,MAAM,CAAC,EAAE,6BAA6B,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CACjH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7C,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,iBAAiB;QAClB,CAAC;IACF,CAAC;IAED,MAAM,IAAI,KAAK,CACd,gCAAgC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;QAChG,GAAG,MAAM,CAAC,EAAE,iBAAiB,GAAG,UAAU,IAAI,KAAK;QACnD,wDAAwD,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CACrG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAuB,EACvB,OAA8E;IAE9E,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,CAAC;YACzC,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/credentials/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,eAAe,EAA6B,MAAM,6CAA6C,CAAC;AACxH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EACN,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAGhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,4FAA4F;AAC5F,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,MAAM,mBAAmB,GAAG,CAAC,OAAqB,EAAW,EAAE,CAC9D,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,GAAG,CAAC;AAE/C,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AA8ChF,kHAAkH;AAClH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACtC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/C,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAyB;IAC7C,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,4BAA4B;IACpC,OAAO,EAAE,GAAG,EAAE,CAAC,4CAA4C;CAC3D,CAAC;AA8CF,MAAM,UAAU,kCAAkC,CACjD,WAAmB;IAEnB,OAAO;QACN,WAAW;QACX,uBAAuB,EAAE,IAAI;QAC7B,oBAAoB,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;KAC9D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,UAAqC;IAErC,OAAO;QACN,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,MAAM,EAAE,UAAU,CAAC,MAAM;KACzB,CAAC;AACH,CAAC;AAUD,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAChE,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;AAE3H,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAGH,MAAM,gBAAgB,GAAyB;IAC9C,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,0BAA0B;IAClC,OAAO,EAAE,GAAG,EAAE,CAAC,uDAAuD;CACtE,CAAC;AAUF,+FAA+F;AAC/F,SAAS,cAAc,CAAC,KAAa,EAAE,OAAyB,EAAE,KAA6C,EAAE;IAChH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAQD,mEAAmE;AACnE,SAAS,cAAc,CAAC,QAAmC;IAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAyB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjE,OAAO,MAAM,CAAC;IACf,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CACpB,WAA6C,EAC7C,IAAqB,EACrB,uBAAuB,GAAG,KAAK;IAE/B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,uBAAuB;QACnC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB,EAAE,QAA0B;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,4GAA4G;AAC5G,SAAS,eAAe,CAAC,OAAqB,EAAE,QAA0B;IACzE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,EAAE;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAiBD,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,IAAc,EAAE,QAA0B,EAAE,MAAmB;IACjH,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAC5C,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,EAChE,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAC7F,CAAC;YACF,OAAO,aAAa,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACzD,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;oBACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAC1C,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACxD,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CACvF,CAAC;oBACF,OAAO,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACzE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACd,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;qBAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9D,KAAK,EAAE,IAAI,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC1F,OAAO;wBACN,IAAI,EAAE,UAAU;wBAChB,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,WAAW,EAAE;qBAC5I,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAqB,EACrB,OAAwC;IAExC,MAAM,KAAK,GAAG,aAAa,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1D,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,IAAI,MAAM,CAAC;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;IACjC,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAEvE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CAAC,qEAAqE,EAAE,aAAa,EAAE;YAC/G,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,2FAA2F;SACzG,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,sGAAsG;IACtG,KAAK,EAAE,IAAI,CAAC,+BAA+B,EAAE;QAC5C,IAAI;QACJ,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;KACnG,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,sDAAsD,EAAE,aAAa,EAAE;YAChG,MAAM,EAAE,mCAAmC;YAC3C,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YAC3D,YAAY,EAAE,0FAA0F;SACxG,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAa;QACtB,OAAO;QACP,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC;QAChH,IAAI;QACJ,oBAAoB,EAAE,GAAG;QACzB,gBAAgB;QAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACxC,CAAC;IACF,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YACjG,SAAS,EAAE,mBAAmB;YAC9B,MAAM,EAAE,uBAAuB;SAC/B,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAC3F,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,SAAS,EAAE;gBACxE,MAAM,EAAE,+BAA+B;gBACvC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;gBAC3F,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAC9B,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxC,sFAAsF;IACtF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,WAAW,EAAE;YACzH,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YACnE,YAAY,EAAE,+EAA+E,GAAG,IAAI;SACpG,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;QACpG,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;KACnE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,IAAuB,EACvB,OAA8E;IAE9E,MAAM,KAAK,GAAG,aAAa,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IAC7F,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE;YAClD,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,GAAG,KAAK,CAAC,OAAO;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvF,CAAC,CAAC;AAEH,0HAA0H;AAC1H,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzI,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,OAAyC;IAEzC,MAAM,KAAK,GAAG,aAAa,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACnF,OAAO,wBAAwB,CAAC,OAAO,EAAE;QACxC,GAAG,KAAK;QACR,GAAG,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC;KACxD,CAAC,CAAC;AACJ,CAAC"}

package/dist/deployment-environment.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The one selection of a deployment environment and of a provider config's
+ * environment block. Generic over every provider whose config nests named
+ * environments under `env` (wrangler's `env.<name>`, and any provider with the
+ * same shape): the deploy driver and each provider implementation select
+ * through these, so the environment that picks credentials, ledgers and
+ * provider bindings is always the same one.
+ */
+import { type ProviderConfig, type ResolvedProviderConfig } from './schemas/deployment-environment.ts';
+export { ProviderConfigSchema, ResolvedProviderConfigSchema, type ProviderConfig, type ResolvedProviderConfig } from './schemas/deployment-environment.ts';
+/** `prod`/absent read as `production`, `dev` as `development`; every other name is kept, lower-cased. */
+export declare function normalizeDeploymentEnvironment(environment: string | undefined): string;
+/**
+ * Select one semantic environment before any runtime, provider, secrets, or
+ * ledger work. `--wrangler-env` remains a compatibility spelling, but it no
+ * longer forms an independent provider-only selector that can drift from the
+ * environment used for credentials and deployment records.
+ */
+export declare function selectDeploymentEnvironment(input: {
+    environment?: string;
+    providerEnvironment?: string;
+}): string;
+/** Select a provider block without inheriting production bindings into named environments. */
+export declare function resolveDeploymentProviderConfig(generatedConfig: ProviderConfig, environment?: string): ResolvedProviderConfig;
+/** Refuse a missing named block before callers resolve credentials or execute provider commands. */
+export declare function requireDeploymentProviderConfig(generatedConfig: ProviderConfig, environment?: string): {
+    config: Record<string, unknown>;
+    providerEnvironment: string | null;
+};
+//# sourceMappingURL=deployment-environment.d.ts.map

package/dist/deployment-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-environment.d.ts","sourceRoot":"","sources":["../src/deployment-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAwB,KAAK,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7H,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,MAAM,qCAAqC,CAAC;AAQ7C,yGAAyG;AACzG,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKtF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAET;AAED,8FAA8F;AAC9F,wBAAgB,+BAA+B,CAC9C,eAAe,EAAE,cAAc,EAC/B,WAAW,CAAC,EAAE,MAAM,GAClB,sBAAsB,CASxB;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAAC,eAAe,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,MAAM;;;EAIpG"}

package/dist/deployment-environment.js

@@ -0,0 +1,53 @@
+/**
+ * The one selection of a deployment environment and of a provider config's
+ * environment block. Generic over every provider whose config nests named
+ * environments under `env` (wrangler's `env.<name>`, and any provider with the
+ * same shape): the deploy driver and each provider implementation select
+ * through these, so the environment that picks credentials, ledgers and
+ * provider bindings is always the same one.
+ */
+import { ProviderConfigSchema } from "./schemas/deployment-environment.js";
+export { ProviderConfigSchema, ResolvedProviderConfigSchema } from "./schemas/deployment-environment.js";
+/** The record view of an admitted value, parsed once at the boundary. */
+function asRecord(value) {
+    const parsed = ProviderConfigSchema.safeParse(value);
+    return parsed.success ? parsed.data : null;
+}
+/** `prod`/absent read as `production`, `dev` as `development`; every other name is kept, lower-cased. */
+export function normalizeDeploymentEnvironment(environment) {
+    const value = environment?.trim().toLowerCase();
+    if (!value || value === 'prod')
+        return 'production';
+    if (value === 'dev')
+        return 'development';
+    return value;
+}
+/**
+ * Select one semantic environment before any runtime, provider, secrets, or
+ * ledger work. `--wrangler-env` remains a compatibility spelling, but it no
+ * longer forms an independent provider-only selector that can drift from the
+ * environment used for credentials and deployment records.
+ */
+export function selectDeploymentEnvironment(input) {
+    return normalizeDeploymentEnvironment(input.environment ?? input.providerEnvironment);
+}
+/** Select a provider block without inheriting production bindings into named environments. */
+export function resolveDeploymentProviderConfig(generatedConfig, environment) {
+    const selected = selectDeploymentEnvironment({ environment });
+    if (selected === 'production')
+        return { config: generatedConfig, providerEnvironment: null };
+    const providerEnvironment = selected === 'local' ? 'development' : selected;
+    const environments = asRecord(generatedConfig.env) ?? {};
+    return {
+        config: asRecord(environments[providerEnvironment]),
+        providerEnvironment
+    };
+}
+/** Refuse a missing named block before callers resolve credentials or execute provider commands. */
+export function requireDeploymentProviderConfig(generatedConfig, environment) {
+    const selected = resolveDeploymentProviderConfig(generatedConfig, environment);
+    if (!selected.config)
+        throw new Error(`Missing explicit provider environment "${selected.providerEnvironment}"; refusing production fallback.`);
+    return { config: selected.config, providerEnvironment: selected.providerEnvironment };
+}
+//# sourceMappingURL=deployment-environment.js.map

package/dist/deployment-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-environment.js","sourceRoot":"","sources":["../src/deployment-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAoD,MAAM,qCAAqC,CAAC;AAC7H,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAG5B,MAAM,qCAAqC,CAAC;AAE7C,yEAAyE;AACzE,SAAS,QAAQ,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,8BAA8B,CAAC,WAA+B;IAC7E,MAAM,KAAK,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAC1C,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACA,OAAO,8BAA8B,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;AACvF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,+BAA+B,CAC9C,eAA+B,EAC/B,WAAoB;IAEpB,MAAM,QAAQ,GAAG,2BAA2B,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC7F,MAAM,mBAAmB,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACzD,OAAO;QACN,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACnD,mBAAmB;KACnB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,+BAA+B,CAAC,eAA+B,EAAE,WAAoB;IACpG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,mBAAmB,kCAAkC,CAAC,CAAC;IAChJ,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,EAAE,CAAC;AACvF,CAAC"}

package/dist/deployment.d.ts

@@ -1,9 +1,13 @@
-import { type AppDeployment, type AppDeploymentInput, type DeploymentDependency, type DeploymentEnvRequirement, type DeploymentOrigin, type DeploymentUpstream } from './schemas.ts';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type * as z from 'zod/v4';
+import { deploymentDependencySchema, type AppDeployment, type AppDeploymentInput, type DeploymentDependency, type DeploymentEnvRequirement, type DeploymentOrigin, type DeploymentOriginEnv, type DeploymentUpstream } from './schemas.ts';
 export declare function createAppDeployment(input: AppDeploymentInput): AppDeployment;
+/** Validate admission using only capabilities selected in the caller's runtime. */
+export declare function validateAppDeployment(runtime: RuntimeRef, deployment: AppDeployment): void;
 export declare function createDeploymentOrigin(input: DeploymentOrigin): DeploymentOrigin;
 export declare function createDeploymentEnvRequirement(input: DeploymentEnvRequirement): DeploymentEnvRequirement;
-export declare function createDeploymentDependency(input: DeploymentDependency): DeploymentDependency;
+export declare function createDeploymentDependency(input: z.input<typeof deploymentDependencySchema>): DeploymentDependency;
 export declare function getPrimaryOrigin(deployment: AppDeployment): DeploymentOrigin;
-export declare function getUpstreamOriginEnv(upstream: DeploymentUpstream): Record<string, string>;
-export type { AppDeployment, AppDeploymentInput, DeploymentDependency, DeploymentEnvRequirement, DeploymentOrigin, DeploymentUpstream };
+export declare function getUpstreamOriginEnv(upstream: DeploymentUpstream): DeploymentOriginEnv;
+export type { AppDeployment, AppDeploymentInput, DeploymentDependency, DeploymentEnvRequirement, DeploymentOrigin, DeploymentOriginEnv, DeploymentUpstream };
 //# sourceMappingURL=deployment.d.ts.map

package/dist/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../src/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAC;AAEtB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAE5E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAEhF;AAED,wBAAgB,8BAA8B,CAC7C,KAAK,EAAE,wBAAwB,GAC7B,wBAAwB,CAE1B;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAE5F;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,gBAAgB,CAI5E;AAED,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,kBAAkB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED,YAAY,EACX,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,CAAC"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../src/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAErF,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AACjC,OAAO,EAEN,0BAA0B,EAG1B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAC;AAEtB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAE5E;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,GAAG,IAAI,CA0B1F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAEhF;AAED,wBAAgB,8BAA8B,CAC7C,KAAK,EAAE,wBAAwB,GAC7B,wBAAwB,CAE1B;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,GAAG,oBAAoB,CAElH;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,gBAAgB,CAI5E;AAED,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,kBAAkB,GAC1B,mBAAmB,CAQrB;AAED,YAAY,EACX,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,CAAC"}

package/dist/deployment.js

@@ -1,7 +1,37 @@
+import { CapabilityError, matchesScope } from '@vibesdotdev/kernel';
+import { DeploymentProviderDescriptorSchema } from "./kinds/deployment-provider.kind.js";
 import { appDeploymentSchema, deploymentDependencySchema, deploymentEnvRequirementSchema, deploymentOriginSchema } from "./schemas.js";
 export function createAppDeployment(input) {
     return appDeploymentSchema.parse(input);
 }
+/** Validate admission using only capabilities selected in the caller's runtime. */
+export function validateAppDeployment(runtime, deployment) {
+    const candidates = runtime.hasKind('infra/deployment-provider')
+        ? runtime.query('infra/deployment-provider')
+            .withId(deployment.provider)
+            .enabled()
+            .filter((provider) => matchesScope(runtime.scope, { hardware: provider.hardware }))
+            .descriptors()
+        : [];
+    const descriptor = candidates[0];
+    if (!descriptor) {
+        throw new CapabilityError('The deployment provider is not registered.', 'UNAVAILABLE', {
+            reason: 'deployment-provider-unavailable', details: { provider: deployment.provider }
+        });
+    }
+    const capabilities = DeploymentProviderDescriptorSchema.parse(descriptor);
+    if (!capabilities.runtimes.includes(deployment.runtime)) {
+        throw new CapabilityError('The deployment provider does not support the requested runtime.', 'INVALID_INPUT', {
+            reason: 'deployment-runtime-unsupported',
+            details: { provider: deployment.provider, runtime: deployment.runtime }
+        });
+    }
+    if (deployment.execution?.pty === true && !capabilities.pty) {
+        throw new CapabilityError('The deployment provider does not support interactive PTY sessions.', 'INVALID_INPUT', {
+            reason: 'deployment-pty-unsupported', details: { provider: deployment.provider }
+        });
+    }
+}
 export function createDeploymentOrigin(input) {
     return deploymentOriginSchema.parse(input);
 }

package/dist/deployment.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../src/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EAOtB,MAAM,cAAc,CAAC;AAEtB,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC5D,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC7D,OAAO,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC7C,KAA+B;IAE/B,OAAO,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAA2B;IACrE,OAAO,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAyB;IACzD,OAAO,CACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAA4B;IAE5B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,OAAO;QACN,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM;KACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../src/deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAmB,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,kCAAkC,EAAqC,MAAM,qCAAqC,CAAC;AAE5H,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EAQtB,MAAM,cAAc,CAAC;AAEtB,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC5D,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,OAAmB,EAAE,UAAyB;IACnF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC;QAC9D,CAAC,CAAC,OAAO,CAAC,KAAK,CAA+B,2BAA2B,CAAC;aACxE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC3B,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;aAClF,WAAW,EAAE;QACf,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,aAAa,EAAE;YACtF,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;SACrF,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,kCAAkC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,iEAAiE,EAAE,eAAe,EAAE;YAC7G,MAAM,EAAE,gCAAgC;YACxC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;SACvE,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,eAAe,CAAC,oEAAoE,EAAE,eAAe,EAAE;YAChH,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;SAChF,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC7D,OAAO,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC7C,KAA+B;IAE/B,OAAO,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiD;IAC3F,OAAO,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAyB;IACzD,OAAO,CACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAA4B;IAE5B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,OAAO;QACN,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM;KACxC,CAAC;AACH,CAAC"}