@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/surfaces/cli/shared/stores/drift-fingerprints.impl.consumer.js

@@ -0,0 +1,157 @@
+import { createFileExclusiveChecked, publishPrivateFile, readFilePrivate, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+import { getPathRoots } from '@vibesdotdev/paths';
+import * as z from 'zod/v4';
+import { assertSecretKey } from "../../../../domain/kinds/secret-key.js";
+import { DRIFT_INDEX_VERSION, driftIndexSchema } from "../../../../schemas/discovery/drift.schema.js";
+import { isAbsentEntry, outcomeOf } from "../../../../support/file-failure.js";
+import { serializeByPath } from "../../../../support/path-queue.js";
+export { DRIFT_INDEX_VERSION, driftFingerprintRecordSchema, driftIndexSchema } from "../../../../schemas/discovery/drift.schema.js";
+export { backfillFingerprints, compareFingerprints, isKeyRefusal, logger, tryGetStoreValue, tryListStore } from "./drift-backfill.js";
+export const CHECKER_KEY_FILE = 'drift-checker.key';
+export const INDEX_FILE = 'drift-fingerprints.json';
+/** The checker key is 32 random bytes. */
+const CHECKER_KEY_BYTES = 32;
+/** The drift directory is the owner's alone. */
+const DRIFT_DIRECTORY_MODE = 0o700;
+/** The drift home of `runtime`: the host's own files, never a workspace-rooted view. */
+export async function driftFingerprintHome(runtime) {
+    const fs = await resolveFileSystemAdapter(runtime, { binding: false });
+    return { fs, directory: fs.join(getPathRoots(runtime).activeHome, 'secrets') };
+}
+function keyPath(home) {
+    return home.fs.join(home.directory, CHECKER_KEY_FILE);
+}
+function indexPath(home) {
+    return home.fs.join(home.directory, INDEX_FILE);
+}
+function toHex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function invalidCheckerKey(path) {
+    return new CapabilityError(`The drift checker key ${path} is not a ${CHECKER_KEY_BYTES}-byte key.`, 'INTERNAL', {
+        reason: 'data-corrupt',
+        retryable: false,
+        details: { path },
+        recoveryHint: 'Move the file aside; `vibes secrets set` creates a new key (recorded fingerprints must be re-recorded).'
+    });
+}
+/** The key file's bytes, or `undefined` when there is none. The key is read only while owner-private. */
+async function readCheckerKey(home) {
+    const read = await outcomeOf(() => readFilePrivate(home.fs, keyPath(home), CHECKER_KEY_BYTES + 1));
+    if (read.ok)
+        return read.value;
+    if (isCapabilityError(read.failure) && read.failure.reason === 'filesystem-private-missing')
+        return undefined;
+    // A key of the wrong size is reported as such, not as the adapter's size refusal.
+    if (isCapabilityError(read.failure) && read.failure.reason === 'filesystem-private-too-large') {
+        throw invalidCheckerKey(keyPath(home));
+    }
+    throw read.failure;
+}
+/**
+ * The checker key, created on first use. Creation is exclusive (the adapter's
+ * `createFileExclusive`, 0600): of two creators one wins and both then read the
+ * winner's key. An adapter without the capability refuses typed.
+ */
+export async function loadCheckerKey(home) {
+    const existing = await readCheckerKey(home);
+    if (existing) {
+        if (existing.byteLength !== CHECKER_KEY_BYTES)
+            throw invalidCheckerKey(keyPath(home));
+        return existing;
+    }
+    await home.fs.mkdir(home.directory, { recursive: true, mode: DRIFT_DIRECTORY_MODE });
+    await createFileExclusiveChecked(home.fs, keyPath(home), crypto.getRandomValues(new Uint8Array(CHECKER_KEY_BYTES)));
+    const key = await readCheckerKey(home);
+    if (!key || key.byteLength !== CHECKER_KEY_BYTES)
+        throw invalidCheckerKey(keyPath(home));
+    return key;
+}
+/** HMAC-SHA256 of `value` under the checker key, hex. */
+export async function fingerprintValue(value, checkerKey) {
+    // A copy: the key bytes may sit on a shared buffer, which the Web Crypto import does not accept.
+    const key = await crypto.subtle.importKey('raw', new Uint8Array(checkerKey), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return toHex(new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value))));
+}
+async function readIndexText(home) {
+    const read = await outcomeOf(() => home.fs.readFile(indexPath(home), 'utf-8'));
+    // Asked for utf-8, the adapter answers text.
+    if (read.ok)
+        return z.string().parse(read.value);
+    if (isAbsentEntry(read.failure))
+        return undefined;
+    throw new CapabilityError('The drift fingerprint index could not be read.', 'UNAVAILABLE', {
+        reason: 'drift-index-unreadable',
+        cause: read.failure,
+        details: { path: indexPath(home) }
+    });
+}
+export async function loadIndex(home) {
+    const path = indexPath(home);
+    const text = await readIndexText(home);
+    if (text === undefined)
+        return { version: DRIFT_INDEX_VERSION, fingerprints: {} };
+    // An unreadable or foreign index fails closed: reading it as empty would
+    // report drift as absent and the next save would erase the history.
+    let rawJson;
+    try {
+        rawJson = JSON.parse(text);
+    }
+    catch (error) {
+        throw new CapabilityError('The drift fingerprint index is not valid JSON.', 'INTERNAL', {
+            reason: 'data-corrupt',
+            cause: error
+        });
+    }
+    const parsed = driftIndexSchema.safeParse(rawJson);
+    if (!parsed.success) {
+        throw new CapabilityError(`The drift fingerprint index ${path} is not a version ${DRIFT_INDEX_VERSION} drift index.`, 'INTERNAL', {
+            reason: 'data-corrupt',
+            retryable: false,
+            recoveryHint: 'Move the file aside; `vibes secrets check` rebuilds it from the stores.'
+        });
+    }
+    return parsed.data;
+}
+/** Publish the index atomically and owner-private. */
+export async function saveIndex(home, index) {
+    await home.fs.mkdir(home.directory, { recursive: true, mode: DRIFT_DIRECTORY_MODE });
+    await publishPrivateFile(home.fs, indexPath(home), `${JSON.stringify(index, null, 2)}\n`);
+}
+/** An environment or backend name that becomes a property of the index: each `/` segment is a plain name. */
+function assertIndexName(name) {
+    for (const segment of name.split('/'))
+        assertSecretKey(segment);
+}
+/** The own entry `name` of `table`, created empty when absent (own data property, so `__proto__` is just a name). */
+function ownTable(table, name, make) {
+    const existing = Object.hasOwn(table, name) ? table[name] : undefined;
+    if (existing)
+        return existing;
+    const created = make();
+    Object.defineProperty(table, name, { value: created, enumerable: true, writable: true, configurable: true });
+    return created;
+}
+export async function recordFingerprint(input) {
+    const home = input.home;
+    assertSecretKey(input.key);
+    assertIndexName(input.environment);
+    assertIndexName(input.backend);
+    const hmac = await fingerprintValue(input.value, await loadCheckerKey(home));
+    // The index is read, changed and published as one step per file in this process.
+    await serializeByPath(indexPath(home), async () => {
+        const index = await loadIndex(home);
+        const env = ownTable(index.fingerprints, input.environment, () => ({}));
+        const backend = ownTable(env, input.backend, () => ({}));
+        Object.defineProperty(backend, input.key, {
+            value: { hmac, recordedAt: new Date().toISOString() },
+            enumerable: true,
+            writable: true,
+            configurable: true
+        });
+        await saveIndex(home, index);
+    });
+    return hmac;
+}
+//# sourceMappingURL=drift-fingerprints.impl.consumer.js.map

package/dist/surfaces/cli/shared/stores/drift-fingerprints.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-fingerprints.impl.consumer.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/drift-fingerprints.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,EACf,wBAAwB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAC,iBAAiB,EAAkB,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAC,gBAAgB,EAAiC,MAAM,+CAA+C,CAAC;AACpI,OAAO,EAAE,aAAa,EAAC,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAC,4BAA4B,EAAC,gBAAgB,EAA8F,MAAM,+CAA+C,CAAC;AAC9N,OAAO,EAAE,oBAAoB,EAAC,mBAAmB,EAAC,YAAY,EAAC,MAAM,EAAC,gBAAgB,EAAC,YAAY,EAAuD,MAAM,qBAAqB,CAAC;AACtL,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAEpD,0CAA0C;AAC1C,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,gDAAgD;AAChD,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB;IAC7D,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CAAC,IAAe;IAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,IAAe;IACjC,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,IAAI,eAAe,CAAC,yBAAyB,IAAI,aAAa,iBAAiB,YAAY,EAAE,UAAU,EAAE;QAC/G,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE;QACjB,YAAY,EAAE,yGAAyG;KACvH,CAAC,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,KAAK,UAAU,cAAc,CAAC,IAAe;IAC5C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,4BAA4B;QAAE,OAAO,SAAS,CAAC;IAC9G,kFAAkF;IAClF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,8BAA8B,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,CAAC,OAAO,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe;IACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,QAAQ,CAAC,UAAU,KAAK,iBAAiB;YAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACrF,MAAM,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,iBAAiB;QAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAAsB;IAC3E,iGAAiG;IACjG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjI,OAAO,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAe;IAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/E,6CAA6C;IAC7C,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,IAAI,eAAe,CAAC,gDAAgD,EAAE,aAAa,EAAE;QAC1F,MAAM,EAAE,wBAAwB;QAChC,KAAK,EAAE,IAAI,CAAC,OAAO;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;KAClC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAe;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAClF,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,gDAAgD,EAAE,UAAU,EAAE;YACvF,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CACxB,+BAA+B,IAAI,qBAAqB,mBAAmB,eAAe,EAC1F,UAAU,EACV;YACC,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,yEAAyE;SACvF,CACD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAe,EAAE,KAAiB;IACjE,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACrF,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe,CAAC,IAAY;IACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,eAAe,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,qHAAqH;AACrH,SAAS,QAAQ,CAAmB,KAAwB,EAAE,IAAY,EAAE,IAAa;IACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7G,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAMvC;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,iFAAiF;IACjF,MAAM,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;YACzC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YACrD,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/surfaces/cli/shared/stores/drift-forget.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Remove one key's recorded drift fingerprint. `vibes secrets unset` calls it
+ * so the index never reports a value that was removed from its store as a
+ * fingerprint a later `check --drift` would compare. It reads and writes the
+ * index only through the drift module's own loader and atomic publisher, and
+ * writes nothing when the index does not hold the key.
+ */
+import { type DriftHome } from './drift-fingerprints.impl.consumer.ts';
+/** True when the index held a fingerprint for `key` in `backend` under `environment` and it was removed. */
+export declare function forgetFingerprint(input: {
+    home: DriftHome;
+    environment: string;
+    backend: string;
+    key: string;
+}): Promise<boolean>;
+//# sourceMappingURL=drift-forget.d.ts.map

package/dist/surfaces/cli/shared/stores/drift-forget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-forget.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/drift-forget.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEtG,4GAA4G;AAC5G,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB"}

package/dist/surfaces/cli/shared/stores/drift-forget.js

@@ -0,0 +1,24 @@
+/**
+ * Remove one key's recorded drift fingerprint. `vibes secrets unset` calls it
+ * so the index never reports a value that was removed from its store as a
+ * fingerprint a later `check --drift` would compare. It reads and writes the
+ * index only through the drift module's own loader and atomic publisher, and
+ * writes nothing when the index does not hold the key.
+ */
+import { serializeByPath } from "../../../../support/path-queue.js";
+import { INDEX_FILE, loadIndex, saveIndex } from "./drift-fingerprints.impl.consumer.js";
+/** True when the index held a fingerprint for `key` in `backend` under `environment` and it was removed. */
+export async function forgetFingerprint(input) {
+    const { home, environment, backend, key } = input;
+    return serializeByPath(home.fs.join(home.directory, INDEX_FILE), async () => {
+        const index = await loadIndex(home);
+        const environmentTable = Object.hasOwn(index.fingerprints, environment) ? index.fingerprints[environment] : undefined;
+        const backendTable = environmentTable !== undefined && Object.hasOwn(environmentTable, backend) ? environmentTable[backend] : undefined;
+        if (backendTable === undefined || !Object.hasOwn(backendTable, key))
+            return false;
+        delete backendTable[key];
+        await saveIndex(home, index);
+        return true;
+    });
+}
+//# sourceMappingURL=drift-forget.js.map

package/dist/surfaces/cli/shared/stores/drift-forget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-forget.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/drift-forget.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAC,SAAS,EAAC,SAAS,EAAiB,MAAM,uCAAuC,CAAC;AAEtG,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACA,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAClD,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,MAAM,YAAY,GACjB,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpH,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/surfaces/cli/shared/stores/leverage-shared.d.ts

@@ -0,0 +1,56 @@
+import { type ResolvedSecrets } from "../../../../schemas/execution/leverage.schema.ts";
+export type { LeverageHop } from '../../../../exec/audit.ts';
+export { type ResolvedSecrets } from "../../../../schemas/execution/leverage.schema.ts";
+export { SENSITIVE_FIELD_NAMES, SENSITIVE_QUERY_PARAM_NAMES, normalizeSecretName, redactForPrint, redactSensitivePayload, redactUrlLikeText, shouldRedactFieldName, shouldRedactQueryParamName, tryRedactJson, type RedactedPayloadOutcome } from "../output/payload-redaction.ts";
+/**
+ * Shared machinery for the secret-LEVERAGE commands (`secrets exec`,
+ * `secrets request`).
+ *
+ * Contract these commands exist to enforce: secret VALUES are resolved
+ * in-process, injected at the point of use (subprocess env / HTTP header),
+ * and NEVER written to stdout/stderr — every byte of command output flows
+ * through the redactor so even a child process or server that echoes a
+ * value back cannot leak it into a terminal, a script capture, or an AI
+ * agent's transcript. Agents must use these instead of `secrets reveal`.
+ */
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+import { type RuntimeExecution } from '@vibesdotdev/kernel/execution';
+/**
+ * The execution of `runtime`, the runtime the command was handed; feature code
+ * never selects a host implementation. A host with none fails `UNAVAILABLE`
+ * `execution-unavailable`.
+ */
+export declare function resolveRuntimeExecution(runtime: RuntimeRef): Promise<RuntimeExecution>;
+/**
+ * The one backend the caller names with `--backend <id>`, or undefined.
+ *
+ * Moved, never removed (rc05 :89, :208, :219): the deleted comma chain
+ * (`a,b@env`, "fall back to b when a lacks the key") is replaced by exactly one
+ * store answering per (runtime, tier, reference). A chain is refused
+ * `INVALID_INPUT` `backend-chain-unsupported`; an `@env` pin is the
+ * `--environment` option's job and is refused the same way.
+ */
+export declare function parseSingleBackend(value: string | undefined): string | undefined;
+/**
+ * Resolve the requested keys through the one store that answers them: the
+ * caller's named `--backend`, else the tier's own store, classifying each as
+ * readable, unreadable (set but write-only), or missing, with the one hop
+ * recorded for the audit. Nothing falls through to another store.
+ *
+ * This is the secrets owner's cross-tier read (rc05 :62-63: "Only the secrets
+ * owner's commands read across tiers: `vibes secrets exec|request|check
+ * --environment T`"), kept inside this package; every other read goes through
+ * `runtime.resolveCredential`.
+ */
+export declare function resolveSecretsForLeverage(runtime: RuntimeRef, keys: string[], options: {
+    environment?: string;
+    backend?: string;
+}): Promise<ResolvedSecrets>;
+/**
+ * The typed refusal for keys only a write-only store holds: they exist only
+ * inside the deployed runtime. Nothing reads another store for them.
+ */
+export declare function writeOnlyRefusal(command: string, resolved: ResolvedSecrets): CapabilityError;
+export { openLeverageAudit, writeLeverageAudit, type LeverageAuditRecord } from '../../../../exec/audit.ts';
+export { createStreamRedactor, redactValues } from '../../../../exec/redactor.ts';
+//# sourceMappingURL=leverage-shared.d.ts.map

package/dist/surfaces/cli/shared/stores/leverage-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leverage-shared.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/leverage-shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACxF,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAC,2BAA2B,EAAC,mBAAmB,EAAC,cAAc,EAAC,sBAAsB,EAAC,iBAAiB,EAAC,qBAAqB,EAAC,0BAA0B,EAAC,aAAa,EAAC,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC1Q;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAsC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAe1F;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE5F;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAchF;AAyCD;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,eAAe,CAAC,CAuB1B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,eAAe,CAc5F;AAID,OAAO,EACP,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAC,YAAY,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/surfaces/cli/shared/stores/leverage-shared.js

@@ -0,0 +1,132 @@
+import {} from "../../../../schemas/execution/leverage.schema.js";
+export {} from "../../../../schemas/execution/leverage.schema.js";
+export { SENSITIVE_FIELD_NAMES, SENSITIVE_QUERY_PARAM_NAMES, normalizeSecretName, redactForPrint, redactSensitivePayload, redactUrlLikeText, shouldRedactFieldName, shouldRedactQueryParamName, tryRedactJson } from "../output/payload-redaction.js";
+/**
+ * Shared machinery for the secret-LEVERAGE commands (`secrets exec`,
+ * `secrets request`).
+ *
+ * Contract these commands exist to enforce: secret VALUES are resolved
+ * in-process, injected at the point of use (subprocess env / HTTP header),
+ * and NEVER written to stdout/stderr — every byte of command output flows
+ * through the redactor so even a child process or server that echoes a
+ * value back cannot leak it into a terminal, a script capture, or an AI
+ * agent's transcript. Agents must use these instead of `secrets reveal`.
+ */
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { assertSecretKey } from "../../../../domain/kinds/secret-key.js";
+import { outcomeOf } from "../../../../support/file-failure.js";
+import { resolveSecretsEnvironment } from "../../environment.js";
+import { listStoreDescriptors, resolveStoreImplementation, selectStore } from "./store-selection.js";
+/**
+ * The execution of `runtime`, the runtime the command was handed; feature code
+ * never selects a host implementation. A host with none fails `UNAVAILABLE`
+ * `execution-unavailable`.
+ */
+export async function resolveRuntimeExecution(runtime) {
+    return getRuntimeExecution(runtime);
+}
+/**
+ * The one backend the caller names with `--backend <id>`, or undefined.
+ *
+ * Moved, never removed (rc05 :89, :208, :219): the deleted comma chain
+ * (`a,b@env`, "fall back to b when a lacks the key") is replaced by exactly one
+ * store answering per (runtime, tier, reference). A chain is refused
+ * `INVALID_INPUT` `backend-chain-unsupported`; an `@env` pin is the
+ * `--environment` option's job and is refused the same way.
+ */
+export function parseSingleBackend(value) {
+    if (value === undefined)
+        return undefined;
+    const backend = value.trim();
+    if (backend.includes(',') || backend.includes('@')) {
+        throw new CapabilityError(`--backend '${value}' names a chain; exactly one store answers each key. Name the one store (--backend <id>) and select another tier with --environment.`, 'INVALID_INPUT', { reason: 'backend-chain-unsupported', details: { backend: value } });
+    }
+    if (backend.length === 0) {
+        throw new CapabilityError('--backend needs a store id.', 'INVALID_INPUT', { reason: 'backend-invalid' });
+    }
+    return backend;
+}
+/** Only a store's typed absence (`isAbsenceOf`, or `NOT_FOUND` `record-absent`) is "not there"; every other failure propagates. */
+function isStoreAbsence(failure, backend) {
+    return (CapabilityError.isAbsenceOf(failure, 'secrets/store', backend) ||
+        (isCapabilityError(failure) && failure.code === 'NOT_FOUND' && failure.reason === 'record-absent'));
+}
+/** Ask one store for `keys`, classifying each; only the store's typed NOT_FOUND counts as absence. */
+async function askHop(impl, backend, environment, keys, values) {
+    const hop = { backend, environment, resolved: [], writeOnly: [], missing: [] };
+    let listed = null;
+    for (const key of keys) {
+        const read = await outcomeOf(() => impl.get(environment, key));
+        if (!read.ok && !isStoreAbsence(read.failure, backend))
+            throw read.failure;
+        const value = read.ok ? read.value : undefined;
+        if (value !== undefined) {
+            values[key] = value;
+            hop.resolved.push(key);
+            continue;
+        }
+        // Distinguish "absent" from "set but not readable back" (write-only
+        // backends): consult the listing once, lazily.
+        if (listed === null) {
+            const listing = await outcomeOf(() => impl.list(environment));
+            if (!listing.ok && !isStoreAbsence(listing.failure, backend))
+                throw listing.failure;
+            listed = new Set(listing.ok ? listing.value.filter((e) => e.hasValue).map((e) => e.key) : []);
+        }
+        (listed.has(key) ? hop.writeOnly : hop.missing).push(key);
+    }
+    return hop;
+}
+/**
+ * Resolve the requested keys through the one store that answers them: the
+ * caller's named `--backend`, else the tier's own store, classifying each as
+ * readable, unreadable (set but write-only), or missing, with the one hop
+ * recorded for the audit. Nothing falls through to another store.
+ *
+ * This is the secrets owner's cross-tier read (rc05 :62-63: "Only the secrets
+ * owner's commands read across tiers: `vibes secrets exec|request|check
+ * --environment T`"), kept inside this package; every other read goes through
+ * `runtime.resolveCredential`.
+ */
+export async function resolveSecretsForLeverage(runtime, keys, options) {
+    for (const key of keys)
+        assertSecretKey(key);
+    const descriptors = listStoreDescriptors(runtime);
+    const { name: environment, tier } = await resolveSecretsEnvironment(runtime, options.environment);
+    // One store answers: the named `--backend`, else the tier's pick (a tie is `store-ambiguous`).
+    const backend = parseSingleBackend(options.backend);
+    const descriptor = selectStore(descriptors, tier, backend);
+    // The one hop is recorded for the audit even when no key was asked.
+    const values = {};
+    const hop = keys.length > 0
+        ? await askHop(await resolveStoreImplementation(runtime, descriptor.id), descriptor.id, environment, keys, values)
+        : { backend: descriptor.id, environment, resolved: [], writeOnly: [], missing: [] };
+    return {
+        environment: hop.environment,
+        backendId: hop.backend,
+        values,
+        unreadable: hop.writeOnly.filter((key) => !Object.hasOwn(values, key)),
+        missing: hop.missing.filter((key) => !Object.hasOwn(values, key)),
+        hops: [hop]
+    };
+}
+/**
+ * The typed refusal for keys only a write-only store holds: they exist only
+ * inside the deployed runtime. Nothing reads another store for them.
+ */
+export function writeOnlyRefusal(command, resolved) {
+    return new CapabilityError(`${command}: backend "${resolved.hops[resolved.hops.length - 1]?.backend ?? resolved.backendId}" stores ` +
+        `${resolved.unreadable.join(', ')} but cannot read values back (write-only backend). These secrets ` +
+        'can only be leveraged inside the deployed runtime.', 'UNAVAILABLE', {
+        reason: 'secret-write-only',
+        retryable: false,
+        recoveryHint: 'Probe the deployed runtime instead, or read an operator copy with --environment local (--backend <id> names one readable store).',
+        details: { keys: resolved.unreadable, hops: resolved.hops }
+    });
+}
+// The audit line and the value redactor live with `spawnWithCredentials`
+// (`@vibesdotdev/secrets/exec`); the leverage commands share them from there.
+export { openLeverageAudit, writeLeverageAudit } from "../../../../exec/audit.js";
+export { createStreamRedactor, redactValues } from "../../../../exec/redactor.js";
+//# sourceMappingURL=leverage-shared.js.map

package/dist/surfaces/cli/shared/stores/leverage-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leverage-shared.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/leverage-shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,kDAAkD,CAAC;AAExF,OAAO,EAAwB,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAC,2BAA2B,EAAC,mBAAmB,EAAC,cAAc,EAAC,sBAAsB,EAAC,iBAAiB,EAAC,qBAAqB,EAAC,0BAA0B,EAAC,aAAa,EAA8B,MAAM,gCAAgC,CAAC;AAC1Q;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAC,iBAAiB,EAAqC,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAwB,MAAM,+BAA+B,CAAC;AAI1F,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACP,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACV,MAAM,sBAAsB,CAAC;AAI9B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAmB;IAChE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACxB,cAAc,KAAK,sIAAsI,EACzJ,eAAe,EACf,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACpE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,mIAAmI;AACnI,SAAS,cAAc,CAAC,OAAsB,EAAE,OAAe;IAC9D,OAAO,CACN,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC;QAC9D,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,CAClG,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,MAAM,CACpB,IAAgC,EAChC,OAAe,EACf,WAAmB,EACnB,IAAuB,EACvB,MAA8B;IAE9B,MAAM,GAAG,GAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,SAAS;QACV,CAAC;QACD,oEAAoE;QACpE,+CAA+C;QAC/C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,MAAM,OAAO,CAAC,OAAO,CAAC;YACpF,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAmB,EACnB,IAAc,EACd,OAAmD;IAEnD,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAElG,+FAA+F;IAC/F,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAE3D,oEAAoE;IACpE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,GAAG,GACR,IAAI,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC;QAClH,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtF,OAAO;QACN,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,OAAO;QACtB,MAAM;QACN,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,GAAG,CAAC;KACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAyB;IAC1E,OAAO,IAAI,eAAe,CACzB,GAAG,OAAO,cAAc,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;QACzG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;QACpG,oDAAoD,EACpD,aAAa,EACb;QACC,MAAM,EAAE,mBAAmB;QAC3B,SAAS,EAAE,KAAK;QAChB,YAAY,EACX,kIAAkI;QACnI,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;KAC3D,CACD,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EACP,iBAAiB,EACjB,kBAAkB,EAEjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAC,YAAY,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/surfaces/cli/shared/stores/store-selection.d.ts

@@ -0,0 +1,39 @@
+import { type StoreSelectionRuntime } from "../../../../schemas/cli/selection.schema.ts";
+export { type StoreSelectionRuntime } from "../../../../schemas/cli/selection.schema.ts";
+/**
+ * The one store pick every `vibes secrets` command shares. A command never
+ * sorts descriptors itself: the unnamed pick is the kind's own
+ * (`pickTierSecretsStore`: highest priority among the tier's scope stores, a
+ * tie is `INVALID_INPUT` `store-ambiguous`), and a named `--backend` must be a
+ * registered `secrets/store`. Descriptors are parsed, implementations typed;
+ * nothing is cast.
+ */
+import { CapabilityError, type CaughtFailure } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../../../../domain/kinds/store.interface.ts';
+import type { EnvironmentTier, ResolvedSecretsStoreDescriptor } from '../../../../domain/kinds/store.schema.ts';
+/** The runtime has no `secrets/store` kind: no backend plugin was composed. */
+export declare function storeKindUnregistered(): CapabilityError;
+/** Every registered `secrets/store` descriptor, parsed. An unregistered kind is typed `UNAVAILABLE`. */
+export declare function listStoreDescriptors(runtime: StoreSelectionRuntime): ResolvedSecretsStoreDescriptor[];
+/** The one scope store serving `tier`, or undefined when none does. A priority tie is `store-ambiguous`. */
+export declare function pickTierStore(descriptors: readonly ResolvedSecretsStoreDescriptor[], tier: EnvironmentTier): ResolvedSecretsStoreDescriptor | undefined;
+/** The store the caller named with `--backend <id>`: it must be a registered `secrets/store`. */
+export declare function requireNamedStore(descriptors: readonly ResolvedSecretsStoreDescriptor[], id: string): ResolvedSecretsStoreDescriptor;
+/**
+ * The store a command acts on: the named `--backend`, else the tier's one
+ * store. No store for the tier is `UNAVAILABLE` `secrets-store-unavailable`.
+ * `candidates` narrows the unnamed pick by a command's own routing policy
+ * (`set` writes only to local stores by default); the pick among the
+ * candidates, and its tie rule, stay the kind's.
+ */
+export declare function selectStore(descriptors: readonly ResolvedSecretsStoreDescriptor[], tier: EnvironmentTier, backendId: string | undefined, candidates?: (descriptor: ResolvedSecretsStoreDescriptor) => boolean): ResolvedSecretsStoreDescriptor;
+/**
+ * A store's failure as a typed `CapabilityError`: a typed one passes through
+ * untouched; anything else (a raw `Error` a backend threw) becomes `UNAVAILABLE`
+ * `store-<operation>-failed` carrying it as `cause`. The message never carries
+ * a key or a value.
+ */
+export declare function typedStoreFailure(caught: CaughtFailure, operation: 'read' | 'write' | 'list', store: string): CapabilityError;
+/** The implementation of one registered store. */
+export declare function resolveStoreImplementation(runtime: StoreSelectionRuntime, id: string): Promise<SecretsStoreImplementation>;
+//# sourceMappingURL=store-selection.d.ts.map

package/dist/surfaces/cli/shared/stores/store-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-selection.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/store-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EACZ,eAAe,EACf,8BAA8B,EAE7B,MAAM,0CAA0C,CAAC;AAElD,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,eAAe,CAMvD;AAED,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,EAAE,CAGrG;AAED,4GAA4G;AAC5G,wBAAgB,aAAa,CAC5B,WAAW,EAAE,SAAS,8BAA8B,EAAE,EACtD,IAAI,EAAE,eAAe,GACnB,8BAA8B,GAAG,SAAS,CAE5C;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAChC,WAAW,EAAE,SAAS,8BAA8B,EAAE,EACtD,EAAE,EAAE,MAAM,GACR,8BAA8B,CAUhC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAC1B,WAAW,EAAE,SAAS,8BAA8B,EAAE,EACtD,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,UAAU,GAAE,CAAC,UAAU,EAAE,8BAA8B,KAAK,OAAoB,GAC9E,8BAA8B,CAShC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EACpC,KAAK,EAAE,MAAM,GACX,eAAe,CAQjB;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,CACzC,OAAO,EAAE,qBAAqB,EAC9B,EAAE,EAAE,MAAM,GACR,OAAO,CAAC,0BAA0B,CAAC,CAErC"}

package/dist/surfaces/cli/shared/stores/store-selection.js

@@ -0,0 +1,79 @@
+import {} from "../../../../schemas/cli/selection.schema.js";
+export {} from "../../../../schemas/cli/selection.schema.js";
+/**
+ * The one store pick every `vibes secrets` command shares. A command never
+ * sorts descriptors itself: the unnamed pick is the kind's own
+ * (`pickTierSecretsStore`: highest priority among the tier's scope stores, a
+ * tie is `INVALID_INPUT` `store-ambiguous`), and a named `--backend` must be a
+ * registered `secrets/store`. Descriptors are parsed, implementations typed;
+ * nothing is cast.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { parseSecretsStoreDescriptors, pickTierSecretsStore } from "../../../../domain/kinds/store-selection.js";
+/** The runtime has no `secrets/store` kind: no backend plugin was composed. */
+export function storeKindUnregistered() {
+    return new CapabilityError('No secrets/store kind registered. Register a secrets backend plugin first.', 'UNAVAILABLE', { reason: 'secrets-store-unregistered', retryable: false });
+}
+/** Every registered `secrets/store` descriptor, parsed. An unregistered kind is typed `UNAVAILABLE`. */
+export function listStoreDescriptors(runtime) {
+    if (!runtime.hasKind('secrets/store'))
+        throw storeKindUnregistered();
+    return parseSecretsStoreDescriptors(runtime.query('secrets/store').descriptors());
+}
+/** The one scope store serving `tier`, or undefined when none does. A priority tie is `store-ambiguous`. */
+export function pickTierStore(descriptors, tier) {
+    return pickTierSecretsStore(descriptors, tier);
+}
+/** The store the caller named with `--backend <id>`: it must be a registered `secrets/store`. */
+export function requireNamedStore(descriptors, id) {
+    const named = descriptors.find((descriptor) => descriptor.id === id);
+    if (named)
+        return named;
+    const available = descriptors.map((descriptor) => descriptor.id).sort();
+    throw new CapabilityError(`No secrets store '${id}' is registered.`, 'INVALID_INPUT', {
+        reason: 'store-unknown',
+        retryable: false,
+        recoveryHint: available.length > 0 ? `Available stores: ${available.join(', ')}` : 'No secrets stores are registered.',
+        details: { store: id, available }
+    });
+}
+/**
+ * The store a command acts on: the named `--backend`, else the tier's one
+ * store. No store for the tier is `UNAVAILABLE` `secrets-store-unavailable`.
+ * `candidates` narrows the unnamed pick by a command's own routing policy
+ * (`set` writes only to local stores by default); the pick among the
+ * candidates, and its tie rule, stay the kind's.
+ */
+export function selectStore(descriptors, tier, backendId, candidates = () => true) {
+    if (backendId !== undefined)
+        return requireNamedStore(descriptors, backendId);
+    const picked = pickTierStore(descriptors.filter(candidates), tier);
+    if (picked)
+        return picked;
+    throw new CapabilityError(`No secrets store available for tier: ${tier}`, 'UNAVAILABLE', {
+        reason: 'secrets-store-unavailable',
+        retryable: false,
+        details: { tier }
+    });
+}
+/**
+ * A store's failure as a typed `CapabilityError`: a typed one passes through
+ * untouched; anything else (a raw `Error` a backend threw) becomes `UNAVAILABLE`
+ * `store-<operation>-failed` carrying it as `cause`. The message never carries
+ * a key or a value.
+ */
+export function typedStoreFailure(caught, operation, store) {
+    const failure = CapabilityError.from(caught);
+    if (failure.reason !== 'untyped')
+        return failure;
+    return new CapabilityError(`The secrets store '${store}' could not ${operation} the secret.`, 'UNAVAILABLE', {
+        reason: `store-${operation}-failed`,
+        cause: caught,
+        details: { store }
+    });
+}
+/** The implementation of one registered store. */
+export function resolveStoreImplementation(runtime, id) {
+    return runtime.query('secrets/store').withId(id).resolve();
+}
+//# sourceMappingURL=store-selection.js.map

package/dist/surfaces/cli/shared/stores/store-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-selection.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/store-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAA8B,MAAM,6CAA6C,CAAC;AACzF;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAC,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAQhH,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB;IACpC,OAAO,IAAI,eAAe,CACzB,4EAA4E,EAC5E,aAAa,EACb,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK,EAAE,CAC1D,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IAClE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,MAAM,qBAAqB,EAAE,CAAC;IACrE,OAAO,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAyB,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAC5B,WAAsD,EACtD,IAAqB;IAErB,OAAO,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAChC,WAAsD,EACtD,EAAU;IAEV,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,eAAe,EAAE;QACrF,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mCAAmC;QACtH,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE;KACjC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAC1B,WAAsD,EACtD,IAAqB,EACrB,SAA6B,EAC7B,aAAsE,GAAG,EAAE,CAAC,IAAI;IAEhF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,eAAe,CAAC,wCAAwC,IAAI,EAAE,EAAE,aAAa,EAAE;QACxF,MAAM,EAAE,2BAA2B;QACnC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE;KACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAAqB,EACrB,SAAoC,EACpC,KAAa;IAEb,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACjD,OAAO,IAAI,eAAe,CAAC,sBAAsB,KAAK,eAAe,SAAS,cAAc,EAAE,aAAa,EAAE;QAC5G,MAAM,EAAE,SAAS,SAAS,SAAS;QACnC,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,EAAE,KAAK,EAAE;KAClB,CAAC,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,0BAA0B,CACzC,OAA8B,EAC9B,EAAU;IAEV,OAAO,OAAO,CAAC,KAAK,CAAqD,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAChH,CAAC"}

package/dist/surfaces/cli/shared/stores/store-transfer.d.ts

@@ -0,0 +1,42 @@
+import { keyOptionSchema, type FingerprintOutcome } from "../../../../schemas/cli/transfer.schema.ts";
+export { keyOptionSchema, type FingerprintOutcome } from "../../../../schemas/cli/transfer.schema.ts";
+/**
+ * What `secrets pull` and `secrets push` share when they copy one store's
+ * values into another: the `--key` filter (every key validated), the source
+ * read (a write-only store is refused, never copied as empty), the destination
+ * write (a raw backend failure typed), and the drift fingerprint each copied
+ * value records, exactly as `secrets set` does.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import type { SecretsStoreImplementation } from '../../../../domain/kinds/store.interface.ts';
+/** The keys a `--key` option names, each validated; undefined when it names none. */
+export declare function parseKeyFilter(value: z.infer<typeof keyOptionSchema>): Set<string> | undefined;
+/** Copying a store's environment onto itself is not a copy. */
+export declare function assertDistinctStores(source: {
+    id: string;
+    environment: string;
+}, target: {
+    id: string;
+    environment: string;
+}): void;
+/**
+ * Every value the source holds for `environment` (narrowed to `filter`). A
+ * source that lists a key as set but returns no value for it is write-only:
+ * copying would silently drop it, so the copy is refused `UNAVAILABLE`
+ * `secret-write-only`, naming the keys.
+ */
+export declare function readSourceSecrets(source: SecretsStoreImplementation, environment: string, filter: ReadonlySet<string> | undefined): Promise<Record<string, string>>;
+/** Write `secrets` to the destination; a raw backend failure is typed. */
+export declare function writeTargetSecrets(target: SecretsStoreImplementation, environment: string, secrets: Record<string, string>): Promise<void>;
+/**
+ * Record each copied value's drift fingerprint under the destination store, as
+ * `secrets set` does. A failure does not undo the copy: it is counted and
+ * returned for the command to report. Values are never reported.
+ */
+export declare function recordCopiedFingerprints(runtime: RuntimeRef, input: {
+    environment: string;
+    backend: string;
+    secrets: Readonly<Record<string, string>>;
+}): Promise<FingerprintOutcome>;
+//# sourceMappingURL=store-transfer.d.ts.map

package/dist/surfaces/cli/shared/stores/store-transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-transfer.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/store-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAC,KAAK,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrG,OAAO,EAAE,eAAe,EAAC,KAAK,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrG;;;;;;GAMG;AAEH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAK9F,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAS9F;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CACnC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzC,IAAI,CAaN;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,0BAA0B,EAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoBjC;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CACvC,MAAM,EAAE,0BAA0B,EAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GACxF,OAAO,CAAC,kBAAkB,CAAC,CAsB7B"}