@clef-sh/runtime 0.1.6-beta.32 → 0.1.12

package/README.md

@@ -0,0 +1,65 @@
+# @clef-sh/runtime
+
+Lightweight runtime secrets engine for [Clef](https://clef.sh). Fetches packed artifacts from VCS APIs, HTTP endpoints, or local files, decrypts with age (or KMS envelope encryption), and serves secrets from an in-memory cache.
+
+Designed for production deployment with minimal dependencies. No SOPS binary, no git dependency, no plaintext on disk.
+
+## Install
+
+```bash
+npm install @clef-sh/runtime
+```
+
+## Usage
+
+```typescript
+import { ClefRuntime } from "@clef-sh/runtime";
+
+const runtime = new ClefRuntime({
+  source: "https://my-bucket.s3.amazonaws.com/clef/api-gateway/production.age.json",
+  // KMS envelope artifacts need no age key — the runtime calls kms:Decrypt
+  // For age-only artifacts:
+  // ageKey: "AGE-SECRET-KEY-1...",
+});
+
+await runtime.start();
+runtime.startPolling();
+
+// Read secrets
+const dbUrl = runtime.get("DB_URL");
+const all = runtime.getAll();
+```
+
+## Features
+
+- **VCS providers**: GitHub, GitLab, Bitbucket — fetch artifacts directly from git repos
+- **HTTP/file sources**: Fetch from S3, CDN, or local file paths
+- **KMS envelope encryption**: AWS KMS, GCP Cloud KMS, Azure Key Vault — no static age key needed
+- **Adaptive polling**: Refreshes at 80% of artifact TTL, content-hash short-circuit skips unnecessary decryption
+- **Resilient caching**: In-memory primary cache with optional encrypted disk fallback
+- **Revocation**: Detects `revokedAt` field and wipes cache immediately
+
+## KMS Providers
+
+KMS SDKs are optional dependencies — install only the one you need:
+
+```bash
+# AWS KMS
+npm install @aws-sdk/client-kms
+
+# GCP Cloud KMS
+npm install @google-cloud/kms
+
+# Azure Key Vault
+npm install @azure/identity @azure/keyvault-keys
+```
+
+## Documentation
+
+- [Runtime Agent guide](https://docs.clef.sh/guide/agent)
+- [Dynamic Secrets guide](https://docs.clef.sh/guide/dynamic-secrets)
+- [API reference](https://docs.clef.sh/api/)
+
+## License
+
+MIT

package/dist/artifact-decryptor.d.ts

@@ -0,0 +1,47 @@
+import { TelemetryEmitter } from "./telemetry";
+import type { ArtifactEnvelope } from "./poller";
+/** Result of decrypting an artifact envelope. */
+export interface DecryptedArtifact {
+    values: Record<string, string>;
+    keys: string[];
+    revision: string;
+}
+export interface ArtifactDecryptorOptions {
+    /** Age private key string. Optional for KMS envelope artifacts. */
+    privateKey?: string;
+    /** Optional telemetry emitter for decrypt error reporting. */
+    telemetry?: TelemetryEmitter;
+}
+/**
+ * Decrypts artifact envelopes into plaintext key-value pairs.
+ *
+ * Supports two paths:
+ *   - **KMS envelope**: unwrap DEK via cloud KMS, then AES-256-GCM decrypt
+ *   - **Age-only**: decrypt via the age private key
+ *
+ * The caller is responsible for validation (version, integrity, signature,
+ * expiry). This module handles only the cryptographic decryption and JSON
+ * parsing of the resulting plaintext.
+ */
+export declare class ArtifactDecryptor {
+    private readonly ageDecryptor;
+    private readonly privateKey?;
+    private telemetryOverride?;
+    private readonly initialTelemetry?;
+    constructor(options: ArtifactDecryptorOptions);
+    /** Set or replace the telemetry emitter. */
+    setTelemetry(emitter: TelemetryEmitter): void;
+    private get telemetry();
+    /**
+     * Decrypt an artifact envelope into plaintext key-value pairs.
+     *
+     * @throws On KMS unwrap failure, AES-GCM auth failure, age decrypt failure,
+     *         missing private key (config error), or malformed plaintext JSON.
+     */
+    decrypt(artifact: ArtifactEnvelope): Promise<DecryptedArtifact>;
+    /** KMS envelope: unwrap DEK via KMS, then AES-256-GCM decrypt. */
+    private decryptKmsEnvelope;
+    /** Age-only: decrypt with the static private key. */
+    private decryptAge;
+}
+//# sourceMappingURL=artifact-decryptor.d.ts.map

package/dist/artifact-decryptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-decryptor.d.ts","sourceRoot":"","sources":["../src/artifact-decryptor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,iBAAiB,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAmB;gBAEzC,OAAO,EAAE,wBAAwB;IAK7C,4CAA4C;IAC5C,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAI7C,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;OAKG;IACG,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAyBrE,kEAAkE;YACpD,kBAAkB;IAiChC,qDAAqD;YACvC,UAAU;CAkBzB"}

package/dist/artifact-decryptor.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArtifactDecryptor = void 0;
+const crypto = __importStar(require("crypto"));
+const decrypt_1 = require("./decrypt");
+const kms_1 = require("./kms");
+/**
+ * Decrypts artifact envelopes into plaintext key-value pairs.
+ *
+ * Supports two paths:
+ *   - **KMS envelope**: unwrap DEK via cloud KMS, then AES-256-GCM decrypt
+ *   - **Age-only**: decrypt via the age private key
+ *
+ * The caller is responsible for validation (version, integrity, signature,
+ * expiry). This module handles only the cryptographic decryption and JSON
+ * parsing of the resulting plaintext.
+ */
+class ArtifactDecryptor {
+    ageDecryptor = new decrypt_1.AgeDecryptor();
+    privateKey;
+    telemetryOverride;
+    initialTelemetry;
+    constructor(options) {
+        this.privateKey = options.privateKey;
+        this.initialTelemetry = options.telemetry;
+    }
+    /** Set or replace the telemetry emitter. */
+    setTelemetry(emitter) {
+        this.telemetryOverride = emitter;
+    }
+    get telemetry() {
+        return this.telemetryOverride ?? this.initialTelemetry;
+    }
+    /**
+     * Decrypt an artifact envelope into plaintext key-value pairs.
+     *
+     * @throws On KMS unwrap failure, AES-GCM auth failure, age decrypt failure,
+     *         missing private key (config error), or malformed plaintext JSON.
+     */
+    async decrypt(artifact) {
+        let plaintext;
+        if (artifact.envelope) {
+            plaintext = await this.decryptKmsEnvelope(artifact);
+        }
+        else {
+            plaintext = await this.decryptAge(artifact);
+        }
+        let values;
+        try {
+            values = JSON.parse(plaintext);
+        }
+        catch (err) {
+            this.telemetry?.artifactInvalid({
+                reason: "payload_parse",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+        finally {
+            plaintext = "";
+        }
+        return { values, keys: artifact.keys, revision: artifact.revision };
+    }
+    /** KMS envelope: unwrap DEK via KMS, then AES-256-GCM decrypt. */
+    async decryptKmsEnvelope(artifact) {
+        const envelope = artifact.envelope;
+        let dek;
+        try {
+            const kms = (0, kms_1.createKmsProvider)(envelope.provider);
+            const wrappedKey = Buffer.from(envelope.wrappedKey, "base64");
+            dek = await kms.unwrap(envelope.keyId, wrappedKey, envelope.algorithm);
+        }
+        catch (err) {
+            this.telemetry?.artifactInvalid({
+                reason: "kms_unwrap",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+        try {
+            const iv = Buffer.from(envelope.iv, "base64");
+            const authTag = Buffer.from(envelope.authTag, "base64");
+            const ciphertextBuf = Buffer.from(artifact.ciphertext, "base64");
+            const decipher = crypto.createDecipheriv("aes-256-gcm", dek, iv);
+            decipher.setAuthTag(authTag);
+            return Buffer.concat([decipher.update(ciphertextBuf), decipher.final()]).toString("utf-8");
+        }
+        catch (err) {
+            this.telemetry?.artifactInvalid({
+                reason: "decrypt",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+        finally {
+            dek.fill(0);
+        }
+    }
+    /** Age-only: decrypt with the static private key. */
+    async decryptAge(artifact) {
+        if (!this.privateKey) {
+            // Config error — NOT an artifact.invalid event
+            throw new Error("Artifact requires an age private key. Set CLEF_AGENT_AGE_KEY or use KMS envelope encryption.");
+        }
+        try {
+            return await this.ageDecryptor.decrypt(artifact.ciphertext, this.privateKey);
+        }
+        catch (err) {
+            this.telemetry?.artifactInvalid({
+                reason: err instanceof SyntaxError ? "payload_parse" : "decrypt",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+    }
+}
+exports.ArtifactDecryptor = ArtifactDecryptor;
+//# sourceMappingURL=artifact-decryptor.js.map

package/dist/artifact-decryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-decryptor.js","sourceRoot":"","sources":["../src/artifact-decryptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AACjC,uCAAyC;AACzC,+BAA0C;AAkB1C;;;;;;;;;;GAUG;AACH,MAAa,iBAAiB;IACX,YAAY,GAAG,IAAI,sBAAY,EAAE,CAAC;IAClC,UAAU,CAAU;IAC7B,iBAAiB,CAAoB;IAC5B,gBAAgB,CAAoB;IAErD,YAAY,OAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC5C,CAAC;IAED,4CAA4C;IAC5C,YAAY,CAAC,OAAyB;QACpC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,QAA0B;QACtC,IAAI,SAAiB,CAAC;QAEtB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,SAAS,GAAG,EAAE,CAAC;QACjB,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC;IAED,kEAAkE;IAC1D,KAAK,CAAC,kBAAkB,CAAC,QAA0B;QACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAS,CAAC;QACpC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC9D,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,qDAAqD;IAC7C,KAAK,CAAC,UAAU,CAAC,QAA0B;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,+CAA+C;YAC/C,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;gBAChE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAxGD,8CAwGC"}

package/dist/decrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../src/decrypt.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,qBAAa,YAAY;IACvB;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQtE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM;CAazD"}
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../src/decrypt.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,qBAAa,YAAY;IACvB;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWtE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM;CAazD"}

package/dist/decrypt.js

@@ -54,7 +54,9 @@ class AgeDecryptor {
         const { Decrypter } = await Promise.resolve(`${"age-encryption"}`).then(s => __importStar(require(s)));
         const d = new Decrypter();
         d.addIdentity(privateKey);
-        return d.decrypt(ciphertext, "text");
+        // Ciphertext is base64-encoded binary age format. Decode to bytes
+        // before passing to the age library.
+        return d.decrypt(Buffer.from(ciphertext, "base64"), "text");
     }
     /**
      * Resolve the age private key from either an inline value or a file path.

package/dist/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../src/decrypt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB;;;;;GAKG;AACH,MAAa,YAAY;IACvB;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,UAAkB;QAClD,gHAAgH;QAChH,MAAM,EAAE,SAAS,EAAE,GAAG,yBAAa,gBAAuB,uCAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,MAAe,EAAE,UAAmB;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,mEAAmE;YACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;CACF;AApCD,oCAoCC"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../src/decrypt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB;;;;;GAKG;AACH,MAAa,YAAY;IACvB;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,UAAkB;QAClD,gHAAgH;QAChH,MAAM,EAAE,SAAS,EAAE,GAAG,yBAAa,gBAAuB,uCAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAE1B,kEAAkE;QAClE,qCAAqC;QACrC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,MAAe,EAAE,UAAmB;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,mEAAmE;YACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;CACF;AAvCD,oCAuCC"}

package/dist/disk-cache.d.ts

@@ -16,6 +16,7 @@ export declare class DiskCache {
     getCachedSha(): string | undefined;
     /** Get the fetchedAt timestamp from metadata, if available. */
     getFetchedAt(): string | undefined;
+    private readMeta;
     /** Remove cached artifact and metadata files. */
     purge(): void;
 }

package/dist/disk-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"disk-cache.d.ts","sourceRoot":"","sources":["../src/disk-cache.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAMpE,+EAA+E;IAC/E,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IActC,sEAAsE;IACtE,IAAI,IAAI,MAAM,GAAG,IAAI;IAQrB,0DAA0D;IAC1D,YAAY,IAAI,MAAM,GAAG,SAAS;IAUlC,+DAA+D;IAC/D,YAAY,IAAI,MAAM,GAAG,SAAS;IAUlC,iDAAiD;IACjD,KAAK,IAAI,IAAI;CAYd"}
+{"version":3,"file":"disk-cache.d.ts","sourceRoot":"","sources":["../src/disk-cache.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAMpE,+EAA+E;IAC/E,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IActC,sEAAsE;IACtE,IAAI,IAAI,MAAM,GAAG,IAAI;IAQrB,0DAA0D;IAC1D,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC,+DAA+D;IAC/D,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC,OAAO,CAAC,QAAQ;IAShB,iDAAiD;IACjD,KAAK,IAAI,IAAI;CAYd"}

package/dist/disk-cache.js

@@ -73,21 +73,16 @@ class DiskCache {
     }
     /** Get the SHA from the cached metadata, if available. */
     getCachedSha() {
-        try {
-            const raw = fs.readFileSync(this.metaPath, "utf-8");
-            const meta = JSON.parse(raw);
-            return meta.sha;
-        }
-        catch {
-            return undefined;
-        }
+        return this.readMeta()?.sha;
     }
     /** Get the fetchedAt timestamp from metadata, if available. */
     getFetchedAt() {
+        return this.readMeta()?.fetchedAt;
+    }
+    readMeta() {
         try {
             const raw = fs.readFileSync(this.metaPath, "utf-8");
-            const meta = JSON.parse(raw);
-            return meta.fetchedAt;
+            return JSON.parse(raw);
         }
         catch {
             return undefined;

package/dist/disk-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"disk-cache.js","sourceRoot":"","sources":["../src/disk-cache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAO7B;;;;;GAKG;AACH,MAAa,SAAS;IACH,YAAY,CAAS;IACrB,QAAQ,CAAS;IAElC,YAAY,SAAiB,EAAE,QAAgB,EAAE,WAAmB;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,GAAW,EAAE,GAAY;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,YAAY,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAkB,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,IAAI;QACF,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,YAAY;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC7D,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,YAAY;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC7D,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK;QACH,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;CACF;AArED,8BAqEC"}
+{"version":3,"file":"disk-cache.js","sourceRoot":"","sources":["../src/disk-cache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAO7B;;;;;GAKG;AACH,MAAa,SAAS;IACH,YAAY,CAAS;IACrB,QAAQ,CAAS;IAElC,YAAY,SAAiB,EAAE,QAAgB,EAAE,WAAmB;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,GAAW,EAAE,GAAY;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,YAAY,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAkB,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,IAAI;QACF,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;IACpC,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK;QACH,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;CACF;AAlED,8BAkEC"}

package/dist/encrypted-artifact-store.d.ts

@@ -0,0 +1,27 @@
+import type { ArtifactEnvelope } from "./poller";
+/**
+ * Holds the latest validated-but-encrypted artifact envelope.
+ *
+ * In JIT mode (cacheTtl=0) the poller writes here after fetch+validate,
+ * and the HTTP server reads from here on each request to decrypt on demand.
+ * Key names and revision are readable without decryption (SOPS metadata).
+ */
+export declare class EncryptedArtifactStore {
+    private artifact;
+    private _storedAt;
+    /** Atomically replace the stored artifact. */
+    swap(artifact: ArtifactEnvelope): void;
+    /** Get the current encrypted artifact. Returns null if not yet loaded. */
+    get(): ArtifactEnvelope | null;
+    /** Whether an artifact has been stored. */
+    isReady(): boolean;
+    /** Epoch ms of last store, or null. */
+    getStoredAt(): number | null;
+    /** Get key names from the stored artifact metadata (no decryption needed). */
+    getKeys(): string[];
+    /** Get the revision from the stored artifact. */
+    getRevision(): string | null;
+    /** Clear the stored artifact (on revocation/expiry). */
+    wipe(): void;
+}
+//# sourceMappingURL=encrypted-artifact-store.d.ts.map

package/dist/encrypted-artifact-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-artifact-store.d.ts","sourceRoot":"","sources":["../src/encrypted-artifact-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,SAAS,CAAuB;IAExC,8CAA8C;IAC9C,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAKtC,0EAA0E;IAC1E,GAAG,IAAI,gBAAgB,GAAG,IAAI;IAI9B,2CAA2C;IAC3C,OAAO,IAAI,OAAO;IAIlB,uCAAuC;IACvC,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,8EAA8E;IAC9E,OAAO,IAAI,MAAM,EAAE;IAInB,iDAAiD;IACjD,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,wDAAwD;IACxD,IAAI,IAAI,IAAI;CAIb"}

package/dist/encrypted-artifact-store.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptedArtifactStore = void 0;
+/**
+ * Holds the latest validated-but-encrypted artifact envelope.
+ *
+ * In JIT mode (cacheTtl=0) the poller writes here after fetch+validate,
+ * and the HTTP server reads from here on each request to decrypt on demand.
+ * Key names and revision are readable without decryption (SOPS metadata).
+ */
+class EncryptedArtifactStore {
+    artifact = null;
+    _storedAt = null;
+    /** Atomically replace the stored artifact. */
+    swap(artifact) {
+        this.artifact = artifact;
+        this._storedAt = Date.now();
+    }
+    /** Get the current encrypted artifact. Returns null if not yet loaded. */
+    get() {
+        return this.artifact;
+    }
+    /** Whether an artifact has been stored. */
+    isReady() {
+        return this.artifact !== null;
+    }
+    /** Epoch ms of last store, or null. */
+    getStoredAt() {
+        return this._storedAt;
+    }
+    /** Get key names from the stored artifact metadata (no decryption needed). */
+    getKeys() {
+        return this.artifact ? [...this.artifact.keys] : [];
+    }
+    /** Get the revision from the stored artifact. */
+    getRevision() {
+        return this.artifact?.revision ?? null;
+    }
+    /** Clear the stored artifact (on revocation/expiry). */
+    wipe() {
+        this.artifact = null;
+        this._storedAt = null;
+    }
+}
+exports.EncryptedArtifactStore = EncryptedArtifactStore;
+//# sourceMappingURL=encrypted-artifact-store.js.map

package/dist/encrypted-artifact-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-artifact-store.js","sourceRoot":"","sources":["../src/encrypted-artifact-store.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACH,MAAa,sBAAsB;IACzB,QAAQ,GAA4B,IAAI,CAAC;IACzC,SAAS,GAAkB,IAAI,CAAC;IAExC,8CAA8C;IAC9C,IAAI,CAAC,QAA0B;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,GAAG;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,2CAA2C;IAC3C,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAED,uCAAuC;IACvC,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,iDAAiD;IACjD,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,wDAAwD;IACxD,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAxCD,wDAwCC"}

package/dist/index.d.ts

@@ -3,6 +3,9 @@ export { DiskCache } from "./disk-cache";
 export { AgeDecryptor } from "./decrypt";
 export { ArtifactPoller } from "./poller";
 export type { PollerOptions, ArtifactEnvelope } from "./poller";
+export { ArtifactDecryptor } from "./artifact-decryptor";
+export type { DecryptedArtifact, ArtifactDecryptorOptions } from "./artifact-decryptor";
+export { EncryptedArtifactStore } from "./encrypted-artifact-store";
 export { TelemetryEmitter } from "./telemetry";
 export type { TelemetryOptions, TelemetryEvent, AgentStartedEvent, AgentStoppedEvent, ArtifactRefreshedEvent, ArtifactRevokedEvent, ArtifactExpiredEvent, FetchFailedEvent, CacheExpiredEvent, ArtifactInvalidEvent, } from "./telemetry";
 export type { VcsProvider, VcsProviderConfig, VcsFileResult } from "./vcs/types";
@@ -17,6 +20,7 @@ export type { ArtifactSource, ArtifactFetchResult } from "./sources/types";
 export { HttpArtifactSource } from "./sources/http";
 export { FileArtifactSource } from "./sources/file";
 export { VcsArtifactSource } from "./sources/vcs";
+export { buildSigningPayload, verifySignature } from "./signature";
 import { SecretsCache } from "./secrets-cache";
 import { ArtifactPoller } from "./poller";
 import { TelemetryEmitter } from "./telemetry";
@@ -54,6 +58,11 @@ export interface RuntimeConfig {
     cacheTtl?: number;
     /** Optional telemetry emitter for event reporting. */
     telemetry?: TelemetryEmitter;
+    /**
+     * Public key for artifact signature verification (base64-encoded DER SPKI).
+     * When set, unsigned or mis-signed artifacts are hard-rejected before decryption.
+     */
+    verifyKey?: string;
 }
 /**
  * High-level runtime for fetching and caching secrets.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG1C,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC7C,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,sDAAsD;IACtD,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,MAAM,EAAE,aAAa;IA+BjC,iEAAiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,yFAAyF;IACzF,YAAY,IAAI,IAAI;IAIpB,+BAA+B;IAC/B,WAAW,IAAI,IAAI;IAInB,wCAAwC;IACxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,wCAAwC;IACxC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIhC,0DAA0D;IAC1D,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7B,gCAAgC;IAChC,IAAI,IAAI,MAAM,EAAE;IAIhB,iCAAiC;IACjC,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,wCAAwC;IACxC,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,yDAAyD;IACzD,SAAS,IAAI,cAAc;IAI3B,wDAAwD;IACxD,QAAQ,IAAI,YAAY;IAIxB,OAAO,CAAC,aAAa;CA0CtB;AAED,2FAA2F;AAC3F,wBAAsB,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAItE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG1C,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC7C,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,sDAAsD;IACtD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAE7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,MAAM,EAAE,aAAa;IAgCjC,iEAAiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,yFAAyF;IACzF,YAAY,IAAI,IAAI;IAIpB,+BAA+B;IAC/B,WAAW,IAAI,IAAI;IAInB,wCAAwC;IACxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,wCAAwC;IACxC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIhC,0DAA0D;IAC1D,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7B,gCAAgC;IAChC,IAAI,IAAI,MAAM,EAAE;IAIhB,iCAAiC;IACjC,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,wCAAwC;IACxC,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,yDAAyD;IACzD,SAAS,IAAI,cAAc;IAI3B,wDAAwD;IACxD,QAAQ,IAAI,YAAY;IAIxB,OAAO,CAAC,aAAa;CA0CtB;AAED,2FAA2F;AAC3F,wBAAsB,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAItE"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClefRuntime = exports.VcsArtifactSource = exports.FileArtifactSource = exports.HttpArtifactSource = exports.createKmsProvider = exports.AwsKmsProvider = exports.createVcsProvider = exports.BitbucketProvider = exports.GitLabProvider = exports.GitHubProvider = exports.TelemetryEmitter = exports.ArtifactPoller = exports.AgeDecryptor = exports.DiskCache = exports.SecretsCache = void 0;
+exports.ClefRuntime = exports.verifySignature = exports.buildSigningPayload = exports.VcsArtifactSource = exports.FileArtifactSource = exports.HttpArtifactSource = exports.createKmsProvider = exports.AwsKmsProvider = exports.createVcsProvider = exports.BitbucketProvider = exports.GitLabProvider = exports.GitHubProvider = exports.TelemetryEmitter = exports.EncryptedArtifactStore = exports.ArtifactDecryptor = exports.ArtifactPoller = exports.AgeDecryptor = exports.DiskCache = exports.SecretsCache = void 0;
 exports.init = init;
 // Core modules
 var secrets_cache_1 = require("./secrets-cache");
@@ -11,6 +11,10 @@ var decrypt_1 = require("./decrypt");
 Object.defineProperty(exports, "AgeDecryptor", { enumerable: true, get: function () { return decrypt_1.AgeDecryptor; } });
 var poller_1 = require("./poller");
 Object.defineProperty(exports, "ArtifactPoller", { enumerable: true, get: function () { return poller_1.ArtifactPoller; } });
+var artifact_decryptor_1 = require("./artifact-decryptor");
+Object.defineProperty(exports, "ArtifactDecryptor", { enumerable: true, get: function () { return artifact_decryptor_1.ArtifactDecryptor; } });
+var encrypted_artifact_store_1 = require("./encrypted-artifact-store");
+Object.defineProperty(exports, "EncryptedArtifactStore", { enumerable: true, get: function () { return encrypted_artifact_store_1.EncryptedArtifactStore; } });
 // Telemetry
 var telemetry_1 = require("./telemetry");
 Object.defineProperty(exports, "TelemetryEmitter", { enumerable: true, get: function () { return telemetry_1.TelemetryEmitter; } });
@@ -32,6 +36,10 @@ var file_1 = require("./sources/file");
 Object.defineProperty(exports, "FileArtifactSource", { enumerable: true, get: function () { return file_1.FileArtifactSource; } });
 var vcs_1 = require("./sources/vcs");
 Object.defineProperty(exports, "VcsArtifactSource", { enumerable: true, get: function () { return vcs_1.VcsArtifactSource; } });
+// Signature verification
+var signature_1 = require("./signature");
+Object.defineProperty(exports, "buildSigningPayload", { enumerable: true, get: function () { return signature_1.buildSigningPayload; } });
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return signature_1.verifySignature; } });
 // High-level API
 const secrets_cache_2 = require("./secrets-cache");
 const disk_cache_2 = require("./disk-cache");
@@ -74,6 +82,7 @@ class ClefRuntime {
             diskCache,
             cacheTtl: config.cacheTtl,
             telemetry: config.telemetry,
+            verifyKey: config.verifyKey,
         });
     }
     /** Initial fetch + decrypt. Must be called before get/getAll. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AA2OA,oBAIC;AA/OD,eAAe;AACf,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,2CAAyC;AAAhC,uGAAA,SAAS,OAAA;AAClB,qCAAyC;AAAhC,uGAAA,YAAY,OAAA;AACrB,mCAA0C;AAAjC,wGAAA,cAAc,OAAA;AAGvB,YAAY;AACZ,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA;AAgBzB,uCAA8C;AAArC,wGAAA,cAAc,OAAA;AACvB,uCAA8C;AAArC,wGAAA,cAAc,OAAA;AACvB,6CAAoD;AAA3C,8GAAA,iBAAiB,OAAA;AAC1B,qCAAgD;AAAvC,0GAAA,iBAAiB,OAAA;AAI1B,6BAAuC;AAA9B,qGAAA,cAAc,OAAA;AACvB,6BAA0C;AAAjC,wGAAA,iBAAiB,OAAA;AAI1B,uCAAoD;AAA3C,0GAAA,kBAAkB,OAAA;AAC3B,uCAAoD;AAA3C,0GAAA,kBAAkB,OAAA;AAC3B,qCAAkD;AAAzC,wGAAA,iBAAiB,OAAA;AAE1B,iBAAiB;AACjB,mDAA+C;AAC/C,6CAAyC;AACzC,uCAAyC;AACzC,qCAA0C;AAC1C,uCAAgD;AAChD,uCAAkD;AAClD,yCAAoD;AACpD,yCAAoD;AA4CpD;;;;;;GAMG;AACH,MAAa,WAAW;IACL,KAAK,GAAG,IAAI,4BAAY,EAAE,CAAC;IAC3B,MAAM,CAAiB;IACvB,MAAM,CAAgB;IAEvC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,8DAA8D;QAC9D,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,sBAAY,EAAE,CAAC;YACrC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,IAAI,sBAAS,CACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,QAAQ,IAAI,SAAS,EAC5B,MAAM,CAAC,WAAW,IAAI,SAAS,CAChC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAc,CAAC;YAC/B,MAAM;YACN,UAAU;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAED,yFAAyF;IACzF,YAAY;QACV,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,+BAA+B;IAC/B,WAAW;QACT,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,wCAAwC;IACxC,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,wCAAwC;IACxC,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,0DAA0D;IAC1D,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,gCAAgC;IAChC,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,iCAAiC;IACjC,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,wCAAwC;IACxC,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,wDAAwD;IACxD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,aAAa,CAAC,MAAqB;QACzC,aAAa;QACb,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,yCAAyC,OAAO,2GAA2G,CAC5J,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAA,yBAAiB,EAAC;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAS;gBAC1B,IAAI,EAAE,MAAM,CAAC,IAAK;gBAClB,KAAK,EAAE,MAAM,CAAC,KAAM;gBACpB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,uBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAS,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;QAChF,CAAC;QAED,sBAAsB;QACtB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChF,OAAO,IAAI,yBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,yBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;CACF;AArID,kCAqIC;AAED,2FAA2F;AACpF,KAAK,UAAU,IAAI,CAAC,MAAqB;IAC9C,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAwPA,oBAIC;AA5PD,eAAe;AACf,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,2CAAyC;AAAhC,uGAAA,SAAS,OAAA;AAClB,qCAAyC;AAAhC,uGAAA,YAAY,OAAA;AACrB,mCAA0C;AAAjC,wGAAA,cAAc,OAAA;AAEvB,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAE1B,uEAAoE;AAA3D,kIAAA,sBAAsB,OAAA;AAE/B,YAAY;AACZ,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA;AAgBzB,uCAA8C;AAArC,wGAAA,cAAc,OAAA;AACvB,uCAA8C;AAArC,wGAAA,cAAc,OAAA;AACvB,6CAAoD;AAA3C,8GAAA,iBAAiB,OAAA;AAC1B,qCAAgD;AAAvC,0GAAA,iBAAiB,OAAA;AAI1B,6BAAuC;AAA9B,qGAAA,cAAc,OAAA;AACvB,6BAA0C;AAAjC,wGAAA,iBAAiB,OAAA;AAI1B,uCAAoD;AAA3C,0GAAA,kBAAkB,OAAA;AAC3B,uCAAoD;AAA3C,0GAAA,kBAAkB,OAAA;AAC3B,qCAAkD;AAAzC,wGAAA,iBAAiB,OAAA;AAE1B,yBAAyB;AACzB,yCAAmE;AAA1D,gHAAA,mBAAmB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAE7C,iBAAiB;AACjB,mDAA+C;AAC/C,6CAAyC;AACzC,uCAAyC;AACzC,qCAA0C;AAC1C,uCAAgD;AAChD,uCAAkD;AAClD,yCAAoD;AACpD,yCAAoD;AAkDpD;;;;;;GAMG;AACH,MAAa,WAAW;IACL,KAAK,GAAG,IAAI,4BAAY,EAAE,CAAC;IAC3B,MAAM,CAAiB;IACvB,MAAM,CAAgB;IAEvC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,8DAA8D;QAC9D,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,sBAAY,EAAE,CAAC;YACrC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,IAAI,sBAAS,CACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,QAAQ,IAAI,SAAS,EAC5B,MAAM,CAAC,WAAW,IAAI,SAAS,CAChC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAc,CAAC;YAC/B,MAAM;YACN,UAAU;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAED,yFAAyF;IACzF,YAAY;QACV,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,+BAA+B;IAC/B,WAAW;QACT,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,wCAAwC;IACxC,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,wCAAwC;IACxC,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,0DAA0D;IAC1D,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,gCAAgC;IAChC,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,iCAAiC;IACjC,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,wCAAwC;IACxC,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,wDAAwD;IACxD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,aAAa,CAAC,MAAqB;QACzC,aAAa;QACb,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,yCAAyC,OAAO,2GAA2G,CAC5J,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAA,yBAAiB,EAAC;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAS;gBAC1B,IAAI,EAAE,MAAM,CAAC,IAAK;gBAClB,KAAK,EAAE,MAAM,CAAC,KAAM;gBACpB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,uBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAS,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;QAChF,CAAC;QAED,sBAAsB;QACtB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChF,OAAO,IAAI,yBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,yBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;CACF;AAtID,kCAsIC;AAED,2FAA2F;AACpF,KAAK,UAAU,IAAI,CAAC,MAAqB;IAC9C,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/kms/aws.d.ts

@@ -11,5 +11,6 @@ export declare class AwsKmsProvider implements KmsProvider {
     private ensureClient;
     wrap(keyId: string, plaintext: Buffer): Promise<KmsWrapResult>;
     unwrap(keyId: string, wrappedKey: Buffer, algorithm: string): Promise<Buffer>;
+    sign(keyId: string, digest: Buffer): Promise<Buffer>;
 }
 //# sourceMappingURL=aws.d.ts.map

package/dist/kms/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/kms/aws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAErD;;;GAGG;AACH,qBAAa,cAAe,YAAW,WAAW;IAEhD,OAAO,CAAC,MAAM,CAAM;IAEpB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;gBAErB,MAAM,CAAC,EAAE,MAAM;YAIb,YAAY;IAYpB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAmB9D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAepF"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/kms/aws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAErD;;;GAGG;AACH,qBAAa,cAAe,YAAW,WAAW;IAEhD,OAAO,CAAC,MAAM,CAAM;IAEpB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;gBAErB,MAAM,CAAC,EAAE,MAAM;YAIb,YAAY;IAYpB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAmB9D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB7E,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAgB3D"}

package/dist/kms/aws.js

@@ -87,6 +87,20 @@ class AwsKmsProvider {
         }
         return Buffer.from(response.Plaintext);
     }
+    async sign(keyId, digest) {
+        await this.ensureClient();
+        const command = new this.sdk.SignCommand({
+            KeyId: keyId,
+            Message: digest,
+            MessageType: "DIGEST",
+            SigningAlgorithm: "ECDSA_SHA_256",
+        });
+        const response = await this.client.send(command);
+        if (!response.Signature) {
+            throw new Error("AWS KMS Sign returned no signature.");
+        }
+        return Buffer.from(response.Signature);
+    }
 }
 exports.AwsKmsProvider = AwsKmsProvider;
 //# sourceMappingURL=aws.js.map

package/dist/kms/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/kms/aws.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;;;GAGG;AACH,MAAa,cAAc;IACzB,wFAAwF;IAChF,MAAM,CAAM;IACpB,wFAAwF;IAChF,GAAG,CAAM;IACA,MAAM,CAAU;IAEjC,YAAY,MAAe;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,GAAG,wDAAa,qBAAqB,GAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,SAAiB;QACzC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,SAAS;YACpB,mBAAmB,EAAE,mBAAmB;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChD,SAAS,EAAE,mBAAmB;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,SAAiB;QAC/D,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,UAAU;YAC1B,mBAAmB,EAAE,SAAS;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AAzDD,wCAyDC"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/kms/aws.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;;;GAGG;AACH,MAAa,cAAc;IACzB,wFAAwF;IAChF,MAAM,CAAM;IACpB,wFAAwF;IAChF,GAAG,CAAM;IACA,MAAM,CAAU;IAEjC,YAAY,MAAe;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,GAAG,wDAAa,qBAAqB,GAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,SAAiB;QACzC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,SAAS;YACpB,mBAAmB,EAAE,mBAAmB;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChD,SAAS,EAAE,mBAAmB;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,SAAiB;QAC/D,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,UAAU;YAC1B,mBAAmB,EAAE,SAAS;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,MAAc;QACtC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,eAAe;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AA1ED,wCA0EC"}

package/dist/kms/types.d.ts

@@ -6,5 +6,7 @@ export interface KmsWrapResult {
 export interface KmsProvider {
     wrap(keyId: string, plaintext: Buffer): Promise<KmsWrapResult>;
     unwrap(keyId: string, wrappedKey: Buffer, algorithm: string): Promise<Buffer>;
+    /** Sign a SHA-256 digest with an asymmetric KMS key (ECDSA_SHA_256). Optional. */
+    sign?(keyId: string, digest: Buffer): Promise<Buffer>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/kms/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/kms/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/kms/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,kFAAkF;IAClF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD"}