@mesh-tech/mesh-cli 0.16.0 → 0.17.0

package/dist/src/utils/temporal-codec.js

@@ -1,319 +1,232 @@
-/**
- * Temporal payload decryption helpers for mesh CLI.
- *
- * Mirrors the AES-256-GCM codec in `@mesh-tech/app-kit/temporal-codec`. The CLI
- * can't depend on app-kit directly because app-kit depends on mesh-cli — so
- * the codec logic is intentionally duplicated here, kept small, and bounded
- * to read-only decryption (the CLI never encrypts).
- *
- * Wire format (matches app-kit EncryptionCodec):
- *   metadata["encoding"] = "binary/encrypted"
- *   metadata["encryption-key-id"] = first 16 hex chars of SHA-256(encodingKey)
- *   data = IV (12 bytes) || ciphertext || GCM auth tag (16 bytes)
- *
- * Decryption of `data` yields a serialized Temporal Payload protobuf, whose
- * inner `encoding` metadata tells you how to interpret the inner bytes
- * (`json/plain`, `binary/plain`, etc.). We hand-decode the Payload message
- * (a trivial 2-field protobuf) instead of depending on `@temporalio/proto`,
- * so the CLI stays dependency-clean and doesn't need a Temporal SDK peer.
- */
+// libs/mesh-cli/src/utils/temporal-codec.ts
 import { execFileSync } from "child_process";
 import { webcrypto as crypto } from "node:crypto";
-import { logSuccess, logWarn } from "./log.js";
-// ── Encoding key resolution ────────────────────────────────────────────────
-/**
- * Read the Temporal encoding key from a Kubernetes secret in the given
- * namespace. Returns `undefined` when kubectl is unavailable, the secret
- * doesn't exist, or the caller isn't authenticated to the cluster.
- *
- * The K8s secret is preferred over Pulumi stack output because personal dev
- * stacks ship a placeholder encoding key that cannot decrypt deployed
- * payloads; the K8s secret is always authoritative for a given namespace.
- *
- * @param namespace - Kubernetes namespace matching the Temporal namespace
- *                    (mesh apps use the same name for both).
- */
-export function resolveTemporalEncodingKeyFromK8s(namespace) {
-    const secretName = `${namespace}-temporal-encoding-key`;
-    try {
-        const b64 = execFileSync("kubectl", [
-            "get",
-            "secret",
-            secretName,
-            "-n",
-            namespace,
-            "-o",
-            "jsonpath={.data.TEMPORAL_ENCODING_KEY}",
-        ], { encoding: "utf-8", timeout: 10_000, stdio: ["pipe", "pipe", "pipe"] }).trim();
-        if (!b64)
-            return undefined;
-        return Buffer.from(b64, "base64").toString("utf-8");
-    }
-    catch {
-        // kubectl missing, secret absent, or no cluster access — caller decides.
-        return undefined;
-    }
+
+// libs/mesh-cli/src/utils/log.ts
+import chalk from "chalk";
+function logPrefix(opts) {
+  const enabled = opts.envFlag === "1" || opts.envFlag !== "0" && !opts.isTTY;
+  return enabled ? `[${opts.now.toISOString().slice(11, 19)}] ` : "";
+}
+function prefix() {
+  return chalk.dim(
+    logPrefix({
+      isTTY: !!process.stderr.isTTY,
+      envFlag: process.env.MESH_LOG_TIMESTAMPS,
+      now: /* @__PURE__ */ new Date()
+    })
+  );
+}
+function logSuccess(message) {
+  console.error(prefix() + chalk.green("\u2713"), message);
+}
+function logWarn(message) {
+  console.error(prefix() + chalk.yellow("\u26A0"), message);
+}
+
+// libs/mesh-cli/src/utils/temporal-codec.ts
+function resolveTemporalEncodingKeyFromK8s(namespace) {
+  const secretName = `${namespace}-temporal-encoding-key`;
+  try {
+    const b64 = execFileSync(
+      "kubectl",
+      [
+        "get",
+        "secret",
+        secretName,
+        "-n",
+        namespace,
+        "-o",
+        "jsonpath={.data.TEMPORAL_ENCODING_KEY}"
+      ],
+      { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+    if (!b64) return void 0;
+    return Buffer.from(b64, "base64").toString("utf-8");
+  } catch {
+    return void 0;
+  }
 }
-// ── AES-256-GCM decryption ─────────────────────────────────────────────────
-const ENCRYPTED_ENCODING = "binary/encrypted";
-const IV_LENGTH = 12;
+var ENCRYPTED_ENCODING = "binary/encrypted";
+var IV_LENGTH = 12;
 async function deriveKey(encodingKey) {
-    const keyData = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(encodingKey));
-    return crypto.subtle.importKey("raw", keyData, { name: "AES-GCM" }, false, ["decrypt"]);
+  const keyData = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(encodingKey)
+  );
+  return crypto.subtle.importKey(
+    "raw",
+    keyData,
+    { name: "AES-GCM" },
+    false,
+    ["decrypt"]
+  );
 }
 async function aesGcmDecrypt(data, key) {
-    const iv = data.slice(0, IV_LENGTH);
-    const ciphertextWithTag = data.slice(IV_LENGTH);
-    const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertextWithTag);
-    return new Uint8Array(decrypted);
+  const iv = data.slice(0, IV_LENGTH);
+  const ciphertextWithTag = data.slice(IV_LENGTH);
+  const decrypted = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv },
+    key,
+    ciphertextWithTag
+  );
+  return new Uint8Array(decrypted);
 }
-/**
- * Build a decrypter closure for the given encoding key.
- */
-export async function createPayloadDecrypter(encodingKey) {
-    const key = await deriveKey(encodingKey);
-    return async (payload) => {
-        if (!payload?.metadata)
-            return null;
-        const encodingBytes = payload.metadata["encoding"];
-        if (!encodingBytes)
-            return null;
-        const encoding = new TextDecoder().decode(encodingBytes);
-        if (encoding !== ENCRYPTED_ENCODING)
-            return null;
-        if (!payload.data)
-            return "[encrypted payload missing data]";
-        let inner;
-        try {
-            const decrypted = await aesGcmDecrypt(payload.data, key);
-            inner = decodePayloadProtobuf(decrypted);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            return `[undecryptable: ${msg}]`;
-        }
-        return decodeInnerPayload(inner);
-    };
+async function createPayloadDecrypter(encodingKey) {
+  const key = await deriveKey(encodingKey);
+  return async (payload) => {
+    if (!payload?.metadata) return null;
+    const encodingBytes = payload.metadata["encoding"];
+    if (!encodingBytes) return null;
+    const encoding = new TextDecoder().decode(encodingBytes);
+    if (encoding !== ENCRYPTED_ENCODING) return null;
+    if (!payload.data) return "[encrypted payload missing data]";
+    let inner;
+    try {
+      const decrypted = await aesGcmDecrypt(payload.data, key);
+      inner = decodePayloadProtobuf(decrypted);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return `[undecryptable: ${msg}]`;
+    }
+    return decodeInnerPayload(inner);
+  };
 }
-/**
- * Build a raw (Payload-in, Payload-out) decrypter for the given encoding key.
- *
- * This is the fixture-capture counterpart of {@link createPayloadDecrypter}:
- * where that one renders a payload for human display (lossy — binary payloads
- * become placeholders), this one returns the exact decrypted inner Payload so
- * the bytes can be re-serialized into a replayable proto3-JSON history.
- */
-export async function createRawPayloadDecrypter(encodingKey) {
-    const key = await deriveKey(encodingKey);
-    return async (payload) => {
-        if (!payload?.metadata)
-            return null;
-        const encodingBytes = payload.metadata["encoding"];
-        if (!encodingBytes)
-            return null;
-        const encoding = new TextDecoder().decode(encodingBytes);
-        if (encoding !== ENCRYPTED_ENCODING)
-            return null;
-        if (!payload.data) {
-            throw new Error("encrypted payload has no data to decrypt");
-        }
-        const decrypted = await aesGcmDecrypt(payload.data, key);
-        return decodePayloadProtobuf(decrypted);
-    };
+async function createRawPayloadDecrypter(encodingKey) {
+  const key = await deriveKey(encodingKey);
+  return async (payload) => {
+    if (!payload?.metadata) return null;
+    const encodingBytes = payload.metadata["encoding"];
+    if (!encodingBytes) return null;
+    const encoding = new TextDecoder().decode(encodingBytes);
+    if (encoding !== ENCRYPTED_ENCODING) return null;
+    if (!payload.data) {
+      throw new Error("encrypted payload has no data to decrypt");
+    }
+    const decrypted = await aesGcmDecrypt(payload.data, key);
+    return decodePayloadProtobuf(decrypted);
+  };
 }
-// ── Hand-rolled Payload protobuf decoder ──────────────────────────────────
-//
-// temporal.api.common.v1.Payload has exactly two fields:
-//   message Payload {
-//     map<string, bytes> metadata = 1;  // field 1, length-delimited
-//     bytes data = 2;                   // field 2, length-delimited
-//   }
-// A protobuf `map<K, V>` is syntactic sugar for:
-//   repeated MapEntry { K key = 1; V value = 2; }
-// so each metadata entry is itself a length-delimited submessage with two
-// inner length-delimited fields.
-//
-// Decoding this by hand avoids pulling in `@temporalio/proto` as a peer dep.
 function readVarint(buf, pos) {
-    let value = 0;
-    let shift = 0;
-    let next = pos;
-    while (next < buf.length) {
-        const byte = buf[next];
-        next += 1;
-        value |= (byte & 0x7f) << shift;
-        if ((byte & 0x80) === 0)
-            return { value, next };
-        shift += 7;
-        if (shift >= 32)
-            throw new Error("varint too large");
-    }
-    throw new Error("truncated varint");
+  let value = 0;
+  let shift = 0;
+  let next = pos;
+  while (next < buf.length) {
+    const byte = buf[next];
+    next += 1;
+    value |= (byte & 127) << shift;
+    if ((byte & 128) === 0) return { value, next };
+    shift += 7;
+    if (shift >= 32) throw new Error("varint too large");
+  }
+  throw new Error("truncated varint");
 }
 function readLengthDelimited(buf, pos) {
-    const { value: length, next: afterLen } = readVarint(buf, pos);
-    const end = afterLen + length;
-    if (end > buf.length)
-        throw new Error("truncated length-delimited field");
-    return { bytes: buf.slice(afterLen, end), next: end };
+  const { value: length, next: afterLen } = readVarint(buf, pos);
+  const end = afterLen + length;
+  if (end > buf.length) throw new Error("truncated length-delimited field");
+  return { bytes: buf.slice(afterLen, end), next: end };
 }
-/**
- * Decode a serialized `temporal.api.common.v1.Payload`.
- *
- * Unknown fields and wire types are skipped rather than throwing; we only
- * need the two documented fields and Temporal's wire format is stable.
- */
 function decodePayloadProtobuf(buf) {
-    const metadata = {};
-    let data;
-    let pos = 0;
-    while (pos < buf.length) {
-        const { value: tag, next: afterTag } = readVarint(buf, pos);
-        const fieldNumber = tag >>> 3;
-        const wireType = tag & 0x7;
-        pos = afterTag;
-        if (wireType === 2) {
-            const { bytes, next } = readLengthDelimited(buf, pos);
-            pos = next;
-            if (fieldNumber === 1) {
-                const entry = decodeMetadataEntry(bytes);
-                if (entry)
-                    metadata[entry.key] = entry.value;
-            }
-            else if (fieldNumber === 2) {
-                data = bytes;
-            }
-            // Other fields: ignore.
-        }
-        else if (wireType === 0) {
-            // varint — skip
-            pos = readVarint(buf, pos).next;
-        }
-        else if (wireType === 1) {
-            pos += 8; // fixed64
-        }
-        else if (wireType === 5) {
-            pos += 4; // fixed32
-        }
-        else {
-            throw new Error(`unsupported wire type ${wireType} at pos ${pos}`);
-        }
+  const metadata = {};
+  let data;
+  let pos = 0;
+  while (pos < buf.length) {
+    const { value: tag, next: afterTag } = readVarint(buf, pos);
+    const fieldNumber = tag >>> 3;
+    const wireType = tag & 7;
+    pos = afterTag;
+    if (wireType === 2) {
+      const { bytes, next } = readLengthDelimited(buf, pos);
+      pos = next;
+      if (fieldNumber === 1) {
+        const entry = decodeMetadataEntry(bytes);
+        if (entry) metadata[entry.key] = entry.value;
+      } else if (fieldNumber === 2) {
+        data = bytes;
+      }
+    } else if (wireType === 0) {
+      pos = readVarint(buf, pos).next;
+    } else if (wireType === 1) {
+      pos += 8;
+    } else if (wireType === 5) {
+      pos += 4;
+    } else {
+      throw new Error(`unsupported wire type ${wireType} at pos ${pos}`);
     }
-    return { metadata, data: data ?? new Uint8Array(0) };
+  }
+  return { metadata, data: data ?? new Uint8Array(0) };
 }
 function decodeMetadataEntry(buf) {
-    let key;
-    let value;
-    let pos = 0;
-    while (pos < buf.length) {
-        const { value: tag, next: afterTag } = readVarint(buf, pos);
-        const fieldNumber = tag >>> 3;
-        const wireType = tag & 0x7;
-        pos = afterTag;
-        if (wireType !== 2) {
-            // Skip unsupported fields defensively.
-            if (wireType === 0)
-                pos = readVarint(buf, pos).next;
-            else if (wireType === 1)
-                pos += 8;
-            else if (wireType === 5)
-                pos += 4;
-            else
-                throw new Error(`unsupported metadata wire type ${wireType}`);
-            continue;
-        }
-        const { bytes, next } = readLengthDelimited(buf, pos);
-        pos = next;
-        if (fieldNumber === 1)
-            key = new TextDecoder().decode(bytes);
-        else if (fieldNumber === 2)
-            value = bytes;
+  let key;
+  let value;
+  let pos = 0;
+  while (pos < buf.length) {
+    const { value: tag, next: afterTag } = readVarint(buf, pos);
+    const fieldNumber = tag >>> 3;
+    const wireType = tag & 7;
+    pos = afterTag;
+    if (wireType !== 2) {
+      if (wireType === 0) pos = readVarint(buf, pos).next;
+      else if (wireType === 1) pos += 8;
+      else if (wireType === 5) pos += 4;
+      else throw new Error(`unsupported metadata wire type ${wireType}`);
+      continue;
     }
-    if (key === undefined || value === undefined)
-        return null;
-    return { key, value };
+    const { bytes, next } = readLengthDelimited(buf, pos);
+    pos = next;
+    if (fieldNumber === 1) key = new TextDecoder().decode(bytes);
+    else if (fieldNumber === 2) value = bytes;
+  }
+  if (key === void 0 || value === void 0) return null;
+  return { key, value };
 }
-/**
- * Render a decrypted inner Payload as a human-readable string.
- *
- * Handles the common encodings Mesh workers emit:
- *   - `json/plain` → pretty-printed JSON
- *   - `binary/null` → literal `null`
- *   - `binary/plain` → `[binary N bytes]`
- *   - anything else → `[encoding=X, N bytes]`
- */
 function decodeInnerPayload(payload) {
-    const meta = payload.metadata ?? {};
-    const encodingBytes = meta["encoding"];
-    const encoding = encodingBytes
-        ? new TextDecoder().decode(encodingBytes)
-        : "unknown";
-    const data = payload.data ?? new Uint8Array(0);
-    if (encoding === "binary/null")
-        return "null";
-    if (encoding === "json/plain") {
-        const text = new TextDecoder().decode(data);
-        try {
-            return JSON.stringify(JSON.parse(text), null, 2);
-        }
-        catch {
-            // Not valid JSON despite the encoding claim — surface the raw text so
-            // the debugger sees whatever garbage the worker actually wrote.
-            return text;
-        }
+  const meta = payload.metadata ?? {};
+  const encodingBytes = meta["encoding"];
+  const encoding = encodingBytes ? new TextDecoder().decode(encodingBytes) : "unknown";
+  const data = payload.data ?? new Uint8Array(0);
+  if (encoding === "binary/null") return "null";
+  if (encoding === "json/plain") {
+    const text = new TextDecoder().decode(data);
+    try {
+      return JSON.stringify(JSON.parse(text), null, 2);
+    } catch {
+      return text;
     }
-    if (encoding === "binary/plain")
-        return `[binary, ${data.length} bytes]`;
-    return `[encoding=${encoding}, ${data.length} bytes]`;
+  }
+  if (encoding === "binary/plain") return `[binary, ${data.length} bytes]`;
+  return `[encoding=${encoding}, ${data.length} bytes]`;
 }
-// ── High-level helper ──────────────────────────────────────────────────────
-/**
- * Resolve the Temporal encoding key for a namespace, logging where it came
- * from (or why it couldn't be found). Prefer the K8s secret (authoritative for
- * the namespace); fall back to an explicit TEMPORAL_ENCODING_KEY env var. The
- * env fallback lets you decrypt a workflow's history OFFLINE — e.g. to
- * reconstruct a conversation, or capture a replay fixture, whose worker can no
- * longer replay it — using the key from a running `mesh dev` worker env when
- * kubectl/cluster access isn't set up.
- *
- * Returns `undefined` when neither source yields a key.
- */
-export function resolveEncodingKey(namespace) {
-    const fromK8s = resolveTemporalEncodingKeyFromK8s(namespace);
-    const key = fromK8s ?? process.env.TEMPORAL_ENCODING_KEY;
-    if (!key) {
-        logWarn(`Could not read TEMPORAL_ENCODING_KEY from secret ` +
-            `${namespace}/${namespace}-temporal-encoding-key, and TEMPORAL_ENCODING_KEY ` +
-            "is not set. Configure kubectl (namespace read " +
-            "access), or export TEMPORAL_ENCODING_KEY (e.g. from a `mesh dev` worker env).");
-        return undefined;
-    }
-    logSuccess(fromK8s
-        ? `Resolved encoding key from ${namespace}-temporal-encoding-key`
-        : "Resolved encoding key from TEMPORAL_ENCODING_KEY env");
-    return key;
+function resolveEncodingKey(namespace) {
+  const fromK8s = resolveTemporalEncodingKeyFromK8s(namespace);
+  const key = fromK8s ?? process.env.TEMPORAL_ENCODING_KEY;
+  if (!key) {
+    logWarn(
+      `Could not read TEMPORAL_ENCODING_KEY from secret ${namespace}/${namespace}-temporal-encoding-key, and TEMPORAL_ENCODING_KEY is not set. Configure kubectl (namespace read access), or export TEMPORAL_ENCODING_KEY (e.g. from a \`mesh dev\` worker env).`
+    );
+    return void 0;
+  }
+  logSuccess(
+    fromK8s ? `Resolved encoding key from ${namespace}-temporal-encoding-key` : "Resolved encoding key from TEMPORAL_ENCODING_KEY env"
+  );
+  return key;
 }
-/**
- * Resolve the encoding key and build a decrypter for the given namespace.
- * Logs a warning and returns `undefined` when the key can't be read; callers
- * should fall back to printing events without payloads.
- */
-export async function buildDecrypterForNamespace(namespace) {
-    const key = resolveEncodingKey(namespace);
-    if (!key)
-        return undefined;
-    return createPayloadDecrypter(key);
+async function buildDecrypterForNamespace(namespace) {
+  const key = resolveEncodingKey(namespace);
+  if (!key) return void 0;
+  return createPayloadDecrypter(key);
 }
-/**
- * Resolve the encoding key and build a RAW (Payload-in/Payload-out) decrypter
- * for the given namespace — used by `capture-history` to decrypt payloads back
- * into replayable proto bytes. Returns `undefined` when the key can't be read;
- * callers decide whether that's fatal.
- */
-export async function buildRawDecrypterForNamespace(namespace) {
-    const key = resolveEncodingKey(namespace);
-    if (!key)
-        return undefined;
-    return createRawPayloadDecrypter(key);
+async function buildRawDecrypterForNamespace(namespace) {
+  const key = resolveEncodingKey(namespace);
+  if (!key) return void 0;
+  return createRawPayloadDecrypter(key);
 }
-//# sourceMappingURL=temporal-codec.js.map
+export {
+  buildDecrypterForNamespace,
+  buildRawDecrypterForNamespace,
+  createPayloadDecrypter,
+  createRawPayloadDecrypter,
+  resolveEncodingKey,
+  resolveTemporalEncodingKeyFromK8s
+};

package/dist/src/utils/temporal-codec.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"temporal-codec.js","sourceRoot":"","sources":["../../../src/utils/temporal-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAE/C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAAiB;IAEjB,MAAM,UAAU,GAAG,GAAG,SAAS,wBAAwB,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,SAAS,EACT;YACE,KAAK;YACL,QAAQ;YACR,UAAU;YACV,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,wCAAwC;SACzC,EACD,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACxE,CAAC,IAAI,EAAE,CAAC;QAET,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,KAAK,UAAU,SAAS,CAAC,WAAmB;IAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CACtC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAgB,EAChB,GAAqB;IAErB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,iBAAiB,CAClB,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AA4BD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;IAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC,OAAO,EAAE,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAEjD,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,kCAAkC,CAAC;QAE7D,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzD,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,mBAAmB,GAAG,GAAG,CAAC;QACnC,CAAC;QAED,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;IAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC,OAAO,EAAE,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAEjD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,EAAE;AACF,yDAAyD;AACzD,sBAAsB;AACtB,qEAAqE;AACrE,qEAAqE;AACrE,MAAM;AACN,iDAAiD;AACjD,kDAAkD;AAClD,0EAA0E;AAC1E,iCAAiC;AACjC,EAAE;AACF,6EAA6E;AAE7E,SAAS,UAAU,CAAC,GAAe,EAAE,GAAW;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,OAAO,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAE,CAAC;QACxB,IAAI,IAAI,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAChD,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,KAAK,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAe,EACf,GAAW;IAEX,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAe;IAC5C,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,IAAI,IAA4B,CAAC;IACjC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC;QAC3B,GAAG,GAAG,QAAQ,CAAC;QAEf,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtD,GAAG,GAAG,IAAI,CAAC;YACX,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,KAAK;oBAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC/C,CAAC;iBAAM,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBAC7B,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;YACD,wBAAwB;QAC1B,CAAC;aAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,gBAAgB;YAChB,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;QAClC,CAAC;aAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU;QACtB,CAAC;aAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAe;IAEf,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAA6B,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC;QAC3B,GAAG,GAAG,QAAQ,CAAC;QACf,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,uCAAuC;YACvC,IAAI,QAAQ,KAAK,CAAC;gBAAE,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;iBAC/C,IAAI,QAAQ,KAAK,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAC;iBAC7B,IAAI,QAAQ,KAAK,CAAC;gBAAE,GAAG,IAAI,CAAC,CAAC;;gBAC7B,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,GAAG,GAAG,IAAI,CAAC;QACX,IAAI,WAAW,KAAK,CAAC;YAAE,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACxD,IAAI,WAAW,KAAK,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAE/C,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,gEAAgE;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,cAAc;QAAE,OAAO,YAAY,IAAI,CAAC,MAAM,SAAS,CAAC;IACzE,OAAO,aAAa,QAAQ,KAAK,IAAI,CAAC,MAAM,SAAS,CAAC;AACxD,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CACL,mDAAmD;YACjD,GAAG,SAAS,IAAI,SAAS,oDAAoD;YAC7E,gDAAgD;YAChD,+EAA+E,CAClF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,UAAU,CACR,OAAO;QACL,CAAC,CAAC,8BAA8B,SAAS,wBAAwB;QACjE,CAAC,CAAC,sDAAsD,CAC3D,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAiB;IAEjB,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB;IAEjB,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC"}
+{
+  "version": 3,
+  "sources": ["../../../src/utils/temporal-codec.ts", "../../../src/utils/log.ts"],
+  "sourcesContent": ["/**\n * Temporal payload decryption helpers for mesh CLI.\n *\n * Mirrors the AES-256-GCM codec in `@mesh-tech/app-kit/temporal-codec`. The CLI\n * can't depend on app-kit directly because app-kit depends on mesh-cli \u2014 so\n * the codec logic is intentionally duplicated here, kept small, and bounded\n * to read-only decryption (the CLI never encrypts).\n *\n * Wire format (matches app-kit EncryptionCodec):\n *   metadata[\"encoding\"] = \"binary/encrypted\"\n *   metadata[\"encryption-key-id\"] = first 16 hex chars of SHA-256(encodingKey)\n *   data = IV (12 bytes) || ciphertext || GCM auth tag (16 bytes)\n *\n * Decryption of `data` yields a serialized Temporal Payload protobuf, whose\n * inner `encoding` metadata tells you how to interpret the inner bytes\n * (`json/plain`, `binary/plain`, etc.). We hand-decode the Payload message\n * (a trivial 2-field protobuf) instead of depending on `@temporalio/proto`,\n * so the CLI stays dependency-clean and doesn't need a Temporal SDK peer.\n */\n\nimport { execFileSync } from \"child_process\";\nimport { webcrypto as crypto } from \"node:crypto\";\nimport { logSuccess, logWarn } from \"./log.js\";\n\n// \u2500\u2500 Encoding key resolution \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Read the Temporal encoding key from a Kubernetes secret in the given\n * namespace. Returns `undefined` when kubectl is unavailable, the secret\n * doesn't exist, or the caller isn't authenticated to the cluster.\n *\n * The K8s secret is preferred over Pulumi stack output because personal dev\n * stacks ship a placeholder encoding key that cannot decrypt deployed\n * payloads; the K8s secret is always authoritative for a given namespace.\n *\n * @param namespace - Kubernetes namespace matching the Temporal namespace\n *                    (mesh apps use the same name for both).\n */\nexport function resolveTemporalEncodingKeyFromK8s(\n  namespace: string,\n): string | undefined {\n  const secretName = `${namespace}-temporal-encoding-key`;\n  try {\n    const b64 = execFileSync(\n      \"kubectl\",\n      [\n        \"get\",\n        \"secret\",\n        secretName,\n        \"-n\",\n        namespace,\n        \"-o\",\n        \"jsonpath={.data.TEMPORAL_ENCODING_KEY}\",\n      ],\n      { encoding: \"utf-8\", timeout: 10_000, stdio: [\"pipe\", \"pipe\", \"pipe\"] },\n    ).trim();\n\n    if (!b64) return undefined;\n    return Buffer.from(b64, \"base64\").toString(\"utf-8\");\n  } catch {\n    // kubectl missing, secret absent, or no cluster access \u2014 caller decides.\n    return undefined;\n  }\n}\n\n// \u2500\u2500 AES-256-GCM decryption \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ENCRYPTED_ENCODING = \"binary/encrypted\";\nconst IV_LENGTH = 12;\n\nasync function deriveKey(encodingKey: string): Promise<crypto.CryptoKey> {\n  const keyData = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(encodingKey),\n  );\n  return crypto.subtle.importKey(\n    \"raw\",\n    keyData,\n    { name: \"AES-GCM\" },\n    false,\n    [\"decrypt\"],\n  );\n}\n\nasync function aesGcmDecrypt(\n  data: Uint8Array,\n  key: crypto.CryptoKey,\n): Promise<Uint8Array> {\n  const iv = data.slice(0, IV_LENGTH);\n  const ciphertextWithTag = data.slice(IV_LENGTH);\n  const decrypted = await crypto.subtle.decrypt(\n    { name: \"AES-GCM\", iv },\n    key,\n    ciphertextWithTag,\n  );\n  return new Uint8Array(decrypted);\n}\n\n// \u2500\u2500 Payload decoder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Minimal shape of a Temporal Payload we care about.\n * Matches `temporal.api.common.v1.Payload` from @temporalio/proto but avoids\n * importing the type at module load time (so the CLI still loads without the\n * Temporal SDK installed).\n */\nexport interface RawPayload {\n  metadata?: Record<string, Uint8Array | null | undefined> | null;\n  data?: Uint8Array | null;\n}\n\n/**\n * A decrypter closure bound to a specific encoding key. Returns a decoded\n * human-readable string for a single encrypted Payload, or `null` when the\n * payload wasn't encrypted and the caller should fall back to raw decoding.\n *\n * Error paths (`[undecryptable]`, `[decode error: ...]`) are returned as\n * strings rather than thrown \u2014 debugging a history is a best-effort read-only\n * operation and one bad payload shouldn't abort the whole dump.\n */\nexport type PayloadDecrypter = (\n  payload: RawPayload | null | undefined,\n) => Promise<string | null>;\n\n/**\n * Build a decrypter closure for the given encoding key.\n */\nexport async function createPayloadDecrypter(\n  encodingKey: string,\n): Promise<PayloadDecrypter> {\n  const key = await deriveKey(encodingKey);\n\n  return async (payload) => {\n    if (!payload?.metadata) return null;\n\n    const encodingBytes = payload.metadata[\"encoding\"];\n    if (!encodingBytes) return null;\n    const encoding = new TextDecoder().decode(encodingBytes);\n    if (encoding !== ENCRYPTED_ENCODING) return null;\n\n    if (!payload.data) return \"[encrypted payload missing data]\";\n\n    let inner: RawPayload;\n    try {\n      const decrypted = await aesGcmDecrypt(payload.data, key);\n      inner = decodePayloadProtobuf(decrypted);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      return `[undecryptable: ${msg}]`;\n    }\n\n    return decodeInnerPayload(inner);\n  };\n}\n\n/**\n * A closure that decrypts a single encrypted Temporal Payload to its INNER\n * (plaintext) Payload \u2014 the `{ metadata, data }` the worker's codec wrapped \u2014\n * rather than the human-readable string {@link PayloadDecrypter} produces.\n *\n * Returns `null` when the payload isn't encrypted (the caller leaves it as-is).\n * Unlike the display decrypter, decryption errors THROW here: a fixture with a\n * silently-mangled payload would replay wrong, so the caller must surface it.\n */\nexport type RawPayloadDecrypter = (\n  payload: RawPayload | null | undefined,\n) => Promise<RawPayload | null>;\n\n/**\n * Build a raw (Payload-in, Payload-out) decrypter for the given encoding key.\n *\n * This is the fixture-capture counterpart of {@link createPayloadDecrypter}:\n * where that one renders a payload for human display (lossy \u2014 binary payloads\n * become placeholders), this one returns the exact decrypted inner Payload so\n * the bytes can be re-serialized into a replayable proto3-JSON history.\n */\nexport async function createRawPayloadDecrypter(\n  encodingKey: string,\n): Promise<RawPayloadDecrypter> {\n  const key = await deriveKey(encodingKey);\n\n  return async (payload) => {\n    if (!payload?.metadata) return null;\n\n    const encodingBytes = payload.metadata[\"encoding\"];\n    if (!encodingBytes) return null;\n    const encoding = new TextDecoder().decode(encodingBytes);\n    if (encoding !== ENCRYPTED_ENCODING) return null;\n\n    if (!payload.data) {\n      throw new Error(\"encrypted payload has no data to decrypt\");\n    }\n\n    const decrypted = await aesGcmDecrypt(payload.data, key);\n    return decodePayloadProtobuf(decrypted);\n  };\n}\n\n// \u2500\u2500 Hand-rolled Payload protobuf decoder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// temporal.api.common.v1.Payload has exactly two fields:\n//   message Payload {\n//     map<string, bytes> metadata = 1;  // field 1, length-delimited\n//     bytes data = 2;                   // field 2, length-delimited\n//   }\n// A protobuf `map<K, V>` is syntactic sugar for:\n//   repeated MapEntry { K key = 1; V value = 2; }\n// so each metadata entry is itself a length-delimited submessage with two\n// inner length-delimited fields.\n//\n// Decoding this by hand avoids pulling in `@temporalio/proto` as a peer dep.\n\nfunction readVarint(buf: Uint8Array, pos: number): { value: number; next: number } {\n  let value = 0;\n  let shift = 0;\n  let next = pos;\n  while (next < buf.length) {\n    const byte = buf[next]!;\n    next += 1;\n    value |= (byte & 0x7f) << shift;\n    if ((byte & 0x80) === 0) return { value, next };\n    shift += 7;\n    if (shift >= 32) throw new Error(\"varint too large\");\n  }\n  throw new Error(\"truncated varint\");\n}\n\nfunction readLengthDelimited(\n  buf: Uint8Array,\n  pos: number,\n): { bytes: Uint8Array; next: number } {\n  const { value: length, next: afterLen } = readVarint(buf, pos);\n  const end = afterLen + length;\n  if (end > buf.length) throw new Error(\"truncated length-delimited field\");\n  return { bytes: buf.slice(afterLen, end), next: end };\n}\n\n/**\n * Decode a serialized `temporal.api.common.v1.Payload`.\n *\n * Unknown fields and wire types are skipped rather than throwing; we only\n * need the two documented fields and Temporal's wire format is stable.\n */\nfunction decodePayloadProtobuf(buf: Uint8Array): RawPayload {\n  const metadata: Record<string, Uint8Array> = {};\n  let data: Uint8Array | undefined;\n  let pos = 0;\n\n  while (pos < buf.length) {\n    const { value: tag, next: afterTag } = readVarint(buf, pos);\n    const fieldNumber = tag >>> 3;\n    const wireType = tag & 0x7;\n    pos = afterTag;\n\n    if (wireType === 2) {\n      const { bytes, next } = readLengthDelimited(buf, pos);\n      pos = next;\n      if (fieldNumber === 1) {\n        const entry = decodeMetadataEntry(bytes);\n        if (entry) metadata[entry.key] = entry.value;\n      } else if (fieldNumber === 2) {\n        data = bytes;\n      }\n      // Other fields: ignore.\n    } else if (wireType === 0) {\n      // varint \u2014 skip\n      pos = readVarint(buf, pos).next;\n    } else if (wireType === 1) {\n      pos += 8; // fixed64\n    } else if (wireType === 5) {\n      pos += 4; // fixed32\n    } else {\n      throw new Error(`unsupported wire type ${wireType} at pos ${pos}`);\n    }\n  }\n\n  return { metadata, data: data ?? new Uint8Array(0) };\n}\n\nfunction decodeMetadataEntry(\n  buf: Uint8Array,\n): { key: string; value: Uint8Array } | null {\n  let key: string | undefined;\n  let value: Uint8Array | undefined;\n  let pos = 0;\n\n  while (pos < buf.length) {\n    const { value: tag, next: afterTag } = readVarint(buf, pos);\n    const fieldNumber = tag >>> 3;\n    const wireType = tag & 0x7;\n    pos = afterTag;\n    if (wireType !== 2) {\n      // Skip unsupported fields defensively.\n      if (wireType === 0) pos = readVarint(buf, pos).next;\n      else if (wireType === 1) pos += 8;\n      else if (wireType === 5) pos += 4;\n      else throw new Error(`unsupported metadata wire type ${wireType}`);\n      continue;\n    }\n    const { bytes, next } = readLengthDelimited(buf, pos);\n    pos = next;\n    if (fieldNumber === 1) key = new TextDecoder().decode(bytes);\n    else if (fieldNumber === 2) value = bytes;\n  }\n\n  if (key === undefined || value === undefined) return null;\n  return { key, value };\n}\n\n/**\n * Render a decrypted inner Payload as a human-readable string.\n *\n * Handles the common encodings Mesh workers emit:\n *   - `json/plain` \u2192 pretty-printed JSON\n *   - `binary/null` \u2192 literal `null`\n *   - `binary/plain` \u2192 `[binary N bytes]`\n *   - anything else \u2192 `[encoding=X, N bytes]`\n */\nfunction decodeInnerPayload(payload: RawPayload): string {\n  const meta = payload.metadata ?? {};\n  const encodingBytes = meta[\"encoding\"];\n  const encoding = encodingBytes\n    ? new TextDecoder().decode(encodingBytes)\n    : \"unknown\";\n  const data = payload.data ?? new Uint8Array(0);\n\n  if (encoding === \"binary/null\") return \"null\";\n  if (encoding === \"json/plain\") {\n    const text = new TextDecoder().decode(data);\n    try {\n      return JSON.stringify(JSON.parse(text), null, 2);\n    } catch {\n      // Not valid JSON despite the encoding claim \u2014 surface the raw text so\n      // the debugger sees whatever garbage the worker actually wrote.\n      return text;\n    }\n  }\n  if (encoding === \"binary/plain\") return `[binary, ${data.length} bytes]`;\n  return `[encoding=${encoding}, ${data.length} bytes]`;\n}\n\n// \u2500\u2500 High-level helper \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Resolve the Temporal encoding key for a namespace, logging where it came\n * from (or why it couldn't be found). Prefer the K8s secret (authoritative for\n * the namespace); fall back to an explicit TEMPORAL_ENCODING_KEY env var. The\n * env fallback lets you decrypt a workflow's history OFFLINE \u2014 e.g. to\n * reconstruct a conversation, or capture a replay fixture, whose worker can no\n * longer replay it \u2014 using the key from a running `mesh dev` worker env when\n * kubectl/cluster access isn't set up.\n *\n * Returns `undefined` when neither source yields a key.\n */\nexport function resolveEncodingKey(namespace: string): string | undefined {\n  const fromK8s = resolveTemporalEncodingKeyFromK8s(namespace);\n  const key = fromK8s ?? process.env.TEMPORAL_ENCODING_KEY;\n  if (!key) {\n    logWarn(\n      `Could not read TEMPORAL_ENCODING_KEY from secret ` +\n        `${namespace}/${namespace}-temporal-encoding-key, and TEMPORAL_ENCODING_KEY ` +\n        \"is not set. Configure kubectl (namespace read \" +\n        \"access), or export TEMPORAL_ENCODING_KEY (e.g. from a `mesh dev` worker env).\",\n    );\n    return undefined;\n  }\n  logSuccess(\n    fromK8s\n      ? `Resolved encoding key from ${namespace}-temporal-encoding-key`\n      : \"Resolved encoding key from TEMPORAL_ENCODING_KEY env\",\n  );\n  return key;\n}\n\n/**\n * Resolve the encoding key and build a decrypter for the given namespace.\n * Logs a warning and returns `undefined` when the key can't be read; callers\n * should fall back to printing events without payloads.\n */\nexport async function buildDecrypterForNamespace(\n  namespace: string,\n): Promise<PayloadDecrypter | undefined> {\n  const key = resolveEncodingKey(namespace);\n  if (!key) return undefined;\n  return createPayloadDecrypter(key);\n}\n\n/**\n * Resolve the encoding key and build a RAW (Payload-in/Payload-out) decrypter\n * for the given namespace \u2014 used by `capture-history` to decrypt payloads back\n * into replayable proto bytes. Returns `undefined` when the key can't be read;\n * callers decide whether that's fatal.\n */\nexport async function buildRawDecrypterForNamespace(\n  namespace: string,\n): Promise<RawPayloadDecrypter | undefined> {\n  const key = resolveEncodingKey(namespace);\n  if (!key) return undefined;\n  return createRawPayloadDecrypter(key);\n}\n", "/**\n * Logging utilities with colored output.\n *\n * Non-TTY streams (CI, agent runs, piped output) get an [HH:MM:SS] prefix on\n * every line so long quiet stretches are attributable after the fact\n * (MESH-2479); interactive terminals stay clean. Override with\n * MESH_LOG_TIMESTAMPS=1 (force on) / =0 (force off).\n */\n\nimport chalk from \"chalk\";\n\n/**\n * Pure prefix decision, exported for tests: timestamps when the env flag says\n * so, else whenever stderr is not a TTY.\n */\nexport function logPrefix(opts: {\n  isTTY: boolean;\n  envFlag: string | undefined;\n  now: Date;\n}): string {\n  const enabled = opts.envFlag === \"1\" || (opts.envFlag !== \"0\" && !opts.isTTY);\n  return enabled ? `[${opts.now.toISOString().slice(11, 19)}] ` : \"\";\n}\n\nfunction prefix(): string {\n  return chalk.dim(\n    logPrefix({\n      isTTY: !!process.stderr.isTTY,\n      envFlag: process.env.MESH_LOG_TIMESTAMPS,\n      now: new Date(),\n    }),\n  );\n}\n\nexport function logInfo(message: string): void {\n  console.error(prefix() + chalk.blue(\"\u2139\"), message);\n}\n\nexport function logSuccess(message: string): void {\n  console.error(prefix() + chalk.green(\"\u2713\"), message);\n}\n\nexport function logWarn(message: string): void {\n  console.error(prefix() + chalk.yellow(\"\u26A0\"), message);\n}\n\nexport function logError(message: string): void {\n  console.error(prefix() + chalk.red(\"\u2717\"), message);\n}\n\n/** Render elapsed milliseconds compactly: \"45s\", \"2m 30s\", \"1h 5m\". */\nexport function formatElapsed(ms: number): string {\n  const totalSec = Math.max(0, Math.round(ms / 1000));\n  const h = Math.floor(totalSec / 3600);\n  const m = Math.floor((totalSec % 3600) / 60);\n  const s = totalSec % 60;\n  if (h > 0) return `${h}h ${m}m`;\n  if (m > 0) return `${m}m ${s}s`;\n  return `${s}s`;\n}\n\n/**\n * Periodic \"still working\" line during a long silent operation (registry\n * fetches, image builds) so a non-TTY first run never sits at 0 bytes of\n * output for minutes (MESH-2479). `touch()` marks recent real output, which\n * suppresses the next beat \u2014 the heartbeat only fills silence.\n */\nexport function startHeartbeat(\n  label: string,\n  intervalMs = 15_000,\n): { stop: () => void; touch: () => void } {\n  const startedAt = Date.now();\n  let lastOutputAt = startedAt;\n  const timer = setInterval(() => {\n    if (Date.now() - lastOutputAt < intervalMs) return;\n    logInfo(`\u2026 still working: ${label} (${formatElapsed(Date.now() - startedAt)} elapsed)`);\n  }, intervalMs);\n  timer.unref?.();\n  return {\n    stop: () => clearInterval(timer),\n    touch: () => {\n      lastOutputAt = Date.now();\n    },\n  };\n}\n"],
+  "mappings": ";AAoBA,SAAS,oBAAoB;AAC7B,SAAS,aAAa,cAAc;;;ACZpC,OAAO,WAAW;AAMX,SAAS,UAAU,MAIf;AACT,QAAM,UAAU,KAAK,YAAY,OAAQ,KAAK,YAAY,OAAO,CAAC,KAAK;AACvE,SAAO,UAAU,IAAI,KAAK,IAAI,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,OAAO;AAClE;AAEA,SAAS,SAAiB;AACxB,SAAO,MAAM;AAAA,IACX,UAAU;AAAA,MACR,OAAO,CAAC,CAAC,QAAQ,OAAO;AAAA,MACxB,SAAS,QAAQ,IAAI;AAAA,MACrB,KAAK,oBAAI,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AACF;AAMO,SAAS,WAAW,SAAuB;AAChD,UAAQ,MAAM,OAAO,IAAI,MAAM,MAAM,QAAG,GAAG,OAAO;AACpD;AAEO,SAAS,QAAQ,SAAuB;AAC7C,UAAQ,MAAM,OAAO,IAAI,MAAM,OAAO,QAAG,GAAG,OAAO;AACrD;;;ADNO,SAAS,kCACd,WACoB;AACpB,QAAM,aAAa,GAAG,SAAS;AAC/B,MAAI;AACF,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,EAAE,UAAU,SAAS,SAAS,KAAQ,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE;AAAA,IACxE,EAAE,KAAK;AAEP,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,OAAO,KAAK,KAAK,QAAQ,EAAE,SAAS,OAAO;AAAA,EACpD,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAIA,IAAM,qBAAqB;AAC3B,IAAM,YAAY;AAElB,eAAe,UAAU,aAAgD;AACvE,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,WAAW;AAAA,EACtC;AACA,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,UAAU;AAAA,IAClB;AAAA,IACA,CAAC,SAAS;AAAA,EACZ;AACF;AAEA,eAAe,cACb,MACA,KACqB;AACrB,QAAM,KAAK,KAAK,MAAM,GAAG,SAAS;AAClC,QAAM,oBAAoB,KAAK,MAAM,SAAS;AAC9C,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,GAAG;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,SAAO,IAAI,WAAW,SAAS;AACjC;AA+BA,eAAsB,uBACpB,aAC2B;AAC3B,QAAM,MAAM,MAAM,UAAU,WAAW;AAEvC,SAAO,OAAO,YAAY;AACxB,QAAI,CAAC,SAAS,SAAU,QAAO;AAE/B,UAAM,gBAAgB,QAAQ,SAAS,UAAU;AACjD,QAAI,CAAC,cAAe,QAAO;AAC3B,UAAM,WAAW,IAAI,YAAY,EAAE,OAAO,aAAa;AACvD,QAAI,aAAa,mBAAoB,QAAO;AAE5C,QAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,cAAc,QAAQ,MAAM,GAAG;AACvD,cAAQ,sBAAsB,SAAS;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,aAAO,mBAAmB,GAAG;AAAA,IAC/B;AAEA,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAuBA,eAAsB,0BACpB,aAC8B;AAC9B,QAAM,MAAM,MAAM,UAAU,WAAW;AAEvC,SAAO,OAAO,YAAY;AACxB,QAAI,CAAC,SAAS,SAAU,QAAO;AAE/B,UAAM,gBAAgB,QAAQ,SAAS,UAAU;AACjD,QAAI,CAAC,cAAe,QAAO;AAC3B,UAAM,WAAW,IAAI,YAAY,EAAE,OAAO,aAAa;AACvD,QAAI,aAAa,mBAAoB,QAAO;AAE5C,QAAI,CAAC,QAAQ,MAAM;AACjB,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,UAAM,YAAY,MAAM,cAAc,QAAQ,MAAM,GAAG;AACvD,WAAO,sBAAsB,SAAS;AAAA,EACxC;AACF;AAgBA,SAAS,WAAW,KAAiB,KAA8C;AACjF,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,OAAO;AACX,SAAO,OAAO,IAAI,QAAQ;AACxB,UAAM,OAAO,IAAI,IAAI;AACrB,YAAQ;AACR,cAAU,OAAO,QAAS;AAC1B,SAAK,OAAO,SAAU,EAAG,QAAO,EAAE,OAAO,KAAK;AAC9C,aAAS;AACT,QAAI,SAAS,GAAI,OAAM,IAAI,MAAM,kBAAkB;AAAA,EACrD;AACA,QAAM,IAAI,MAAM,kBAAkB;AACpC;AAEA,SAAS,oBACP,KACA,KACqC;AACrC,QAAM,EAAE,OAAO,QAAQ,MAAM,SAAS,IAAI,WAAW,KAAK,GAAG;AAC7D,QAAM,MAAM,WAAW;AACvB,MAAI,MAAM,IAAI,OAAQ,OAAM,IAAI,MAAM,kCAAkC;AACxE,SAAO,EAAE,OAAO,IAAI,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI;AACtD;AAQA,SAAS,sBAAsB,KAA6B;AAC1D,QAAM,WAAuC,CAAC;AAC9C,MAAI;AACJ,MAAI,MAAM;AAEV,SAAO,MAAM,IAAI,QAAQ;AACvB,UAAM,EAAE,OAAO,KAAK,MAAM,SAAS,IAAI,WAAW,KAAK,GAAG;AAC1D,UAAM,cAAc,QAAQ;AAC5B,UAAM,WAAW,MAAM;AACvB,UAAM;AAEN,QAAI,aAAa,GAAG;AAClB,YAAM,EAAE,OAAO,KAAK,IAAI,oBAAoB,KAAK,GAAG;AACpD,YAAM;AACN,UAAI,gBAAgB,GAAG;AACrB,cAAM,QAAQ,oBAAoB,KAAK;AACvC,YAAI,MAAO,UAAS,MAAM,GAAG,IAAI,MAAM;AAAA,MACzC,WAAW,gBAAgB,GAAG;AAC5B,eAAO;AAAA,MACT;AAAA,IAEF,WAAW,aAAa,GAAG;AAEzB,YAAM,WAAW,KAAK,GAAG,EAAE;AAAA,IAC7B,WAAW,aAAa,GAAG;AACzB,aAAO;AAAA,IACT,WAAW,aAAa,GAAG;AACzB,aAAO;AAAA,IACT,OAAO;AACL,YAAM,IAAI,MAAM,yBAAyB,QAAQ,WAAW,GAAG,EAAE;AAAA,IACnE;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,MAAM,QAAQ,IAAI,WAAW,CAAC,EAAE;AACrD;AAEA,SAAS,oBACP,KAC2C;AAC3C,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM;AAEV,SAAO,MAAM,IAAI,QAAQ;AACvB,UAAM,EAAE,OAAO,KAAK,MAAM,SAAS,IAAI,WAAW,KAAK,GAAG;AAC1D,UAAM,cAAc,QAAQ;AAC5B,UAAM,WAAW,MAAM;AACvB,UAAM;AACN,QAAI,aAAa,GAAG;AAElB,UAAI,aAAa,EAAG,OAAM,WAAW,KAAK,GAAG,EAAE;AAAA,eACtC,aAAa,EAAG,QAAO;AAAA,eACvB,aAAa,EAAG,QAAO;AAAA,UAC3B,OAAM,IAAI,MAAM,kCAAkC,QAAQ,EAAE;AACjE;AAAA,IACF;AACA,UAAM,EAAE,OAAO,KAAK,IAAI,oBAAoB,KAAK,GAAG;AACpD,UAAM;AACN,QAAI,gBAAgB,EAAG,OAAM,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,aAClD,gBAAgB,EAAG,SAAQ;AAAA,EACtC;AAEA,MAAI,QAAQ,UAAa,UAAU,OAAW,QAAO;AACrD,SAAO,EAAE,KAAK,MAAM;AACtB;AAWA,SAAS,mBAAmB,SAA6B;AACvD,QAAM,OAAO,QAAQ,YAAY,CAAC;AAClC,QAAM,gBAAgB,KAAK,UAAU;AACrC,QAAM,WAAW,gBACb,IAAI,YAAY,EAAE,OAAO,aAAa,IACtC;AACJ,QAAM,OAAO,QAAQ,QAAQ,IAAI,WAAW,CAAC;AAE7C,MAAI,aAAa,cAAe,QAAO;AACvC,MAAI,aAAa,cAAc;AAC7B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AAC1C,QAAI;AACF,aAAO,KAAK,UAAU,KAAK,MAAM,IAAI,GAAG,MAAM,CAAC;AAAA,IACjD,QAAQ;AAGN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,aAAa,eAAgB,QAAO,YAAY,KAAK,MAAM;AAC/D,SAAO,aAAa,QAAQ,KAAK,KAAK,MAAM;AAC9C;AAeO,SAAS,mBAAmB,WAAuC;AACxE,QAAM,UAAU,kCAAkC,SAAS;AAC3D,QAAM,MAAM,WAAW,QAAQ,IAAI;AACnC,MAAI,CAAC,KAAK;AACR;AAAA,MACE,oDACK,SAAS,IAAI,SAAS;AAAA,IAG7B;AACA,WAAO;AAAA,EACT;AACA;AAAA,IACE,UACI,8BAA8B,SAAS,2BACvC;AAAA,EACN;AACA,SAAO;AACT;AAOA,eAAsB,2BACpB,WACuC;AACvC,QAAM,MAAM,mBAAmB,SAAS;AACxC,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,uBAAuB,GAAG;AACnC;AAQA,eAAsB,8BACpB,WAC0C;AAC1C,QAAM,MAAM,mBAAmB,SAAS;AACxC,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,0BAA0B,GAAG;AACtC;",
+  "names": []
+}

package/fragments/base/index.ts.hbs

@@ -7,7 +7,7 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { mesh } from "@mesh-tech/app-kit";
+import { mesh } from "@mesh-tech/app-kit/infra";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);