@pikku/redis 0.12.13 → 0.12.15

package/CHANGELOG.md

@@ -1,3 +1,372 @@
+## 0.12.15
+
+### Patch Changes
+
+- 78b29f0: `SecretService` now returns a `SecretValue<T>` rather than the bare value, so a
+  vault secret cannot reach a sink by accident.
+
+  `SecretValue` is nominally typed, which means it is not assignable to `string`
+  (or to any other concretely-typed field). Every sink with a real type — a
+  database column, an email body, a session payload — rejects it with no lint
+  rule involved. The sinks typed `any`, `unknown`, or a free generic — the logger,
+  queue payloads, webhook and email inputs, and a function's own output — are
+  guarded with `Safe<T>`, which collapses a `SecretValue` found anywhere inside
+  `T`, however deeply nested, to `never`.
+
+  Unwrap deliberately at the point the secret reaches the wire:
+
+  ```ts
+  const secret = await secrets.getSecret('BETTER_AUTH_SECRET')
+  betterAuth({ secret: secret.reveal() })
+  ```
+
+  Two behaviours cover what types cannot see. Structured serialization redacts —
+  `JSON.stringify` and node's inspect both yield `[secret]`, so an audit or log
+  write stays honest without crashing the request. String coercion throws
+  `SecretCoercionError`, because a template literal is always a leak.
+
+  `AuditLog.write` is guarded the same way as the logger, since an audit event
+  carries `input` and `metadata` as `unknown` and nominality alone cannot stop a
+  secret landing in one.
+
+  `.reveal()` is the deliberate escape hatch, and what it hands back is an
+  ordinary string as far as every sink signature is concerned. **PKU953** closes
+  that gap: under `pikku all --security` the inspector reports a revealed secret
+  that flows into a logger, an audit, a queue, an email or a webhook — `console` included.
+
+  This also fixed a real one: `remote-addon-auth.ts` called `String(token)` on an
+  `unknown` and wrote the result straight into an `Authorization` header.
+
+- Updated dependencies [62ea4cc]
+- Updated dependencies [9dddff8]
+- Updated dependencies [78b29f0]
+  - @pikku/core@0.12.76
+
+## 0.12.14
+
+### Patch Changes
+
+- 6a307f0: Fix four latent correctness bugs in the function, RPC and error runtimes, and
+  remove dead code from the workflow service surface.
+
+  `WorkflowService.getNodesWithoutSteps` is gone. It was declared on the abstract
+  service and implemented by all five storage backends, and nothing ever called
+  it — hence the non-core packages in this changeset, which only lose that method.
+
+  **An RPC could execute twice.** `RPCService.invoke`, its addon path, and
+  `rpcWithWire` each wrapped the _execution_ of a resolved function in a `try`
+  whose `catch` treated `RPCNotFoundError` as "not found locally" and re-dispatched
+  the call through `deploymentService`. A nested `rpc.invoke` to a missing name,
+  raised from inside an already-running function, therefore re-ran that function on
+  a remote instance after its local side effects had already committed. Resolution
+  is now separated from execution on all three paths, so only a genuinely
+  unresolvable name reaches the fallback. What escapes to callers is unchanged.
+
+  **`addonNamespace` leaked between sibling calls.** The function runner's
+  middleware path restored `rpc`, `functionId`, `audit` and `addonNamespace` after
+  an invocation; the non-middleware path restored the first three but not the
+  fourth. A call into an addon function with no middleware left the addon's
+  namespace on the wire, so subsequent sibling calls resolved the wrong
+  per-instance singletons and `credentialOverrides`.
+
+  **Errors registered on a subclass never resolved.** `misc.errors` was typed
+  `Map<PikkuError, ErrorDetails>` — instances — while `addError` stores
+  constructors, a mismatch hidden by its `error: any` parameter. The instance
+  lookup in `getErrorResponse` was consequently dead, and lookup fell through to a
+  scan comparing `constructor.name`, so a subclass of a registered error got no
+  status mapping at all. The map is now typed `Map<PikkuErrorConstructor, …>` and
+  lookup walks the prototype chain first. Name matching is retained, deliberately,
+  as the fallback that keeps error mapping working when two copies of
+  `@pikku/core` are installed.
+
+  **`createWeakUID` collided across instances.** The prefix was
+  `Date.now().toString(36)` evaluated at module load, so any two instances loading
+  the module in the same millisecond emitted identical `channelId` and `requestId`
+  sequences — reproducibly, not just in principle. It is now seeded lazily from
+  `crypto.randomUUID()`.
+
+  Also: `pikkuState` keys its global map with `Symbol.for` rather than `Symbol`, so
+  two copies of the package share registrations instead of silently getting
+  disjoint state; and the local channel upgrade path no longer keys its middleware
+  cache on the raw request path, which grew the cache without bound while the
+  cached value never varied by path.
+
+- afef587: Close eleven security weaknesses found in a review of `@pikku/core`. Most are
+  breaking, and two invalidate data or credentials already in the wild — read the
+  migration notes before upgrading.
+
+  **Breaking: AI agent thread ownership now fails closed.** Reading, listing,
+  resuming or approving an existing thread or run requires a resolved session
+  principal (`userId`, or `orgId` for `sessionScope: 'org'`), regardless of the
+  agent's `auth` setting. Previously a request without a session had no ownership
+  model at all: the caller-supplied `resourceId` was accepted as the ownership
+  key, so any caller could read or resume another party's thread by naming its
+  `resourceId`. Worse, `threadOwnerConstraint` returned `undefined` for a
+  sessionless caller, and `undefined` means _no filter_ rather than _no rows_ —
+  so `getAgentThreads` returned every thread in the deployment. It now returns
+  `string[]`, empty for a sessionless caller, which every storage backend already
+  treats as matching nothing. Sessionless agents still run one-shot conversations,
+  each with a fresh unguessable owner; what they lose is cross-request continuity.
+  Wire a session to restore it.
+
+  **Breaking: stored secrets and credentials must be re-entered.** `deriveKey` ran
+  a single unsalted round of SHA-256 over the passphrase and used the digest
+  directly as the AES-GCM key — roughly one hash per brute-force guess, with one
+  rainbow table working against every deployment. It is now PBKDF2-HMAC-SHA256 at
+  600,000 iterations over a random salt. There is no compatibility path: every
+  value held by the kysely, mongodb and redis secret services and the kysely
+  credential service becomes undecryptable. They fail loud, naming the key and
+  `key_version`, so the app hard-fails on first secret read until each is re-set.
+
+  The KEK salt is scoped to the key version and stored alongside it, rather than
+  per secret, so a bulk read costs one derivation instead of N — `getSecrets` over
+  50 secrets went from ~2.3s to ~48ms, and rotation from ~4.6s to ~94ms. This adds
+  a salt table (kysely), hash field (redis) or collection (mongodb), created
+  automatically on first use.
+
+  **Breaking: `PIKKU_REMOTE_SECRET` must be at least 32 characters.** The
+  remote-RPC session envelope moved from PBKDF2 to HKDF, which expands
+  high-entropy key material rather than stretching a low-entropy passphrase. That
+  took a remote hop from ~269ms to ~0.4ms — PBKDF2 was running twice per request —
+  but HKDF supplies no brute-force resistance, so the secret must carry the
+  entropy itself. A shorter secret now throws `WeakKeyMaterialError` at both ends.
+  Generate one with `openssl rand -base64 32` and roll it out to every service in
+  the mesh together: existing bearer tokens are format-incompatible, so a partial
+  rollout produces 401s until every instance is updated. The Cloudflare, Lambda
+  and Azure deployment services each hand-rolled a copy of `buildRemoteHeaders`
+  and now call the shared one, which is what keeps the two sides in step.
+
+  **Breaking: previously signed content URLs stop verifying.** `LocalContent`
+  signed only `{signedAt, expiresAt, notBefore}`, so a signature proved when a URL
+  was issued but never what it was issued for — any valid token was a skeleton
+  key, and swapping the pathname from a public thumbnail to a private document
+  still verified. The signature now binds the request path. Separately, the
+  verifier returned "valid" when no JWT service was wired, which is how
+  `pikku serve` ran: a forged `?signedAt=0&expiresAt=99999999999999` was accepted.
+  It now rejects with 403, `LocalContent` requires a `JWTService`, and
+  `pikku serve`/`pikku dev` mint an ephemeral per-process signing key so local
+  development works without shipping a fail-open path. In-flight signed URLs must
+  be re-issued.
+
+  **Request body size limits now apply to every adapter.** The `maxBodySize` cap
+  existed only in `PikkuFetchHTTPRequest`. The real hole was uWebSockets, which
+  drove `res.onData` itself and concatenated every chunk with no bound and nothing
+  downstream able to intervene; it now drops chunks past the limit and replies 413
+  before routing. Fastify delegates to its native `bodyLimit` (set only when
+  `maxBodySize` is configured, so fastify's stricter 1 MB default is never
+  loosened), and `PikkuExpressServer` feeds the limit into its body parsers. Two
+  paths can only reject rather than prevent, and are documented as such:
+  `express-middleware` mounted on your own app receives an already-parsed body, so
+  that deployment must bound its own parser; Next server actions bottom out at
+  `experimental.serverActions.bodySizeLimit`.
+
+  **Breaking: the console addon's privileged functions are gated by default.**
+  `wireAddon` gains a `scopes` option that applies to every function in the
+  addon's namespace, and the console scaffold now generates
+  `wireAddon({ name: 'console', package: '@pikku/addon-console', scopes: ['admin'] })`.
+  Previously the console's entire privileged surface — around 54 functions
+  including `credentialGet`, which returns a resolved OAuth token for an arbitrary
+  `userId`, `updateFunctionBody`, and `installAddon`, which shells out to a
+  package install — was protected only by an optional host-registered
+  `addGlobalPermission`. `resolveGlobalPermissions` returns `[]` when none is
+  registered and permission checking then no-ops, so an app that never registered
+  one served those functions to anyone, and with the template's default
+  `scaffold.rpc: "no-auth"` that meant unauthenticated. All of them now return 403
+  `MissingScopeError` without an `admin`, `admin:*` or `*` scope. **Regenerating
+  is required** — an app holding an old `console.gen.ts` stays open.
+  `installAddon` and `installOpenapiAddon` additionally declare their own
+  `auth: true, scopes: ['admin']`, and `getAgentThreads` now scopes its listing to
+  the session's own threads unless the caller holds admin.
+
+  Addon scopes are enforced in `runPikkuFunc` rather than at the RPC boundary,
+  because a wiring can reference an addon function directly — the inspector
+  records the addon's `packageName` on HTTP, channel, schedule, queue, CLI,
+  trigger, gateway and MCP wirings — and those paths never call `resolveNamespace`.
+  Enforcing at the RPC seam would have covered only the `namespace:function` form
+  while reading as complete.
+
+  **Breaking: `wireAddon`'s `auth` and `tags` now apply on direct wirings too.**
+  Both were read only by `resolveAddonFunction`, so they had exactly the hole
+  scopes had: `wireAddon({ name: 'console', package: '@pikku/addon-console', auth:
+true, tags: ['admin'] })` gated `rpc('console:credentialGet')` and gated nothing
+  at all on an HTTP route wired straight to `credentialGet`. A consumer who
+  reached for the documented way to lock an addon down got a control that was
+  silently inert on every wiring except one. Both now resolve in `runPikkuFunc`.
+  `auth` merges as an OR — `auth: false` from an addon is ignored on a direct
+  wiring, because an addon may require a session the wiring did not but must never
+  waive one it did. Addon tags resolve to concrete middleware against the **root**
+  tag groups before the call rather than being folded into the function's
+  inherited middleware: `addTagMiddleware('admin', …)` is written by the consuming
+  app and registers under the root package, whereas `combineMiddleware` would look
+  the tag up under the addon's own `packageName`, where it does not exist.
+
+  One consequence worth naming: an addon that wires `auth: true` and also runs its
+  own sessionless internal work — a scheduled task or queue worker inside the
+  addon calling a sibling function — is now gated where it previously was not,
+  because a bare `rpc('fn')` from inside the addon reaches `runPikkuFunc` with the
+  addon's `packageName` like any other call. This reverses a decision that
+  deliberately scoped the gate to the namespaced boundary; that reasoning held
+  only while the boundary was real, and a direct wiring can enter an addon without
+  crossing it, so "already inside" is not something the runtime can infer. Such an
+  addon should carry authorization on the function via
+  `pikkuFunc({ permissions })`, which has always been enforced on every path. A
+  follow-up will add execution provenance so an intra-addon call can be
+  distinguished from an external one and skip the addon-level check; that needs a
+  marker no caller outside the process can set, which is its own design problem
+  and does not belong in a security fix.
+
+  **Codegen now warns when an exposed function has no gate (PKU574).** The
+  generated `POST /rpc/:rpcName` dispatcher forwards to `rpc.exposed`, which
+  refuses anything without `expose: true` — but nothing checked whether the
+  target was gated, because a dispatcher cannot know what it dispatches to. The
+  console shipped ~54 privileged functions through that gap and the toolchain was
+  silent. The inspector now reports every function that is exposed, sessionless,
+  and carries no `auth`, `scopes` or `permissions` of its own and none from a
+  governing `wireAddon`. It is a `warn`, not a critical: `expose: true` on an
+  ungated sessionless function is correct for a genuinely public endpoint, so it
+  blocks a build only under `--fail-on-warn`.
+
+  Two pieces of metadata were missing for this to be answerable statically, and
+  both are now recorded. A `pikkuSessionlessFunc`'s own `auth: true` was read at
+  runtime but never written to function meta, so a self-gated function was
+  indistinguishable from an ungated one — `sessionless` carries the baseline, and
+  `auth` now carries the tightening. And `wireAddon`'s `scopes`, `auth` and `tags`
+  were not parsed at all: the inspector recorded the addon's `rpcEndpoint` and its
+  secret, variable and credential overrides, and dropped every one of its gates.
+  An addon whose gates are not statically knowable is treated as gated, because a
+  false positive on a correctly-secured addon costs more than the one case it
+  would catch.
+
+  **Breaking: an application's global permissions now apply inside addons.**
+  `resolveGlobalPermissions` read only the bucket matching the function's own
+  package, but the generated `addGlobalPermission` wrapper takes no package
+  argument and always registers under the root. An app-wide rule like "every
+  request needs a signed-in user" therefore stopped at the addon boundary, and the
+  bucket an addon's functions did read was one no host could write to — which is
+  why the console addon's recommended `addGlobalPermission([isAdmin],
+'@pikku/addon-console')` was never a gate anybody could actually install. A
+  function now resolves the root bucket and its own package's, root first.
+  Unioning is safe in a way nothing else here would be: globals AND, so adding the
+  root ones can only tighten. Package buckets stay one-way — a package's globals
+  never reach root functions, or an installed addon could gate the whole
+  application. Apps with both a root global and addon-provided functions will see
+  those functions gated where they previously were not.
+
+  **Codegen now records whether each HTTP route requires a session, and warns
+  about inert addon tags (PKU575).** Four separate things can demand a session —
+  the function's `sessionless`, its own `auth`, the route's (or its group's)
+  `auth`, and the addon it belongs to — and answering "which routes are open?"
+  meant joining all four by hand and knowing which wins. Each route's meta now
+  carries the resolved `requiresSession` alongside the route's own `auth`. Scopes
+  count as requiring one, since they are matched against the session's and fail
+  closed. Anything not statically knowable resolves to `true`, matching PKU574:
+  a route that looks stricter than it is costs less than one that looks open and
+  isn't. Separately, `wireAddon({ tags: ['admin'] })` reads like a gate and is
+  applied like one right up until no `addTagMiddleware('admin', …)` exists, at
+  which point it resolves to an empty list and gates nothing; that now warns.
+  Only addon tags are reported — a tag on a function is as likely to be
+  organizational, and warning about those would bury the case that matters.
+
+  **Object-shorthand permissions were missing from meta.** The inspector visited
+  `ts.PropertyAssignment` but not `ts.ShorthandPropertyAssignment`, so
+  `permissions: { canAdminOrg }` — enforced identically to the longhand form at
+  runtime, since `verifyPermissions` has a non-array branch — was recorded as _no
+  permissions at all_. That is the most dangerous direction for meta to be wrong
+  in: an audit reading it sees an open door where one is shut. It cost this review
+  a false IDOR report across ~35 billing and org functions before the source
+  contradicted the metadata.
+
+  **Functions that authorize in their own body can say so.** A webhook receiver
+  verifying a signature, or a handler redeeming a signed invite, is genuinely
+  closed while carrying no session, scope or permission — indistinguishable in
+  meta from one nobody remembered to gate, and so warned about forever by PKU574.
+  `selfAuthenticated: true` on the function config records the claim and silences
+  the warning for that function. It is declarative only: nothing at runtime reads
+  it and it grants nothing. Detection was rejected deliberately — inferring it
+  from the body means a function that _looks_ like it checks something silences
+  the warning while checking nothing, and a warning that is usually wrong stops
+  being read.
+
+  **Breaking: `scaffold.<feature>` is now `boolean | { auth?, path? }`, and `true`
+  means authenticated.** The old `'auth' | 'no-auth' | false` read like a
+  starter-file preference while being a live authorization decision, set three
+  directories from the functions it governed — the shape the console incident
+  took. A surface now becomes public only by writing `{ auth: false }`, so
+  omitting a field can never open anything: the failure mode of a forgotten flag
+  is a locked door. `{ path }` additionally overrides where the file is
+  generated, which previously could only be set for all features at once via
+  `pikkuDir`.
+
+  The legacy strings are **refused, not coerced**. `resolveScaffoldFeature` throws
+  naming the key and its replacement (`"rpc": "no-auth"` → `"rpc": { "auth":
+false }`), and it does so at config load, not downstream. An earlier design used
+  a bare `string` for the output path, under which `"no-auth"` would have parsed
+  as a file named `no-auth` and every unmigrated config would have silently
+  produced nonsense; the object form makes any string invalid, so the failure is
+  loud.
+
+  The collapse is deliberately not uniform in effect. For `rpc` the flag was a
+  blanket "no anonymous RPC in this app" set on a dispatcher that cannot know what
+  it dispatches to; for `userAdmin` it was redundant, since the generated
+  functions are already `pikkuFunc` with `scopes: ['admin:users:list']`. But for
+  `agent`, `workflow`, `events` and `scenarios` it is the only gate — those
+  generate real endpoints the app never authors — so `true` keeps them
+  authenticated rather than opening them as a side effect of a config cleanup.
+  `webhook` and `remoteRpc` have no auth dimension at all (`serialize-remote-rpc.ts`
+  hardcodes `auth: false`), so an `{ auth }` on them is ignored. The three
+  configs in this repo are migrated preserving their current behaviour exactly.
+
+  **Queue job identities are signed.** A job carried the producer's `pikkuUserId`
+  as a plain string and the worker resolved a session from it with no
+  verification, so write access to the queue backend was act-as-any-user. The
+  identity is now `pq1.<claim>.<hmac>`, HMAC-SHA256 over the claim and the
+  canonicalized job payload, keyed by HKDF expansion of a new
+  `PIKKU_QUEUE_IDENTITY_SECRET`. Producers opt in by wrapping their queue service
+  with `SignedQueueService`. This fails safe rather than closed: with no secret
+  configured the identity is dropped and jobs still process, warning once per
+  process, so no existing deployment breaks on upgrade — it simply loses queue
+  identity until the secret is set. The payload rather than the job id is bound
+  because SQS, Cloudflare Queues, Azure and the in-memory service all mint ids
+  after `add` returns.
+
+  **Workflow inline state is read from the run record.** `isInline` consulted a
+  process-local `Map`, while `WorkflowRun.inline` is durable. Any instance that
+  did not start a run disagreed with the record, so one instance could dispatch a
+  queued job for a workflow another was already executing in-process. It is now
+  async and resolves through the durable identity, cached only when a context
+  already exists so a passive reader allocates nothing. The same `Map` also leaked:
+  `nextStepKey` fabricated replay state on every step, and `releaseContext`
+  refused to free anything carrying it, so runs whose steps executed outside a
+  `beginReplay` bracket — the step-worker queue path — stranded their context and
+  step state for the process lifetime. Contexts are now released by an explicit
+  execution counter. Step ordinals reset per execution rather than accumulating
+  across step-worker invocations in one process, which makes step naming
+  independent of how work was distributed.
+
+  **Secret reads fail loud in every store.** `MongoDBSecretService.getSecrets`
+  skipped rows that failed to decrypt, and the redis equivalent dropped every
+  rejection via `Promise.allSettled`, including the "No KEK available for
+  key_version N" configuration error. Both now throw, naming the key and its key
+  version, matching the kysely behaviour. This matters most alongside the KEK
+  change above: without it, an upgrade surfaces as a partial secrets map and an
+  opaque downstream failure instead of an error naming the secret to re-enter.
+
+  **A second middleware registration for a pattern no longer erases the first.**
+  `addHTTPMiddleware`, `addTagMiddleware` and `addChannelMiddleware` groups are
+  keyed by pattern or tag and held one source file each, so a second file's call
+  overwrote the first's. Codegen emits its imports from what is stored, so the
+  losing file was never imported and its middleware never registered — the
+  runtime composes repeated registrations for a pattern happily, and only codegen
+  dropped one. Adding an unrelated `addHTTPMiddleware('*', …)` to an app was
+  enough to silently unregister the generated better-auth session bridge, which
+  fails open and gives no sign until a request arrives without a session. A group
+  now carries every registration made for it, and all of them are imported.
+
+- Updated dependencies [6a307f0]
+- Updated dependencies [afef587]
+- Updated dependencies [8075f6a]
+  - @pikku/core@0.12.74
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/src/redis-secret-service.d.ts

@@ -1,4 +1,5 @@
-import type { SecretService } from '@pikku/core/services';
+import { type SecretValue } from '@pikku/core';
+import type { SecretService, SecretValues } from '@pikku/core/services';
 import { Redis, type RedisOptions } from 'ioredis';
 export interface RedisSecretServiceConfig {
     key: string;
@@ -13,14 +14,18 @@ export declare class RedisSecretService implements SecretService {
     private keyVersion;
     private previousKey?;
     private keyPrefix;
+    private kekSalts;
+    private keks;
     constructor(connectionOrConfig: Redis | RedisOptions | string, config: RedisSecretServiceConfig);
     private secretKey;
+    private saltKey;
+    private getKEKSalt;
     private getKEK;
-    getSecret<T = string>(key: string): Promise<T>;
+    getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
-    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<T>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<SecretValues<T>>>;
     rotateKEK(): Promise<number>;
     close(): Promise<void>;
 }

package/dist/src/redis-secret-service.js

@@ -1,5 +1,6 @@
+import { createSecretValue, isSecretValue } from '@pikku/core';
 import { Redis } from 'ioredis';
-import { envelopeEncrypt, envelopeDecrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
+import { deriveKEK, generateKEKSalt, envelopeEncrypt, envelopeDecrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
 export class RedisSecretService {
     redis;
     ownsConnection;
@@ -7,6 +8,8 @@ export class RedisSecretService {
     keyVersion;
     previousKey;
     keyPrefix;
+    kekSalts = new Map();
+    keks = new Map();
     constructor(connectionOrConfig, config) {
         if (typeof connectionOrConfig === 'object' &&
             'hgetall' in connectionOrConfig &&
@@ -30,26 +33,50 @@ export class RedisSecretService {
     secretKey(key) {
         return `${this.keyPrefix}:secret:${key}`;
     }
-    getKEK(version) {
-        if (version === this.keyVersion)
-            return this.key;
-        if (this.previousKey)
-            return this.previousKey;
-        throw new Error(`No KEK available for key_version ${version}`);
+    saltKey() {
+        return `${this.keyPrefix}:kek-salt`;
+    }
+    async getKEKSalt(version) {
+        const cached = this.kekSalts.get(version);
+        if (cached)
+            return cached;
+        const field = String(version);
+        let salt = await this.redis.hget(this.saltKey(), field);
+        if (!salt) {
+            await this.redis.hsetnx(this.saltKey(), field, generateKEKSalt());
+            salt = await this.redis.hget(this.saltKey(), field);
+            if (!salt) {
+                throw new Error(`Failed to persist a KEK salt for key_version ${version}`);
+            }
+        }
+        this.kekSalts.set(version, salt);
+        return salt;
+    }
+    async getKEK(version) {
+        const cached = this.keks.get(version);
+        if (cached)
+            return cached;
+        const passphrase = version === this.keyVersion ? this.key : this.previousKey;
+        if (!passphrase) {
+            throw new Error(`No KEK available for key_version ${version}`);
+        }
+        const kek = await deriveKEK(passphrase, await this.getKEKSalt(version));
+        this.keks.set(version, kek);
+        return kek;
     }
     async getSecret(key) {
         const data = await this.redis.hgetall(this.secretKey(key));
         if (!data.ciphertext)
             throw new Error('Requested secret not found');
-        const kek = this.getKEK(Number(data.key_version));
-        return envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek);
+        const kek = await this.getKEK(Number(data.key_version));
+        return createSecretValue(await envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek));
     }
     async hasSecret(key) {
         const exists = await this.redis.exists(this.secretKey(key));
         return exists === 1;
     }
     async setSecret(key, value) {
-        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value);
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(await this.getKEK(this.keyVersion), isSecretValue(value) ? value.reveal() : value);
         await this.redis.hset(this.secretKey(key), {
             ciphertext,
             wrapped_dek: wrappedDEK,
@@ -60,19 +87,32 @@ export class RedisSecretService {
         await this.redis.del(this.secretKey(key));
     }
     async getSecrets(keys) {
-        const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)));
+        const rows = await Promise.all(keys.map(async (key) => ({
+            key,
+            data: await this.redis.hgetall(this.secretKey(key)),
+        })));
         const out = {};
-        keys.forEach((key, i) => {
-            const result = results[i];
-            if (result?.status === 'fulfilled')
-                out[key] = result.value;
-        });
+        for (const { key, data } of rows) {
+            if (!data.ciphertext)
+                continue;
+            const keyVersion = Number(data.key_version);
+            try {
+                const kek = await this.getKEK(keyVersion);
+                out[key] = createSecretValue(await envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek));
+            }
+            catch (cause) {
+                throw new Error(`Failed to decrypt secret "${key}" (key_version ${keyVersion}): ` +
+                    `the configured KEK does not match the key it was wrapped under`, { cause });
+            }
+        }
         return out;
     }
     async rotateKEK() {
         if (!this.previousKey) {
             throw new Error('No previousKey configured — nothing to rotate from');
         }
+        const oldKEK = await this.getKEK(this.keyVersion - 1);
+        const newKEK = await this.getKEK(this.keyVersion);
         const pattern = `${this.keyPrefix}:secret:*`;
         let cursor = '0';
         let count = 0;
@@ -84,7 +124,7 @@ export class RedisSecretService {
                 const version = Number(data.key_version);
                 if (version >= this.keyVersion)
                     continue;
-                const newWrappedDEK = await envelopeRewrap(this.previousKey, this.key, data.wrapped_dek);
+                const newWrappedDEK = await envelopeRewrap(oldKEK, newKEK, data.wrapped_dek);
                 await this.redis.hset(redisKey, {
                     wrapped_dek: newWrappedDEK,
                     key_version: this.keyVersion.toString(),

package/dist/src/redis-secret-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-secret-service.js","sourceRoot":"","sources":["../../src/redis-secret-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAqB,MAAM,SAAS,CAAA;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,0BAA0B,CAAA;AASjC,MAAM,OAAO,kBAAkB;IACrB,KAAK,CAAO;IACZ,cAAc,CAAS;IACvB,GAAG,CAAQ;IACX,UAAU,CAAQ;IAClB,WAAW,CAAS;IACpB,SAAS,CAAQ;IAEzB,YACE,kBAAiD,EACjD,MAAgC;QAEhC,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,SAAS,IAAI,kBAAkB;YAC/B,MAAM,IAAI,kBAAkB,EAC5B,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,kBAA2B,CAAA;YACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;QAC7B,CAAC;aAAM,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAA;IAC9C,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,OAAO,GAAG,IAAI,CAAC,SAAS,WAAW,GAAG,EAAE,CAAA;IAC1C,CAAC;IAEO,MAAM,CAAC,OAAe;QAC5B,IAAI,OAAO,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,GAAG,CAAA;QAChD,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAA;QAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,SAAS,CAAa,GAAW;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAEnE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QACjD,OAAO,eAAe,CAAI,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,IAAI,CAAC,WAAY,CAAC,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3D,OAAO,MAAM,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAc;QACzC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAEzE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;YACzC,UAAU;YACV,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,UAAU,CAEd,IAA0B;QAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5E,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YACzB,IAAI,MAAM,EAAE,MAAM,KAAK,WAAW;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAA;QAC7D,CAAC,CAAC,CAAA;QACF,OAAO,GAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,WAAW,CAAA;QAC5C,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,GAAG,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC9C,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,UAAU,CAAA;YAEnB,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBACxC,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU;oBAAE,SAAQ;gBAExC,MAAM,aAAa,GAAG,MAAM,cAAc,CACxC,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,WAAY,CAClB,CAAA;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAC9B,WAAW,EAAE,aAAa;oBAC1B,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;iBACxC,CAAC,CAAA;gBACF,KAAK,EAAE,CAAA;YACT,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QAExB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"redis-secret-service.js","sourceRoot":"","sources":["../../src/redis-secret-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,KAAK,EAAqB,MAAM,SAAS,CAAA;AAClD,OAAO,EACL,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,0BAA0B,CAAA;AASjC,MAAM,OAAO,kBAAkB;IACrB,KAAK,CAAO;IACZ,cAAc,CAAS;IACvB,GAAG,CAAQ;IACX,UAAU,CAAQ;IAClB,WAAW,CAAS;IACpB,SAAS,CAAQ;IACjB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IACpC,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IAE3C,YACE,kBAAiD,EACjD,MAAgC;QAEhC,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,SAAS,IAAI,kBAAkB;YAC/B,MAAM,IAAI,kBAAkB,EAC5B,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,kBAA2B,CAAA;YACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;QAC7B,CAAC;aAAM,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAA;IAC9C,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,OAAO,GAAG,IAAI,CAAC,SAAS,WAAW,GAAG,EAAE,CAAA;IAC1C,CAAC;IAEO,OAAO;QACb,OAAO,GAAG,IAAI,CAAC,SAAS,WAAW,CAAA;IACrC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAAe;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7B,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;YACjE,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,gDAAgD,OAAO,EAAE,CAC1D,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAAe;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;QACvE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,SAAS,CAAa,GAAW;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAEnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QACvD,OAAO,iBAAiB,CACtB,MAAM,eAAe,CAAI,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,IAAI,CAAC,WAAY,CAAC,CACnE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3D,OAAO,MAAM,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAc;QAGzC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CACtD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAClC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAC9C,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;YACzC,UAAU;YACV,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,UAAU,CACd,IAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,GAAG;YACH,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;SACpD,CAAC,CAAC,CACJ,CAAA;QAED,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAQ;YAE9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACzC,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAC1B,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAY,CAAC,CAC/D,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,kBAAkB,UAAU,KAAK;oBAC/D,gEAAgE,EAClE,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAA+B,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAEjD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,WAAW,CAAA;QAC5C,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,GAAG,CAAC;YACF,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC9C,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,UAAU,CAAA;YAEnB,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBACxC,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU;oBAAE,SAAQ;gBAExC,MAAM,aAAa,GAAG,MAAM,cAAc,CACxC,MAAM,EACN,MAAM,EACN,IAAI,CAAC,WAAY,CAClB,CAAA;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAC9B,WAAW,EAAE,aAAa;oBAC1B,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;iBACxC,CAAC,CAAA;gBACF,KAAK,EAAE,CAAA;YACT,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QAExB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;IACH,CAAC;CACF"}

package/dist/src/redis-workflow-service.d.ts

@@ -43,7 +43,6 @@ export declare class RedisWorkflowService extends PikkuWorkflowService {
         failedNodeIds: string[];
         branchKeys: Record<string, string>;
     }>;
-    getNodesWithoutSteps(runId: string, nodeIds: string[]): Promise<string[]>;
     getStepInstances(runId: string): Promise<Array<{
         stepName: string;
         status: StepStatus;

package/dist/src/redis-workflow-service.js

@@ -400,19 +400,6 @@ export class RedisWorkflowService extends PikkuWorkflowService {
         } while (cursor !== '0');
         return { completedNodeIds, failedNodeIds, branchKeys };
     }
-    async getNodesWithoutSteps(runId, nodeIds) {
-        if (nodeIds.length === 0)
-            return [];
-        const result = [];
-        for (const nodeId of nodeIds) {
-            const key = this.stepKey(runId, nodeId);
-            const exists = await this.redis.exists(key);
-            if (!exists) {
-                result.push(nodeId);
-            }
-        }
-        return result;
-    }
     async getStepInstances(runId) {
         const instances = [];
         const pattern = `${this.keyPrefix}:step:${runId}:*`;

package/dist/src/redis-workflow-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-workflow-service.js","sourceRoot":"","sources":["../../src/redis-workflow-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GASrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAqB,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAanC,MAAM,OAAO,oBAAqB,SAAQ,oBAAoB;IACpD,KAAK,CAAO;IACZ,SAAS,CAAQ;IACjB,cAAc,CAAS;IACvB,OAAO,GAAG,KAAK,CAAA;IAMvB,YACE,kBAA6D,EAC7D,SAAS,GAAG,WAAW,EACvB,UAAgC,EAAE;QAElC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAM1B,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,kBAAkB,KAAK,IAAI;YAC3B,SAAS,IAAI,kBAAkB;YAC/B,MAAM,IAAI,kBAAkB,EAC5B,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,kBAA2B,CAAA;YACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAyB,CAAC,CAAA;YACjD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;IACH,CAAC;IAKM,KAAK,CAAC,IAAI;QAEf,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAA;IACzC,CAAC;IAEO,OAAO,CAAC,KAAa,EAAE,QAAgB;QAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,QAAQ,EAAE,CAAA;IACtD,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,GAAG,IAAI,CAAC,SAAS,iBAAiB,MAAM,EAAE,CAAA;IACnD,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,OAAO,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,EAAE,CAAA;IAC1C,CAAC;IAEO,WAAW,CAAC,KAAa,EAAE,QAAgB;QACjD,OAAO,GAAG,IAAI,CAAC,SAAS,cAAc,KAAK,IAAI,QAAQ,EAAE,CAAA;IAC3D,CAAC;IAKO,KAAK,CAAC,eAAe,CAC3B,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,MAAoE,EACpE,MAAY,EACZ,KAAuB,EACvB,OAAgB,EAChB,UAAmB;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,KAAK,GAAQ;YACjB,MAAM;YACN,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9D,OAAO;YACP,UAAU;YACV,SAAS,EAAE,GAAG;SACf,CAAA;QAGD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,KAAK,CAAC,SAAS,GAAG,GAAG,CAAA;gBACrB,MAAK;YACP,KAAK,WAAW;gBACd,KAAK,CAAC,WAAW,GAAG,GAAG,CAAA;gBACvB,MAAK;YACP,KAAK,WAAW;gBACd,KAAK,CAAC,WAAW,GAAG,GAAG,CAAA;gBACvB,MAAK;YACP,KAAK,QAAQ;gBACX,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAA;gBACpB,MAAK;QACT,CAAC;QAGD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CACxB,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,CACvD,CAAA;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,CAAC;IAKO,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,MAAwD,EACxD,MAAY,EACZ,KAAuB,EACvB,OAAgB,EAChB,UAAmB;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAG9C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CACnD,UAAU,EACV,YAAY,EACZ,YAAY,CACb,CAAA;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAEhC,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,EACP,UAAU,CACX,CAAA;YACD,OAAM;QACR,CAAC;QAGD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAA;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAGtB,MAAM,YAAY,GAAQ;YACxB,GAAG,aAAa;YAChB,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAA;QAGD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,YAAY,CAAC,SAAS,GAAG,GAAG,CAAA;gBAC5B,MAAK;YACP,KAAK,WAAW;gBACd,YAAY,CAAC,WAAW,GAAG,GAAG,CAAA;gBAC9B,MAAK;YACP,KAAK,WAAW;gBACd,YAAY,CAAC,WAAW,GAAG,GAAG,CAAA;gBAC9B,MAAK;YACP,KAAK,QAAQ;gBACX,YAAY,CAAC,QAAQ,GAAG,GAAG,CAAA;gBAC3B,MAAK;QACT,CAAC;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;QACzE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,UAAU,EACV,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAC7B,CAAA;IACH,CAAC;IAES,KAAK,CAAC,aAAa,CAC3B,YAAoB,EACpB,KAAU,EACV,MAAe,EACf,SAAiB,EACjB,IAAqB,EACrB,OAGC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,IAAI,EACJ,EAAE,EACF,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,QAAQ,EACR,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EACzB,WAAW,EACX,SAAS,EACT,eAAe,EACf,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EACzC,cAAc,EACd,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,EACjE,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EACpB,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,EACd,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAED,OAAO,EAAE,CAAA;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAS;YACxB,MAAM,EAAE,IAAI,CAAC,MAAyB;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAM,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACjD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;YACtC,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC/B,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;SAC7C,CAAA;IACH,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,EAAU,EACV,MAAsB,EACtB,MAAY,EACZ,KAAuB;QAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3B,MAAM,MAAM,GAA2B;YACrC,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;SAC1B,CAAA;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,KAAa,EACb,QAAgB,EAChB,OAAe,EACf,IAAS,EACT,WAAgE,EAChE,YAAqB;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAA;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAEzC,MAAM,MAAM,GAA2B;YACrC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;YACzB,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;SAC1B,CAAA;QAED,IAAI,WAAW,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;QACjD,CAAC;QAED,IAAI,WAAW,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAA;QACvD,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,YAAY,CAAA;QACpC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAGnC,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,EACN,QAAQ,EACR,CAAC,EACD,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EAAE,OAAO,EACpB,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CACpC,CAAA;QAED,OAAO;YACL,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,WAAW,EAAE,OAAO;YAC7B,UAAU,EACR,WAAW,EAAE,UAAU,KAAK,SAAS;gBACnC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE;gBACnC,CAAC,CAAC,SAAS;YACf,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;YACxB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SACzB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,cAAc,QAAQ,qCAAqC,CAC1F,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAa;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACxD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;SAC7C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa;QAGb,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,CAAA;QACnD,MAAM,QAAQ,GAAa,EAAE,CAAA;QAG7B,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,GAAG,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClD,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,SAAS,CAAA;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;QAC7B,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QAGxB,MAAM,iBAAiB,GAA4C,EAAE,CAAA;QAErE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAAE,SAAQ;YAE9B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAG9C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAEjE,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAElC,iBAAiB,CAAC,IAAI,CAAC;oBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBAExB,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,SAAS;oBAChD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;oBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;oBACpC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;oBACpC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClE,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;wBAC7B,CAAC,CAAC,SAAS;oBACb,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;wBAC7B,CAAC,CAAC,SAAS;oBACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;iBAChE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAGD,OAAO,iBAAiB,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CACxD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAE/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,SAAS,EACT,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,MAAc;QAEjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,MAAc,EACd,UAAkB;QAElB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,YAAY,EACZ,UAAU,EACV,WAAW,EACX,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACtB,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,MAAW;QAGX,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAGnC,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,MAAM,EACN,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,MAAc,EACd,KAAY;QAGZ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,eAAe,GAAoB;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAG,KAAa,CAAC,IAAI;SAC1B,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAC/B,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAGpC,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,eAAe,EACf,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAe,EACf,YAAoB,EACpB,EAAoB;QAEpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;QAC9B,MAAM,UAAU,GAAG,EAAE,CAAA;QACrB,MAAM,UAAU,GAAG,GAAG,CAAA;QAGtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CACnC,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,CAAC,OAAO,EACZ,IAAI,CACL,CAAA;YAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC;oBAEH,OAAO,MAAM,EAAE,EAAE,CAAA;gBACnB,CAAC;wBAAS,CAAC;oBAET,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,mGAAmG,EACnG,CAAC,EACD,OAAO,EACP,SAAS,CACV,CAAA;gBACH,CAAC;YACH,CAAC;YAGD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,UAAU,UAAU,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CAAI,EAAU,EAAE,EAAoB;QACnD,OAAO,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAChB,kCAAkC,EAAE,EAAE,EACtC,EAAE,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,QAAgB,EAChB,EAAoB;QAEpB,OAAO,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjC,uCAAuC,KAAK,UAAU,QAAQ,EAAE,EAChE,EAAE,CACH,CAAA;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,MAA6B;QAK7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,eAAe,GAAG,cAAc,GAAG,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAGlC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,MAAM,EACN,cAAc,EACd,eAAe,CAAC,QAAQ,EAAE,EAC1B,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,EACN,QAAQ,EACR,eAAe,EACf,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAO;YACpB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SACzB,CAAA;IACH,CAAC;IAMD,KAAK,CAAC,sBAAsB,CAAC,KAAa;QAKxC,MAAM,gBAAgB,GAAa,EAAE,CAAA;QACrC,MAAM,aAAa,GAAa,EAAE,CAAA;QAClC,MAAM,UAAU,GAA2B,EAAE,CAAA;QAE7C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,CAAA;QACnD,IAAI,MAAM,GAAG,GAAG,CAAA;QAEhB,GAAG,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClD,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,SAAS,CAAA;YAElB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACjC,GAAG,EACH,QAAQ,EACR,aAAa,EACb,cAAc,EACd,SAAS,CACV,CAAA;gBACD,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;gBAEzD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM;oBAAE,SAAQ;gBAC/D,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,KAAK;oBAAE,SAAQ;gBAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAEnD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC7B,IAAI,WAAW,EAAE,CAAC;wBAChB,UAAU,CAAC,MAAM,CAAC,GAAG,WAAW,CAAA;oBAClC,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;oBAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;oBACvD,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;wBAC5B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QAExB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,OAAiB;QAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnC,MAAM,MAAM,GAAa,EAAE,CAAA;QAE3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAa;QAIb,MAAM,SAAS,GAIV,EAAE,CAAA;QACP,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,CAAA;QACnD,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,GAAG,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClD,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,SAAS,CAAA;YAClB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnD,GAAG,EACH,QAAQ,EACR,cAAc,CACf,CAAA;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,KAAK;oBAAE,SAAQ;gBAChE,SAAS,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC9C,MAAM,EAAE,MAAoB;oBAC5B,YAAY,EAAE,YAAY,IAAI,SAAS;iBACxC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,OAAiB;QAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnC,MAAM,OAAO,GAAwB,EAAE,CAAA;QAEvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;YAE7B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC;gBACrC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,MAAc,EACd,SAAiB;QAGjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAEzC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,aAAa,EACb,SAAS,EACT,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;IACH,CAAC;IAUO,WAAW,CAAC,KAAa;QAC/B,OAAO,GAAG,IAAI,CAAC,SAAS,cAAc,KAAK,EAAE,CAAA;IAC/C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAa,EACb,IAAY,EACZ,KAAc;QAKd,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EACvB,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAChC,CAAA;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAClB,WAAW,EACX,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACtB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAI7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,KAAK,GAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAEnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;QAChE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,SAAiB;QAChD,OAAO,GAAG,IAAI,CAAC,SAAS,YAAY,IAAI,IAAI,SAAS,EAAE,CAAA;IACzD,CAAC;IAES,KAAK,CAAC,yBAAyB,CACvC,IAAY,EACZ,SAAiB,EACjB,KAAU,EACV,MAAc,EACd,MAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,cAAc,EACd,IAAI,EACJ,WAAW,EACX,SAAS,EACT,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,MAAM,IAAI,QAAQ,EAClB,WAAW,EACX,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACtB,CAAA;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,+BAA+B,CAC7C,IAAY,EACZ,SAAiB,EACjB,MAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAY,EACZ,SAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAC5B,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAO;SACrB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"redis-workflow-service.js","sourceRoot":"","sources":["../../src/redis-workflow-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GASrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAqB,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAanC,MAAM,OAAO,oBAAqB,SAAQ,oBAAoB;IACpD,KAAK,CAAO;IACZ,SAAS,CAAQ;IACjB,cAAc,CAAS;IACvB,OAAO,GAAG,KAAK,CAAA;IAMvB,YACE,kBAA6D,EAC7D,SAAS,GAAG,WAAW,EACvB,UAAgC,EAAE;QAElC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAM1B,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,kBAAkB,KAAK,IAAI;YAC3B,SAAS,IAAI,kBAAkB;YAC/B,MAAM,IAAI,kBAAkB,EAC5B,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,kBAA2B,CAAA;YACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAyB,CAAC,CAAA;YACjD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;IACH,CAAC;IAKM,KAAK,CAAC,IAAI;QAEf,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAA;IACzC,CAAC;IAEO,OAAO,CAAC,KAAa,EAAE,QAAgB;QAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,QAAQ,EAAE,CAAA;IACtD,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,GAAG,IAAI,CAAC,SAAS,iBAAiB,MAAM,EAAE,CAAA;IACnD,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,OAAO,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,EAAE,CAAA;IAC1C,CAAC;IAEO,WAAW,CAAC,KAAa,EAAE,QAAgB;QACjD,OAAO,GAAG,IAAI,CAAC,SAAS,cAAc,KAAK,IAAI,QAAQ,EAAE,CAAA;IAC3D,CAAC;IAKO,KAAK,CAAC,eAAe,CAC3B,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,MAAoE,EACpE,MAAY,EACZ,KAAuB,EACvB,OAAgB,EAChB,UAAmB;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,KAAK,GAAQ;YACjB,MAAM;YACN,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9D,OAAO;YACP,UAAU;YACV,SAAS,EAAE,GAAG;SACf,CAAA;QAGD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,KAAK,CAAC,SAAS,GAAG,GAAG,CAAA;gBACrB,MAAK;YACP,KAAK,WAAW;gBACd,KAAK,CAAC,WAAW,GAAG,GAAG,CAAA;gBACvB,MAAK;YACP,KAAK,WAAW;gBACd,KAAK,CAAC,WAAW,GAAG,GAAG,CAAA;gBACvB,MAAK;YACP,KAAK,QAAQ;gBACX,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAA;gBACpB,MAAK;QACT,CAAC;QAGD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CACxB,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,CACvD,CAAA;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,CAAC;IAKO,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,MAAwD,EACxD,MAAY,EACZ,KAAuB,EACvB,OAAgB,EAChB,UAAmB;QAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAG9C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CACnD,UAAU,EACV,YAAY,EACZ,YAAY,CACb,CAAA;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAEhC,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,EACP,UAAU,CACX,CAAA;YACD,OAAM;QACR,CAAC;QAGD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAA;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAGtB,MAAM,YAAY,GAAQ;YACxB,GAAG,aAAa;YAChB,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAA;QAGD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,YAAY,CAAC,SAAS,GAAG,GAAG,CAAA;gBAC5B,MAAK;YACP,KAAK,WAAW;gBACd,YAAY,CAAC,WAAW,GAAG,GAAG,CAAA;gBAC9B,MAAK;YACP,KAAK,WAAW;gBACd,YAAY,CAAC,WAAW,GAAG,GAAG,CAAA;gBAC9B,MAAK;YACP,KAAK,QAAQ;gBACX,YAAY,CAAC,QAAQ,GAAG,GAAG,CAAA;gBAC3B,MAAK;QACT,CAAC;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;QACzE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,UAAU,EACV,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAC7B,CAAA;IACH,CAAC;IAES,KAAK,CAAC,aAAa,CAC3B,YAAoB,EACpB,KAAU,EACV,MAAe,EACf,SAAiB,EACjB,IAAqB,EACrB,OAGC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,IAAI,EACJ,EAAE,EACF,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,QAAQ,EACR,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EACzB,WAAW,EACX,SAAS,EACT,eAAe,EACf,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EACzC,cAAc,EACd,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,EACjE,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EACpB,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,EACd,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAED,OAAO,EAAE,CAAA;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAS;YACxB,MAAM,EAAE,IAAI,CAAC,MAAyB;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAM,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACjD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;YACtC,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC/B,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;SAC7C,CAAA;IACH,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,EAAU,EACV,MAAsB,EACtB,MAAY,EACZ,KAAuB;QAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3B,MAAM,MAAM,GAA2B;YACrC,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;SAC1B,CAAA;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,KAAa,EACb,QAAgB,EAChB,OAAe,EACf,IAAS,EACT,WAAgE,EAChE,YAAqB;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAA;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAEzC,MAAM,MAAM,GAA2B;YACrC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;YACzB,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;SAC1B,CAAA;QAED,IAAI,WAAW,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;QACjD,CAAC;QAED,IAAI,WAAW,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAA;QACvD,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,YAAY,CAAA;QACpC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAGnC,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,EACN,QAAQ,EACR,CAAC,EACD,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EAAE,OAAO,EACpB,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CACpC,CAAA;QAED,OAAO;YACL,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,WAAW,EAAE,OAAO;YAC7B,UAAU,EACR,WAAW,EAAE,UAAU,KAAK,SAAS;gBACnC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE;gBACnC,CAAC,CAAC,SAAS;YACf,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;YACxB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SACzB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,cAAc,QAAQ,qCAAqC,CAC1F,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAa;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACxD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;SAC7C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa;QAGb,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,CAAA;QACnD,MAAM,QAAQ,GAAa,EAAE,CAAA;QAG7B,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,GAAG,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClD,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,SAAS,CAAA;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;QAC7B,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QAGxB,MAAM,iBAAiB,GAA4C,EAAE,CAAA;QAErE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAAE,SAAQ;YAE9B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAG9C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAEjE,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAElC,iBAAiB,CAAC,IAAI,CAAC;oBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBAExB,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,SAAS;oBAChD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;oBACxD,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;oBACpC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;oBACpC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClE,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;wBAC7B,CAAC,CAAC,SAAS;oBACb,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;wBAC7B,CAAC,CAAC,SAAS;oBACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;iBAChE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAGD,OAAO,iBAAiB,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CACxD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAE/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,SAAS,EACT,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,MAAc;QAEjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,MAAc,EACd,UAAkB;QAElB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,YAAY,EACZ,UAAU,EACV,WAAW,EACX,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACtB,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,MAAW;QAGX,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAGnC,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,MAAM,EACN,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,MAAc,EACd,KAAY;QAGZ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,eAAe,GAAoB;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAG,KAAa,CAAC,IAAI;SAC1B,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAC/B,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAGpC,MAAM,IAAI,CAAC,0BAA0B,CACnC,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,eAAe,EACf,OAAO,EACP,UAAU,CACX,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAe,EACf,YAAoB,EACpB,EAAoB;QAEpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;QAC9B,MAAM,UAAU,GAAG,EAAE,CAAA;QACrB,MAAM,UAAU,GAAG,GAAG,CAAA;QAGtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CACnC,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,CAAC,OAAO,EACZ,IAAI,CACL,CAAA;YAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC;oBAEH,OAAO,MAAM,EAAE,EAAE,CAAA;gBACnB,CAAC;wBAAS,CAAC;oBAET,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,mGAAmG,EACnG,CAAC,EACD,OAAO,EACP,SAAS,CACV,CAAA;gBACH,CAAC;YACH,CAAC;YAGD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,UAAU,UAAU,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CAAI,EAAU,EAAE,EAAoB;QACnD,OAAO,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAChB,kCAAkC,EAAE,EAAE,EACtC,EAAE,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,QAAgB,EAChB,EAAoB;QAEpB,OAAO,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjC,uCAAuC,KAAK,UAAU,QAAQ,EAAE,EAChE,EAAE,CACH,CAAA;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,MAA6B;QAK7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAGzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,eAAe,GAAG,cAAc,GAAG,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAGlC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,QAAQ,EACR,MAAM,EACN,cAAc,EACd,eAAe,CAAC,QAAQ,EAAE,EAC1B,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;QAGD,MAAM,IAAI,CAAC,eAAe,CACxB,MAAM,EACN,QAAQ,EACR,eAAe,EACf,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,CACX,CAAA;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAO;YACpB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;YAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SACzB,CAAA;IACH,CAAC;IAMD,KAAK,CAAC,sBAAsB,CAAC,KAAa;QAKxC,MAAM,gBAAgB,GAAa,EAAE,CAAA;QACrC,MAAM,aAAa,GAAa,EAAE,CAAA;QAClC,MAAM,UAAU,GAA2B,EAAE,CAAA;QAE7C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,CAAA;QACnD,IAAI,MAAM,GAAG,GAAG,CAAA;QAEhB,GAAG,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClD,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,SAAS,CAAA;YAElB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACjC,GAAG,EACH,QAAQ,EACR,aAAa,EACb,cAAc,EACd,SAAS,CACV,CAAA;gBACD,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;gBAEzD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM;oBAAE,SAAQ;gBAC/D,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,KAAK;oBAAE,SAAQ;gBAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAEnD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC7B,IAAI,WAAW,EAAE,CAAC;wBAChB,UAAU,CAAC,MAAM,CAAC,GAAG,WAAW,CAAA;oBAClC,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;oBAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;oBACvD,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;wBAC5B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QAExB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAa;QAIb,MAAM,SAAS,GAIV,EAAE,CAAA;QACP,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,SAAS,KAAK,IAAI,CAAA;QACnD,IAAI,MAAM,GAAG,GAAG,CAAA;QAChB,GAAG,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClD,MAAM,EACN,OAAO,EACP,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAA;YACD,MAAM,GAAG,SAAS,CAAA;YAClB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACnD,GAAG,EACH,QAAQ,EACR,cAAc,CACf,CAAA;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,KAAK;oBAAE,SAAQ;gBAChE,SAAS,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC9C,MAAM,EAAE,MAAoB;oBAC5B,YAAY,EAAE,YAAY,IAAI,SAAS;iBACxC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,OAAiB;QAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnC,MAAM,OAAO,GAAwB,EAAE,CAAA;QAEvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;YAE7B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC;gBACrC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,MAAc,EACd,SAAiB;QAGjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAEzC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,aAAa,EACb,SAAS,EACT,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,CACf,CAAA;IACH,CAAC;IAUO,WAAW,CAAC,KAAa;QAC/B,OAAO,GAAG,IAAI,CAAC,SAAS,cAAc,KAAK,EAAE,CAAA;IAC/C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAa,EACb,IAAY,EACZ,KAAc;QAKd,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EACvB,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAChC,CAAA;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAClB,WAAW,EACX,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACtB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAI7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,KAAK,GAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAEnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;QAChE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,SAAiB;QAChD,OAAO,GAAG,IAAI,CAAC,SAAS,YAAY,IAAI,IAAI,SAAS,EAAE,CAAA;IACzD,CAAC;IAES,KAAK,CAAC,yBAAyB,CACvC,IAAY,EACZ,SAAiB,EACjB,KAAU,EACV,MAAc,EACd,MAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,cAAc,EACd,IAAI,EACJ,WAAW,EACX,SAAS,EACT,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,MAAM,IAAI,QAAQ,EAClB,WAAW,EACX,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACtB,CAAA;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,+BAA+B,CAC7C,IAAY,EACZ,SAAiB,EACjB,MAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAY,EACZ,SAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAC5B,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAO;SACrB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/redis",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "description": "Redis services for Pikku — workflow state, agent runs, secrets, sessions and channel stores",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.71"
+    "@pikku/core": "^0.12.76"
   },
   "dependencies": {
     "ioredis": "^5.10.0"

package/src/redis-secret-service.test.ts

@@ -41,8 +41,82 @@ describe('RedisSecretService', () => {
     const r1 = await s1.getSecret<{ from: string }>('shared-name')
     const r2 = await s2.getSecret<{ from: string }>('shared-name')
 
-    assert.deepEqual(r1, { from: 'app1' })
-    assert.deepEqual(r2, { from: 'app2' })
+    assert.deepEqual(r1.reveal(), { from: 'app1' })
+    assert.deepEqual(r2.reveal(), { from: 'app2' })
     prefixRedis.disconnect()
   })
+
+  describe('decryption failures', () => {
+    const kek = 'test-key-encryption-key-32chars!'
+    const otherKek = 'a-totally-different-kek-32chars!'
+
+    test('getSecrets throws naming a secret it cannot decrypt', async () => {
+      const writer = new RedisSecretService(redis as any, { key: kek })
+      await writer.setSecret('undecryptable', { token: 'abc' })
+
+      const reader = new RedisSecretService(redis as any, { key: otherKek })
+
+      await assert.rejects(
+        () => reader.getSecrets(['undecryptable']),
+        (error: Error) => {
+          assert.equal(
+            error.message,
+            'Failed to decrypt secret "undecryptable" (key_version 1): ' +
+              'the configured KEK does not match the key it was wrapped under'
+          )
+          assert.ok(error.cause, 'the underlying crypto failure is preserved')
+          return true
+        }
+      )
+    })
+
+    test('getSecrets throws when no KEK is available for a stored key_version', async () => {
+      const writer = new RedisSecretService(redis as any, {
+        key: kek,
+        keyVersion: 7,
+      })
+      await writer.setSecret('old-version', 'value')
+
+      const reader = new RedisSecretService(redis as any, {
+        key: kek,
+        keyVersion: 8,
+      })
+
+      await assert.rejects(
+        () => reader.getSecrets(['old-version']),
+        (error: Error) => {
+          assert.equal(
+            error.message,
+            'Failed to decrypt secret "old-version" (key_version 7): ' +
+              'the configured KEK does not match the key it was wrapped under'
+          )
+          return true
+        }
+      )
+    })
+
+    test('getSecrets returns every secret when they all decrypt', async () => {
+      const service = new RedisSecretService(redis as any, { key: kek })
+      await service.setSecret('batch-a', { v: 1 })
+      await service.setSecret('batch-b', 'two')
+
+      const out = await service.getSecrets<{
+        'batch-a': { v: number }
+        'batch-b': string
+      }>(['batch-a', 'batch-b'])
+
+      assert.deepEqual(out['batch-a']!.reveal(), { v: 1 })
+      assert.equal(out['batch-b']!.reveal(), 'two')
+    })
+
+    test('getSecrets omits keys that were never stored', async () => {
+      const service = new RedisSecretService(redis as any, { key: kek })
+      await service.setSecret('present', 'here')
+
+      const out = await service.getSecrets(['present', 'never-stored'])
+
+      assert.deepEqual(Object.keys(out), ['present'])
+      assert.equal(out.present!.reveal(), 'here')
+    })
+  })
 })

package/src/redis-secret-service.ts

@@ -1,6 +1,9 @@
-import type { SecretService } from '@pikku/core/services'
+import { createSecretValue, isSecretValue, type SecretValue } from '@pikku/core'
+import type { SecretService, SecretValues } from '@pikku/core/services'
 import { Redis, type RedisOptions } from 'ioredis'
 import {
+  deriveKEK,
+  generateKEKSalt,
   envelopeEncrypt,
   envelopeDecrypt,
   envelopeRewrap,
@@ -20,6 +23,8 @@ export class RedisSecretService implements SecretService {
   private keyVersion: number
   private previousKey?: string
   private keyPrefix: string
+  private kekSalts = new Map<number, string>()
+  private keks = new Map<number, CryptoKey>()
 
   constructor(
     connectionOrConfig: Redis | RedisOptions | string,
@@ -50,18 +55,52 @@ export class RedisSecretService implements SecretService {
     return `${this.keyPrefix}:secret:${key}`
   }
 
-  private getKEK(version: number): string {
-    if (version === this.keyVersion) return this.key
-    if (this.previousKey) return this.previousKey
-    throw new Error(`No KEK available for key_version ${version}`)
+  private saltKey(): string {
+    return `${this.keyPrefix}:kek-salt`
   }
 
-  async getSecret<T = string>(key: string): Promise<T> {
+  private async getKEKSalt(version: number): Promise<string> {
+    const cached = this.kekSalts.get(version)
+    if (cached) return cached
+
+    const field = String(version)
+    let salt = await this.redis.hget(this.saltKey(), field)
+    if (!salt) {
+      await this.redis.hsetnx(this.saltKey(), field, generateKEKSalt())
+      salt = await this.redis.hget(this.saltKey(), field)
+      if (!salt) {
+        throw new Error(
+          `Failed to persist a KEK salt for key_version ${version}`
+        )
+      }
+    }
+
+    this.kekSalts.set(version, salt)
+    return salt
+  }
+
+  private async getKEK(version: number): Promise<CryptoKey> {
+    const cached = this.keks.get(version)
+    if (cached) return cached
+
+    const passphrase = version === this.keyVersion ? this.key : this.previousKey
+    if (!passphrase) {
+      throw new Error(`No KEK available for key_version ${version}`)
+    }
+
+    const kek = await deriveKEK(passphrase, await this.getKEKSalt(version))
+    this.keks.set(version, kek)
+    return kek
+  }
+
+  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
     const data = await this.redis.hgetall(this.secretKey(key))
     if (!data.ciphertext) throw new Error('Requested secret not found')
 
-    const kek = this.getKEK(Number(data.key_version))
-    return envelopeDecrypt<T>(kek, data.ciphertext!, data.wrapped_dek!)
+    const kek = await this.getKEK(Number(data.key_version))
+    return createSecretValue(
+      await envelopeDecrypt<T>(kek, data.ciphertext!, data.wrapped_dek!)
+    )
   }
 
   async hasSecret(key: string): Promise<boolean> {
@@ -70,7 +109,12 @@ export class RedisSecretService implements SecretService {
   }
 
   async setSecret(key: string, value: unknown): Promise<void> {
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value)
+    // Encrypting the wrapper would store its redaction, not the secret —
+    // writing a secret back to the vault is exactly what this method is for.
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
+      await this.getKEK(this.keyVersion),
+      isSecretValue(value) ? value.reveal() : value
+    )
 
     await this.redis.hset(this.secretKey(key), {
       ciphertext,
@@ -83,16 +127,35 @@ export class RedisSecretService implements SecretService {
     await this.redis.del(this.secretKey(key))
   }
 
-  async getSecrets<
-    T extends Record<string, unknown> = Record<string, unknown>,
-  >(keys: (keyof T & string)[]): Promise<T> {
-    const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)))
+  async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
+    keys: (keyof T & string)[]
+  ): Promise<Partial<SecretValues<T>>> {
+    const rows = await Promise.all(
+      keys.map(async (key) => ({
+        key,
+        data: await this.redis.hgetall(this.secretKey(key)),
+      }))
+    )
+
     const out: Record<string, unknown> = {}
-    keys.forEach((key, i) => {
-      const result = results[i]
-      if (result?.status === 'fulfilled') out[key] = result.value
-    })
-    return out as T
+    for (const { key, data } of rows) {
+      if (!data.ciphertext) continue
+
+      const keyVersion = Number(data.key_version)
+      try {
+        const kek = await this.getKEK(keyVersion)
+        out[key] = createSecretValue(
+          await envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek!)
+        )
+      } catch (cause) {
+        throw new Error(
+          `Failed to decrypt secret "${key}" (key_version ${keyVersion}): ` +
+            `the configured KEK does not match the key it was wrapped under`,
+          { cause }
+        )
+      }
+    }
+    return out as Partial<SecretValues<T>>
   }
 
   async rotateKEK(): Promise<number> {
@@ -100,6 +163,9 @@ export class RedisSecretService implements SecretService {
       throw new Error('No previousKey configured — nothing to rotate from')
     }
 
+    const oldKEK = await this.getKEK(this.keyVersion - 1)
+    const newKEK = await this.getKEK(this.keyVersion)
+
     const pattern = `${this.keyPrefix}:secret:*`
     let cursor = '0'
     let count = 0
@@ -120,8 +186,8 @@ export class RedisSecretService implements SecretService {
         if (version >= this.keyVersion) continue
 
         const newWrappedDEK = await envelopeRewrap(
-          this.previousKey,
-          this.key,
+          oldKEK,
+          newKEK,
           data.wrapped_dek!
         )
         await this.redis.hset(redisKey, {

package/src/redis-workflow-service.ts

@@ -829,25 +829,6 @@ export class RedisWorkflowService extends PikkuWorkflowService {
     return { completedNodeIds, failedNodeIds, branchKeys }
   }
 
-  async getNodesWithoutSteps(
-    runId: string,
-    nodeIds: string[]
-  ): Promise<string[]> {
-    if (nodeIds.length === 0) return []
-
-    const result: string[] = []
-
-    for (const nodeId of nodeIds) {
-      const key = this.stepKey(runId, nodeId)
-      const exists = await this.redis.exists(key)
-      if (!exists) {
-        result.push(nodeId)
-      }
-    }
-
-    return result
-  }
-
   async getStepInstances(
     runId: string
   ): Promise<