@stigmer/runner 3.12.8 → 3.12.9

package/src/shared/runner-credential-keys.ts

@@ -63,7 +63,8 @@ export const RUNNER_CREDENTIAL_ENV_KEYS: readonly string[] = [
  * rotation bookkeeping, not secrets.
  */
 export const RUNNER_ENCRYPTION_ENV_KEYS: readonly string[] = [
-  // Temporal payload-encryption keys (encryption/config.ts). An agent that
+  // Temporal payload-encryption keys (@stigmer/temporal-codecs' encryption
+  // config, read through the injected getRunnerSecret). An agent that
   // reads these could decrypt the runner's Temporal history payloads.
   "STIGMER_PAYLOAD_ENCRYPTION_KEY",
   "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",

package/dist/claimcheck/compressor.d.ts

@@ -1,2 +0,0 @@
-export declare function compress(data: Buffer): Buffer<ArrayBuffer>;
-export declare function decompress(data: Buffer): Buffer<ArrayBuffer>;

package/dist/claimcheck/compressor.js

@@ -1,8 +0,0 @@
-import { gzipSync, gunzipSync } from "node:zlib";
-export function compress(data) {
-    return gzipSync(data);
-}
-export function decompress(data) {
-    return gunzipSync(data);
-}
-//# sourceMappingURL=compressor.js.map

package/dist/claimcheck/compressor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compressor.js","sourceRoot":"","sources":["../../src/claimcheck/compressor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAwB,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,IAAI,CAAwB,CAAC;AACjD,CAAC"}

package/dist/claimcheck/config.d.ts

@@ -1,7 +0,0 @@
-export interface ClaimcheckConfig {
-    readonly enabled: boolean;
-    readonly thresholdBytes: number;
-    readonly compressionEnabled: boolean;
-    readonly keyPrefix: string;
-}
-export declare function loadClaimcheckConfig(): ClaimcheckConfig;

package/dist/claimcheck/config.js

@@ -1,10 +0,0 @@
-const DEFAULT_THRESHOLD_BYTES = 128 * 1024; // 128KB
-export function loadClaimcheckConfig() {
-    return {
-        enabled: process.env.CLAIMCHECK_ENABLED === "true",
-        thresholdBytes: parseInt(process.env.CLAIMCHECK_THRESHOLD_BYTES ?? String(DEFAULT_THRESHOLD_BYTES), 10),
-        compressionEnabled: process.env.CLAIMCHECK_COMPRESSION_ENABLED !== "false",
-        keyPrefix: process.env.CLAIMCHECK_KEY_PREFIX ?? "claimcheck/",
-    };
-}
-//# sourceMappingURL=config.js.map

package/dist/claimcheck/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/claimcheck/config.ts"],"names":[],"mappings":"AAOA,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEpD,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM;QAClD,cAAc,EAAE,QAAQ,CACtB,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,MAAM,CAAC,uBAAuB,CAAC,EACzE,EAAE,CACH;QACD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,OAAO;QAC1E,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,aAAa;KAC9D,CAAC;AACJ,CAAC"}

package/dist/claimcheck/index.d.ts

@@ -1,3 +0,0 @@
-export { ClaimcheckPayloadCodec } from "./payload-codec.js";
-export { loadClaimcheckConfig, type ClaimcheckConfig } from "./config.js";
-export { compress, decompress } from "./compressor.js";

package/dist/claimcheck/index.js

@@ -1,4 +0,0 @@
-export { ClaimcheckPayloadCodec } from "./payload-codec.js";
-export { loadClaimcheckConfig } from "./config.js";
-export { compress, decompress } from "./compressor.js";
-//# sourceMappingURL=index.js.map

package/dist/claimcheck/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/claimcheck/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAyB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/claimcheck/payload-codec.d.ts

@@ -1,23 +0,0 @@
-/**
- * Temporal PayloadCodec that transparently offloads large payloads to
- * external storage (ArtifactStorage). Payloads below the threshold pass
- * through unchanged. Payloads at or above the threshold are compressed
- * (optional), uploaded, and replaced with a small reference marker.
- *
- * On decode, markers are detected, the original payload is downloaded
- * and decompressed, and the original bytes are restored — transparent
- * to workflow/activity code.
- */
-import type { Payload, PayloadCodec } from "@temporalio/common";
-import type { ArtifactStorage } from "../shared/artifact-storage.js";
-import type { ClaimcheckConfig } from "./config.js";
-export declare class ClaimcheckPayloadCodec implements PayloadCodec {
-    private readonly storage;
-    private readonly config;
-    constructor(storage: ArtifactStorage, config: ClaimcheckConfig);
-    encode(payloads: Payload[]): Promise<Payload[]>;
-    decode(payloads: Payload[]): Promise<Payload[]>;
-    private encodePayload;
-    private decodePayload;
-    private isClaimcheckPayload;
-}

package/dist/claimcheck/payload-codec.js

@@ -1,105 +0,0 @@
-/**
- * Temporal PayloadCodec that transparently offloads large payloads to
- * external storage (ArtifactStorage). Payloads below the threshold pass
- * through unchanged. Payloads at or above the threshold are compressed
- * (optional), uploaded, and replaced with a small reference marker.
- *
- * On decode, markers are detected, the original payload is downloaded
- * and decompressed, and the original bytes are restored — transparent
- * to workflow/activity code.
- */
-import { randomUUID } from "node:crypto";
-import { compress, decompress } from "./compressor.js";
-const MARKER_METADATA_KEY = "encoding";
-const MARKER_ENCODING_VALUE = "binary/claimcheck";
-export class ClaimcheckPayloadCodec {
-    storage;
-    config;
-    constructor(storage, config) {
-        this.storage = storage;
-        this.config = config;
-    }
-    async encode(payloads) {
-        return Promise.all(payloads.map((p) => this.encodePayload(p)));
-    }
-    async decode(payloads) {
-        return Promise.all(payloads.map((p) => this.decodePayload(p)));
-    }
-    async encodePayload(payload) {
-        const data = payload.data;
-        if (!data || data.length < this.config.thresholdBytes) {
-            return payload;
-        }
-        const originalBuf = Buffer.from(data);
-        let uploadBuf = originalBuf;
-        let compressed = false;
-        if (this.config.compressionEnabled) {
-            const compressedBuf = compress(originalBuf);
-            if (compressedBuf.length < originalBuf.length) {
-                uploadBuf = compressedBuf;
-                compressed = true;
-            }
-        }
-        const key = `${this.config.keyPrefix}${randomUUID()}`;
-        await this.storage.upload(key, uploadBuf, "application/octet-stream");
-        const marker = {
-            key,
-            size: data.length,
-            compressed,
-            metadata: serializeMetadata(payload.metadata),
-        };
-        return {
-            metadata: {
-                [MARKER_METADATA_KEY]: Buffer.from(MARKER_ENCODING_VALUE),
-            },
-            data: Buffer.from(JSON.stringify(marker)),
-        };
-    }
-    async decodePayload(payload) {
-        if (!this.isClaimcheckPayload(payload)) {
-            return payload;
-        }
-        const marker = JSON.parse(Buffer.from(payload.data).toString("utf-8"));
-        let rawBuf;
-        try {
-            rawBuf = await this.storage.download(marker.key);
-        }
-        catch (err) {
-            // Preserve the claimcheck-scoped error contract; the shared download error
-            // already carries the HTTP status (proxy) or the miss (local) as the cause.
-            const cause = err instanceof Error ? err.message : String(err);
-            throw new Error(`Claimcheck retrieve failed for key ${marker.key}: ${cause}`);
-        }
-        const dataBuf = marker.compressed ? decompress(rawBuf) : rawBuf;
-        return {
-            metadata: marker.metadata
-                ? deserializeMetadata(marker.metadata)
-                : payload.metadata,
-            data: dataBuf,
-        };
-    }
-    isClaimcheckPayload(payload) {
-        const encoding = payload.metadata?.[MARKER_METADATA_KEY];
-        if (!encoding)
-            return false;
-        return Buffer.from(encoding).toString("utf-8") === MARKER_ENCODING_VALUE;
-    }
-}
-function serializeMetadata(metadata) {
-    if (!metadata)
-        return undefined;
-    const out = {};
-    for (const [key, value] of Object.entries(metadata)) {
-        if (value)
-            out[key] = Buffer.from(value).toString("base64");
-    }
-    return out;
-}
-function deserializeMetadata(metadata) {
-    const out = {};
-    for (const [key, value] of Object.entries(metadata)) {
-        out[key] = Buffer.from(value, "base64");
-    }
-    return out;
-}
-//# sourceMappingURL=payload-codec.js.map

package/dist/claimcheck/payload-codec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"payload-codec.js","sourceRoot":"","sources":["../../src/claimcheck/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAgBlD,MAAM,OAAO,sBAAsB;IAEd;IACA;IAFnB,YACmB,OAAwB,EACxB,MAAwB;QADxB,YAAO,GAAP,OAAO,CAAiB;QACxB,WAAM,GAAN,MAAM,CAAkB;IACxC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,SAAS,GAAG,WAAW,CAAC;QAC5B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;gBAC9C,SAAS,GAAG,aAAa,CAAC;gBAC1B,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,UAAU,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAqB;YAC/B,GAAG;YACH,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,UAAU;YACV,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC9C,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE;gBACR,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;aAC1D;YACD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;SAC1C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAAqB,IAAI,CAAC,KAAK,CACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7C,CAAC;QAEF,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAEhE,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtC,CAAC,CAAC,OAAO,CAAC,QAAQ;YACpB,IAAI,EAAE,OAAO;SACd,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,OAAgB;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,qBAAqB,CAAC;IAC3E,CAAC;CACF;AAED,SAAS,iBAAiB,CACxB,QAA6B;IAE7B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgC;IAEhC,MAAM,GAAG,GAA+B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/encryption/config.d.ts

@@ -1,64 +0,0 @@
-/**
- * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
- *
- * Two key sources, strict precedence:
- *
- *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
- *      explicit choice: self-hosted deployments sharing one key with their
- *      server, and cloud sandboxes injected with the platform key. When the
- *      env key is set, bootstrap-delivered material is ignored entirely.
- *   2. Bootstrap-delivered — server-managed per-identity keys handed to
- *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
- *      only; persistence lives server-side, which is what makes Temporal
- *      replay work across runner restarts (every boot re-fetches the SAME
- *      key).
- *
- * Encryption is enabled iff a key is present from either source — the same
- * enabled-iff-configured pattern as the claim-check codec. A malformed key
- * fails the boot rather than silently running plaintext: an operator who set
- * the key (or a server that minted one) intended history to be encrypted.
- *
- * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via the
- * secondary pair while new payloads are written under the primary key.
- * Workers capture keys at construction, so a rotated bootstrap key lands
- * on the next runner boot — there is no live re-key.
- */
-export interface EncryptionKey {
-    readonly keyId: string;
-    /** 32-byte AES-256 key. */
-    readonly key: Buffer;
-}
-export interface PayloadEncryptionConfig {
-    /** Key used to encrypt outgoing payloads (and decrypt its own). */
-    readonly primary: EncryptionKey;
-    /** Decrypt-only key accepted during rotation windows. */
-    readonly secondary?: EncryptionKey;
-}
-/**
- * Server-managed key material delivered by getRunnerBootstrapConfig.
- * Structurally mirrors {@link BootstrapPayloadEncryptionKeys} in
- * stigmer-client.ts — declared here so this leaf module stays free of
- * client imports.
- */
-export interface BootstrapKeyMaterial {
-    readonly key: string;
-    readonly keyId?: string;
-    readonly secondaryKey?: string;
-    readonly secondaryKeyId?: string;
-}
-/**
- * Returns the encryption config, or undefined when encryption is not
- * configured (the codec is then simply not installed).
- *
- * Source precedence: the env key wins outright; bootstrap-delivered
- * material applies only when no env key is set (see the module doc).
- *
- * @throws when a key is present but malformed, or a key id is missing —
- *   key misconfiguration must stop the boot, not degrade to plaintext.
- *   This applies equally to bootstrap material: a server that hands out
- *   a bad key or omits its id has broken the protocol contract, and
- *   running plaintext against a server that manages keys would silently
- *   defeat the feature.
- */
-export declare function loadPayloadEncryptionConfig(bootstrap?: BootstrapKeyMaterial): PayloadEncryptionConfig | undefined;

package/dist/encryption/config.js

@@ -1,113 +0,0 @@
-/**
- * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
- *
- * Two key sources, strict precedence:
- *
- *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
- *      explicit choice: self-hosted deployments sharing one key with their
- *      server, and cloud sandboxes injected with the platform key. When the
- *      env key is set, bootstrap-delivered material is ignored entirely.
- *   2. Bootstrap-delivered — server-managed per-identity keys handed to
- *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
- *      only; persistence lives server-side, which is what makes Temporal
- *      replay work across runner restarts (every boot re-fetches the SAME
- *      key).
- *
- * Encryption is enabled iff a key is present from either source — the same
- * enabled-iff-configured pattern as the claim-check codec. A malformed key
- * fails the boot rather than silently running plaintext: an operator who set
- * the key (or a server that minted one) intended history to be encrypted.
- *
- * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via the
- * secondary pair while new payloads are written under the primary key.
- * Workers capture keys at construction, so a rotated bootstrap key lands
- * on the next runner boot — there is no live re-key.
- */
-import { getRunnerSecret } from "../shared/runner-credential-store.js";
-const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
-const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
-const SECONDARY_KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY";
-const SECONDARY_KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID";
-const AES_256_KEY_BYTES = 32;
-/**
- * Returns the encryption config, or undefined when encryption is not
- * configured (the codec is then simply not installed).
- *
- * Source precedence: the env key wins outright; bootstrap-delivered
- * material applies only when no env key is set (see the module doc).
- *
- * @throws when a key is present but malformed, or a key id is missing —
- *   key misconfiguration must stop the boot, not degrade to plaintext.
- *   This applies equally to bootstrap material: a server that hands out
- *   a bad key or omits its id has broken the protocol contract, and
- *   running plaintext against a server that manages keys would silently
- *   defeat the feature.
- */
-export function loadPayloadEncryptionConfig(bootstrap) {
-    // Key VALUES resolve through the credential store (the #508 boot capture
-    // moves them out of process.env — agent shells must not read them); the
-    // *_KEY_ID companions are rotation bookkeeping, not secrets, and stay
-    // plain env reads.
-    const rawKey = getRunnerSecret(KEY_ENV);
-    if (rawKey) {
-        const primary = {
-            keyId: requireKeyId(KEY_ID_ENV),
-            key: parseKey(rawKey, KEY_ENV),
-        };
-        const rawSecondary = getRunnerSecret(SECONDARY_KEY_ENV);
-        const secondary = rawSecondary
-            ? {
-                keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
-                key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
-            }
-            : undefined;
-        return { primary, secondary };
-    }
-    if (bootstrap?.key) {
-        const primary = {
-            keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
-            key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
-        };
-        const secondary = bootstrap.secondaryKey
-            ? {
-                keyId: requireBootstrapKeyId(bootstrap.secondaryKeyId, "payload_encryption_secondary_key_id"),
-                key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
-            }
-            : undefined;
-        return { primary, secondary };
-    }
-    return undefined;
-}
-function requireKeyId(envName) {
-    const keyId = process.env[envName];
-    // An explicit id is required (no default): during rotation two keys
-    // coexist, and payloads must name which one encrypted them.
-    if (!keyId) {
-        throw new Error(`Payload encryption misconfigured: ${envName} is required when the ` +
-            `corresponding key is set`);
-    }
-    return keyId;
-}
-function requireBootstrapKeyId(keyId, fieldName) {
-    if (!keyId) {
-        throw new Error(`Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
-            `refusing to encrypt under an unidentified key (server contract violation)`);
-    }
-    return keyId;
-}
-function parseKey(rawBase64, envName) {
-    let key;
-    try {
-        key = Buffer.from(rawBase64, "base64");
-    }
-    catch {
-        throw new Error(`Payload encryption misconfigured: ${envName} is not valid base64`);
-    }
-    if (key.length !== AES_256_KEY_BYTES) {
-        throw new Error(`Payload encryption misconfigured: ${envName} must decode to ` +
-            `${AES_256_KEY_BYTES} bytes (AES-256), got ${key.length}`);
-    }
-    return key;
-}
-//# sourceMappingURL=config.js.map

package/dist/encryption/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AA4BvE,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AACrE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAgC;IAEhC,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,mBAAmB;IACnB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;SAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,SAAS,GAA8B,YAAY;YACvD,CAAC,CAAC;gBACE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;aAC/C;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC;YAC1E,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,kCAAkC,CAAC;SACjE,CAAC;QAEF,MAAM,SAAS,GAA8B,SAAS,CAAC,YAAY;YACjE,CAAC,CAAC;gBACE,KAAK,EAAE,qBAAqB,CAC1B,SAAS,CAAC,cAAc,EACxB,qCAAqC,CACtC;gBACD,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,4CAA4C,CAAC;aACpF;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,wBAAwB;YAClE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB,EAAE,SAAiB;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,KAAK;YAC9E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,sBAAsB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,kBAAkB;YAC5D,GAAG,iBAAiB,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/encryption/index.d.ts

@@ -1,3 +0,0 @@
-export { EncryptionPayloadCodec } from "./payload-codec.js";
-export { loadPayloadEncryptionConfig } from "./config.js";
-export type { PayloadEncryptionConfig, EncryptionKey } from "./config.js";

package/dist/encryption/index.js

@@ -1,3 +0,0 @@
-export { EncryptionPayloadCodec } from "./payload-codec.js";
-export { loadPayloadEncryptionConfig } from "./config.js";
-//# sourceMappingURL=index.js.map

package/dist/encryption/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC"}

package/dist/encryption/payload-codec.d.ts

@@ -1,41 +0,0 @@
-/**
- * Temporal PayloadCodec that encrypts payloads at rest in workflow
- * history (stigmer-cloud#227).
- *
- * Why: the workflow engine runs inside the Temporal deterministic
- * sandbox, so decrypted execution-context values cross the history
- * boundary in many places — the hydrate activity result, the runtime
- * env passed as an input to every per-task activity, and expression
- * results recorded as local-activity markers. Encrypting at the payload
- * codec layer closes the entire class with one mechanism instead of
- * chasing each crossing.
- *
- * Envelope (cross-SDK contract — the Java decode-only codec in
- * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
- * by the conformance fixture in __tests__/fixtures/):
- *
- *   metadata: encoding            = "binary/encrypted"
- *             encryption-key-id   = <key id that encrypted this payload>
- *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
- *
- * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
- * data), so decode restores the payload exactly — including its
- * original encoding — with no side channel.
- *
- * Decode passes through payloads it did not encode. This is what keeps
- * plaintext signals from the Java/Go orchestrators and pre-rollout
- * in-flight histories working with zero migration. Everything else
- * fails closed: unknown key id, missing key id, and ciphertext tampering
- * all throw rather than surfacing bogus payloads.
- */
-import type { Payload, PayloadCodec } from "@temporalio/common";
-import type { PayloadEncryptionConfig } from "./config.js";
-export declare class EncryptionPayloadCodec implements PayloadCodec {
-    private readonly config;
-    private readonly decryptKeysById;
-    constructor(config: PayloadEncryptionConfig);
-    encode(payloads: Payload[]): Promise<Payload[]>;
-    decode(payloads: Payload[]): Promise<Payload[]>;
-    private encodePayload;
-    private decodePayload;
-}

package/dist/encryption/payload-codec.js

@@ -1,130 +0,0 @@
-/**
- * Temporal PayloadCodec that encrypts payloads at rest in workflow
- * history (stigmer-cloud#227).
- *
- * Why: the workflow engine runs inside the Temporal deterministic
- * sandbox, so decrypted execution-context values cross the history
- * boundary in many places — the hydrate activity result, the runtime
- * env passed as an input to every per-task activity, and expression
- * results recorded as local-activity markers. Encrypting at the payload
- * codec layer closes the entire class with one mechanism instead of
- * chasing each crossing.
- *
- * Envelope (cross-SDK contract — the Java decode-only codec in
- * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
- * by the conformance fixture in __tests__/fixtures/):
- *
- *   metadata: encoding            = "binary/encrypted"
- *             encryption-key-id   = <key id that encrypted this payload>
- *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
- *
- * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
- * data), so decode restores the payload exactly — including its
- * original encoding — with no side channel.
- *
- * Decode passes through payloads it did not encode. This is what keeps
- * plaintext signals from the Java/Go orchestrators and pre-rollout
- * in-flight histories working with zero migration. Everything else
- * fails closed: unknown key id, missing key id, and ciphertext tampering
- * all throw rather than surfacing bogus payloads.
- */
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-// Default-import + destructure, NOT `import { temporal } from …`:
-// @temporalio/proto is CommonJS and its `temporal` export defeats Node's
-// cjs-module-lexer named-export detection, so the named form loads under
-// tsx/vitest (their interop is looser) but crashes plain `node dist/main.js`
-// at startup with "Named export 'temporal' not found" (stigmer/stigmer#399
-// boot regression). Pinned by scripts/verify-dist-boot.mjs in CI.
-import proto from "@temporalio/proto";
-const { temporal } = proto;
-const ENCODING_METADATA_KEY = "encoding";
-const ENCRYPTED_ENCODING_VALUE = "binary/encrypted";
-const KEY_ID_METADATA_KEY = "encryption-key-id";
-/** AES-GCM parameters shared with the Java implementation. */
-const IV_BYTES = 12;
-const AUTH_TAG_BYTES = 16;
-export class EncryptionPayloadCodec {
-    config;
-    decryptKeysById;
-    constructor(config) {
-        this.config = config;
-        this.decryptKeysById = new Map([[config.primary.keyId, config.primary.key]]);
-        if (config.secondary) {
-            this.decryptKeysById.set(config.secondary.keyId, config.secondary.key);
-        }
-    }
-    async encode(payloads) {
-        return payloads.map((p) => this.encodePayload(p));
-    }
-    async decode(payloads) {
-        return payloads.map((p) => this.decodePayload(p));
-    }
-    encodePayload(payload) {
-        // Data-less payloads (binary/null from void results) stay as-is:
-        // there is nothing to protect, and the cross-language parents that
-        // await our workflows as void must be able to read them without a key.
-        if (!payload.data || payload.data.length === 0) {
-            return payload;
-        }
-        const plaintext = temporal.api.common.v1.Payload.encode(payload).finish();
-        return {
-            metadata: {
-                [ENCODING_METADATA_KEY]: Buffer.from(ENCRYPTED_ENCODING_VALUE),
-                [KEY_ID_METADATA_KEY]: Buffer.from(this.config.primary.keyId),
-            },
-            data: encrypt(plaintext, this.config.primary),
-        };
-    }
-    decodePayload(payload) {
-        if (!isEncryptedPayload(payload)) {
-            return payload;
-        }
-        const keyIdBytes = payload.metadata?.[KEY_ID_METADATA_KEY];
-        if (!keyIdBytes) {
-            throw new Error("Encrypted payload is missing its encryption-key-id metadata — refusing to decode");
-        }
-        const keyId = Buffer.from(keyIdBytes).toString("utf-8");
-        const key = this.decryptKeysById.get(keyId);
-        if (!key) {
-            throw new Error(`Encrypted payload uses unknown key id '${keyId}' — configure it as the ` +
-                `primary or secondary payload encryption key (rotation window?)`);
-        }
-        const plaintext = decrypt(payload.data, key, keyId);
-        return temporal.api.common.v1.Payload.decode(plaintext);
-    }
-}
-function isEncryptedPayload(payload) {
-    const encoding = payload.metadata?.[ENCODING_METADATA_KEY];
-    if (!encoding)
-        return false;
-    return Buffer.from(encoding).toString("utf-8") === ENCRYPTED_ENCODING_VALUE;
-}
-function encrypt(plaintext, key) {
-    const iv = randomBytes(IV_BYTES);
-    const cipher = createCipheriv("aes-256-gcm", key.key, iv);
-    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    // Layout iv ‖ ciphertext ‖ tag matches Java's AES/GCM/NoPadding, whose
-    // doFinal() output is ciphertext ‖ tag.
-    return Buffer.concat([iv, ciphertext, cipher.getAuthTag()]);
-}
-function decrypt(data, key, keyId) {
-    if (data.length < IV_BYTES + AUTH_TAG_BYTES) {
-        throw new Error(`Encrypted payload under key id '${keyId}' is truncated (${data.length} bytes)`);
-    }
-    const buf = Buffer.from(data);
-    const iv = buf.subarray(0, IV_BYTES);
-    const ciphertext = buf.subarray(IV_BYTES, buf.length - AUTH_TAG_BYTES);
-    const tag = buf.subarray(buf.length - AUTH_TAG_BYTES);
-    const decipher = createDecipheriv("aes-256-gcm", key, iv);
-    decipher.setAuthTag(tag);
-    try {
-        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-    }
-    catch {
-        // GCM auth failure: tampered ciphertext or a key that does not match
-        // its advertised id. Never surface partially decrypted bytes.
-        throw new Error(`Failed to decrypt payload under key id '${keyId}' — ciphertext is ` +
-            `corrupt or the configured key does not match`);
-    }
-}
-//# sourceMappingURL=payload-codec.js.map

package/dist/encryption/payload-codec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"payload-codec.js","sourceRoot":"","sources":["../../src/encryption/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,OAAO,KAAK,MAAM,mBAAmB,CAAC;AAGtC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;AAE3B,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,OAAO,sBAAsB;IAGJ;IAFZ,eAAe,CAAsB;IAEtD,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QAC1D,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,iEAAiE;QACjE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO;YACL,QAAQ,EAAE;gBACR,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;gBAC9D,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC9D;YACD,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;SAC9C,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,0BAA0B;gBACvE,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,wBAAwB,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,SAAqB,EAAE,GAAkB;IACxD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,uEAAuE;IACvE,wCAAwC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,GAAW,EAAE,KAAa;IAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,mBAAmB,IAAI,CAAC,MAAM,SAAS,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,oBAAoB;YAClE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}