@stigmer/server 3.14.0-dev.20260910084630

package/dist/encryption/key-manager.js

@@ -0,0 +1,130 @@
+/**
+ * Named-key loader — ports pkg/encryption/keymanager.go.
+ *
+ * One convention for every 32-byte key the server holds (sub-project
+ * DD-002): env var (Base64) → ~/.stigmer/<file> (raw bytes, 0600) →
+ * auto-generate and persist. The loader is generalized over the env var
+ * and file name so sibling key material (the runner-token signing key,
+ * oss#535) rides the same ladder instead of growing a divergent loader.
+ *
+ * Ladder semantics, exactly Go's:
+ *   - An EXPLICITLY configured env key that is unusable (bad Base64, wrong
+ *     length) is an ERROR, never a degrade — silently ignoring deliberate
+ *     configuration would be worse than refusing to boot.
+ *   - A key file that fails its load checks (permissions other than 0600,
+ *     wrong size) is never adopted; the ladder FALLS THROUGH to
+ *     auto-generate, which overwrites the file's content — Go's shipped
+ *     behavior (loadKeyFromFile error → generate → save), ported as-is.
+ *   - Auto-generation persists for future boots; a persist FAILURE is a
+ *     stderr warning only — the key is still usable for this process.
+ *
+ * `env` and `homeDir` are injectable with process defaults — the
+ * loadConfig(env = process.env) idiom (boot/config.ts) — so unit tests
+ * stay hermetic and never touch the real ~/.stigmer (DD-002). The key env
+ * vars deliberately do NOT ride ServerConfig: Go's pkg/config never sees
+ * them either, and config.ts's contract is that no entry exists before
+ * the code that reads it.
+ */
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** AES-256 / HMAC-SHA256 key size (32 bytes = 256 bits) — Go KeySize. */
+export const KEY_SIZE = 32;
+/** Directory under home for key files — Go KeyFileDir. */
+export const KEY_FILE_DIR = ".stigmer";
+/** Key file permissions (owner read/write only) — Go KeyFilePermissions. */
+export const KEY_FILE_PERMISSIONS = 0o600;
+/** Key directory permissions — Go KeyDirPermissions. */
+export const KEY_DIR_PERMISSIONS = 0o700;
+/**
+ * Go GetOrCreateNamedKey: env var → key file → auto-generate. Throws only
+ * on unusable EXPLICIT configuration (bad env value) or when no key can be
+ * produced at all.
+ */
+export function getOrCreateNamedKey(envVar, fileName, options = {}) {
+    const env = options.env ?? process.env;
+    // 1. Environment variable (highest priority) — Base64-encoded 32 bytes.
+    const envValue = env[envVar];
+    if (envValue !== undefined && envValue !== "") {
+        return decodeEnvKey(envVar, envValue);
+    }
+    // 2. Local key file — raw 32 bytes, refused on insecure permissions.
+    const keyPath = namedKeyFilePath(fileName, options);
+    const fromFile = loadKeyFromFile(keyPath);
+    if (fromFile !== undefined) {
+        return fromFile;
+    }
+    // 3. Auto-generate (local development); persist for future boots.
+    const key = randomBytes(KEY_SIZE);
+    try {
+        saveKeyToFile(keyPath, key);
+    }
+    catch (error) {
+        // Warn but don't fail — the key is still usable (Go's posture).
+        process.stderr.write(`Warning: could not save key to ${keyPath}: ${error instanceof Error ? error.message : String(error)}\n`);
+    }
+    return key;
+}
+/** Strict Base64 decode + length check for an env-configured key. */
+function decodeEnvKey(envVar, value) {
+    const key = Buffer.from(value, "base64");
+    // Node's base64 decoder is lenient (skips invalid characters, accepts
+    // missing padding) and never throws; Go's StdEncoding errors on any
+    // non-canonical input. Round-tripping — Buffer always re-emits the
+    // canonical padded form — restores Go's strictness.
+    if (key.toString("base64") !== value) {
+        throw new Error(`invalid Base64 encoding in ${envVar}`);
+    }
+    if (key.length !== KEY_SIZE) {
+        throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${key.length} bytes`);
+    }
+    return key;
+}
+/** Path to a named key file under <home>/.stigmer. */
+export function namedKeyFilePath(fileName, options = {}) {
+    const home = options.homeDir ?? os.homedir();
+    return path.join(home, KEY_FILE_DIR, fileName);
+}
+/**
+ * Reads raw key bytes, mirroring Go loadKeyFromFile: missing file →
+ * undefined (fall through the ladder); present-but-wrong (insecure
+ * permissions, wrong size) also falls through — exactly Go's behavior,
+ * where any load error falls to auto-generate. The 0600 check is skipped
+ * on Windows, where POSIX modes are not meaningful.
+ */
+function loadKeyFromFile(keyPath) {
+    let stat;
+    try {
+        stat = fs.statSync(keyPath);
+    }
+    catch {
+        return undefined;
+    }
+    if (process.platform !== "win32") {
+        const mode = stat.mode & 0o777;
+        if (mode !== KEY_FILE_PERMISSIONS) {
+            return undefined;
+        }
+    }
+    let key;
+    try {
+        key = fs.readFileSync(keyPath);
+    }
+    catch {
+        return undefined;
+    }
+    if (key.length !== KEY_SIZE) {
+        return undefined;
+    }
+    return key;
+}
+/** Writes the key with secure permissions (dir 0700, file 0600). */
+function saveKeyToFile(keyPath, key) {
+    fs.mkdirSync(path.dirname(keyPath), {
+        recursive: true,
+        mode: KEY_DIR_PERMISSIONS,
+    });
+    fs.writeFileSync(keyPath, key, { mode: KEY_FILE_PERMISSIONS });
+}
+//# sourceMappingURL=key-manager.js.map

package/dist/encryption/key-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AASzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,0DAA0D,GAAG,CAAC,MAAM,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IACjD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/encryption/scope.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The scope under which a secret is encrypted — ports the cloud edition's
+ * ai.stigmer.infra.encryption.EncryptionScope record: its tenancy (which
+ * key-encryption key wraps it) and — when the write version needs one —
+ * the location of the secret in the resource model (which vault KV path
+ * stores its value).
+ *
+ * Exists as a type (rather than bare strings threaded through encrypt) so
+ * a call site cannot pass unvalidated or empty values, and so the
+ * tenant-name derivation lives in exactly one place.
+ *
+ * The tenant segment — one discriminator for keys and paths:
+ * `tenantSegment` is `org-<slug>` for organization-scoped resources and
+ * the literal `platform` for platform-scoped ones. The same string is the
+ * Transit key name (kekKeyName) and the KV path root, deliberately: the
+ * `org-` prefix makes an organization literally named "platform"
+ * collision-free in both namespaces at once.
+ *
+ * Located scopes (v3 writes): the vault-backed enc:v3: codec derives a KV
+ * path `{tenant}/{kind}/{id}/{key}` (enc-v3-wire-format.md in the vault
+ * migration project docs), so v3 writes need a scope carrying kind and id
+ * — built with forOrganizationResource / forPlatformResource. The v1/v2
+ * codecs ignore location entirely, so their call sites use
+ * forOrganization unchanged (the pre-v3 posture, kept deliberately —
+ * write paths adopt located scopes only when a v3 write flip demands
+ * them). keyName names the secret for SINGULAR encrypts (withKeyName);
+ * batch encrypts take key names from their map keys instead.
+ *
+ * Validation: org slugs must match the org-slug contract from
+ * ai.stigmer.commons.apiresource metadata.proto
+ * (^[a-z][a-z0-9-]*[a-z0-9]$, min 2 chars). That charset is safe as a
+ * Transit key name and as a KV path segment, so passing validation here
+ * guarantees the derived names need no escaping. The check matters even
+ * though callers read the org from server state, not client input: a
+ * malformed slug reaching a crypto key name would otherwise fail deep
+ * inside the vault with a routing error naming nothing.
+ */
+/** The reserved tenant segment for platform-scoped resources. */
+export declare const PLATFORM_TENANT = "platform";
+export declare class EncryptionScope {
+    /** `org-<slug>` or `platform` — the Transit key name and KV path root. */
+    readonly tenantSegment: string;
+    /** The resource kind, lowercase (undefined when not located). */
+    readonly kind: string | undefined;
+    /** The resource's immutable identity (undefined exactly when kind is). */
+    readonly id: string | undefined;
+    /** The secret's key name for singular encrypts (undefined for batch calls). */
+    readonly keyName: string | undefined;
+    private constructor();
+    /**
+     * A tenancy-only scope — all a v1/v2 write needs. The long-standing
+     * factory; every pre-v3 call site uses exactly this.
+     */
+    static forOrganization(orgSlug: string): EncryptionScope;
+    /**
+     * A located org-scoped scope, as v3 batch writes need: the KV path root
+     * is `org-<slug>/<kind>/<id>`, key names come from the batch map keys.
+     */
+    static forOrganizationResource(orgSlug: string, kind: string, id: string): EncryptionScope;
+    /**
+     * A located platform-scoped scope (e.g. CursorAccount in the cloud
+     * composition): the KV path root is `platform/<kind>/<id>` and the KEK
+     * is the reserved PLATFORM_TENANT Transit key.
+     */
+    static forPlatformResource(kind: string, id: string): EncryptionScope;
+    /**
+     * This scope with the secret's key name attached — for SINGULAR
+     * encrypts, where no batch map key can name the secret. Requires a
+     * located scope.
+     */
+    withKeyName(keyName: string): EncryptionScope;
+    /** Whether this scope names a resource location (required for v3 writes). */
+    isLocated(): boolean;
+    /**
+     * The Transit key name that wraps data keys for this scope — identical
+     * to tenantSegment by design (see the module header).
+     */
+    kekKeyName(): string;
+}
+//# sourceMappingURL=scope.d.ts.map

package/dist/encryption/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/encryption/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,iEAAiE;AACjE,eAAO,MAAM,eAAe,aAAa,CAAC;AAe1C,qBAAa,eAAe;IAExB,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IARtC,OAAO;IAWP;;;OAGG;IACH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe;IASxD;;;OAGG;IACH,MAAM,CAAC,uBAAuB,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,eAAe;IAKlB;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,eAAe;IAKrE;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe;IAY7C,6EAA6E;IAC7E,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}

package/dist/encryption/scope.js

@@ -0,0 +1,133 @@
+/**
+ * The scope under which a secret is encrypted — ports the cloud edition's
+ * ai.stigmer.infra.encryption.EncryptionScope record: its tenancy (which
+ * key-encryption key wraps it) and — when the write version needs one —
+ * the location of the secret in the resource model (which vault KV path
+ * stores its value).
+ *
+ * Exists as a type (rather than bare strings threaded through encrypt) so
+ * a call site cannot pass unvalidated or empty values, and so the
+ * tenant-name derivation lives in exactly one place.
+ *
+ * The tenant segment — one discriminator for keys and paths:
+ * `tenantSegment` is `org-<slug>` for organization-scoped resources and
+ * the literal `platform` for platform-scoped ones. The same string is the
+ * Transit key name (kekKeyName) and the KV path root, deliberately: the
+ * `org-` prefix makes an organization literally named "platform"
+ * collision-free in both namespaces at once.
+ *
+ * Located scopes (v3 writes): the vault-backed enc:v3: codec derives a KV
+ * path `{tenant}/{kind}/{id}/{key}` (enc-v3-wire-format.md in the vault
+ * migration project docs), so v3 writes need a scope carrying kind and id
+ * — built with forOrganizationResource / forPlatformResource. The v1/v2
+ * codecs ignore location entirely, so their call sites use
+ * forOrganization unchanged (the pre-v3 posture, kept deliberately —
+ * write paths adopt located scopes only when a v3 write flip demands
+ * them). keyName names the secret for SINGULAR encrypts (withKeyName);
+ * batch encrypts take key names from their map keys instead.
+ *
+ * Validation: org slugs must match the org-slug contract from
+ * ai.stigmer.commons.apiresource metadata.proto
+ * (^[a-z][a-z0-9-]*[a-z0-9]$, min 2 chars). That charset is safe as a
+ * Transit key name and as a KV path segment, so passing validation here
+ * guarantees the derived names need no escaping. The check matters even
+ * though callers read the org from server state, not client input: a
+ * malformed slug reaching a crypto key name would otherwise fail deep
+ * inside the vault with a routing error naming nothing.
+ */
+/** The reserved tenant segment for platform-scoped resources. */
+export const PLATFORM_TENANT = "platform";
+/** Prefix of organization tenant segments; what makes PLATFORM_TENANT unclaimable. */
+const ORG_TENANT_PREFIX = "org-";
+/**
+ * The org-slug contract from metadata.proto, verbatim. Kept in lockstep
+ * with the proto: a value that passes resource validation always passes
+ * here.
+ */
+const ORG_SLUG = /^[a-z][a-z0-9-]*[a-z0-9]$/;
+/** Resource kinds are server-side constants: lowercase, no separators. */
+const KIND = /^[a-z][a-z0-9]*$/;
+export class EncryptionScope {
+    tenantSegment;
+    kind;
+    id;
+    keyName;
+    constructor(
+    /** `org-<slug>` or `platform` — the Transit key name and KV path root. */
+    tenantSegment, 
+    /** The resource kind, lowercase (undefined when not located). */
+    kind, 
+    /** The resource's immutable identity (undefined exactly when kind is). */
+    id, 
+    /** The secret's key name for singular encrypts (undefined for batch calls). */
+    keyName) {
+        this.tenantSegment = tenantSegment;
+        this.kind = kind;
+        this.id = id;
+        this.keyName = keyName;
+    }
+    /**
+     * A tenancy-only scope — all a v1/v2 write needs. The long-standing
+     * factory; every pre-v3 call site uses exactly this.
+     */
+    static forOrganization(orgSlug) {
+        return new EncryptionScope(orgSegment(orgSlug), undefined, undefined, undefined);
+    }
+    /**
+     * A located org-scoped scope, as v3 batch writes need: the KV path root
+     * is `org-<slug>/<kind>/<id>`, key names come from the batch map keys.
+     */
+    static forOrganizationResource(orgSlug, kind, id) {
+        validateLocation(kind, id);
+        return new EncryptionScope(orgSegment(orgSlug), kind, id, undefined);
+    }
+    /**
+     * A located platform-scoped scope (e.g. CursorAccount in the cloud
+     * composition): the KV path root is `platform/<kind>/<id>` and the KEK
+     * is the reserved PLATFORM_TENANT Transit key.
+     */
+    static forPlatformResource(kind, id) {
+        validateLocation(kind, id);
+        return new EncryptionScope(PLATFORM_TENANT, kind, id, undefined);
+    }
+    /**
+     * This scope with the secret's key name attached — for SINGULAR
+     * encrypts, where no batch map key can name the secret. Requires a
+     * located scope.
+     */
+    withKeyName(keyName) {
+        if (this.kind === undefined) {
+            throw new Error(`encryption scope keyName requires a located scope (kind + id) - keyName '${keyName}' names a secret inside a resource`);
+        }
+        if (keyName === "") {
+            throw new Error("encryption scope keyName must not be empty");
+        }
+        return new EncryptionScope(this.tenantSegment, this.kind, this.id, keyName);
+    }
+    /** Whether this scope names a resource location (required for v3 writes). */
+    isLocated() {
+        return this.kind !== undefined;
+    }
+    /**
+     * The Transit key name that wraps data keys for this scope — identical
+     * to tenantSegment by design (see the module header).
+     */
+    kekKeyName() {
+        return this.tenantSegment;
+    }
+}
+function orgSegment(orgSlug) {
+    if (!ORG_SLUG.test(orgSlug)) {
+        throw new Error(`encryption scope requires a valid org slug (pattern ${ORG_SLUG.source}), got: '${orgSlug}'`);
+    }
+    return ORG_TENANT_PREFIX + orgSlug;
+}
+function validateLocation(kind, id) {
+    if (!KIND.test(kind)) {
+        throw new Error(`encryption scope kind must be a lowercase server-side constant (pattern ${KIND.source}), got: '${kind}'`);
+    }
+    if (id.trim() === "") {
+        throw new Error("encryption scope id must not be blank");
+    }
+}
+//# sourceMappingURL=scope.js.map

package/dist/encryption/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/encryption/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;GAIG;AACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAE7C,0EAA0E;AAC1E,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEhC,MAAM,OAAO,eAAe;IAGf;IAEA;IAEA;IAEA;IARX;IACE,0EAA0E;IACjE,aAAqB;IAC9B,iEAAiE;IACxD,IAAwB;IACjC,0EAA0E;IACjE,EAAsB;IAC/B,+EAA+E;IACtE,OAA2B;QAN3B,kBAAa,GAAb,aAAa,CAAQ;QAErB,SAAI,GAAJ,IAAI,CAAoB;QAExB,OAAE,GAAF,EAAE,CAAoB;QAEtB,YAAO,GAAP,OAAO,CAAoB;IACnC,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,eAAe,CAAC,OAAe;QACpC,OAAO,IAAI,eAAe,CACxB,UAAU,CAAC,OAAO,CAAC,EACnB,SAAS,EACT,SAAS,EACT,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,uBAAuB,CAC5B,OAAe,EACf,IAAY,EACZ,EAAU;QAEV,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,IAAY,EAAE,EAAU;QACjD,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,OAAe;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,4EAA4E,OAAO,oCAAoC,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uDAAuD,QAAQ,CAAC,MAAM,YAAY,OAAO,GAAG,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,GAAG,OAAO,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,EAAU;IAChD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,2EAA2E,IAAI,CAAC,MAAM,YAAY,IAAI,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/encryption/v1-codec.d.ts

@@ -0,0 +1,36 @@
+import type { SecretCodec } from "./codec.js";
+import type { EncryptionScope } from "./scope.js";
+/** Nonce size for AES-GCM (12 bytes = 96 bits, NIST) — Go GCMNonceSize. */
+export declare const GCM_NONCE_SIZE = 12;
+/** GCM authentication tag size (128 bits) — Go's gcm.Overhead(). */
+export declare const GCM_TAG_SIZE = 16;
+/** Version prefix for v1-encrypted values — Go EncryptedPrefix. */
+export declare const ENCRYPTED_PREFIX = "enc:v1:";
+/** The version token the static-key codec serves. */
+export declare const V1_VERSION = "v1";
+export declare class StaticKeySecretCodec implements SecretCodec {
+    readonly version = "v1";
+    private readonly key;
+    /**
+     * Go NewSecretService's key contract, now the codec's: nil/empty key →
+     * disabled (keyless) codec; a present key must be exactly 32 bytes.
+     */
+    constructor(key: Buffer | undefined);
+    /** Go IsEnabled: whether a key is configured. */
+    isEnabled(): boolean;
+    /**
+     * Go Encrypt's crypto arm: enc:v1:<base64(nonce || ct || tag)>;
+     * disabled → plaintext unchanged (the WARN-degrade posture). The
+     * already-prefixed idempotent pass-through is facade policy and never
+     * reaches here.
+     */
+    encrypt(plaintext: string, _scope: EncryptionScope): Promise<string>;
+    /**
+     * Go Decrypt's crypto arm: the value carries this codec's prefix (the
+     * facade dispatched it here) and decrypts or fails with the taxonomy
+     * the callers branch on (invalid-ciphertext / decryption-failed /
+     * encryption-disabled).
+     */
+    decrypt(encrypted: string): Promise<string>;
+}
+//# sourceMappingURL=v1-codec.d.ts.map

package/dist/encryption/v1-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1-codec.d.ts","sourceRoot":"","sources":["../../src/encryption/v1-codec.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAO9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,2EAA2E;AAC3E,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,oEAAoE;AACpE,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C,qDAAqD;AACrD,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,qBAAa,oBAAqB,YAAW,WAAW;IACtD,QAAQ,CAAC,OAAO,QAAc;IAE9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC;;;OAGG;gBACS,GAAG,EAAE,MAAM,GAAG,SAAS;IAanC,iDAAiD;IACjD,SAAS,IAAI,OAAO;IAIpB;;;;;OAKG;IAGG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1E;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAkClD"}

package/dist/encryption/v1-codec.js

@@ -0,0 +1,120 @@
+/**
+ * The built-in enc:v1 static-key codec — the crypto that lived directly
+ * on SecretService before the versioned-codec seam (20260830.04 Stage 1),
+ * extracted byte-for-byte. Provenance: ports pkg/encryption/encryption.go
+ * (the retired Go server), the Go twin of the cloud edition's RETIRED v1
+ * codec (deleted 2026-08, PR-3 of the vault migration). Cross-edition
+ * wire contract: same wire format, but a DIFFERENT key per deployment —
+ * the OSS enc:v1 is a same-wire-format SIBLING of the cloud's retired v1,
+ * never interchangeable ciphertext.
+ *
+ * Format: enc:v1:<base64(nonce || ciphertext || tag)>
+ *   - AES-256-GCM, 12-byte crypto-random nonce (unique per encryption),
+ *     16-byte GCM tag, standard padded Base64.
+ *
+ * Keyless ("disabled") semantics are load-bearing and asymmetric:
+ *   - encrypt() passes plaintext through (the WARN-degrade posture — the
+ *     write steps own the per-request warning, oss#394);
+ *   - decrypt() fails loud (EncryptionDisabledError): stored ciphertext
+ *     with no key must never be returned as-is.
+ * The unprefixed-plaintext pass-through (pre-oss#405 rows) is FACADE
+ * policy, not codec behavior — this codec only ever sees enc:v1: values.
+ *
+ * The scope parameter is deliberately ignored: v1 has one deployment-wide
+ * key, no per-tenant KEK and no location. It is threaded anyway so every
+ * call site already carries the tenancy a vault-backed codec needs — the
+ * whole point of the seam.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { DecryptionFailedError, EncryptionDisabledError, InvalidCiphertextError, } from "./errors.js";
+import { KEY_SIZE } from "./key-manager.js";
+/** Nonce size for AES-GCM (12 bytes = 96 bits, NIST) — Go GCMNonceSize. */
+export const GCM_NONCE_SIZE = 12;
+/** GCM authentication tag size (128 bits) — Go's gcm.Overhead(). */
+export const GCM_TAG_SIZE = 16;
+/** Version prefix for v1-encrypted values — Go EncryptedPrefix. */
+export const ENCRYPTED_PREFIX = "enc:v1:";
+/** The version token the static-key codec serves. */
+export const V1_VERSION = "v1";
+export class StaticKeySecretCodec {
+    version = V1_VERSION;
+    key;
+    /**
+     * Go NewSecretService's key contract, now the codec's: nil/empty key →
+     * disabled (keyless) codec; a present key must be exactly 32 bytes.
+     */
+    constructor(key) {
+        if (key === undefined || key.length === 0) {
+            this.key = undefined;
+            return;
+        }
+        if (key.length !== KEY_SIZE) {
+            throw new Error(`encryption key must be exactly 32 bytes (256 bits): got ${key.length} bytes`);
+        }
+        this.key = key;
+    }
+    /** Go IsEnabled: whether a key is configured. */
+    isEnabled() {
+        return this.key !== undefined;
+    }
+    /**
+     * Go Encrypt's crypto arm: enc:v1:<base64(nonce || ct || tag)>;
+     * disabled → plaintext unchanged (the WARN-degrade posture). The
+     * already-prefixed idempotent pass-through is facade policy and never
+     * reaches here.
+     */
+    // async without await: the interface is async for vault-backed codecs
+    // (Transit/KV round trips); v1 is pure local crypto.
+    async encrypt(plaintext, _scope) {
+        if (this.key === undefined) {
+            return plaintext;
+        }
+        const nonce = randomBytes(GCM_NONCE_SIZE);
+        const cipher = createCipheriv("aes-256-gcm", this.key, nonce);
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext, "utf8"),
+            cipher.final(),
+        ]);
+        const tag = cipher.getAuthTag();
+        // Layout matches Go's gcm.Seal(nonce, nonce, plaintext, nil):
+        // nonce || ciphertext || tag, then standard Base64.
+        const sealed = Buffer.concat([nonce, ciphertext, tag]);
+        return ENCRYPTED_PREFIX + sealed.toString("base64");
+    }
+    /**
+     * Go Decrypt's crypto arm: the value carries this codec's prefix (the
+     * facade dispatched it here) and decrypts or fails with the taxonomy
+     * the callers branch on (invalid-ciphertext / decryption-failed /
+     * encryption-disabled).
+     */
+    async decrypt(encrypted) {
+        if (this.key === undefined) {
+            throw new EncryptionDisabledError();
+        }
+        const base64Data = encrypted.slice(ENCRYPTED_PREFIX.length);
+        const sealed = Buffer.from(base64Data, "base64");
+        // Node's lenient decoder never throws; the round-trip check restores
+        // Go's strict-decode error for corrupted Base64.
+        if (sealed.toString("base64") !== base64Data) {
+            throw new InvalidCiphertextError("invalid base64 encoding");
+        }
+        if (sealed.length < GCM_NONCE_SIZE + GCM_TAG_SIZE) {
+            throw new InvalidCiphertextError("ciphertext too short");
+        }
+        const nonce = sealed.subarray(0, GCM_NONCE_SIZE);
+        const ciphertext = sealed.subarray(GCM_NONCE_SIZE, sealed.length - GCM_TAG_SIZE);
+        const tag = sealed.subarray(sealed.length - GCM_TAG_SIZE);
+        const decipher = createDecipheriv("aes-256-gcm", this.key, nonce);
+        decipher.setAuthTag(tag);
+        try {
+            return Buffer.concat([
+                decipher.update(ciphertext),
+                decipher.final(),
+            ]).toString("utf8");
+        }
+        catch (error) {
+            throw new DecryptionFailedError(error);
+        }
+    }
+}
+//# sourceMappingURL=v1-codec.js.map

package/dist/encryption/v1-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1-codec.js","sourceRoot":"","sources":["../../src/encryption/v1-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAE/B,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAE1C,qDAAqD;AACrD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAE/B,MAAM,OAAO,oBAAoB;IACtB,OAAO,GAAG,UAAU,CAAC;IAEb,GAAG,CAAqB;IAEzC;;;OAGG;IACH,YAAY,GAAuB;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,2DAA2D,GAAG,CAAC,MAAM,QAAQ,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,iDAAiD;IACjD,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,sEAAsE;IACtE,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,MAAuB;QACtD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAChC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,8DAA8D;QAC9D,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,OAAO,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,GAAG,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAChC,cAAc,EACd,MAAM,CAAC,MAAM,GAAG,YAAY,CAC7B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC3B,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}

package/dist/envmerge/envmerge.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Environment layer merging — ports backend/libs/go/envmerge/merge.go.
+ * Consumed by the agentexecution execution-context builder (#17) and,
+ * with #20, the workflowexecution equivalent. Lives inside the server per
+ * the ratified shared-library posture (extraction to backend/libs/ts/
+ * only on a second SERVICE consumer — the temporal-codecs precedent).
+ */
+import type { Environment } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import type { EnvVarDeclaration } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import type { ExecutionValue } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/spec_pb";
+/**
+ * Merges two layers of environment configuration into a single map of
+ * ExecutionValue entries, suitable for persisting in an ExecutionContext.
+ *
+ * Merge priority (lowest to highest):
+ *  1. environments — resolved Environment resources from instance
+ *     environment_refs (in order; later overrides earlier; empty values
+ *     skipped)
+ *  2. runtimeEnv — execution-scoped runtime_env overrides
+ */
+export declare function mergeEnvironmentLayers(environments: Environment[], runtimeEnv: {
+    [key: string]: ExecutionValue;
+}): Map<string, ExecutionValue>;
+/**
+ * Restricts a merged environment map to only the keys declared in the
+ * blueprint's env field (least-privilege): a blueprint only receives the
+ * variables it explicitly declared, even if the linked environments carry
+ * additional secrets. Empty declarations return the merged map unchanged
+ * (backward compatibility for blueprints declaring no env vars). Returns
+ * the filtered map and a sorted list of excluded keys for observability.
+ */
+export declare function filterByDeclaredKeys(merged: Map<string, ExecutionValue>, declarations: {
+    [key: string]: EnvVarDeclaration;
+}): {
+    filtered: Map<string, ExecutionValue>;
+    excludedKeys: string[];
+};
+/**
+ * Checks that every required (non-optional) declared key has an entry in
+ * the filtered map; returns the sorted missing keys (empty = passed).
+ */
+export declare function validateRequiredKeys(filtered: Map<string, ExecutionValue>, declarations: {
+    [key: string]: EnvVarDeclaration;
+}): string[];
+//# sourceMappingURL=envmerge.d.ts.map

package/dist/envmerge/envmerge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envmerge.d.ts","sourceRoot":"","sources":["../../src/envmerge/envmerge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gEAAgE,CAAC;AAIrG;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,WAAW,EAAE,EAC3B,UAAU,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GAC5C,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAiC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACnC,YAAY,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBnE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,YAAY,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAA;CAAE,GACjD,MAAM,EAAE,CAYV"}