@stigmer/temporal-codecs 0.1.0-dev.20261017020314.g644422724c27

package/connection/config.js

@@ -0,0 +1,171 @@
+/**
+ * Temporal connection security: how a Stigmer process authenticates to the
+ * Temporal frontend it dials. The server's client and worker connections
+ * and the runner's worker connection all read it, so it lives here, in the
+ * one library both processes share. Unset means today's plaintext
+ * connection, unchanged.
+ *
+ * The settings (each `_PATH` item has a `_DATA` twin holding the PEM text):
+ *
+ *   STIGMER_TEMPORAL_API_KEY                    bearer key; implies TLS
+ *   STIGMER_TEMPORAL_TLS                        "true" or "1": TLS with the
+ *                                               system's trusted roots
+ *   STIGMER_TEMPORAL_TLS_SERVER_NAME            SNI / host-name override
+ *   STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH    the frontend's CA (implies TLS)
+ *   STIGMER_TEMPORAL_TLS_CLIENT_CERT_PATH       mutual TLS: the client's
+ *   STIGMER_TEMPORAL_TLS_CLIENT_KEY_PATH          certificate and key, together
+ *
+ * WHY Stigmer's own names, not Temporal's `TEMPORAL_API_KEY` and
+ * `TEMPORAL_TLS_*`: those belong to the user's own Temporal work. A local
+ * Stigmer (`stigmer up`) inherits the user's shell, and agents that build
+ * Temporal applications export `TEMPORAL_API_KEY` for their own namespaces.
+ * Reading it would present the user's key to Stigmer's own Temporal and,
+ * through the runner's secret custody, take it away from the agents that
+ * need it. The shape follows Temporal's so an operator recognises it.
+ *
+ * WHY not Temporal's reader (`@temporalio/envconfig`): at the SDK version
+ * every Stigmer package pins (1.16.2), it reads `TEMPORAL_TLS=true` as TLS
+ * disabled. Releases before 1.22.0 carry that inversion. It also ignores
+ * host-verification settings, and it reads the user's own Temporal profile
+ * file by default.
+ *
+ * Misconfiguration fails the boot, the posture of the payload-encryption
+ * config beside this module: an operator who set half a client pair, or
+ * the same item twice, believes the connection is authenticated, and a
+ * silently weaker connection would be a security failure. An empty value
+ * means unset, so a blank line in a deployment's environment turns nothing
+ * on.
+ *
+ * Values are read through an injected {@link SecretReader}, as the
+ * encryption keys are: secret custody is the consumer's policy. The runner
+ * passes its credential store's reader, so the API key and the client key
+ * never live in an environment its agent tools can read.
+ */
+import { readFileSync } from "node:fs";
+export const TEMPORAL_API_KEY_ENV = "STIGMER_TEMPORAL_API_KEY";
+export const TEMPORAL_TLS_ENV = "STIGMER_TEMPORAL_TLS";
+export const TEMPORAL_TLS_SERVER_NAME_ENV = "STIGMER_TEMPORAL_TLS_SERVER_NAME";
+/** The PEM items, each settable as a file path or as its text. */
+const PEM_ITEMS = {
+    serverCa: "STIGMER_TEMPORAL_TLS_SERVER_CA_CERT",
+    clientCert: "STIGMER_TEMPORAL_TLS_CLIENT_CERT",
+    clientKey: "STIGMER_TEMPORAL_TLS_CLIENT_KEY",
+};
+/**
+ * The `_DATA` name of the client key: a credential, which the runner takes
+ * into custody beside the API key (its `_PATH` twin names a file, not a
+ * secret).
+ */
+export const TEMPORAL_TLS_CLIENT_KEY_DATA_ENV = `${PEM_ITEMS.clientKey}_DATA`;
+/**
+ * Every setting name this module reads, exactly. A process that hands its
+ * children their own rendered settings ({@link temporalConnectionEnv})
+ * removes these from what the child inherits; other `STIGMER_TEMPORAL_*`
+ * names (the CLI's own) are not connection settings.
+ */
+export const TEMPORAL_CONNECTION_ENV_NAMES = [
+    TEMPORAL_API_KEY_ENV,
+    TEMPORAL_TLS_ENV,
+    TEMPORAL_TLS_SERVER_NAME_ENV,
+    ...Object.values(PEM_ITEMS).flatMap((item) => [`${item}_PATH`, `${item}_DATA`]),
+];
+/**
+ * Loads the connection settings.
+ *
+ * @throws when a setting is contradictory or unreadable: a client
+ *   certificate without its key (or the reverse), both the `_PATH` and the
+ *   `_DATA` form of one item, a path that cannot be read, or a
+ *   `STIGMER_TEMPORAL_TLS` that is neither true nor false.
+ */
+export function loadTemporalConnectionConfig(read) {
+    const value = (name) => {
+        const raw = read(name);
+        return raw === undefined || raw.trim() === "" ? undefined : raw;
+    };
+    const apiKey = value(TEMPORAL_API_KEY_ENV)?.trim();
+    const tlsFlag = parseFlag(value(TEMPORAL_TLS_ENV));
+    const serverName = value(TEMPORAL_TLS_SERVER_NAME_ENV)?.trim();
+    const serverCa = readPem(PEM_ITEMS.serverCa, value);
+    const clientCert = readPem(PEM_ITEMS.clientCert, value);
+    const clientKey = readPem(PEM_ITEMS.clientKey, value);
+    if ((clientCert === undefined) !== (clientKey === undefined)) {
+        throw new Error(`Temporal connection misconfigured: mutual TLS needs both ` +
+            `${PEM_ITEMS.clientCert}_* and ${PEM_ITEMS.clientKey}_* — set both or neither`);
+    }
+    const tlsRequested = tlsFlag === true ||
+        apiKey !== undefined ||
+        serverName !== undefined ||
+        serverCa !== undefined ||
+        clientCert !== undefined;
+    if (tlsFlag === false && tlsRequested) {
+        throw new Error(`Temporal connection misconfigured: ${TEMPORAL_TLS_ENV} is false while ` +
+            `an API key, a server name, a CA or a client certificate is set — ` +
+            `each of those needs TLS`);
+    }
+    if (!tlsRequested)
+        return {};
+    const tls = {
+        ...(serverName !== undefined ? { serverNameOverride: serverName } : {}),
+        ...(serverCa !== undefined ? { serverRootCACertificate: serverCa } : {}),
+        ...(clientCert !== undefined && clientKey !== undefined
+            ? { clientCertPair: { crt: clientCert, key: clientKey } }
+            : {}),
+    };
+    return { tls, ...(apiKey !== undefined ? { apiKey } : {}) };
+}
+/**
+ * Renders loaded settings back as the environment a child runner reads,
+ * every PEM item in its `_DATA` form, so that no file has to exist where
+ * the child runs. The server's sandbox drivers pass this to the runners
+ * they start. Round-trips: loading the rendered environment yields the
+ * same settings.
+ */
+export function temporalConnectionEnv(config) {
+    const env = {};
+    if (config.tls === undefined)
+        return env;
+    env[TEMPORAL_TLS_ENV] = "true";
+    const text = (bytes) => Buffer.from(bytes).toString("utf8");
+    const { serverNameOverride, serverRootCACertificate, clientCertPair } = config.tls;
+    if (serverNameOverride !== undefined)
+        env[TEMPORAL_TLS_SERVER_NAME_ENV] = serverNameOverride;
+    if (serverRootCACertificate !== undefined) {
+        env[`${PEM_ITEMS.serverCa}_DATA`] = text(serverRootCACertificate);
+    }
+    if (clientCertPair !== undefined) {
+        env[`${PEM_ITEMS.clientCert}_DATA`] = text(clientCertPair.crt);
+        env[TEMPORAL_TLS_CLIENT_KEY_DATA_ENV] = text(clientCertPair.key);
+    }
+    if (config.apiKey !== undefined)
+        env[TEMPORAL_API_KEY_ENV] = config.apiKey;
+    return env;
+}
+function parseFlag(raw) {
+    if (raw === undefined)
+        return undefined;
+    const flag = raw.trim().toLowerCase();
+    if (flag === "true" || flag === "1")
+        return true;
+    if (flag === "false" || flag === "0")
+        return false;
+    throw new Error(`Temporal connection misconfigured: ${TEMPORAL_TLS_ENV} must be true, 1, false or 0, got "${raw}"`);
+}
+function readPem(item, value) {
+    const path = value(`${item}_PATH`);
+    const data = value(`${item}_DATA`);
+    if (path !== undefined && data !== undefined) {
+        throw new Error(`Temporal connection misconfigured: set ${item}_PATH or ${item}_DATA, not both`);
+    }
+    if (data !== undefined)
+        return Buffer.from(data, "utf8");
+    if (path === undefined)
+        return undefined;
+    try {
+        return readFileSync(path.trim());
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`Temporal connection misconfigured: ${item}_PATH "${path.trim()}" cannot be read (${reason})`);
+    }
+}
+//# sourceMappingURL=config.js.map

package/connection/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/connection/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA4BvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAC;AAE/E,kEAAkE;AAClE,MAAM,SAAS,GAAG;IAChB,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,kCAAkC;IAC9C,SAAS,EAAE,iCAAiC;CACpC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,SAAS,CAAC,SAAS,OAAO,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,oBAAoB;IACpB,gBAAgB;IAChB,4BAA4B;IAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;CAChF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAsB,EAAE;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAEtD,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,GAAG,SAAS,CAAC,UAAU,UAAU,SAAS,CAAC,SAAS,0BAA0B,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,OAAO,KAAK,IAAI;QAChB,MAAM,KAAK,SAAS;QACpB,UAAU,KAAK,SAAS;QACxB,QAAQ,KAAK,SAAS;QACtB,UAAU,KAAK,SAAS,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,sCAAsC,gBAAgB,kBAAkB;YACtE,mEAAmE;YACnE,yBAAyB,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,GAAG,GAAgB;QACvB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAgC;IAEhC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;IACnF,IAAI,kBAAkB,KAAK,SAAS;QAAE,GAAG,CAAC,4BAA4B,CAAC,GAAG,kBAAkB,CAAC;IAC7F,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,OAAO,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,SAAS,CAAC,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/D,GAAG,CAAC,gCAAgC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,KAAK,CACb,sCAAsC,gBAAgB,sCAAsC,GAAG,GAAG,CACnG,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAAY,EACZ,KAA2C;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,YAAY,IAAI,iBAAiB,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,UAAU,IAAI,CAAC,IAAI,EAAE,qBAAqB,MAAM,GAAG,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/encryption/config.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Payload-encryption configuration (stigmer#398).
+ *
+ * Two key sources, strict precedence:
+ *
+ *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
+ *      explicit choice: self-hosted deployments sharing one key with their
+ *      server, and cloud sandboxes injected with the platform key. When the
+ *      env key is set, bootstrap-delivered material is ignored entirely.
+ *   2. Bootstrap-delivered — server-managed per-identity keys handed to
+ *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
+ *      only; persistence lives server-side, which is what makes Temporal
+ *      replay work across runner restarts (every boot re-fetches the SAME
+ *      key).
+ *
+ * Encryption is enabled iff a key is present from either source — the same
+ * enabled-iff-configured pattern as the claim-check codec. A malformed key
+ * fails the boot rather than silently running plaintext: an operator who set
+ * the key (or a server that minted one) intended history to be encrypted.
+ *
+ * Key rotation: payloads carry the id of the key that encrypted them.
+ * During a rotation window the previous key stays readable via the
+ * secondary pair while new payloads are written under the primary key.
+ * Workers capture keys at construction, so a rotated bootstrap key lands
+ * on the next runner boot — there is no live re-key.
+ *
+ * Moved from backend/services/runner/src/encryption/config.ts when the
+ * codecs became @stigmer/temporal-codecs (one home for the cross-language
+ * envelope contract; the TS server is the second consumer). Key VALUES are
+ * read through an injected {@link SecretReader} because secret custody is
+ * consumer policy, not codec policy: the runner routes reads through its
+ * boot-capture credential store (stigmer#508 — secrets must not live in
+ * process.env where agent shells could read them), while other consumers
+ * read their own stores. No process.env default is provided for the
+ * VALUES: a forgotten injection must fail to compile, not silently bypass
+ * a consumer's secret custody.
+ */
+export interface EncryptionKey {
+    readonly keyId: string;
+    /** 32-byte AES-256 key. */
+    readonly key: Buffer;
+}
+/**
+ * Resolves decrypt-key material for a key id absent from the static
+ * config (a hosting server may decode desktop-runner histories written
+ * under server-managed per-identity `rpk_` keys, whose material lives in
+ * a database, not the environment).
+ * Returns undefined when the id is unknown — the codec then fails closed
+ * with its pinned unknown-key-id error. Implementations own their lookup
+ * and unsealing; the codec caches every RESOLVED key for the process
+ * lifetime (key material per id is immutable — rotation mints a new id),
+ * and never caches misses (the key may be minted moments later).
+ */
+export type PayloadKeyResolver = (keyId: string) => Promise<Buffer | undefined>;
+export interface PayloadEncryptionConfig {
+    /** Key used to encrypt outgoing payloads (and decrypt its own). */
+    readonly primary: EncryptionKey;
+    /** Decrypt-only key accepted during rotation windows. */
+    readonly secondary?: EncryptionKey;
+    /**
+     * Decrypt-only fallback consulted when a payload names a key id the
+     * static pair does not cover ({@link PayloadKeyResolver}). Encode never
+     * consults it — outgoing payloads are always written under `primary`.
+     */
+    readonly resolveKey?: PayloadKeyResolver;
+}
+/**
+ * Reads one secret VALUE by its env-var name. Consumers inject their own
+ * custody policy (see the module doc); the *_KEY_ID companions are
+ * rotation bookkeeping, not secrets, and stay plain `process.env` reads.
+ */
+export type SecretReader = (name: string) => string | undefined;
+/**
+ * Server-managed key material delivered by the runner's
+ * getRunnerBootstrapConfig. Structurally mirrors
+ * {@link BootstrapPayloadEncryptionKeys} in the runner's stigmer-client.ts
+ * — declared here so the library stays free of client imports.
+ */
+export interface BootstrapKeyMaterial {
+    readonly key: string;
+    readonly keyId?: string;
+    readonly secondaryKey?: string;
+    readonly secondaryKeyId?: string;
+}
+/**
+ * Returns the encryption config, or undefined when encryption is not
+ * configured (the codec is then simply not installed).
+ *
+ * Source precedence: the env key wins outright; bootstrap-delivered
+ * material applies only when no env key is set (see the module doc).
+ *
+ * @throws when a key is present but malformed, or a key id is missing —
+ *   key misconfiguration must stop the boot, not degrade to plaintext.
+ *   This applies equally to bootstrap material: a server that hands out
+ *   a bad key or omits its id has broken the protocol contract, and
+ *   running plaintext against a server that manages keys would silently
+ *   defeat the feature.
+ */
+export declare function loadPayloadEncryptionConfig(readSecret: SecretReader, bootstrap?: BootstrapKeyMaterial): PayloadEncryptionConfig | undefined;
+//# sourceMappingURL=config.d.ts.map

package/encryption/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEhF,MAAM,WAAW,uBAAuB;IACtC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,YAAY,EACxB,SAAS,CAAC,EAAE,oBAAoB,GAC/B,uBAAuB,GAAG,SAAS,CA6CrC"}

package/encryption/config.js

@@ -0,0 +1,119 @@
+/**
+ * Payload-encryption configuration (stigmer#398).
+ *
+ * Two key sources, strict precedence:
+ *
+ *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
+ *      explicit choice: self-hosted deployments sharing one key with their
+ *      server, and cloud sandboxes injected with the platform key. When the
+ *      env key is set, bootstrap-delivered material is ignored entirely.
+ *   2. Bootstrap-delivered — server-managed per-identity keys handed to
+ *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
+ *      only; persistence lives server-side, which is what makes Temporal
+ *      replay work across runner restarts (every boot re-fetches the SAME
+ *      key).
+ *
+ * Encryption is enabled iff a key is present from either source — the same
+ * enabled-iff-configured pattern as the claim-check codec. A malformed key
+ * fails the boot rather than silently running plaintext: an operator who set
+ * the key (or a server that minted one) intended history to be encrypted.
+ *
+ * Key rotation: payloads carry the id of the key that encrypted them.
+ * During a rotation window the previous key stays readable via the
+ * secondary pair while new payloads are written under the primary key.
+ * Workers capture keys at construction, so a rotated bootstrap key lands
+ * on the next runner boot — there is no live re-key.
+ *
+ * Moved from backend/services/runner/src/encryption/config.ts when the
+ * codecs became @stigmer/temporal-codecs (one home for the cross-language
+ * envelope contract; the TS server is the second consumer). Key VALUES are
+ * read through an injected {@link SecretReader} because secret custody is
+ * consumer policy, not codec policy: the runner routes reads through its
+ * boot-capture credential store (stigmer#508 — secrets must not live in
+ * process.env where agent shells could read them), while other consumers
+ * read their own stores. No process.env default is provided for the
+ * VALUES: a forgotten injection must fail to compile, not silently bypass
+ * a consumer's secret custody.
+ */
+const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
+const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
+const SECONDARY_KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY";
+const SECONDARY_KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID";
+const AES_256_KEY_BYTES = 32;
+/**
+ * Returns the encryption config, or undefined when encryption is not
+ * configured (the codec is then simply not installed).
+ *
+ * Source precedence: the env key wins outright; bootstrap-delivered
+ * material applies only when no env key is set (see the module doc).
+ *
+ * @throws when a key is present but malformed, or a key id is missing —
+ *   key misconfiguration must stop the boot, not degrade to plaintext.
+ *   This applies equally to bootstrap material: a server that hands out
+ *   a bad key or omits its id has broken the protocol contract, and
+ *   running plaintext against a server that manages keys would silently
+ *   defeat the feature.
+ */
+export function loadPayloadEncryptionConfig(readSecret, bootstrap) {
+    const rawKey = readSecret(KEY_ENV);
+    if (rawKey) {
+        const primary = {
+            keyId: requireKeyId(KEY_ID_ENV),
+            key: parseKey(rawKey, KEY_ENV),
+        };
+        const rawSecondary = readSecret(SECONDARY_KEY_ENV);
+        const secondary = rawSecondary
+            ? {
+                keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
+                key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
+            }
+            : undefined;
+        return { primary, secondary };
+    }
+    if (bootstrap?.key) {
+        const primary = {
+            keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
+            key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
+        };
+        const secondary = bootstrap.secondaryKey
+            ? {
+                keyId: requireBootstrapKeyId(bootstrap.secondaryKeyId, "payload_encryption_secondary_key_id"),
+                key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
+            }
+            : undefined;
+        return { primary, secondary };
+    }
+    return undefined;
+}
+function requireKeyId(envName) {
+    const keyId = process.env[envName];
+    // An explicit id is required (no default): during rotation two keys
+    // coexist, and payloads must name which one encrypted them.
+    if (!keyId) {
+        throw new Error(`Payload encryption misconfigured: ${envName} is required when the ` +
+            `corresponding key is set`);
+    }
+    return keyId;
+}
+function requireBootstrapKeyId(keyId, fieldName) {
+    if (!keyId) {
+        throw new Error(`Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
+            `refusing to encrypt under an unidentified key (server contract violation)`);
+    }
+    return keyId;
+}
+function parseKey(rawBase64, envName) {
+    let key;
+    try {
+        key = Buffer.from(rawBase64, "base64");
+    }
+    catch {
+        throw new Error(`Payload encryption misconfigured: ${envName} is not valid base64`);
+    }
+    if (key.length !== AES_256_KEY_BYTES) {
+        throw new Error(`Payload encryption misconfigured: ${envName} must decode to ` +
+            `${AES_256_KEY_BYTES} bytes (AES-256), got ${key.length}`);
+    }
+    return key;
+}
+//# sourceMappingURL=config.js.map

package/encryption/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAsDH,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AACrE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAwB,EACxB,SAAgC;IAEhC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;SAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACnD,MAAM,SAAS,GAA8B,YAAY;YACvD,CAAC,CAAC;gBACE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;aAC/C;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,qBAAqB,CAC1B,SAAS,CAAC,KAAK,EACf,2BAA2B,CAC5B;YACD,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,kCAAkC,CAAC;SACjE,CAAC;QAEF,MAAM,SAAS,GAA8B,SAAS,CAAC,YAAY;YACjE,CAAC,CAAC;gBACE,KAAK,EAAE,qBAAqB,CAC1B,SAAS,CAAC,cAAc,EACxB,qCAAqC,CACtC;gBACD,GAAG,EAAE,QAAQ,CACX,SAAS,CAAC,YAAY,EACtB,4CAA4C,CAC7C;aACF;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,wBAAwB;YAClE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAyB,EACzB,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,KAAK;YAC9E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,sBAAsB,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,kBAAkB;YAC5D,GAAG,iBAAiB,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/encryption/payload-codec.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Temporal PayloadCodec that encrypts payloads at rest in workflow
+ * history.
+ *
+ * Why: Temporal history is durable, and an agent run puts customer data
+ * there at every crossing — the run credential on each runner activity's
+ * input, and each activity result carrying the run's status (its errors,
+ * its pending approvals, what the run said and did). A run's vault values
+ * never ride history (the runner fetches them when the work starts), but
+ * the rest is still a customer's. Encrypting at the payload codec layer
+ * covers every crossing with one mechanism instead of chasing each one.
+ *
+ * Envelope (cross-SDK contract — the Java decode-only codec in
+ * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
+ * by the conformance fixture in __tests__/fixtures/):
+ *
+ *   metadata: encoding            = "binary/encrypted"
+ *             encryption-key-id   = <key id that encrypted this payload>
+ *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
+ *
+ * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
+ * data), so decode restores the payload exactly — including its
+ * original encoding — with no side channel.
+ *
+ * Decode passes through payloads it did not encode. This is what keeps
+ * plaintext signals from the Java/Go orchestrators and pre-rollout
+ * in-flight histories working with zero migration. Everything else
+ * fails closed: unknown key id, missing key id, and ciphertext tampering
+ * all throw rather than surfacing bogus payloads.
+ *
+ * Key ids outside the static primary/secondary pair may be resolved
+ * through the config's optional resolveKey seam (a hosting server may
+ * decode desktop-runner histories under database-resident `rpk_` keys).
+ * Resolution is decode-only, resolved keys are cached for the process
+ * lifetime (an id's material is immutable — rotation mints a new id),
+ * misses are never cached, and an unresolvable id keeps the pinned
+ * fail-closed throw.
+ *
+ * Moved from backend/services/runner/src/encryption/payload-codec.ts when
+ * the codecs became @stigmer/temporal-codecs (one home for the
+ * cross-language envelope contract; the TS server is the second consumer).
+ */
+import type { Payload, PayloadCodec } from "@temporalio/common";
+import type { PayloadEncryptionConfig } from "./config.js";
+export declare class EncryptionPayloadCodec implements PayloadCodec {
+    private readonly config;
+    private readonly decryptKeysById;
+    constructor(config: PayloadEncryptionConfig);
+    encode(payloads: Payload[]): Promise<Payload[]>;
+    decode(payloads: Payload[]): Promise<Payload[]>;
+    private encodePayload;
+    private decodePayload;
+    /**
+     * The static map first; on a miss, the config's resolver (when present),
+     * caching the RESOLVED key only — a miss stays unresolved so a key
+     * minted after this process booted is found on the next decode.
+     */
+    private decryptKeyFor;
+}
+//# sourceMappingURL=payload-codec.d.ts.map

package/encryption/payload-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-codec.d.ts","sourceRoot":"","sources":["../src/encryption/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQhE,OAAO,KAAK,EAAiB,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAY1E,qBAAa,sBAAuB,YAAW,YAAY;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAEzB,MAAM,EAAE,uBAAuB;IAStD,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI/C,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAIrD,OAAO,CAAC,aAAa;YAkBP,aAAa;IAwB3B;;;;OAIG;YACW,aAAa;CAc5B"}

package/encryption/payload-codec.js

@@ -0,0 +1,163 @@
+/**
+ * Temporal PayloadCodec that encrypts payloads at rest in workflow
+ * history.
+ *
+ * Why: Temporal history is durable, and an agent run puts customer data
+ * there at every crossing — the run credential on each runner activity's
+ * input, and each activity result carrying the run's status (its errors,
+ * its pending approvals, what the run said and did). A run's vault values
+ * never ride history (the runner fetches them when the work starts), but
+ * the rest is still a customer's. Encrypting at the payload codec layer
+ * covers every crossing with one mechanism instead of chasing each one.
+ *
+ * Envelope (cross-SDK contract — the Java decode-only codec in
+ * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
+ * by the conformance fixture in __tests__/fixtures/):
+ *
+ *   metadata: encoding            = "binary/encrypted"
+ *             encryption-key-id   = <key id that encrypted this payload>
+ *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
+ *
+ * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
+ * data), so decode restores the payload exactly — including its
+ * original encoding — with no side channel.
+ *
+ * Decode passes through payloads it did not encode. This is what keeps
+ * plaintext signals from the Java/Go orchestrators and pre-rollout
+ * in-flight histories working with zero migration. Everything else
+ * fails closed: unknown key id, missing key id, and ciphertext tampering
+ * all throw rather than surfacing bogus payloads.
+ *
+ * Key ids outside the static primary/secondary pair may be resolved
+ * through the config's optional resolveKey seam (a hosting server may
+ * decode desktop-runner histories under database-resident `rpk_` keys).
+ * Resolution is decode-only, resolved keys are cached for the process
+ * lifetime (an id's material is immutable — rotation mints a new id),
+ * misses are never cached, and an unresolvable id keeps the pinned
+ * fail-closed throw.
+ *
+ * Moved from backend/services/runner/src/encryption/payload-codec.ts when
+ * the codecs became @stigmer/temporal-codecs (one home for the
+ * cross-language envelope contract; the TS server is the second consumer).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+// Default-import + destructure, NOT `import { temporal } from …`:
+// @temporalio/proto is CommonJS and its `temporal` export defeats Node's
+// cjs-module-lexer named-export detection, so the named form loads under
+// tsx/vitest (their interop is looser) but crashes plain `node dist/main.js`
+// at startup with "Named export 'temporal' not found" (stigmer/stigmer#399
+// boot regression). Pinned by scripts/verify-dist-boot.mjs in CI.
+import proto from "@temporalio/proto";
+const { temporal } = proto;
+const ENCODING_METADATA_KEY = "encoding";
+const ENCRYPTED_ENCODING_VALUE = "binary/encrypted";
+const KEY_ID_METADATA_KEY = "encryption-key-id";
+/** AES-GCM parameters shared with the Java implementation. */
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+export class EncryptionPayloadCodec {
+    config;
+    decryptKeysById;
+    constructor(config) {
+        this.config = config;
+        this.decryptKeysById = new Map([
+            [config.primary.keyId, config.primary.key],
+        ]);
+        if (config.secondary) {
+            this.decryptKeysById.set(config.secondary.keyId, config.secondary.key);
+        }
+    }
+    async encode(payloads) {
+        return payloads.map((p) => this.encodePayload(p));
+    }
+    async decode(payloads) {
+        return Promise.all(payloads.map((p) => this.decodePayload(p)));
+    }
+    encodePayload(payload) {
+        // Data-less payloads (binary/null from void results) stay as-is:
+        // there is nothing to protect, and the cross-language parents that
+        // await our workflows as void must be able to read them without a key.
+        if (!payload.data || payload.data.length === 0) {
+            return payload;
+        }
+        const plaintext = temporal.api.common.v1.Payload.encode(payload).finish();
+        return {
+            metadata: {
+                [ENCODING_METADATA_KEY]: Buffer.from(ENCRYPTED_ENCODING_VALUE),
+                [KEY_ID_METADATA_KEY]: Buffer.from(this.config.primary.keyId),
+            },
+            data: encrypt(plaintext, this.config.primary),
+        };
+    }
+    async decodePayload(payload) {
+        if (!isEncryptedPayload(payload)) {
+            return payload;
+        }
+        const keyIdBytes = payload.metadata?.[KEY_ID_METADATA_KEY];
+        if (!keyIdBytes) {
+            throw new Error("Encrypted payload is missing its encryption-key-id metadata — refusing to decode");
+        }
+        const keyId = Buffer.from(keyIdBytes).toString("utf-8");
+        const key = await this.decryptKeyFor(keyId);
+        if (!key) {
+            throw new Error(`Encrypted payload uses unknown key id '${keyId}' — configure it as the ` +
+                `primary or secondary payload encryption key (rotation window?)`);
+        }
+        const plaintext = decrypt(payload.data, key, keyId);
+        return temporal.api.common.v1.Payload.decode(plaintext);
+    }
+    /**
+     * The static map first; on a miss, the config's resolver (when present),
+     * caching the RESOLVED key only — a miss stays unresolved so a key
+     * minted after this process booted is found on the next decode.
+     */
+    async decryptKeyFor(keyId) {
+        const known = this.decryptKeysById.get(keyId);
+        if (known !== undefined) {
+            return known;
+        }
+        if (this.config.resolveKey === undefined) {
+            return undefined;
+        }
+        const resolved = await this.config.resolveKey(keyId);
+        if (resolved !== undefined) {
+            this.decryptKeysById.set(keyId, resolved);
+        }
+        return resolved;
+    }
+}
+function isEncryptedPayload(payload) {
+    const encoding = payload.metadata?.[ENCODING_METADATA_KEY];
+    if (!encoding)
+        return false;
+    return Buffer.from(encoding).toString("utf-8") === ENCRYPTED_ENCODING_VALUE;
+}
+function encrypt(plaintext, key) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", key.key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    // Layout iv ‖ ciphertext ‖ tag matches Java's AES/GCM/NoPadding, whose
+    // doFinal() output is ciphertext ‖ tag.
+    return Buffer.concat([iv, ciphertext, cipher.getAuthTag()]);
+}
+function decrypt(data, key, keyId) {
+    if (data.length < IV_BYTES + AUTH_TAG_BYTES) {
+        throw new Error(`Encrypted payload under key id '${keyId}' is truncated (${data.length} bytes)`);
+    }
+    const buf = Buffer.from(data);
+    const iv = buf.subarray(0, IV_BYTES);
+    const ciphertext = buf.subarray(IV_BYTES, buf.length - AUTH_TAG_BYTES);
+    const tag = buf.subarray(buf.length - AUTH_TAG_BYTES);
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch {
+        // GCM auth failure: tampered ciphertext or a key that does not match
+        // its advertised id. Never surface partially decrypted bytes.
+        throw new Error(`Failed to decrypt payload under key id '${keyId}' — ciphertext is ` +
+            `corrupt or the configured key does not match`);
+    }
+}
+//# sourceMappingURL=payload-codec.js.map

package/encryption/payload-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-codec.js","sourceRoot":"","sources":["../src/encryption/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,OAAO,KAAK,MAAM,mBAAmB,CAAC;AAGtC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;AAE3B,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,OAAO,sBAAsB;IAGJ;IAFZ,eAAe,CAAsB;IAEtD,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QAC1D,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC;YAC7B,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,iEAAiE;QACjE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO;YACL,QAAQ,EAAE;gBACR,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;gBAC9D,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC9D;YACD,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;SAC9C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,0BAA0B;gBACvE,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,wBAAwB,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,SAAqB,EAAE,GAAkB;IACxD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,uEAAuE;IACvE,wCAAwC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,GAAW,EAAE,KAAa;IAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,mBAAmB,IAAI,CAAC,MAAM,SAAS,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,oBAAoB;YAClE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}