@workflow/core 5.0.0-beta.4 → 5.0.0-beta.41

package/dist/encryption.js

@@ -1,22 +1,10 @@
-/**
- * Browser-compatible AES-256-GCM encryption module.
- *
- * Uses the Web Crypto API (`globalThis.crypto.subtle`) which works in
- * both modern browsers and Node.js 20+. This module is intentionally
- * free of Node.js-specific imports so it can be bundled for the browser.
- *
- * The World interface (`getEncryptionKeyForRun`) returns a raw 32-byte
- * AES-256 key. Callers should use `importKey()` once to convert it to a
- * `CryptoKey`, then pass that to `encrypt()`/`decrypt()` for all
- * operations within the same run. This avoids repeated `importKey()`
- * calls on every encrypt/decrypt invocation.
- *
- * Wire format: `[nonce (12 bytes)][ciphertext + auth tag]`
- * The `encr` format prefix is NOT part of this module — it's added/stripped
- * by the serialization layer in `maybeEncrypt`/`maybeDecrypt`.
- */
-const NONCE_LENGTH = 12;
-const TAG_LENGTH = 128; // bits
+import { RuntimeDecryptionError, WorkflowRuntimeError } from '@workflow/errors';
+/** AES-GCM nonce length in bytes. */
+export const NONCE_LENGTH = 12;
+/** AES-GCM authentication tag length in bits. */
+export const TAG_LENGTH = 128;
+/** AES-GCM authentication tag length in bytes. */
+export const TAG_BYTES = TAG_LENGTH / 8;
 const KEY_LENGTH = 32; // bytes (AES-256)
 /**
  * Import a raw AES-256 key as a `CryptoKey` for use with `encrypt()`/`decrypt()`.
@@ -24,28 +12,59 @@ const KEY_LENGTH = 32; // bytes (AES-256)
  * Callers should call this once per run (after `getEncryptionKeyForRun()`)
  * and pass the resulting `CryptoKey` to all subsequent encrypt/decrypt calls.
  *
+ * Pass `usages: ['encrypt']` (or `['decrypt']`) for cross-run scenarios
+ * where the caller should not be able to perform the inverse operation
+ * with the key — for example a child workflow writing into a parent
+ * run's forwarded WritableStream only needs to encrypt, never decrypt.
+ *
  * @param raw - Raw 32-byte AES-256 key (from World.getEncryptionKeyForRun)
+ * @param usages - Key usages. Defaults to `['encrypt', 'decrypt']`.
  * @returns CryptoKey ready for AES-GCM operations
  */
-export async function importKey(raw) {
+export async function importKey(raw, usages = ['encrypt', 'decrypt']) {
     if (raw.byteLength !== KEY_LENGTH) {
-        throw new Error(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw.byteLength}`);
+        throw new WorkflowRuntimeError(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw.byteLength}`);
     }
-    return globalThis.crypto.subtle.importKey('raw', raw, 'AES-GCM', false, [
-        'encrypt',
-        'decrypt',
-    ]);
+    return globalThis.crypto.subtle.importKey('raw', raw, 'AES-GCM', false, 
+    // `KeyUsage` is a DOM-lib type that's not in scope under `es2022`.
+    // The `ReadonlyArray<'encrypt' | 'decrypt'>` parameter type matches
+    // a strict subset of `KeyUsage[]`, so this cast is sound.
+    usages);
 }
 /**
  * Encrypt data using AES-256-GCM.
  *
  * @param key - CryptoKey from `importKey()`
  * @param data - Plaintext to encrypt
+ * @param aad - Optional additional authenticated data. Not encrypted, but
+ *   covered by the GCM auth tag: decryption fails unless the exact same
+ *   bytes are supplied. Used by the sealed-box layer to bind ciphertext to
+ *   a `projectId|runId` context. Omit for no AAD (the legacy behavior).
  * @returns `[nonce (12 bytes)][ciphertext + GCM auth tag]`
  */
-export async function encrypt(key, data) {
+export async function encrypt(key, data, aad) {
     const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
-    const ciphertext = await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, tagLength: TAG_LENGTH }, key, data);
+    let ciphertext;
+    try {
+        ciphertext = await globalThis.crypto.subtle.encrypt({
+            name: 'AES-GCM',
+            iv: nonce,
+            tagLength: TAG_LENGTH,
+            ...(aad ? { additionalData: aad } : {}),
+        }, key, data);
+    }
+    catch (cause) {
+        // Re-wrap any Web Crypto failure (DOMException etc.) as a
+        // RuntimeDecryptionError. Failures here are rare — they happen e.g.
+        // when a CryptoKey was imported with `usages: ['decrypt']` only.
+        throw new RuntimeDecryptionError(`AES-256-GCM encryption failed: ${cause instanceof Error ? cause.message : String(cause)}`, {
+            cause,
+            context: {
+                operation: 'encrypt',
+                byteLength: data.byteLength,
+            },
+        });
+    }
     const result = new Uint8Array(NONCE_LENGTH + ciphertext.byteLength);
     result.set(nonce, 0);
     result.set(new Uint8Array(ciphertext), NONCE_LENGTH);
@@ -54,18 +73,65 @@ export async function encrypt(key, data) {
 /**
  * Decrypt data using AES-256-GCM.
  *
+ * Any failure inside the Web Crypto layer — most commonly an
+ * `OperationError: The operation failed for an operation-specific reason`
+ * raised by `AESCipherJob.onDone` when the GCM authentication tag does
+ * not verify — is rewrapped as {@link RuntimeDecryptionError}. The
+ * wrapped error carries the original DOMException as `cause`, plus a
+ * small diagnostic context (`operation`, input `byteLength`) to help
+ * disambiguate ciphertext corruption from key mismatch from truncated
+ * transport reads.
+ *
+ * Note: `data` is the raw AES payload (`[nonce][ciphertext + tag]`), not a
+ * format-prefixed envelope — callers strip the `encr` marker via
+ * `decodeFormatPrefix()` before reaching this function. The outer
+ * envelope's format prefix is therefore attached by the serialization
+ * layer (`serialization/encryption.ts`), which is the layer that has it.
+ *
  * @param key - CryptoKey from `importKey()`
  * @param data - `[nonce (12 bytes)][ciphertext + GCM auth tag]`
+ * @param aad - Optional additional authenticated data. Must match the bytes
+ *   passed to {@link encrypt} exactly, otherwise the GCM tag fails to verify
+ *   and a {@link RuntimeDecryptionError} is thrown.
  * @returns Decrypted plaintext
  */
-export async function decrypt(key, data) {
+export async function decrypt(key, data, aad) {
     const minLength = NONCE_LENGTH + TAG_LENGTH / 8; // nonce + auth tag
     if (data.byteLength < minLength) {
-        throw new Error(`Encrypted data too short: expected at least ${minLength} bytes, got ${data.byteLength}`);
+        throw new RuntimeDecryptionError(`Encrypted data too short: expected at least ${minLength} bytes, got ${data.byteLength}`, {
+            context: {
+                operation: 'decrypt',
+                byteLength: data.byteLength,
+            },
+        });
     }
     const nonce = data.subarray(0, NONCE_LENGTH);
     const ciphertext = data.subarray(NONCE_LENGTH);
-    const plaintext = await globalThis.crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, tagLength: TAG_LENGTH }, key, ciphertext);
+    let plaintext;
+    try {
+        plaintext = await globalThis.crypto.subtle.decrypt({
+            name: 'AES-GCM',
+            iv: nonce,
+            tagLength: TAG_LENGTH,
+            ...(aad ? { additionalData: aad } : {}),
+        }, key, ciphertext);
+    }
+    catch (cause) {
+        // The most common shape we see in the wild is a DOMException with
+        // `name: 'OperationError'` and message "The operation failed for
+        // an operation-specific reason" — this is what Web Crypto throws
+        // when the GCM auth tag does not verify. Re-throw as
+        // RuntimeDecryptionError, attaching diagnostic context (byte length)
+        // that the bare DOMException lacks.
+        const causeMsg = cause instanceof Error ? cause.message : String(cause);
+        throw new RuntimeDecryptionError(`AES-256-GCM decryption failed: ${causeMsg}`, {
+            cause,
+            context: {
+                operation: 'decrypt',
+                byteLength: data.byteLength,
+            },
+        });
+    }
     return new Uint8Array(plaintext);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9lbmNyeXB0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBT0gsTUFBTSxZQUFZLEdBQUcsRUFBRSxDQUFDO0FBQ3hCLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxDQUFDLE9BQU87QUFDL0IsTUFBTSxVQUFVLEdBQUcsRUFBRSxDQUFDLENBQUMsa0JBQWtCO0FBRXpDOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxTQUFTLENBQUMsR0FBZTtJQUM3QyxJQUFJLEdBQUcsQ0FBQyxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDbEMsTUFBTSxJQUFJLEtBQUssQ0FDYixrQ0FBa0MsVUFBVSxlQUFlLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FDNUUsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7UUFDdEUsU0FBUztRQUNULFNBQVM7S0FDVixDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLEdBQWMsRUFDZCxJQUFnQjtJQUVoQixNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sVUFBVSxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUN2RCxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLEVBQ3JELEdBQUcsRUFDSCxJQUFJLENBQ0wsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLFlBQVksR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDckIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNyRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLEdBQWMsRUFDZCxJQUFnQjtJQUVoQixNQUFNLFNBQVMsR0FBRyxZQUFZLEdBQUcsVUFBVSxHQUFHLENBQUMsQ0FBQyxDQUFDLG1CQUFtQjtJQUNwRSxJQUFJLElBQUksQ0FBQyxVQUFVLEdBQUcsU0FBUyxFQUFFLENBQUM7UUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FDYiwrQ0FBK0MsU0FBUyxlQUFlLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FDekYsQ0FBQztJQUNKLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUM3QyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQy9DLE1BQU0sU0FBUyxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUN0RCxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLEVBQ3JELEdBQUcsRUFDSCxVQUFVLENBQ1gsQ0FBQztJQUNGLE9BQU8sSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDbkMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQnJvd3Nlci1jb21wYXRpYmxlIEFFUy0yNTYtR0NNIGVuY3J5cHRpb24gbW9kdWxlLlxuICpcbiAqIFVzZXMgdGhlIFdlYiBDcnlwdG8gQVBJIChgZ2xvYmFsVGhpcy5jcnlwdG8uc3VidGxlYCkgd2hpY2ggd29ya3MgaW5cbiAqIGJvdGggbW9kZXJuIGJyb3dzZXJzIGFuZCBOb2RlLmpzIDIwKy4gVGhpcyBtb2R1bGUgaXMgaW50ZW50aW9uYWxseVxuICogZnJlZSBvZiBOb2RlLmpzLXNwZWNpZmljIGltcG9ydHMgc28gaXQgY2FuIGJlIGJ1bmRsZWQgZm9yIHRoZSBicm93c2VyLlxuICpcbiAqIFRoZSBXb3JsZCBpbnRlcmZhY2UgKGBnZXRFbmNyeXB0aW9uS2V5Rm9yUnVuYCkgcmV0dXJucyBhIHJhdyAzMi1ieXRlXG4gKiBBRVMtMjU2IGtleS4gQ2FsbGVycyBzaG91bGQgdXNlIGBpbXBvcnRLZXkoKWAgb25jZSB0byBjb252ZXJ0IGl0IHRvIGFcbiAqIGBDcnlwdG9LZXlgLCB0aGVuIHBhc3MgdGhhdCB0byBgZW5jcnlwdCgpYC9gZGVjcnlwdCgpYCBmb3IgYWxsXG4gKiBvcGVyYXRpb25zIHdpdGhpbiB0aGUgc2FtZSBydW4uIFRoaXMgYXZvaWRzIHJlcGVhdGVkIGBpbXBvcnRLZXkoKWBcbiAqIGNhbGxzIG9uIGV2ZXJ5IGVuY3J5cHQvZGVjcnlwdCBpbnZvY2F0aW9uLlxuICpcbiAqIFdpcmUgZm9ybWF0OiBgW25vbmNlICgxMiBieXRlcyldW2NpcGhlcnRleHQgKyBhdXRoIHRhZ11gXG4gKiBUaGUgYGVuY3JgIGZvcm1hdCBwcmVmaXggaXMgTk9UIHBhcnQgb2YgdGhpcyBtb2R1bGUg4oCUIGl0J3MgYWRkZWQvc3RyaXBwZWRcbiAqIGJ5IHRoZSBzZXJpYWxpemF0aW9uIGxheWVyIGluIGBtYXliZUVuY3J5cHRgL2BtYXliZURlY3J5cHRgLlxuICovXG5cbi8vIENyeXB0b0tleSBpcyBhIGdsb2JhbCB0eXBlIGluIGJyb3dzZXJzIGFuZCBOb2RlLmpzIDIwKywgYnV0IFR5cGVTY3JpcHQnc1xuLy8gYGVzMjAyMmAgbGliIGRvZXNuJ3QgaW5jbHVkZSBpdC4gUmUtZXhwb3J0IGl0IGZyb20gdGhlIG5vZGU6Y3J5cHRvIHR5cGVzXG4vLyBzbyBjb25zdW1lcnMgY2FuIHJlZmVyZW5jZSBpdCB3aXRob3V0IGFkZGluZyBgZG9tYCBsaWIuXG5leHBvcnQgdHlwZSBDcnlwdG9LZXkgPSBpbXBvcnQoJ25vZGU6Y3J5cHRvJykud2ViY3J5cHRvLkNyeXB0b0tleTtcblxuY29uc3QgTk9OQ0VfTEVOR1RIID0gMTI7XG5jb25zdCBUQUdfTEVOR1RIID0gMTI4OyAvLyBiaXRzXG5jb25zdCBLRVlfTEVOR1RIID0gMzI7IC8vIGJ5dGVzIChBRVMtMjU2KVxuXG4vKipcbiAqIEltcG9ydCBhIHJhdyBBRVMtMjU2IGtleSBhcyBhIGBDcnlwdG9LZXlgIGZvciB1c2Ugd2l0aCBgZW5jcnlwdCgpYC9gZGVjcnlwdCgpYC5cbiAqXG4gKiBDYWxsZXJzIHNob3VsZCBjYWxsIHRoaXMgb25jZSBwZXIgcnVuIChhZnRlciBgZ2V0RW5jcnlwdGlvbktleUZvclJ1bigpYClcbiAqIGFuZCBwYXNzIHRoZSByZXN1bHRpbmcgYENyeXB0b0tleWAgdG8gYWxsIHN1YnNlcXVlbnQgZW5jcnlwdC9kZWNyeXB0IGNhbGxzLlxuICpcbiAqIEBwYXJhbSByYXcgLSBSYXcgMzItYnl0ZSBBRVMtMjU2IGtleSAoZnJvbSBXb3JsZC5nZXRFbmNyeXB0aW9uS2V5Rm9yUnVuKVxuICogQHJldHVybnMgQ3J5cHRvS2V5IHJlYWR5IGZvciBBRVMtR0NNIG9wZXJhdGlvbnNcbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGltcG9ydEtleShyYXc6IFVpbnQ4QXJyYXkpIHtcbiAgaWYgKHJhdy5ieXRlTGVuZ3RoICE9PSBLRVlfTEVOR1RIKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYEVuY3J5cHRpb24ga2V5IG11c3QgYmUgZXhhY3RseSAke0tFWV9MRU5HVEh9IGJ5dGVzLCBnb3QgJHtyYXcuYnl0ZUxlbmd0aH1gXG4gICAgKTtcbiAgfVxuICByZXR1cm4gZ2xvYmFsVGhpcy5jcnlwdG8uc3VidGxlLmltcG9ydEtleSgncmF3JywgcmF3LCAnQUVTLUdDTScsIGZhbHNlLCBbXG4gICAgJ2VuY3J5cHQnLFxuICAgICdkZWNyeXB0JyxcbiAgXSk7XG59XG5cbi8qKlxuICogRW5jcnlwdCBkYXRhIHVzaW5nIEFFUy0yNTYtR0NNLlxuICpcbiAqIEBwYXJhbSBrZXkgLSBDcnlwdG9LZXkgZnJvbSBgaW1wb3J0S2V5KClgXG4gKiBAcGFyYW0gZGF0YSAtIFBsYWludGV4dCB0byBlbmNyeXB0XG4gKiBAcmV0dXJucyBgW25vbmNlICgxMiBieXRlcyldW2NpcGhlcnRleHQgKyBHQ00gYXV0aCB0YWddYFxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZW5jcnlwdChcbiAga2V5OiBDcnlwdG9LZXksXG4gIGRhdGE6IFVpbnQ4QXJyYXlcbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICBjb25zdCBub25jZSA9IGdsb2JhbFRoaXMuY3J5cHRvLmdldFJhbmRvbVZhbHVlcyhuZXcgVWludDhBcnJheShOT05DRV9MRU5HVEgpKTtcbiAgY29uc3QgY2lwaGVydGV4dCA9IGF3YWl0IGdsb2JhbFRoaXMuY3J5cHRvLnN1YnRsZS5lbmNyeXB0KFxuICAgIHsgbmFtZTogJ0FFUy1HQ00nLCBpdjogbm9uY2UsIHRhZ0xlbmd0aDogVEFHX0xFTkdUSCB9LFxuICAgIGtleSxcbiAgICBkYXRhXG4gICk7XG4gIGNvbnN0IHJlc3VsdCA9IG5ldyBVaW50OEFycmF5KE5PTkNFX0xFTkdUSCArIGNpcGhlcnRleHQuYnl0ZUxlbmd0aCk7XG4gIHJlc3VsdC5zZXQobm9uY2UsIDApO1xuICByZXN1bHQuc2V0KG5ldyBVaW50OEFycmF5KGNpcGhlcnRleHQpLCBOT05DRV9MRU5HVEgpO1xuICByZXR1cm4gcmVzdWx0O1xufVxuXG4vKipcbiAqIERlY3J5cHQgZGF0YSB1c2luZyBBRVMtMjU2LUdDTS5cbiAqXG4gKiBAcGFyYW0ga2V5IC0gQ3J5cHRvS2V5IGZyb20gYGltcG9ydEtleSgpYFxuICogQHBhcmFtIGRhdGEgLSBgW25vbmNlICgxMiBieXRlcyldW2NpcGhlcnRleHQgKyBHQ00gYXV0aCB0YWddYFxuICogQHJldHVybnMgRGVjcnlwdGVkIHBsYWludGV4dFxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZGVjcnlwdChcbiAga2V5OiBDcnlwdG9LZXksXG4gIGRhdGE6IFVpbnQ4QXJyYXlcbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICBjb25zdCBtaW5MZW5ndGggPSBOT05DRV9MRU5HVEggKyBUQUdfTEVOR1RIIC8gODsgLy8gbm9uY2UgKyBhdXRoIHRhZ1xuICBpZiAoZGF0YS5ieXRlTGVuZ3RoIDwgbWluTGVuZ3RoKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYEVuY3J5cHRlZCBkYXRhIHRvbyBzaG9ydDogZXhwZWN0ZWQgYXQgbGVhc3QgJHttaW5MZW5ndGh9IGJ5dGVzLCBnb3QgJHtkYXRhLmJ5dGVMZW5ndGh9YFxuICAgICk7XG4gIH1cbiAgY29uc3Qgbm9uY2UgPSBkYXRhLnN1YmFycmF5KDAsIE5PTkNFX0xFTkdUSCk7XG4gIGNvbnN0IGNpcGhlcnRleHQgPSBkYXRhLnN1YmFycmF5KE5PTkNFX0xFTkdUSCk7XG4gIGNvbnN0IHBsYWludGV4dCA9IGF3YWl0IGdsb2JhbFRoaXMuY3J5cHRvLnN1YnRsZS5kZWNyeXB0KFxuICAgIHsgbmFtZTogJ0FFUy1HQ00nLCBpdjogbm9uY2UsIHRhZ0xlbmd0aDogVEFHX0xFTkdUSCB9LFxuICAgIGtleSxcbiAgICBjaXBoZXJ0ZXh0XG4gICk7XG4gIHJldHVybiBuZXcgVWludDhBcnJheShwbGFpbnRleHQpO1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9lbmNyeXB0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBeUJoRixxQ0FBcUM7QUFDckMsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFHLEVBQUUsQ0FBQztBQUMvQixpREFBaUQ7QUFDakQsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQztBQUM5QixrREFBa0Q7QUFDbEQsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFHLFVBQVUsR0FBRyxDQUFDLENBQUM7QUFDeEMsTUFBTSxVQUFVLEdBQUcsRUFBRSxDQUFDLENBQUMsa0JBQWtCO0FBRXpDOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxTQUFTLENBQzdCLEdBQWUsRUFDZixTQUErQyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7SUFFckUsSUFBSSxHQUFHLENBQUMsVUFBVSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sSUFBSSxvQkFBb0IsQ0FDNUIsa0NBQWtDLFVBQVUsZUFBZSxHQUFHLENBQUMsVUFBVSxFQUFFLENBQzVFLENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQ3ZDLEtBQUssRUFDTCxHQUFHLEVBQ0gsU0FBUyxFQUNULEtBQUs7SUFDTCxtRUFBbUU7SUFDbkUsb0VBQW9FO0lBQ3BFLDBEQUEwRDtJQUMxRCxNQUFtQyxDQUNwQyxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDM0IsR0FBYyxFQUNkLElBQWdCLEVBQ2hCLEdBQWdCO0lBRWhCLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQUksVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDOUUsSUFBSSxVQUF1QixDQUFDO0lBQzVCLElBQUksQ0FBQztRQUNILFVBQVUsR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FDakQ7WUFDRSxJQUFJLEVBQUUsU0FBUztZQUNmLEVBQUUsRUFBRSxLQUFLO1lBQ1QsU0FBUyxFQUFFLFVBQVU7WUFDckIsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUN4QyxFQUNELEdBQUcsRUFDSCxJQUFJLENBQ0wsQ0FBQztJQUNKLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsMERBQTBEO1FBQzFELG9FQUFvRTtRQUNwRSxpRUFBaUU7UUFDakUsTUFBTSxJQUFJLHNCQUFzQixDQUM5QixrQ0FBa0MsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQzFGO1lBQ0UsS0FBSztZQUNMLE9BQU8sRUFBRTtnQkFDUCxTQUFTLEVBQUUsU0FBUztnQkFDcEIsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO2FBQzVCO1NBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLFlBQVksR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDckIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNyRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXdCRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsT0FBTyxDQUMzQixHQUFjLEVBQ2QsSUFBZ0IsRUFDaEIsR0FBZ0I7SUFFaEIsTUFBTSxTQUFTLEdBQUcsWUFBWSxHQUFHLFVBQVUsR0FBRyxDQUFDLENBQUMsQ0FBQyxtQkFBbUI7SUFDcEUsSUFBSSxJQUFJLENBQUMsVUFBVSxHQUFHLFNBQVMsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sSUFBSSxzQkFBc0IsQ0FDOUIsK0NBQStDLFNBQVMsZUFBZSxJQUFJLENBQUMsVUFBVSxFQUFFLEVBQ3hGO1lBQ0UsT0FBTyxFQUFFO2dCQUNQLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7YUFDNUI7U0FDRixDQUNGLENBQUM7SUFDSixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDN0MsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUMvQyxJQUFJLFNBQXNCLENBQUM7SUFDM0IsSUFBSSxDQUFDO1FBQ0gsU0FBUyxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUNoRDtZQUNFLElBQUksRUFBRSxTQUFTO1lBQ2YsRUFBRSxFQUFFLEtBQUs7WUFDVCxTQUFTLEVBQUUsVUFBVTtZQUNyQixHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLGNBQWMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ3hDLEVBQ0QsR0FBRyxFQUNILFVBQVUsQ0FDWCxDQUFDO0lBQ0osQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixrRUFBa0U7UUFDbEUsaUVBQWlFO1FBQ2pFLGlFQUFpRTtRQUNqRSxxREFBcUQ7UUFDckQscUVBQXFFO1FBQ3JFLG9DQUFvQztRQUNwQyxNQUFNLFFBQVEsR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDeEUsTUFBTSxJQUFJLHNCQUFzQixDQUM5QixrQ0FBa0MsUUFBUSxFQUFFLEVBQzVDO1lBQ0UsS0FBSztZQUNMLE9BQU8sRUFBRTtnQkFDUCxTQUFTLEVBQUUsU0FBUztnQkFDcEIsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO2FBQzVCO1NBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUNELE9BQU8sSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDbkMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IsIFdvcmtmbG93UnVudGltZUVycm9yIH0gZnJvbSAnQHdvcmtmbG93L2Vycm9ycyc7XG5cbi8qKlxuICogQnJvd3Nlci1jb21wYXRpYmxlIEFFUy0yNTYtR0NNIGVuY3J5cHRpb24gbW9kdWxlLlxuICpcbiAqIFVzZXMgdGhlIFdlYiBDcnlwdG8gQVBJIChgZ2xvYmFsVGhpcy5jcnlwdG8uc3VidGxlYCkgd2hpY2ggd29ya3MgaW5cbiAqIGJvdGggbW9kZXJuIGJyb3dzZXJzIGFuZCBOb2RlLmpzIDIwKy4gVGhpcyBtb2R1bGUgaXMgaW50ZW50aW9uYWxseVxuICogZnJlZSBvZiBOb2RlLmpzLXNwZWNpZmljIGltcG9ydHMgc28gaXQgY2FuIGJlIGJ1bmRsZWQgZm9yIHRoZSBicm93c2VyLlxuICpcbiAqIFRoZSBXb3JsZCBpbnRlcmZhY2UgKGBnZXRFbmNyeXB0aW9uS2V5Rm9yUnVuYCkgcmV0dXJucyBhIHJhdyAzMi1ieXRlXG4gKiBBRVMtMjU2IGtleS4gQ2FsbGVycyBzaG91bGQgdXNlIGBpbXBvcnRLZXkoKWAgb25jZSB0byBjb252ZXJ0IGl0IHRvIGFcbiAqIGBDcnlwdG9LZXlgLCB0aGVuIHBhc3MgdGhhdCB0byBgZW5jcnlwdCgpYC9gZGVjcnlwdCgpYCBmb3IgYWxsXG4gKiBvcGVyYXRpb25zIHdpdGhpbiB0aGUgc2FtZSBydW4uIFRoaXMgYXZvaWRzIHJlcGVhdGVkIGBpbXBvcnRLZXkoKWBcbiAqIGNhbGxzIG9uIGV2ZXJ5IGVuY3J5cHQvZGVjcnlwdCBpbnZvY2F0aW9uLlxuICpcbiAqIFdpcmUgZm9ybWF0OiBgW25vbmNlICgxMiBieXRlcyldW2NpcGhlcnRleHQgKyBhdXRoIHRhZ11gXG4gKiBUaGUgYGVuY3JgIGZvcm1hdCBwcmVmaXggaXMgTk9UIHBhcnQgb2YgdGhpcyBtb2R1bGUg4oCUIGl0J3MgYWRkZWQvc3RyaXBwZWRcbiAqIGJ5IHRoZSBzZXJpYWxpemF0aW9uIGxheWVyIGluIGBtYXliZUVuY3J5cHRgL2BtYXliZURlY3J5cHRgLlxuICovXG5cbi8vIENyeXB0b0tleSBpcyBhIGdsb2JhbCB0eXBlIGluIGJyb3dzZXJzIGFuZCBOb2RlLmpzIDIwKywgYnV0IFR5cGVTY3JpcHQnc1xuLy8gYGVzMjAyMmAgbGliIGRvZXNuJ3QgaW5jbHVkZSBpdC4gUmUtZXhwb3J0IGl0IGZyb20gdGhlIG5vZGU6Y3J5cHRvIHR5cGVzXG4vLyBzbyBjb25zdW1lcnMgY2FuIHJlZmVyZW5jZSBpdCB3aXRob3V0IGFkZGluZyBgZG9tYCBsaWIuXG5leHBvcnQgdHlwZSBDcnlwdG9LZXkgPSBpbXBvcnQoJ25vZGU6Y3J5cHRvJykud2ViY3J5cHRvLkNyeXB0b0tleTtcblxuLyoqIEFFUy1HQ00gbm9uY2UgbGVuZ3RoIGluIGJ5dGVzLiAqL1xuZXhwb3J0IGNvbnN0IE5PTkNFX0xFTkdUSCA9IDEyO1xuLyoqIEFFUy1HQ00gYXV0aGVudGljYXRpb24gdGFnIGxlbmd0aCBpbiBiaXRzLiAqL1xuZXhwb3J0IGNvbnN0IFRBR19MRU5HVEggPSAxMjg7XG4vKiogQUVTLUdDTSBhdXRoZW50aWNhdGlvbiB0YWcgbGVuZ3RoIGluIGJ5dGVzLiAqL1xuZXhwb3J0IGNvbnN0IFRBR19CWVRFUyA9IFRBR19MRU5HVEggLyA4O1xuY29uc3QgS0VZX0xFTkdUSCA9IDMyOyAvLyBieXRlcyAoQUVTLTI1NilcblxuLyoqXG4gKiBJbXBvcnQgYSByYXcgQUVTLTI1NiBrZXkgYXMgYSBgQ3J5cHRvS2V5YCBmb3IgdXNlIHdpdGggYGVuY3J5cHQoKWAvYGRlY3J5cHQoKWAuXG4gKlxuICogQ2FsbGVycyBzaG91bGQgY2FsbCB0aGlzIG9uY2UgcGVyIHJ1biAoYWZ0ZXIgYGdldEVuY3J5cHRpb25LZXlGb3JSdW4oKWApXG4gKiBhbmQgcGFzcyB0aGUgcmVzdWx0aW5nIGBDcnlwdG9LZXlgIHRvIGFsbCBzdWJzZXF1ZW50IGVuY3J5cHQvZGVjcnlwdCBjYWxscy5cbiAqXG4gKiBQYXNzIGB1c2FnZXM6IFsnZW5jcnlwdCddYCAob3IgYFsnZGVjcnlwdCddYCkgZm9yIGNyb3NzLXJ1biBzY2VuYXJpb3NcbiAqIHdoZXJlIHRoZSBjYWxsZXIgc2hvdWxkIG5vdCBiZSBhYmxlIHRvIHBlcmZvcm0gdGhlIGludmVyc2Ugb3BlcmF0aW9uXG4gKiB3aXRoIHRoZSBrZXkg4oCUIGZvciBleGFtcGxlIGEgY2hpbGQgd29ya2Zsb3cgd3JpdGluZyBpbnRvIGEgcGFyZW50XG4gKiBydW4ncyBmb3J3YXJkZWQgV3JpdGFibGVTdHJlYW0gb25seSBuZWVkcyB0byBlbmNyeXB0LCBuZXZlciBkZWNyeXB0LlxuICpcbiAqIEBwYXJhbSByYXcgLSBSYXcgMzItYnl0ZSBBRVMtMjU2IGtleSAoZnJvbSBXb3JsZC5nZXRFbmNyeXB0aW9uS2V5Rm9yUnVuKVxuICogQHBhcmFtIHVzYWdlcyAtIEtleSB1c2FnZXMuIERlZmF1bHRzIHRvIGBbJ2VuY3J5cHQnLCAnZGVjcnlwdCddYC5cbiAqIEByZXR1cm5zIENyeXB0b0tleSByZWFkeSBmb3IgQUVTLUdDTSBvcGVyYXRpb25zXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBpbXBvcnRLZXkoXG4gIHJhdzogVWludDhBcnJheSxcbiAgdXNhZ2VzOiBSZWFkb25seUFycmF5PCdlbmNyeXB0JyB8ICdkZWNyeXB0Jz4gPSBbJ2VuY3J5cHQnLCAnZGVjcnlwdCddXG4pIHtcbiAgaWYgKHJhdy5ieXRlTGVuZ3RoICE9PSBLRVlfTEVOR1RIKSB7XG4gICAgdGhyb3cgbmV3IFdvcmtmbG93UnVudGltZUVycm9yKFxuICAgICAgYEVuY3J5cHRpb24ga2V5IG11c3QgYmUgZXhhY3RseSAke0tFWV9MRU5HVEh9IGJ5dGVzLCBnb3QgJHtyYXcuYnl0ZUxlbmd0aH1gXG4gICAgKTtcbiAgfVxuICByZXR1cm4gZ2xvYmFsVGhpcy5jcnlwdG8uc3VidGxlLmltcG9ydEtleShcbiAgICAncmF3JyxcbiAgICByYXcsXG4gICAgJ0FFUy1HQ00nLFxuICAgIGZhbHNlLFxuICAgIC8vIGBLZXlVc2FnZWAgaXMgYSBET00tbGliIHR5cGUgdGhhdCdzIG5vdCBpbiBzY29wZSB1bmRlciBgZXMyMDIyYC5cbiAgICAvLyBUaGUgYFJlYWRvbmx5QXJyYXk8J2VuY3J5cHQnIHwgJ2RlY3J5cHQnPmAgcGFyYW1ldGVyIHR5cGUgbWF0Y2hlc1xuICAgIC8vIGEgc3RyaWN0IHN1YnNldCBvZiBgS2V5VXNhZ2VbXWAsIHNvIHRoaXMgY2FzdCBpcyBzb3VuZC5cbiAgICB1c2FnZXMgYXMgKCdlbmNyeXB0JyB8ICdkZWNyeXB0JylbXVxuICApO1xufVxuXG4vKipcbiAqIEVuY3J5cHQgZGF0YSB1c2luZyBBRVMtMjU2LUdDTS5cbiAqXG4gKiBAcGFyYW0ga2V5IC0gQ3J5cHRvS2V5IGZyb20gYGltcG9ydEtleSgpYFxuICogQHBhcmFtIGRhdGEgLSBQbGFpbnRleHQgdG8gZW5jcnlwdFxuICogQHBhcmFtIGFhZCAtIE9wdGlvbmFsIGFkZGl0aW9uYWwgYXV0aGVudGljYXRlZCBkYXRhLiBOb3QgZW5jcnlwdGVkLCBidXRcbiAqICAgY292ZXJlZCBieSB0aGUgR0NNIGF1dGggdGFnOiBkZWNyeXB0aW9uIGZhaWxzIHVubGVzcyB0aGUgZXhhY3Qgc2FtZVxuICogICBieXRlcyBhcmUgc3VwcGxpZWQuIFVzZWQgYnkgdGhlIHNlYWxlZC1ib3ggbGF5ZXIgdG8gYmluZCBjaXBoZXJ0ZXh0IHRvXG4gKiAgIGEgYHByb2plY3RJZHxydW5JZGAgY29udGV4dC4gT21pdCBmb3Igbm8gQUFEICh0aGUgbGVnYWN5IGJlaGF2aW9yKS5cbiAqIEByZXR1cm5zIGBbbm9uY2UgKDEyIGJ5dGVzKV1bY2lwaGVydGV4dCArIEdDTSBhdXRoIHRhZ11gXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbmNyeXB0KFxuICBrZXk6IENyeXB0b0tleSxcbiAgZGF0YTogVWludDhBcnJheSxcbiAgYWFkPzogVWludDhBcnJheVxuKTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gIGNvbnN0IG5vbmNlID0gZ2xvYmFsVGhpcy5jcnlwdG8uZ2V0UmFuZG9tVmFsdWVzKG5ldyBVaW50OEFycmF5KE5PTkNFX0xFTkdUSCkpO1xuICBsZXQgY2lwaGVydGV4dDogQXJyYXlCdWZmZXI7XG4gIHRyeSB7XG4gICAgY2lwaGVydGV4dCA9IGF3YWl0IGdsb2JhbFRoaXMuY3J5cHRvLnN1YnRsZS5lbmNyeXB0KFxuICAgICAge1xuICAgICAgICBuYW1lOiAnQUVTLUdDTScsXG4gICAgICAgIGl2OiBub25jZSxcbiAgICAgICAgdGFnTGVuZ3RoOiBUQUdfTEVOR1RILFxuICAgICAgICAuLi4oYWFkID8geyBhZGRpdGlvbmFsRGF0YTogYWFkIH0gOiB7fSksXG4gICAgICB9LFxuICAgICAga2V5LFxuICAgICAgZGF0YVxuICAgICk7XG4gIH0gY2F0Y2ggKGNhdXNlKSB7XG4gICAgLy8gUmUtd3JhcCBhbnkgV2ViIENyeXB0byBmYWlsdXJlIChET01FeGNlcHRpb24gZXRjLikgYXMgYVxuICAgIC8vIFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IuIEZhaWx1cmVzIGhlcmUgYXJlIHJhcmUg4oCUIHRoZXkgaGFwcGVuIGUuZy5cbiAgICAvLyB3aGVuIGEgQ3J5cHRvS2V5IHdhcyBpbXBvcnRlZCB3aXRoIGB1c2FnZXM6IFsnZGVjcnlwdCddYCBvbmx5LlxuICAgIHRocm93IG5ldyBSdW50aW1lRGVjcnlwdGlvbkVycm9yKFxuICAgICAgYEFFUy0yNTYtR0NNIGVuY3J5cHRpb24gZmFpbGVkOiAke2NhdXNlIGluc3RhbmNlb2YgRXJyb3IgPyBjYXVzZS5tZXNzYWdlIDogU3RyaW5nKGNhdXNlKX1gLFxuICAgICAge1xuICAgICAgICBjYXVzZSxcbiAgICAgICAgY29udGV4dDoge1xuICAgICAgICAgIG9wZXJhdGlvbjogJ2VuY3J5cHQnLFxuICAgICAgICAgIGJ5dGVMZW5ndGg6IGRhdGEuYnl0ZUxlbmd0aCxcbiAgICAgICAgfSxcbiAgICAgIH1cbiAgICApO1xuICB9XG4gIGNvbnN0IHJlc3VsdCA9IG5ldyBVaW50OEFycmF5KE5PTkNFX0xFTkdUSCArIGNpcGhlcnRleHQuYnl0ZUxlbmd0aCk7XG4gIHJlc3VsdC5zZXQobm9uY2UsIDApO1xuICByZXN1bHQuc2V0KG5ldyBVaW50OEFycmF5KGNpcGhlcnRleHQpLCBOT05DRV9MRU5HVEgpO1xuICByZXR1cm4gcmVzdWx0O1xufVxuXG4vKipcbiAqIERlY3J5cHQgZGF0YSB1c2luZyBBRVMtMjU2LUdDTS5cbiAqXG4gKiBBbnkgZmFpbHVyZSBpbnNpZGUgdGhlIFdlYiBDcnlwdG8gbGF5ZXIg4oCUIG1vc3QgY29tbW9ubHkgYW5cbiAqIGBPcGVyYXRpb25FcnJvcjogVGhlIG9wZXJhdGlvbiBmYWlsZWQgZm9yIGFuIG9wZXJhdGlvbi1zcGVjaWZpYyByZWFzb25gXG4gKiByYWlzZWQgYnkgYEFFU0NpcGhlckpvYi5vbkRvbmVgIHdoZW4gdGhlIEdDTSBhdXRoZW50aWNhdGlvbiB0YWcgZG9lc1xuICogbm90IHZlcmlmeSDigJQgaXMgcmV3cmFwcGVkIGFzIHtAbGluayBSdW50aW1lRGVjcnlwdGlvbkVycm9yfS4gVGhlXG4gKiB3cmFwcGVkIGVycm9yIGNhcnJpZXMgdGhlIG9yaWdpbmFsIERPTUV4Y2VwdGlvbiBhcyBgY2F1c2VgLCBwbHVzIGFcbiAqIHNtYWxsIGRpYWdub3N0aWMgY29udGV4dCAoYG9wZXJhdGlvbmAsIGlucHV0IGBieXRlTGVuZ3RoYCkgdG8gaGVscFxuICogZGlzYW1iaWd1YXRlIGNpcGhlcnRleHQgY29ycnVwdGlvbiBmcm9tIGtleSBtaXNtYXRjaCBmcm9tIHRydW5jYXRlZFxuICogdHJhbnNwb3J0IHJlYWRzLlxuICpcbiAqIE5vdGU6IGBkYXRhYCBpcyB0aGUgcmF3IEFFUyBwYXlsb2FkIChgW25vbmNlXVtjaXBoZXJ0ZXh0ICsgdGFnXWApLCBub3QgYVxuICogZm9ybWF0LXByZWZpeGVkIGVudmVsb3BlIOKAlCBjYWxsZXJzIHN0cmlwIHRoZSBgZW5jcmAgbWFya2VyIHZpYVxuICogYGRlY29kZUZvcm1hdFByZWZpeCgpYCBiZWZvcmUgcmVhY2hpbmcgdGhpcyBmdW5jdGlvbi4gVGhlIG91dGVyXG4gKiBlbnZlbG9wZSdzIGZvcm1hdCBwcmVmaXggaXMgdGhlcmVmb3JlIGF0dGFjaGVkIGJ5IHRoZSBzZXJpYWxpemF0aW9uXG4gKiBsYXllciAoYHNlcmlhbGl6YXRpb24vZW5jcnlwdGlvbi50c2ApLCB3aGljaCBpcyB0aGUgbGF5ZXIgdGhhdCBoYXMgaXQuXG4gKlxuICogQHBhcmFtIGtleSAtIENyeXB0b0tleSBmcm9tIGBpbXBvcnRLZXkoKWBcbiAqIEBwYXJhbSBkYXRhIC0gYFtub25jZSAoMTIgYnl0ZXMpXVtjaXBoZXJ0ZXh0ICsgR0NNIGF1dGggdGFnXWBcbiAqIEBwYXJhbSBhYWQgLSBPcHRpb25hbCBhZGRpdGlvbmFsIGF1dGhlbnRpY2F0ZWQgZGF0YS4gTXVzdCBtYXRjaCB0aGUgYnl0ZXNcbiAqICAgcGFzc2VkIHRvIHtAbGluayBlbmNyeXB0fSBleGFjdGx5LCBvdGhlcndpc2UgdGhlIEdDTSB0YWcgZmFpbHMgdG8gdmVyaWZ5XG4gKiAgIGFuZCBhIHtAbGluayBSdW50aW1lRGVjcnlwdGlvbkVycm9yfSBpcyB0aHJvd24uXG4gKiBAcmV0dXJucyBEZWNyeXB0ZWQgcGxhaW50ZXh0XG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBkZWNyeXB0KFxuICBrZXk6IENyeXB0b0tleSxcbiAgZGF0YTogVWludDhBcnJheSxcbiAgYWFkPzogVWludDhBcnJheVxuKTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gIGNvbnN0IG1pbkxlbmd0aCA9IE5PTkNFX0xFTkdUSCArIFRBR19MRU5HVEggLyA4OyAvLyBub25jZSArIGF1dGggdGFnXG4gIGlmIChkYXRhLmJ5dGVMZW5ndGggPCBtaW5MZW5ndGgpIHtcbiAgICB0aHJvdyBuZXcgUnVudGltZURlY3J5cHRpb25FcnJvcihcbiAgICAgIGBFbmNyeXB0ZWQgZGF0YSB0b28gc2hvcnQ6IGV4cGVjdGVkIGF0IGxlYXN0ICR7bWluTGVuZ3RofSBieXRlcywgZ290ICR7ZGF0YS5ieXRlTGVuZ3RofWAsXG4gICAgICB7XG4gICAgICAgIGNvbnRleHQ6IHtcbiAgICAgICAgICBvcGVyYXRpb246ICdkZWNyeXB0JyxcbiAgICAgICAgICBieXRlTGVuZ3RoOiBkYXRhLmJ5dGVMZW5ndGgsXG4gICAgICAgIH0sXG4gICAgICB9XG4gICAgKTtcbiAgfVxuICBjb25zdCBub25jZSA9IGRhdGEuc3ViYXJyYXkoMCwgTk9OQ0VfTEVOR1RIKTtcbiAgY29uc3QgY2lwaGVydGV4dCA9IGRhdGEuc3ViYXJyYXkoTk9OQ0VfTEVOR1RIKTtcbiAgbGV0IHBsYWludGV4dDogQXJyYXlCdWZmZXI7XG4gIHRyeSB7XG4gICAgcGxhaW50ZXh0ID0gYXdhaXQgZ2xvYmFsVGhpcy5jcnlwdG8uc3VidGxlLmRlY3J5cHQoXG4gICAgICB7XG4gICAgICAgIG5hbWU6ICdBRVMtR0NNJyxcbiAgICAgICAgaXY6IG5vbmNlLFxuICAgICAgICB0YWdMZW5ndGg6IFRBR19MRU5HVEgsXG4gICAgICAgIC4uLihhYWQgPyB7IGFkZGl0aW9uYWxEYXRhOiBhYWQgfSA6IHt9KSxcbiAgICAgIH0sXG4gICAgICBrZXksXG4gICAgICBjaXBoZXJ0ZXh0XG4gICAgKTtcbiAgfSBjYXRjaCAoY2F1c2UpIHtcbiAgICAvLyBUaGUgbW9zdCBjb21tb24gc2hhcGUgd2Ugc2VlIGluIHRoZSB3aWxkIGlzIGEgRE9NRXhjZXB0aW9uIHdpdGhcbiAgICAvLyBgbmFtZTogJ09wZXJhdGlvbkVycm9yJ2AgYW5kIG1lc3NhZ2UgXCJUaGUgb3BlcmF0aW9uIGZhaWxlZCBmb3JcbiAgICAvLyBhbiBvcGVyYXRpb24tc3BlY2lmaWMgcmVhc29uXCIg4oCUIHRoaXMgaXMgd2hhdCBXZWIgQ3J5cHRvIHRocm93c1xuICAgIC8vIHdoZW4gdGhlIEdDTSBhdXRoIHRhZyBkb2VzIG5vdCB2ZXJpZnkuIFJlLXRocm93IGFzXG4gICAgLy8gUnVudGltZURlY3J5cHRpb25FcnJvciwgYXR0YWNoaW5nIGRpYWdub3N0aWMgY29udGV4dCAoYnl0ZSBsZW5ndGgpXG4gICAgLy8gdGhhdCB0aGUgYmFyZSBET01FeGNlcHRpb24gbGFja3MuXG4gICAgY29uc3QgY2F1c2VNc2cgPSBjYXVzZSBpbnN0YW5jZW9mIEVycm9yID8gY2F1c2UubWVzc2FnZSA6IFN0cmluZyhjYXVzZSk7XG4gICAgdGhyb3cgbmV3IFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IoXG4gICAgICBgQUVTLTI1Ni1HQ00gZGVjcnlwdGlvbiBmYWlsZWQ6ICR7Y2F1c2VNc2d9YCxcbiAgICAgIHtcbiAgICAgICAgY2F1c2UsXG4gICAgICAgIGNvbnRleHQ6IHtcbiAgICAgICAgICBvcGVyYXRpb246ICdkZWNyeXB0JyxcbiAgICAgICAgICBieXRlTGVuZ3RoOiBkYXRhLmJ5dGVMZW5ndGgsXG4gICAgICAgIH0sXG4gICAgICB9XG4gICAgKTtcbiAgfVxuICByZXR1cm4gbmV3IFVpbnQ4QXJyYXkocGxhaW50ZXh0KTtcbn1cbiJdfQ==

package/dist/events-consumer.d.ts

@@ -1,4 +1,20 @@
-import type { Event } from '@workflow/world';
+import { type Event } from '@workflow/world';
+/**
+ * Delay before firing the deferred unconsumed-event check after the promise
+ * queue has drained. Must be long enough for cross-VM microtask chains to
+ * propagate (resolve in host → workflow code in VM → subscribe call back
+ * in host). Any subscribe() arriving during this window cancels the check.
+ */
+export declare const DEFERRED_CHECK_DELAY_MS = 100;
+/**
+ * Floor for the deferred-check delay, so a too-low override can't manufacture
+ * spurious divergence (each false positive burns a divergence-recovery retry
+ * and can escalate to a terminal `CorruptedEventLogError`).
+ *
+ * Exported so tests needing the shortest legal delay can ask for it instead of
+ * hardcoding a number this floor would silently clamp up.
+ */
+export declare const MIN_DEFERRED_CHECK_DELAY_MS = 10;
 export declare enum EventConsumerResult {
     /**
      * Callback consumed the event, but should not be removed from the callbacks list
@@ -15,6 +31,12 @@ export declare enum EventConsumerResult {
 }
 type EventConsumerCallback = (event: Event | null) => EventConsumerResult;
 export interface EventsConsumerOptions {
+    /**
+     * Callback invoked after an event has been consumed. Consumers such as the
+     * deterministic workflow clock must not observe events that are merely
+     * inspected while waiting for user code to subscribe to the next operation.
+     */
+    onConsumedEvent?: (event: Event) => void;
     /**
      * Callback invoked when a non-null event cannot be consumed by any registered
      * callback, indicating an orphaned or invalid event in the event log. The
@@ -30,17 +52,73 @@ export interface EventsConsumerOptions {
      * deserialization delays the resolve() that triggers the next subscribe().
      */
     getPromiseQueue: () => Promise<void>;
+    /**
+     * Whether no data delivery is in flight (`isDeliveryIdle` in private.ts).
+     * The unconsumed-event check waits for this before it fires: a delivery in
+     * flight means the workflow VM is mid-reaction, and an event it has not
+     * claimed yet is an event it has not reached yet.
+     *
+     * Required rather than defaulting to always-idle: always-idle is exactly the
+     * pre-gate behaviour, so a defaulted option would let a construction site opt
+     * a whole replay path back out without saying so. Tests that drive a consumer
+     * with no orchestrator context pass `() => true` to keep the pre-existing
+     * timing, and say so at the call site.
+     */
+    isDeliveryIdle: () => boolean;
 }
 export declare class EventsConsumer {
     eventIndex: number;
     readonly events: Event[];
     readonly callbacks: EventConsumerCallback[];
+    /**
+     * Events the ordered walk stepped over because nobody claimed them and their
+     * type carries no ordering claim. Each keeps the index it held in the log:
+     * consumers read {@link eventIndex} at consumption time to order their
+     * delivery against the rest of the log, and a late delivery must still make
+     * the claim its position gave it.
+     *
+     * Held in log order, drained in log order, and drained before every offer so
+     * a consumer registered after the walk passed the event still receives it.
+     */
+    private readonly parked;
+    /**
+     * Correlation ids of the {@link ONE_SHOT_EVENT_TYPES} events consumed so
+     * far, so a second resolution for one of them is recognized as unclaimable
+     * rather than parked for a consumer that cannot exist.
+     */
+    private readonly resolved;
+    private onConsumedEvent?;
     private onUnconsumedEvent;
     private getPromiseQueue;
+    private isDeliveryIdle;
     private pendingUnconsumedCheck;
     private pendingUnconsumedTimeout;
     private unconsumedCheckVersion;
     constructor(events: Event[], options: EventsConsumerOptions);
+    /**
+     * The oldest event the walk stepped over that no consumer has claimed yet,
+     * if any. Parking is a bet that a consumer will be registered later, so at
+     * any point where no consumer ever will be again — the replay finishing is
+     * the definitive one — this answers which event the bet lost on.
+     */
+    get strandedEvent(): Event | undefined;
+    /**
+     * What the walk is still holding, or `undefined` when it holds nothing.
+     *
+     * Read at every point a replay stops, including the suspensions that are not
+     * settling points, so the held state reaches telemetry. A replay cannot tell
+     * a delivery awaiting a later consumer from one no consumer will ever
+     * register, so it reports rather than decides: the same `eventId` reported on
+     * suspension after suspension of one run is the shape that says the bet
+     * parking made is not going to pay off, and that shape is only visible across
+     * replays.
+     */
+    get parkedSummary(): {
+        count: number;
+        eventId: string;
+        eventType: Event['eventType'];
+    } | undefined;
+    append(events: Event[]): void;
     /**
      * Registers a callback function to be called after an event has been consumed
      * by a different callback. The callback can return:
@@ -51,7 +129,75 @@ export declare class EventsConsumer {
      * @param fn - The callback function to register.
      */
     subscribe(fn: EventConsumerCallback): void;
+    private notifyConsumedEvent;
     private consume;
+    /**
+     * Offer `currentEvent` to each registered callback in turn. Returns true
+     * when a callback consumed it. Does not move {@link eventIndex}: the ordered
+     * walk and the parked drain advance differently, so each does its own.
+     */
+    private offer;
+    /**
+     * Offer everything parked, oldest first, until a pass claims nothing.
+     *
+     * Each offer runs with {@link eventIndex} moved back to the position the
+     * parked event held in the log, because that is the position its consumer
+     * will register a delivery barrier under. Restoring the walk pointer
+     * afterwards is what keeps the two pointers from interfering.
+     */
+    private drainParked;
+    /**
+     * Step the ordered walk over an event nobody claimed, holding on to it for a
+     * later consumer. Returns false when the event's type makes its position a
+     * decision record, which is the one case where nobody claiming it means the
+     * replay diverged.
+     */
+    private park;
+    private handleEndOfLog;
+    private scheduleUnconsumedCheck;
+    /**
+     * Run `fn` once no data delivery is in flight, polling the way
+     * `scheduleWhenIdle` does: let the promise queue drain, re-check a timer
+     * tick later, repeat.
+     *
+     * Without this the check is a bet that every delivery the walk is running
+     * ahead of lands inside a fixed window. Consumption is synchronous while the
+     * resolution it triggers is not: a step result hydrates in the host, resolves
+     * from a detached continuation behind `awaitEarlierDeliveries`, and only then
+     * does VM code run far enough to subscribe the next consumer. Replaying a
+     * batch of N parallel step results leaves N-1 of them on that detached path
+     * with the queue already drained, so the walk sits on the ordered event the
+     * VM is about to draw and the window is the only thing standing between a
+     * healthy run and `ReplayDivergenceError`.
+     *
+     * Shortening the window shows that mechanism directly: on identical event logs
+     * the local race repro corrupts 34 of 42 runs at a 10ms window and 0 of 114 at
+     * the 100ms default. That measures how the bet loses, not that the default
+     * loses it, and no measurement of a delivery outrunning 100ms exists either
+     * way. So read this as retiring the bet rather than as repairing an observed
+     * failure of that number: the delay is a user-settable env override, which
+     * leaves the old behaviour one configuration away from losing on any backend.
+     *
+     * Termination is `hasParkedCommittedDelivery`'s: it counts only deliveries
+     * that resolve on their own, so nothing here can gate its own retirement. A
+     * genuinely orphaned event has no delivery to wait on and reaches `fn` on the
+     * first poll.
+     *
+     * What the gate gives up: for the ordered events that still reach
+     * `onUnconsumedEvent` rather than {@link park}, this stops being the thing
+     * that catches a diverged log while a delivery is in flight. The suspension
+     * and this check now wake from the same `isDeliveryIdle` edge, and
+     * `scheduleWhenIdle` fires on the first timer tick after idle while this waits
+     * a further `getDeferredCheckDelayMs()`. So a run with a pending `sleep()`
+     * suspends first, and `onWorkflowError` drops the divergence arriving second
+     * (its `'suspended'` branch demotes to `'replay'` and surfaces nothing),
+     * leaving a later `resume()` to decline into a cold replay. Pre-gate the
+     * suspension already won that race whenever the delivery landed inside the
+     * fixed window, so what changed is that the outcome stopped depending on
+     * timing. Nothing should treat this check as the mechanism that reports
+     * divergence on a log the run is still delivering into.
+     */
+    private whenDeliveryIdle;
 }
 export {};
 //# sourceMappingURL=events-consumer.d.ts.map

package/dist/events-consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events-consumer.d.ts","sourceRoot":"","sources":["../src/events-consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAG7C,oBAAY,mBAAmB;IAC7B;;OAEG;IACH,QAAQ,IAAA;IACR;;OAEG;IACH,WAAW,IAAA;IACX;;OAEG;IACH,QAAQ,IAAA;CACT;AAED,KAAK,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,mBAAmB,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C;;;;;OAKG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,qBAAa,cAAc;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAM;IAC9B,QAAQ,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAM;IACjD,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,OAAO,CAAC,wBAAwB,CAA8C;IAC9E,OAAO,CAAC,sBAAsB,CAAK;gBAEvB,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB;IAO3D;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,EAAE,qBAAqB;IAgBnC,OAAO,CAAC,OAAO,CA+Db;CACH"}
+{"version":3,"file":"events-consumer.d.ts","sourceRoot":"","sources":["../src/events-consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAGxD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAgG9C,oBAAY,mBAAmB;IAC7B;;OAEG;IACH,QAAQ,IAAA;IACR;;OAEG;IACH,WAAW,IAAA;IACX;;OAEG;IACH,QAAQ,IAAA;CACT;AAED,KAAK,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,mBAAmB,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C;;;;;OAKG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC;CAC/B;AAED,qBAAa,cAAc;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAM;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,eAAe,CAAC,CAAyB;IACjD,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,OAAO,CAAC,wBAAwB,CAA8C;IAC9E,OAAO,CAAC,sBAAsB,CAAK;gBAEvB,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB;IAY3D;;;;;OAKG;IACH,IAAI,aAAa,IAAI,KAAK,GAAG,SAAS,CAErC;IAED;;;;;;;;;;OAUG;IACH,IAAI,aAAa,IACb;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;KAAE,GACjE,SAAS,CAUZ;IAED,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;IAK7B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,EAAE,qBAAqB;IAgBnC,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,OAAO,CA4Cb;IAEF;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAmCb;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAyBnB;;;;;OAKG;IACH,OAAO,CAAC,IAAI;IAqBZ,OAAO,CAAC,cAAc;IA2BtB,OAAO,CAAC,uBAAuB;IAqD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,gBAAgB;CA2BzB"}