@workflow/core 5.0.0-beta.4 → 5.0.0-beta.41

package/dist/serialization/encryption.js

@@ -0,0 +1,186 @@
+/**
+ * Composable encryption layer for serialized data.
+ *
+ * Wraps/unwraps serialized payloads with either symmetric AES-256-GCM
+ * encryption (`encr`) or an asymmetric sealed box (`encp`), using the format
+ * prefix system to mark which. See {@link PayloadKey} for how a caller
+ * declares which capabilities it holds.
+ */
+import { RuntimeDecryptionError } from '@workflow/errors';
+import { decrypt as aesGcmDecrypt, encrypt as aesGcmEncrypt, importKey as importAesKey, } from '../encryption.js';
+import { deriveRunKeyPair, open as openSealed, seal as sealToPublicKey, } from '../sealed-box.js';
+import { decodeFormatPrefix, encodeWithFormatPrefix, peekFormatPrefix, } from './format.js';
+import { SerializationFormat } from './types.js';
+/**
+ * Brands distinguishing the structured key variants from a bare `CryptoKey`.
+ *
+ * `Symbol.for` rather than `Symbol()` because these values cross realm
+ * boundaries (host ↔ workflow VM), and the global symbol registry is shared
+ * across realms while unique symbols are not.
+ */
+const SEAL_TARGET_BRAND = Symbol.for('workflow.serialization.sealTarget');
+const RUN_KEYS_BRAND = Symbol.for('workflow.serialization.runKeys');
+/**
+ * Build a write-only seal capability for a recipient run's public key.
+ *
+ * @param recipientPublicKey - The recipient run's raw 32-byte X25519 public key
+ * @param aad - Additional authenticated data, conventionally `runAad(projectId, runId)`
+ */
+export function sealTo(recipientPublicKey, aad) {
+    return { [SEAL_TARGET_BRAND]: true, recipientPublicKey, aad };
+}
+/**
+ * Bundle a run's symmetric key with the keypair that opens payloads sealed
+ * to it.
+ */
+export function runPayloadKeys(aes, keyPair, aad) {
+    return { [RUN_KEYS_BRAND]: true, aes, keyPair, aad };
+}
+/**
+ * Build the full key capability for a run from its raw 32-byte key material —
+ * the value `World.getEncryptionKeyForRun()` returns.
+ *
+ * Use this anywhere a run reads its own event log: it yields a key that opens
+ * both its own symmetric (`encr`) payloads and sealed (`encp`) payloads other
+ * runs wrote to it. Resolving only `importKey(material)` would leave the
+ * reader unable to open sealed writes.
+ */
+export async function deriveRunPayloadKeys(runKeyMaterial) {
+    const [aes, keyPair] = await Promise.all([
+        importAesKey(runKeyMaterial),
+        deriveRunKeyPair(runKeyMaterial),
+    ]);
+    return runPayloadKeys(aes, keyPair);
+}
+export function isSealTarget(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value[SEAL_TARGET_BRAND] === true);
+}
+export function isRunPayloadKeys(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value[RUN_KEYS_BRAND] === true);
+}
+/**
+ * The symmetric key to use for `encr` operations, or undefined when this key
+ * has no symmetric capability (i.e. it is a seal-only target).
+ */
+export function aesKeyOf(key) {
+    if (!key)
+        return undefined;
+    if (isRunPayloadKeys(key))
+        return key.aes;
+    if (isSealTarget(key))
+        return undefined;
+    return key;
+}
+export async function resolveEncryptionKey(key) {
+    return typeof key === 'function' ? key() : key;
+}
+/**
+ * Encrypt a format-prefixed payload if a key is provided.
+ *
+ * Wraps the data with the `encr` prefix for symmetric keys, or the `encp`
+ * prefix when handed a {@link SealTarget} — a cross-run writer that holds only
+ * the recipient's public key.
+ *
+ * @param data - The format-prefixed serialized data
+ * @param key - Encryption key (undefined to skip encryption)
+ * @returns The encrypted data with its format prefix, or the original data if no key
+ */
+export async function encrypt(data, key) {
+    if (!key || !(data instanceof Uint8Array))
+        return data;
+    if (isSealTarget(key)) {
+        const sealed = await sealToPublicKey(key.recipientPublicKey, data, key.aad);
+        return encodeWithFormatPrefix(SerializationFormat.SEALED, sealed);
+    }
+    // Symmetric path — a run's own payloads, including when the caller holds
+    // the full `RunPayloadKeys` bundle and *could* seal. See `PayloadKey`.
+    const aesKey = isRunPayloadKeys(key) ? key.aes : key;
+    const encrypted = await aesGcmEncrypt(aesKey, data);
+    return encodeWithFormatPrefix(SerializationFormat.ENCRYPTED, encrypted);
+}
+/**
+ * Decrypt a format-prefixed payload if it's encrypted or sealed.
+ *
+ * Strips the `encr`/`encp` format prefix and recovers the inner payload.
+ * Opening a sealed (`encp`) payload requires the run's X25519 keypair, so the
+ * caller must supply {@link RunPayloadKeys} — a bare symmetric key cannot do
+ * it, and neither can a {@link SealTarget} (which is write-only by design).
+ *
+ * @param data - The potentially encrypted data
+ * @param key - Encryption key (undefined to skip decryption)
+ * @returns The decrypted inner payload, or the original data if not encrypted
+ */
+/**
+ * Open a sealed (`encp`) envelope. Split out from {@link decrypt} to keep
+ * each scheme's error handling readable on its own.
+ */
+async function openSealedEnvelope(data, key) {
+    // Sealed payloads need the private scalar. Anything else — no key, a bare
+    // symmetric key, or a write-only seal target — cannot open them.
+    if (!isRunPayloadKeys(key)) {
+        throw new RuntimeDecryptionError('Sealed data encountered but no run keypair is available. ' +
+            "Opening a sealed payload requires the run's own encryption key " +
+            'material; a symmetric key or a seal-only target cannot decrypt it.', {
+            context: {
+                operation: 'decrypt',
+                byteLength: data.byteLength,
+                formatPrefix: 'encp',
+            },
+        });
+    }
+    const { payload } = decodeFormatPrefix(data);
+    try {
+        return await openSealed(key.keyPair, payload, key.aad);
+    }
+    catch (error) {
+        // The sealed-box layer only sees the stripped payload, so it cannot
+        // record the outer envelope prefix. Enrich it here before rethrowing.
+        if (RuntimeDecryptionError.is(error) && error.context) {
+            error.context.formatPrefix = SerializationFormat.SEALED;
+        }
+        throw error;
+    }
+}
+export async function decrypt(data, key) {
+    // Non-binary data is returned as-is.
+    if (!(data instanceof Uint8Array))
+        return data;
+    const format = peekFormatPrefix(data);
+    if (format === SerializationFormat.SEALED) {
+        return openSealedEnvelope(data, key);
+    }
+    // If the data is not encrypted, return it unchanged.
+    if (format !== SerializationFormat.ENCRYPTED)
+        return data;
+    // If the data is encrypted but no symmetric key is available, fail fast.
+    const aesKey = aesKeyOf(key);
+    if (!aesKey) {
+        throw new RuntimeDecryptionError('Encrypted data encountered but no encryption key is available. ' +
+            'Encryption is not configured or no key was provided for this run.', {
+            context: {
+                operation: 'decrypt',
+                byteLength: data.byteLength,
+                formatPrefix: 'encr',
+            },
+        });
+    }
+    const { payload } = decodeFormatPrefix(data);
+    try {
+        return await aesGcmDecrypt(aesKey, payload);
+    }
+    catch (error) {
+        // The low-level AES layer only sees the stripped payload, so it cannot
+        // record the outer envelope prefix. This layer peeked it (`encr`), so
+        // enrich the diagnostic context with the real format prefix before
+        // rethrowing.
+        if (RuntimeDecryptionError.is(error) && error.context) {
+            error.context.formatPrefix = format;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJpYWxpemF0aW9uL2VuY3J5cHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7R0FPRztBQUVILE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQzFELE9BQU8sRUFDTCxPQUFPLElBQUksYUFBYSxFQUN4QixPQUFPLElBQUksYUFBYSxFQUV4QixTQUFTLElBQUksWUFBWSxHQUMxQixNQUFNLGtCQUFrQixDQUFDO0FBQzFCLE9BQU8sRUFDTCxnQkFBZ0IsRUFDaEIsSUFBSSxJQUFJLFVBQVUsRUFFbEIsSUFBSSxJQUFJLGVBQWUsR0FDeEIsTUFBTSxrQkFBa0IsQ0FBQztBQUMxQixPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLHNCQUFzQixFQUN0QixnQkFBZ0IsR0FDakIsTUFBTSxhQUFhLENBQUM7QUFDckIsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sWUFBWSxDQUFDO0FBSWpEOzs7Ozs7R0FNRztBQUNILE1BQU0saUJBQWlCLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0FBQzFFLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztBQXVFcEU7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsTUFBTSxDQUNwQixrQkFBOEIsRUFDOUIsR0FBZ0I7SUFFaEIsT0FBTyxFQUFFLENBQUMsaUJBQWlCLENBQUMsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsR0FBRyxFQUFFLENBQUM7QUFDaEUsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxjQUFjLENBQzVCLEdBQWMsRUFDZCxPQUFtQixFQUNuQixHQUFnQjtJQUVoQixPQUFPLEVBQUUsQ0FBQyxjQUFjLENBQUMsRUFBRSxJQUFJLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQztBQUN2RCxDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLG9CQUFvQixDQUN4QyxjQUEwQjtJQUUxQixNQUFNLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN2QyxZQUFZLENBQUMsY0FBYyxDQUFDO1FBQzVCLGdCQUFnQixDQUFDLGNBQWMsQ0FBQztLQUNqQyxDQUFDLENBQUM7SUFDSCxPQUFPLGNBQWMsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDdEMsQ0FBQztBQUVELE1BQU0sVUFBVSxZQUFZLENBQUMsS0FBYztJQUN6QyxPQUFPLENBQ0wsT0FBTyxLQUFLLEtBQUssUUFBUTtRQUN6QixLQUFLLEtBQUssSUFBSTtRQUNiLEtBQTZCLENBQUMsaUJBQWlCLENBQUMsS0FBSyxJQUFJLENBQzNELENBQUM7QUFDSixDQUFDO0FBRUQsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWM7SUFDN0MsT0FBTyxDQUNMLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFDekIsS0FBSyxLQUFLLElBQUk7UUFDYixLQUFpQyxDQUFDLGNBQWMsQ0FBQyxLQUFLLElBQUksQ0FDNUQsQ0FBQztBQUNKLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFDLEdBQTJCO0lBQ2xELElBQUksQ0FBQyxHQUFHO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDM0IsSUFBSSxnQkFBZ0IsQ0FBQyxHQUFHLENBQUM7UUFBRSxPQUFPLEdBQUcsQ0FBQyxHQUFHLENBQUM7SUFDMUMsSUFBSSxZQUFZLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDeEMsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDO0FBWUQsTUFBTSxDQUFDLEtBQUssVUFBVSxvQkFBb0IsQ0FDeEMsR0FBdUI7SUFFdkIsT0FBTyxPQUFPLEdBQUcsS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7QUFDakQsQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDM0IsSUFBMEIsRUFDMUIsR0FBMkI7SUFFM0IsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsSUFBSSxZQUFZLFVBQVUsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXZELElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxlQUFlLENBQUMsR0FBRyxDQUFDLGtCQUFrQixFQUFFLElBQUksRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDNUUsT0FBTyxzQkFBc0IsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUVELHlFQUF5RTtJQUN6RSx1RUFBdUU7SUFDdkUsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztJQUNyRCxNQUFNLFNBQVMsR0FBRyxNQUFNLGFBQWEsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDcEQsT0FBTyxzQkFBc0IsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFDMUUsQ0FBQztBQUVEOzs7Ozs7Ozs7OztHQVdHO0FBQ0g7OztHQUdHO0FBQ0gsS0FBSyxVQUFVLGtCQUFrQixDQUMvQixJQUFnQixFQUNoQixHQUEyQjtJQUUzQiwwRUFBMEU7SUFDMUUsaUVBQWlFO0lBQ2pFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxzQkFBc0IsQ0FDOUIsMkRBQTJEO1lBQ3pELGlFQUFpRTtZQUNqRSxvRUFBb0UsRUFDdEU7WUFDRSxPQUFPLEVBQUU7Z0JBQ1AsU0FBUyxFQUFFLFNBQVM7Z0JBQ3BCLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDM0IsWUFBWSxFQUFFLE1BQU07YUFDckI7U0FDRixDQUNGLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdDLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxVQUFVLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2Ysb0VBQW9FO1FBQ3BFLHNFQUFzRTtRQUN0RSxJQUFJLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLElBQTBCLEVBQzFCLEdBQTJCO0lBRTNCLHFDQUFxQztJQUNyQyxJQUFJLENBQUMsQ0FBQyxJQUFJLFlBQVksVUFBVSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFL0MsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdEMsSUFBSSxNQUFNLEtBQUssbUJBQW1CLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUMsT0FBTyxrQkFBa0IsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDdkMsQ0FBQztJQUVELHFEQUFxRDtJQUNyRCxJQUFJLE1BQU0sS0FBSyxtQkFBbUIsQ0FBQyxTQUFTO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFMUQseUVBQXlFO0lBQ3pFLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM3QixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUksc0JBQXNCLENBQzlCLGlFQUFpRTtZQUMvRCxtRUFBbUUsRUFDckU7WUFDRSxPQUFPLEVBQUU7Z0JBQ1AsU0FBUyxFQUFFLFNBQVM7Z0JBQ3BCLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDM0IsWUFBWSxFQUFFLE1BQU07YUFDckI7U0FDRixDQUNGLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdDLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxhQUFhLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsdUVBQXVFO1FBQ3ZFLHNFQUFzRTtRQUN0RSxtRUFBbUU7UUFDbkUsY0FBYztRQUNkLElBQUksc0JBQXNCLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN0RCxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksR0FBRyxNQUFNLENBQUM7UUFDdEMsQ0FBQztRQUNELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIENvbXBvc2FibGUgZW5jcnlwdGlvbiBsYXllciBmb3Igc2VyaWFsaXplZCBkYXRhLlxuICpcbiAqIFdyYXBzL3Vud3JhcHMgc2VyaWFsaXplZCBwYXlsb2FkcyB3aXRoIGVpdGhlciBzeW1tZXRyaWMgQUVTLTI1Ni1HQ01cbiAqIGVuY3J5cHRpb24gKGBlbmNyYCkgb3IgYW4gYXN5bW1ldHJpYyBzZWFsZWQgYm94IChgZW5jcGApLCB1c2luZyB0aGUgZm9ybWF0XG4gKiBwcmVmaXggc3lzdGVtIHRvIG1hcmsgd2hpY2guIFNlZSB7QGxpbmsgUGF5bG9hZEtleX0gZm9yIGhvdyBhIGNhbGxlclxuICogZGVjbGFyZXMgd2hpY2ggY2FwYWJpbGl0aWVzIGl0IGhvbGRzLlxuICovXG5cbmltcG9ydCB7IFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IgfSBmcm9tICdAd29ya2Zsb3cvZXJyb3JzJztcbmltcG9ydCB7XG4gIGRlY3J5cHQgYXMgYWVzR2NtRGVjcnlwdCxcbiAgZW5jcnlwdCBhcyBhZXNHY21FbmNyeXB0LFxuICB0eXBlIENyeXB0b0tleSxcbiAgaW1wb3J0S2V5IGFzIGltcG9ydEFlc0tleSxcbn0gZnJvbSAnLi4vZW5jcnlwdGlvbi5qcyc7XG5pbXBvcnQge1xuICBkZXJpdmVSdW5LZXlQYWlyLFxuICBvcGVuIGFzIG9wZW5TZWFsZWQsXG4gIHR5cGUgUnVuS2V5UGFpcixcbiAgc2VhbCBhcyBzZWFsVG9QdWJsaWNLZXksXG59IGZyb20gJy4uL3NlYWxlZC1ib3guanMnO1xuaW1wb3J0IHtcbiAgZGVjb2RlRm9ybWF0UHJlZml4LFxuICBlbmNvZGVXaXRoRm9ybWF0UHJlZml4LFxuICBwZWVrRm9ybWF0UHJlZml4LFxufSBmcm9tICcuL2Zvcm1hdC5qcyc7XG5pbXBvcnQgeyBTZXJpYWxpemF0aW9uRm9ybWF0IH0gZnJvbSAnLi90eXBlcy5qcyc7XG5cbmV4cG9ydCB0eXBlIHsgQ3J5cHRvS2V5LCBSdW5LZXlQYWlyIH07XG5cbi8qKlxuICogQnJhbmRzIGRpc3Rpbmd1aXNoaW5nIHRoZSBzdHJ1Y3R1cmVkIGtleSB2YXJpYW50cyBmcm9tIGEgYmFyZSBgQ3J5cHRvS2V5YC5cbiAqXG4gKiBgU3ltYm9sLmZvcmAgcmF0aGVyIHRoYW4gYFN5bWJvbCgpYCBiZWNhdXNlIHRoZXNlIHZhbHVlcyBjcm9zcyByZWFsbVxuICogYm91bmRhcmllcyAoaG9zdCDihpQgd29ya2Zsb3cgVk0pLCBhbmQgdGhlIGdsb2JhbCBzeW1ib2wgcmVnaXN0cnkgaXMgc2hhcmVkXG4gKiBhY3Jvc3MgcmVhbG1zIHdoaWxlIHVuaXF1ZSBzeW1ib2xzIGFyZSBub3QuXG4gKi9cbmNvbnN0IFNFQUxfVEFSR0VUX0JSQU5EID0gU3ltYm9sLmZvcignd29ya2Zsb3cuc2VyaWFsaXphdGlvbi5zZWFsVGFyZ2V0Jyk7XG5jb25zdCBSVU5fS0VZU19CUkFORCA9IFN5bWJvbC5mb3IoJ3dvcmtmbG93LnNlcmlhbGl6YXRpb24ucnVuS2V5cycpO1xuXG4vKipcbiAqIEEgd3JpdGUtb25seSBjYXBhYmlsaXR5OiBzZWFsIHBheWxvYWRzIHRvIGEgcnVuJ3MgWDI1NTE5IHB1YmxpYyBrZXkuXG4gKlxuICogVGhpcyBpcyB3aGF0IGEgKmNyb3NzLXJ1biogd3JpdGVyIGhvbGRzIOKAlCBhIGhvb2sgcmVzdW1wdGlvbiB0YXJnZXRpbmdcbiAqIGFub3RoZXIgcnVuLCBvciBhIGNoaWxkIHdvcmtmbG93IHdyaXRpbmcgaW50byBhIHBhcmVudCdzIGZvcndhcmRlZCBzdHJlYW0uXG4gKiBJdCBjYXJyaWVzIG5vIGFiaWxpdHkgdG8gZGVjcnlwdCBhbnl0aGluZywgYW5kIGJlY2F1c2UgaXQgaXMgYSBkaXN0aW5jdFxuICogbm9taW5hbCB0eXBlIGl0IGNhbm5vdCBiZSBtaXN0YWtlbiBmb3Igc3ltbWV0cmljIGtleSBtYXRlcmlhbC5cbiAqXG4gKiBUaGF0IGxhc3QgcHJvcGVydHkgbWF0dGVycyBtb3JlIHRoYW4gaXQgbG9va3M6IGEgcmF3IDMyLWJ5dGUgWDI1NTE5IHB1YmxpY1xuICoga2V5IGlzIGEgKnN0cnVjdHVyYWxseSB2YWxpZCogQUVTLTI1NiBrZXksIHNvIGhhbmRpbmcgb25lIHRvXG4gKiBgaW1wb3J0S2V5KC4uLiwgJ0FFUy1HQ00nKWAgc3VjY2VlZHMgYW5kIHNpbGVudGx5IHByb2R1Y2VzIGNpcGhlcnRleHQgdGhhdFxuICogbm9ib2R5IGNhbiBldmVyIG9wZW4uIFJvdXRpbmcgcHVibGljIGtleXMgZXhjbHVzaXZlbHkgdGhyb3VnaFxuICoge0BsaW5rIHNlYWxUb30gbWFrZXMgdGhhdCBtaXN0YWtlIHVucmVwcmVzZW50YWJsZSByYXRoZXIgdGhhbiBtZXJlbHlcbiAqIGRpc2NvdXJhZ2VkLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFNlYWxUYXJnZXQge1xuICByZWFkb25seSBbU0VBTF9UQVJHRVRfQlJBTkRdOiB0cnVlO1xuICAvKiogVGhlIHJlY2lwaWVudCBydW4ncyByYXcgMzItYnl0ZSBYMjU1MTkgcHVibGljIGtleS4gKi9cbiAgcmVhZG9ubHkgcmVjaXBpZW50UHVibGljS2V5OiBVaW50OEFycmF5O1xuICAvKiogQWRkaXRpb25hbCBhdXRoZW50aWNhdGVkIGRhdGEgYmluZGluZyB0aGUgcGF5bG9hZCB0byB0aGUgcmVjaXBpZW50IHJ1bi4gKi9cbiAgcmVhZG9ubHkgYWFkPzogVWludDhBcnJheTtcbn1cblxuLyoqXG4gKiBUaGUgZnVsbCBrZXkgY2FwYWJpbGl0eSBvZiBhIHJ1bidzICpvd24qIHJ1bnRpbWUgKGFuZCBvZiBvMTF5IHRvb2xpbmdcbiAqIGFjdGluZyBvbiBpdHMgYmVoYWxmKTogdGhlIHN5bW1ldHJpYyBrZXkgZm9yIGl0cyBvd24gcGF5bG9hZHMsIHBsdXMgdGhlXG4gKiBrZXlwYWlyIG5lZWRlZCB0byBvcGVuIHNlYWxlZCBwYXlsb2FkcyB0aGF0IG90aGVyIHJ1bnMgd3JvdGUgdG8gaXQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUnVuUGF5bG9hZEtleXMge1xuICByZWFkb25seSBbUlVOX0tFWVNfQlJBTkRdOiB0cnVlO1xuICAvKiogU3ltbWV0cmljIEFFUy0yNTYtR0NNIGtleSDigJQgdGhlIHJ1bidzIG93biBgZW5jcmAgcGF5bG9hZHMuICovXG4gIHJlYWRvbmx5IGFlczogQ3J5cHRvS2V5O1xuICAvKiogWDI1NTE5IGtleXBhaXIg4oCUIG9wZW5zIGBlbmNwYCBwYXlsb2FkcyBzZWFsZWQgdG8gdGhpcyBydW4uICovXG4gIHJlYWRvbmx5IGtleVBhaXI6IFJ1bktleVBhaXI7XG4gIC8qKiBBZGRpdGlvbmFsIGF1dGhlbnRpY2F0ZWQgZGF0YSBleHBlY3RlZCBvbiBzZWFsZWQgcGF5bG9hZHMuICovXG4gIHJlYWRvbmx5IGFhZD86IFVpbnQ4QXJyYXk7XG59XG5cbi8qKlxuICogQSByZXNvbHZlZCBrZXkgZm9yIHJlYWRpbmcgb3Igd3JpdGluZyBhIHNlcmlhbGl6ZWQgcGF5bG9hZC5cbiAqXG4gKiBUaGUgYmFyZSBgQ3J5cHRvS2V5YCB2YXJpYW50IGlzIHRoZSBoaXN0b3JpY2FsIHNoYXBlIGFuZCByZW1haW5zIHZhbGlkOiBpdFxuICogbWVhbnMgXCJzeW1tZXRyaWMgb25seVwiLCB3aGljaCBpcyBleGFjdGx5IHJpZ2h0IGZvciBhIHJ1biB0aGF0IHByZWRhdGVzXG4gKiBzZWFsZWQgYm94ZXMgb3IgZm9yIGFueSBzYW1lLXJ1biBwYXlsb2FkLiBUaGUgc3RydWN0dXJlZCB2YXJpYW50cyBhcmVcbiAqIGFkZGl0aXZlOlxuICpcbiAqIHwgVmFyaWFudCAgICAgICAgICAgIHwgV3JpdGVzICB8IFJlYWRzICAgICAgICAgIHwgSGVsZCBieSAgICAgICAgICAgICAgICAgIHxcbiAqIHwgLS0tLS0tLS0tLS0tLS0tLS0tIHwgLS0tLS0tLSB8IC0tLS0tLS0tLS0tLS0tIHwgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIHxcbiAqIHwgYENyeXB0b0tleWAgICAgICAgIHwgYGVuY3JgICB8IGBlbmNyYCAgICAgICAgIHwgc2FtZS1ydW4gKGxlZ2FjeSBzaGFwZSkgIHxcbiAqIHwge0BsaW5rIFJ1blBheWxvYWRLZXlzfSB8IGBlbmNyYCAgfCBgZW5jcmAsIGBlbmNwYCB8IHRoZSBvd25pbmcgcnVuLCBvMTF5ICAgICB8XG4gKiB8IHtAbGluayBTZWFsVGFyZ2V0fSB8IGBlbmNwYCAgfCDigJQgICAgICAgICAgICAgIHwgY3Jvc3MtcnVuIHdyaXRlcnMgICAgICAgIHxcbiAqXG4gKiBBIHJ1bidzIG93biBwYXlsb2FkcyBkZWxpYmVyYXRlbHkgc3RheSBzeW1tZXRyaWMgZXZlbiB3aGVuIHRoZSB3cml0ZXIgY291bGRcbiAqIHNlYWw6IHNlYWxpbmcgY29zdHMgYSBmcmVzaCBFQ0RIIHBlciBlbnZlbG9wZSBhbmQgMzIgZXh0cmEgYnl0ZXMsIGFuZCBidXlzXG4gKiBub3RoaW5nIHdoZW4gdGhlIHdyaXRlciBhbHJlYWR5IGhvbGRzIHRoZSBkZWNyeXB0aW9uIGtleS5cbiAqL1xuZXhwb3J0IHR5cGUgUGF5bG9hZEtleSA9IENyeXB0b0tleSB8IFNlYWxUYXJnZXQgfCBSdW5QYXlsb2FkS2V5cztcblxuLyoqXG4gKiBUaGUgc3Vic2V0IG9mIHtAbGluayBQYXlsb2FkS2V5fSB0aGF0IGNhbiBhY3R1YWxseSAqcmVhZCogYSBwYXlsb2FkLlxuICpcbiAqIEV4Y2x1ZGVzIHtAbGluayBTZWFsVGFyZ2V0fSwgd2hpY2ggaXMgd3JpdGUtb25seSBieSBjb25zdHJ1Y3Rpb246IGl0IGhvbGRzIGFcbiAqIHB1YmxpYyBrZXksIHNvIGl0IGNhbiBvcGVuIG5laXRoZXIgYGVuY3BgIChuZWVkcyB0aGUgcHJpdmF0ZSBzY2FsYXIpIG5vclxuICogYGVuY3JgIChuZWVkcyB0aGUgc3ltbWV0cmljIGtleSkuIERlY3J5cHQtc2lkZSBzaWduYXR1cmVzIHNob3VsZCB0YWtlIHRoaXNcbiAqIHJhdGhlciB0aGFuIGBQYXlsb2FkS2V5YCwgc28gcGFzc2luZyBhIHNlYWwgdGFyZ2V0IGlzIGEgY29tcGlsZSBlcnJvciBpbnN0ZWFkXG4gKiBvZiBhIGd1YXJhbnRlZWQgcnVudGltZSBmYWlsdXJlLlxuICovXG5leHBvcnQgdHlwZSBEZWNyeXB0aW9uS2V5ID0gQ3J5cHRvS2V5IHwgUnVuUGF5bG9hZEtleXM7XG5cbi8qKlxuICogQnVpbGQgYSB3cml0ZS1vbmx5IHNlYWwgY2FwYWJpbGl0eSBmb3IgYSByZWNpcGllbnQgcnVuJ3MgcHVibGljIGtleS5cbiAqXG4gKiBAcGFyYW0gcmVjaXBpZW50UHVibGljS2V5IC0gVGhlIHJlY2lwaWVudCBydW4ncyByYXcgMzItYnl0ZSBYMjU1MTkgcHVibGljIGtleVxuICogQHBhcmFtIGFhZCAtIEFkZGl0aW9uYWwgYXV0aGVudGljYXRlZCBkYXRhLCBjb252ZW50aW9uYWxseSBgcnVuQWFkKHByb2plY3RJZCwgcnVuSWQpYFxuICovXG5leHBvcnQgZnVuY3Rpb24gc2VhbFRvKFxuICByZWNpcGllbnRQdWJsaWNLZXk6IFVpbnQ4QXJyYXksXG4gIGFhZD86IFVpbnQ4QXJyYXlcbik6IFNlYWxUYXJnZXQge1xuICByZXR1cm4geyBbU0VBTF9UQVJHRVRfQlJBTkRdOiB0cnVlLCByZWNpcGllbnRQdWJsaWNLZXksIGFhZCB9O1xufVxuXG4vKipcbiAqIEJ1bmRsZSBhIHJ1bidzIHN5bW1ldHJpYyBrZXkgd2l0aCB0aGUga2V5cGFpciB0aGF0IG9wZW5zIHBheWxvYWRzIHNlYWxlZFxuICogdG8gaXQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBydW5QYXlsb2FkS2V5cyhcbiAgYWVzOiBDcnlwdG9LZXksXG4gIGtleVBhaXI6IFJ1bktleVBhaXIsXG4gIGFhZD86IFVpbnQ4QXJyYXlcbik6IFJ1blBheWxvYWRLZXlzIHtcbiAgcmV0dXJuIHsgW1JVTl9LRVlTX0JSQU5EXTogdHJ1ZSwgYWVzLCBrZXlQYWlyLCBhYWQgfTtcbn1cblxuLyoqXG4gKiBCdWlsZCB0aGUgZnVsbCBrZXkgY2FwYWJpbGl0eSBmb3IgYSBydW4gZnJvbSBpdHMgcmF3IDMyLWJ5dGUga2V5IG1hdGVyaWFsIOKAlFxuICogdGhlIHZhbHVlIGBXb3JsZC5nZXRFbmNyeXB0aW9uS2V5Rm9yUnVuKClgIHJldHVybnMuXG4gKlxuICogVXNlIHRoaXMgYW55d2hlcmUgYSBydW4gcmVhZHMgaXRzIG93biBldmVudCBsb2c6IGl0IHlpZWxkcyBhIGtleSB0aGF0IG9wZW5zXG4gKiBib3RoIGl0cyBvd24gc3ltbWV0cmljIChgZW5jcmApIHBheWxvYWRzIGFuZCBzZWFsZWQgKGBlbmNwYCkgcGF5bG9hZHMgb3RoZXJcbiAqIHJ1bnMgd3JvdGUgdG8gaXQuIFJlc29sdmluZyBvbmx5IGBpbXBvcnRLZXkobWF0ZXJpYWwpYCB3b3VsZCBsZWF2ZSB0aGVcbiAqIHJlYWRlciB1bmFibGUgdG8gb3BlbiBzZWFsZWQgd3JpdGVzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZGVyaXZlUnVuUGF5bG9hZEtleXMoXG4gIHJ1bktleU1hdGVyaWFsOiBVaW50OEFycmF5XG4pOiBQcm9taXNlPFJ1blBheWxvYWRLZXlzPiB7XG4gIGNvbnN0IFthZXMsIGtleVBhaXJdID0gYXdhaXQgUHJvbWlzZS5hbGwoW1xuICAgIGltcG9ydEFlc0tleShydW5LZXlNYXRlcmlhbCksXG4gICAgZGVyaXZlUnVuS2V5UGFpcihydW5LZXlNYXRlcmlhbCksXG4gIF0pO1xuICByZXR1cm4gcnVuUGF5bG9hZEtleXMoYWVzLCBrZXlQYWlyKTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGlzU2VhbFRhcmdldCh2YWx1ZTogdW5rbm93bik6IHZhbHVlIGlzIFNlYWxUYXJnZXQge1xuICByZXR1cm4gKFxuICAgIHR5cGVvZiB2YWx1ZSA9PT0gJ29iamVjdCcgJiZcbiAgICB2YWx1ZSAhPT0gbnVsbCAmJlxuICAgICh2YWx1ZSBhcyBQYXJ0aWFsPFNlYWxUYXJnZXQ+KVtTRUFMX1RBUkdFVF9CUkFORF0gPT09IHRydWVcbiAgKTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGlzUnVuUGF5bG9hZEtleXModmFsdWU6IHVua25vd24pOiB2YWx1ZSBpcyBSdW5QYXlsb2FkS2V5cyB7XG4gIHJldHVybiAoXG4gICAgdHlwZW9mIHZhbHVlID09PSAnb2JqZWN0JyAmJlxuICAgIHZhbHVlICE9PSBudWxsICYmXG4gICAgKHZhbHVlIGFzIFBhcnRpYWw8UnVuUGF5bG9hZEtleXM+KVtSVU5fS0VZU19CUkFORF0gPT09IHRydWVcbiAgKTtcbn1cblxuLyoqXG4gKiBUaGUgc3ltbWV0cmljIGtleSB0byB1c2UgZm9yIGBlbmNyYCBvcGVyYXRpb25zLCBvciB1bmRlZmluZWQgd2hlbiB0aGlzIGtleVxuICogaGFzIG5vIHN5bW1ldHJpYyBjYXBhYmlsaXR5IChpLmUuIGl0IGlzIGEgc2VhbC1vbmx5IHRhcmdldCkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhZXNLZXlPZihrZXk6IFBheWxvYWRLZXkgfCB1bmRlZmluZWQpOiBDcnlwdG9LZXkgfCB1bmRlZmluZWQge1xuICBpZiAoIWtleSkgcmV0dXJuIHVuZGVmaW5lZDtcbiAgaWYgKGlzUnVuUGF5bG9hZEtleXMoa2V5KSkgcmV0dXJuIGtleS5hZXM7XG4gIGlmIChpc1NlYWxUYXJnZXQoa2V5KSkgcmV0dXJuIHVuZGVmaW5lZDtcbiAgcmV0dXJuIGtleTtcbn1cblxuLyoqXG4gKiBFbmNyeXB0aW9uIGtleSBwYXJhbWV0ZXIgdHlwZS4gQWNjZXB0cyBhIHJlc29sdmVkIGtleSwgdW5kZWZpbmVkIChubyBlbmNyeXB0aW9uKSxcbiAqIGEgcHJvbWlzZSwgb3IgYSByZXNvbHZlciB0aGF0IGNhbiBkZWZlciBmZXRjaGluZyB0aGUga2V5IHVudGlsIGRhdGEgbmVlZHMgaXQuXG4gKi9cbmV4cG9ydCB0eXBlIEVuY3J5cHRpb25LZXlQYXJhbSA9XG4gIHwgUGF5bG9hZEtleVxuICB8IHVuZGVmaW5lZFxuICB8IFByb21pc2U8UGF5bG9hZEtleSB8IHVuZGVmaW5lZD5cbiAgfCAoKCkgPT4gUHJvbWlzZTxQYXlsb2FkS2V5IHwgdW5kZWZpbmVkPik7XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZXNvbHZlRW5jcnlwdGlvbktleShcbiAga2V5OiBFbmNyeXB0aW9uS2V5UGFyYW1cbik6IFByb21pc2U8UGF5bG9hZEtleSB8IHVuZGVmaW5lZD4ge1xuICByZXR1cm4gdHlwZW9mIGtleSA9PT0gJ2Z1bmN0aW9uJyA/IGtleSgpIDoga2V5O1xufVxuXG4vKipcbiAqIEVuY3J5cHQgYSBmb3JtYXQtcHJlZml4ZWQgcGF5bG9hZCBpZiBhIGtleSBpcyBwcm92aWRlZC5cbiAqXG4gKiBXcmFwcyB0aGUgZGF0YSB3aXRoIHRoZSBgZW5jcmAgcHJlZml4IGZvciBzeW1tZXRyaWMga2V5cywgb3IgdGhlIGBlbmNwYFxuICogcHJlZml4IHdoZW4gaGFuZGVkIGEge0BsaW5rIFNlYWxUYXJnZXR9IOKAlCBhIGNyb3NzLXJ1biB3cml0ZXIgdGhhdCBob2xkcyBvbmx5XG4gKiB0aGUgcmVjaXBpZW50J3MgcHVibGljIGtleS5cbiAqXG4gKiBAcGFyYW0gZGF0YSAtIFRoZSBmb3JtYXQtcHJlZml4ZWQgc2VyaWFsaXplZCBkYXRhXG4gKiBAcGFyYW0ga2V5IC0gRW5jcnlwdGlvbiBrZXkgKHVuZGVmaW5lZCB0byBza2lwIGVuY3J5cHRpb24pXG4gKiBAcmV0dXJucyBUaGUgZW5jcnlwdGVkIGRhdGEgd2l0aCBpdHMgZm9ybWF0IHByZWZpeCwgb3IgdGhlIG9yaWdpbmFsIGRhdGEgaWYgbm8ga2V5XG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbmNyeXB0KFxuICBkYXRhOiBVaW50OEFycmF5IHwgdW5rbm93bixcbiAga2V5OiBQYXlsb2FkS2V5IHwgdW5kZWZpbmVkXG4pOiBQcm9taXNlPFVpbnQ4QXJyYXkgfCB1bmtub3duPiB7XG4gIGlmICgha2V5IHx8ICEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSByZXR1cm4gZGF0YTtcblxuICBpZiAoaXNTZWFsVGFyZ2V0KGtleSkpIHtcbiAgICBjb25zdCBzZWFsZWQgPSBhd2FpdCBzZWFsVG9QdWJsaWNLZXkoa2V5LnJlY2lwaWVudFB1YmxpY0tleSwgZGF0YSwga2V5LmFhZCk7XG4gICAgcmV0dXJuIGVuY29kZVdpdGhGb3JtYXRQcmVmaXgoU2VyaWFsaXphdGlvbkZvcm1hdC5TRUFMRUQsIHNlYWxlZCk7XG4gIH1cblxuICAvLyBTeW1tZXRyaWMgcGF0aCDigJQgYSBydW4ncyBvd24gcGF5bG9hZHMsIGluY2x1ZGluZyB3aGVuIHRoZSBjYWxsZXIgaG9sZHNcbiAgLy8gdGhlIGZ1bGwgYFJ1blBheWxvYWRLZXlzYCBidW5kbGUgYW5kICpjb3VsZCogc2VhbC4gU2VlIGBQYXlsb2FkS2V5YC5cbiAgY29uc3QgYWVzS2V5ID0gaXNSdW5QYXlsb2FkS2V5cyhrZXkpID8ga2V5LmFlcyA6IGtleTtcbiAgY29uc3QgZW5jcnlwdGVkID0gYXdhaXQgYWVzR2NtRW5jcnlwdChhZXNLZXksIGRhdGEpO1xuICByZXR1cm4gZW5jb2RlV2l0aEZvcm1hdFByZWZpeChTZXJpYWxpemF0aW9uRm9ybWF0LkVOQ1JZUFRFRCwgZW5jcnlwdGVkKTtcbn1cblxuLyoqXG4gKiBEZWNyeXB0IGEgZm9ybWF0LXByZWZpeGVkIHBheWxvYWQgaWYgaXQncyBlbmNyeXB0ZWQgb3Igc2VhbGVkLlxuICpcbiAqIFN0cmlwcyB0aGUgYGVuY3JgL2BlbmNwYCBmb3JtYXQgcHJlZml4IGFuZCByZWNvdmVycyB0aGUgaW5uZXIgcGF5bG9hZC5cbiAqIE9wZW5pbmcgYSBzZWFsZWQgKGBlbmNwYCkgcGF5bG9hZCByZXF1aXJlcyB0aGUgcnVuJ3MgWDI1NTE5IGtleXBhaXIsIHNvIHRoZVxuICogY2FsbGVyIG11c3Qgc3VwcGx5IHtAbGluayBSdW5QYXlsb2FkS2V5c30g4oCUIGEgYmFyZSBzeW1tZXRyaWMga2V5IGNhbm5vdCBkb1xuICogaXQsIGFuZCBuZWl0aGVyIGNhbiBhIHtAbGluayBTZWFsVGFyZ2V0fSAod2hpY2ggaXMgd3JpdGUtb25seSBieSBkZXNpZ24pLlxuICpcbiAqIEBwYXJhbSBkYXRhIC0gVGhlIHBvdGVudGlhbGx5IGVuY3J5cHRlZCBkYXRhXG4gKiBAcGFyYW0ga2V5IC0gRW5jcnlwdGlvbiBrZXkgKHVuZGVmaW5lZCB0byBza2lwIGRlY3J5cHRpb24pXG4gKiBAcmV0dXJucyBUaGUgZGVjcnlwdGVkIGlubmVyIHBheWxvYWQsIG9yIHRoZSBvcmlnaW5hbCBkYXRhIGlmIG5vdCBlbmNyeXB0ZWRcbiAqL1xuLyoqXG4gKiBPcGVuIGEgc2VhbGVkIChgZW5jcGApIGVudmVsb3BlLiBTcGxpdCBvdXQgZnJvbSB7QGxpbmsgZGVjcnlwdH0gdG8ga2VlcFxuICogZWFjaCBzY2hlbWUncyBlcnJvciBoYW5kbGluZyByZWFkYWJsZSBvbiBpdHMgb3duLlxuICovXG5hc3luYyBmdW5jdGlvbiBvcGVuU2VhbGVkRW52ZWxvcGUoXG4gIGRhdGE6IFVpbnQ4QXJyYXksXG4gIGtleTogUGF5bG9hZEtleSB8IHVuZGVmaW5lZFxuKTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gIC8vIFNlYWxlZCBwYXlsb2FkcyBuZWVkIHRoZSBwcml2YXRlIHNjYWxhci4gQW55dGhpbmcgZWxzZSDigJQgbm8ga2V5LCBhIGJhcmVcbiAgLy8gc3ltbWV0cmljIGtleSwgb3IgYSB3cml0ZS1vbmx5IHNlYWwgdGFyZ2V0IOKAlCBjYW5ub3Qgb3BlbiB0aGVtLlxuICBpZiAoIWlzUnVuUGF5bG9hZEtleXMoa2V5KSkge1xuICAgIHRocm93IG5ldyBSdW50aW1lRGVjcnlwdGlvbkVycm9yKFxuICAgICAgJ1NlYWxlZCBkYXRhIGVuY291bnRlcmVkIGJ1dCBubyBydW4ga2V5cGFpciBpcyBhdmFpbGFibGUuICcgK1xuICAgICAgICBcIk9wZW5pbmcgYSBzZWFsZWQgcGF5bG9hZCByZXF1aXJlcyB0aGUgcnVuJ3Mgb3duIGVuY3J5cHRpb24ga2V5IFwiICtcbiAgICAgICAgJ21hdGVyaWFsOyBhIHN5bW1ldHJpYyBrZXkgb3IgYSBzZWFsLW9ubHkgdGFyZ2V0IGNhbm5vdCBkZWNyeXB0IGl0LicsXG4gICAgICB7XG4gICAgICAgIGNvbnRleHQ6IHtcbiAgICAgICAgICBvcGVyYXRpb246ICdkZWNyeXB0JyxcbiAgICAgICAgICBieXRlTGVuZ3RoOiBkYXRhLmJ5dGVMZW5ndGgsXG4gICAgICAgICAgZm9ybWF0UHJlZml4OiAnZW5jcCcsXG4gICAgICAgIH0sXG4gICAgICB9XG4gICAgKTtcbiAgfVxuXG4gIGNvbnN0IHsgcGF5bG9hZCB9ID0gZGVjb2RlRm9ybWF0UHJlZml4KGRhdGEpO1xuICB0cnkge1xuICAgIHJldHVybiBhd2FpdCBvcGVuU2VhbGVkKGtleS5rZXlQYWlyLCBwYXlsb2FkLCBrZXkuYWFkKTtcbiAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAvLyBUaGUgc2VhbGVkLWJveCBsYXllciBvbmx5IHNlZXMgdGhlIHN0cmlwcGVkIHBheWxvYWQsIHNvIGl0IGNhbm5vdFxuICAgIC8vIHJlY29yZCB0aGUgb3V0ZXIgZW52ZWxvcGUgcHJlZml4LiBFbnJpY2ggaXQgaGVyZSBiZWZvcmUgcmV0aHJvd2luZy5cbiAgICBpZiAoUnVudGltZURlY3J5cHRpb25FcnJvci5pcyhlcnJvcikgJiYgZXJyb3IuY29udGV4dCkge1xuICAgICAgZXJyb3IuY29udGV4dC5mb3JtYXRQcmVmaXggPSBTZXJpYWxpemF0aW9uRm9ybWF0LlNFQUxFRDtcbiAgICB9XG4gICAgdGhyb3cgZXJyb3I7XG4gIH1cbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlY3J5cHQoXG4gIGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duLFxuICBrZXk6IFBheWxvYWRLZXkgfCB1bmRlZmluZWRcbik6IFByb21pc2U8VWludDhBcnJheSB8IHVua25vd24+IHtcbiAgLy8gTm9uLWJpbmFyeSBkYXRhIGlzIHJldHVybmVkIGFzLWlzLlxuICBpZiAoIShkYXRhIGluc3RhbmNlb2YgVWludDhBcnJheSkpIHJldHVybiBkYXRhO1xuXG4gIGNvbnN0IGZvcm1hdCA9IHBlZWtGb3JtYXRQcmVmaXgoZGF0YSk7XG5cbiAgaWYgKGZvcm1hdCA9PT0gU2VyaWFsaXphdGlvbkZvcm1hdC5TRUFMRUQpIHtcbiAgICByZXR1cm4gb3BlblNlYWxlZEVudmVsb3BlKGRhdGEsIGtleSk7XG4gIH1cblxuICAvLyBJZiB0aGUgZGF0YSBpcyBub3QgZW5jcnlwdGVkLCByZXR1cm4gaXQgdW5jaGFuZ2VkLlxuICBpZiAoZm9ybWF0ICE9PSBTZXJpYWxpemF0aW9uRm9ybWF0LkVOQ1JZUFRFRCkgcmV0dXJuIGRhdGE7XG5cbiAgLy8gSWYgdGhlIGRhdGEgaXMgZW5jcnlwdGVkIGJ1dCBubyBzeW1tZXRyaWMga2V5IGlzIGF2YWlsYWJsZSwgZmFpbCBmYXN0LlxuICBjb25zdCBhZXNLZXkgPSBhZXNLZXlPZihrZXkpO1xuICBpZiAoIWFlc0tleSkge1xuICAgIHRocm93IG5ldyBSdW50aW1lRGVjcnlwdGlvbkVycm9yKFxuICAgICAgJ0VuY3J5cHRlZCBkYXRhIGVuY291bnRlcmVkIGJ1dCBubyBlbmNyeXB0aW9uIGtleSBpcyBhdmFpbGFibGUuICcgK1xuICAgICAgICAnRW5jcnlwdGlvbiBpcyBub3QgY29uZmlndXJlZCBvciBubyBrZXkgd2FzIHByb3ZpZGVkIGZvciB0aGlzIHJ1bi4nLFxuICAgICAge1xuICAgICAgICBjb250ZXh0OiB7XG4gICAgICAgICAgb3BlcmF0aW9uOiAnZGVjcnlwdCcsXG4gICAgICAgICAgYnl0ZUxlbmd0aDogZGF0YS5ieXRlTGVuZ3RoLFxuICAgICAgICAgIGZvcm1hdFByZWZpeDogJ2VuY3InLFxuICAgICAgICB9LFxuICAgICAgfVxuICAgICk7XG4gIH1cblxuICBjb25zdCB7IHBheWxvYWQgfSA9IGRlY29kZUZvcm1hdFByZWZpeChkYXRhKTtcbiAgdHJ5IHtcbiAgICByZXR1cm4gYXdhaXQgYWVzR2NtRGVjcnlwdChhZXNLZXksIHBheWxvYWQpO1xuICB9IGNhdGNoIChlcnJvcikge1xuICAgIC8vIFRoZSBsb3ctbGV2ZWwgQUVTIGxheWVyIG9ubHkgc2VlcyB0aGUgc3RyaXBwZWQgcGF5bG9hZCwgc28gaXQgY2Fubm90XG4gICAgLy8gcmVjb3JkIHRoZSBvdXRlciBlbnZlbG9wZSBwcmVmaXguIFRoaXMgbGF5ZXIgcGVla2VkIGl0IChgZW5jcmApLCBzb1xuICAgIC8vIGVucmljaCB0aGUgZGlhZ25vc3RpYyBjb250ZXh0IHdpdGggdGhlIHJlYWwgZm9ybWF0IHByZWZpeCBiZWZvcmVcbiAgICAvLyByZXRocm93aW5nLlxuICAgIGlmIChSdW50aW1lRGVjcnlwdGlvbkVycm9yLmlzKGVycm9yKSAmJiBlcnJvci5jb250ZXh0KSB7XG4gICAgICBlcnJvci5jb250ZXh0LmZvcm1hdFByZWZpeCA9IGZvcm1hdDtcbiAgICB9XG4gICAgdGhyb3cgZXJyb3I7XG4gIH1cbn1cbiJdfQ==

package/dist/serialization/errors.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Shared error formatting utility for serialization failures.
+ *
+ * Used by the mode-specific serializers (workflow, step, client) to
+ * produce consistent error messages with devalue path information.
+ *
+ * Returns a `{ message, hint }` pair so callers can throw a
+ * `SerializationError(message, { hint, cause })` and have the hint flow
+ * through the standard friendly-errors framing instead of being baked
+ * into the message string.
+ */
+/**
+ * Rethrow SDK runtime errors that must not be reframed as
+ * `SerializationError`.
+ *
+ * The serialize/dehydrate wrappers catch every throw and reframe it as a
+ * `SerializationError` (which classifies as `USER_ERROR`). That's correct
+ * for genuine serialization failures, but a `RuntimeDecryptionError` from
+ * the AES-GCM layer is an SDK-internal failure that must keep its identity
+ * so the run-failure classifier routes it to `RUNTIME_ERROR`. Call this at
+ * the top of each serialize catch block to let those errors propagate
+ * unchanged.
+ */
+export declare function rethrowIfRuntimeError(error: unknown): void;
+/**
+ * Format a serialization error with context about what failed.
+ * Extracts path, value, and reason from devalue's DevalueError when available.
+ * Logs the problematic value to the console for better debugging.
+ */
+export declare function formatSerializationError(context: string, error: unknown): {
+    message: string;
+    hint: string;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/serialization/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/serialization/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAI1D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAqBnC"}

package/dist/serialization/errors.js

@@ -0,0 +1,59 @@
+/**
+ * Shared error formatting utility for serialization failures.
+ *
+ * Used by the mode-specific serializers (workflow, step, client) to
+ * produce consistent error messages with devalue path information.
+ *
+ * Returns a `{ message, hint }` pair so callers can throw a
+ * `SerializationError(message, { hint, cause })` and have the hint flow
+ * through the standard friendly-errors framing instead of being baked
+ * into the message string.
+ */
+import { RuntimeDecryptionError } from '@workflow/errors';
+import { DevalueError } from 'devalue';
+import { runtimeLogger } from '../logger.js';
+/**
+ * Rethrow SDK runtime errors that must not be reframed as
+ * `SerializationError`.
+ *
+ * The serialize/dehydrate wrappers catch every throw and reframe it as a
+ * `SerializationError` (which classifies as `USER_ERROR`). That's correct
+ * for genuine serialization failures, but a `RuntimeDecryptionError` from
+ * the AES-GCM layer is an SDK-internal failure that must keep its identity
+ * so the run-failure classifier routes it to `RUNTIME_ERROR`. Call this at
+ * the top of each serialize catch block to let those errors propagate
+ * unchanged.
+ */
+export function rethrowIfRuntimeError(error) {
+    if (RuntimeDecryptionError.is(error)) {
+        throw error;
+    }
+}
+/**
+ * Format a serialization error with context about what failed.
+ * Extracts path, value, and reason from devalue's DevalueError when available.
+ * Logs the problematic value to the console for better debugging.
+ */
+export function formatSerializationError(context, error) {
+    // `returning` for outputs, `passing` for everything that crosses the
+    // boundary the other way (arguments, stream messages, etc.).
+    const verb = context.includes('return value') ? 'returning' : 'passing';
+    let message = `Failed to serialize ${context}`;
+    if (error instanceof DevalueError && error.path) {
+        message += ` at path "${error.path}"`;
+    }
+    // Workflow can serialize a much richer set than the devalue defaults —
+    // classes registered via `WORKFLOW_SERIALIZE`, FatalError / RetryableError
+    // subclasses, AbortSignal, etc. Pointing at the foundations doc keeps
+    // this hint accurate as the supported set grows, instead of repeating
+    // a hardcoded list that drifts out of sync.
+    const hint = `Ensure you're ${verb} workflow serializable types. Check the serialization docs to see what's serializable: https://workflow-sdk.dev/docs/foundations/serialization`;
+    if (error instanceof DevalueError && error.value !== undefined) {
+        runtimeLogger.error('Serialization failed', {
+            context,
+            problematicValue: error.value,
+        });
+    }
+    return { message, hint };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcmlhbGl6YXRpb24vZXJyb3JzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7O0dBVUc7QUFFSCxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUMxRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQ3ZDLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFN0M7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUMsS0FBYztJQUNsRCxJQUFJLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLHdCQUF3QixDQUN0QyxPQUFlLEVBQ2YsS0FBYztJQUVkLHFFQUFxRTtJQUNyRSw2REFBNkQ7SUFDN0QsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDeEUsSUFBSSxPQUFPLEdBQUcsdUJBQXVCLE9BQU8sRUFBRSxDQUFDO0lBQy9DLElBQUksS0FBSyxZQUFZLFlBQVksSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEQsT0FBTyxJQUFJLGFBQWEsS0FBSyxDQUFDLElBQUksR0FBRyxDQUFDO0lBQ3hDLENBQUM7SUFDRCx1RUFBdUU7SUFDdkUsMkVBQTJFO0lBQzNFLHNFQUFzRTtJQUN0RSxzRUFBc0U7SUFDdEUsNENBQTRDO0lBQzVDLE1BQU0sSUFBSSxHQUFHLGlCQUFpQixJQUFJLGdKQUFnSixDQUFDO0lBQ25MLElBQUksS0FBSyxZQUFZLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9ELGFBQWEsQ0FBQyxLQUFLLENBQUMsc0JBQXNCLEVBQUU7WUFDMUMsT0FBTztZQUNQLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxLQUFLO1NBQzlCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQzNCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFNoYXJlZCBlcnJvciBmb3JtYXR0aW5nIHV0aWxpdHkgZm9yIHNlcmlhbGl6YXRpb24gZmFpbHVyZXMuXG4gKlxuICogVXNlZCBieSB0aGUgbW9kZS1zcGVjaWZpYyBzZXJpYWxpemVycyAod29ya2Zsb3csIHN0ZXAsIGNsaWVudCkgdG9cbiAqIHByb2R1Y2UgY29uc2lzdGVudCBlcnJvciBtZXNzYWdlcyB3aXRoIGRldmFsdWUgcGF0aCBpbmZvcm1hdGlvbi5cbiAqXG4gKiBSZXR1cm5zIGEgYHsgbWVzc2FnZSwgaGludCB9YCBwYWlyIHNvIGNhbGxlcnMgY2FuIHRocm93IGFcbiAqIGBTZXJpYWxpemF0aW9uRXJyb3IobWVzc2FnZSwgeyBoaW50LCBjYXVzZSB9KWAgYW5kIGhhdmUgdGhlIGhpbnQgZmxvd1xuICogdGhyb3VnaCB0aGUgc3RhbmRhcmQgZnJpZW5kbHktZXJyb3JzIGZyYW1pbmcgaW5zdGVhZCBvZiBiZWluZyBiYWtlZFxuICogaW50byB0aGUgbWVzc2FnZSBzdHJpbmcuXG4gKi9cblxuaW1wb3J0IHsgUnVudGltZURlY3J5cHRpb25FcnJvciB9IGZyb20gJ0B3b3JrZmxvdy9lcnJvcnMnO1xuaW1wb3J0IHsgRGV2YWx1ZUVycm9yIH0gZnJvbSAnZGV2YWx1ZSc7XG5pbXBvcnQgeyBydW50aW1lTG9nZ2VyIH0gZnJvbSAnLi4vbG9nZ2VyLmpzJztcblxuLyoqXG4gKiBSZXRocm93IFNESyBydW50aW1lIGVycm9ycyB0aGF0IG11c3Qgbm90IGJlIHJlZnJhbWVkIGFzXG4gKiBgU2VyaWFsaXphdGlvbkVycm9yYC5cbiAqXG4gKiBUaGUgc2VyaWFsaXplL2RlaHlkcmF0ZSB3cmFwcGVycyBjYXRjaCBldmVyeSB0aHJvdyBhbmQgcmVmcmFtZSBpdCBhcyBhXG4gKiBgU2VyaWFsaXphdGlvbkVycm9yYCAod2hpY2ggY2xhc3NpZmllcyBhcyBgVVNFUl9FUlJPUmApLiBUaGF0J3MgY29ycmVjdFxuICogZm9yIGdlbnVpbmUgc2VyaWFsaXphdGlvbiBmYWlsdXJlcywgYnV0IGEgYFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3JgIGZyb21cbiAqIHRoZSBBRVMtR0NNIGxheWVyIGlzIGFuIFNESy1pbnRlcm5hbCBmYWlsdXJlIHRoYXQgbXVzdCBrZWVwIGl0cyBpZGVudGl0eVxuICogc28gdGhlIHJ1bi1mYWlsdXJlIGNsYXNzaWZpZXIgcm91dGVzIGl0IHRvIGBSVU5USU1FX0VSUk9SYC4gQ2FsbCB0aGlzIGF0XG4gKiB0aGUgdG9wIG9mIGVhY2ggc2VyaWFsaXplIGNhdGNoIGJsb2NrIHRvIGxldCB0aG9zZSBlcnJvcnMgcHJvcGFnYXRlXG4gKiB1bmNoYW5nZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXRocm93SWZSdW50aW1lRXJyb3IoZXJyb3I6IHVua25vd24pOiB2b2lkIHtcbiAgaWYgKFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IuaXMoZXJyb3IpKSB7XG4gICAgdGhyb3cgZXJyb3I7XG4gIH1cbn1cblxuLyoqXG4gKiBGb3JtYXQgYSBzZXJpYWxpemF0aW9uIGVycm9yIHdpdGggY29udGV4dCBhYm91dCB3aGF0IGZhaWxlZC5cbiAqIEV4dHJhY3RzIHBhdGgsIHZhbHVlLCBhbmQgcmVhc29uIGZyb20gZGV2YWx1ZSdzIERldmFsdWVFcnJvciB3aGVuIGF2YWlsYWJsZS5cbiAqIExvZ3MgdGhlIHByb2JsZW1hdGljIHZhbHVlIHRvIHRoZSBjb25zb2xlIGZvciBiZXR0ZXIgZGVidWdnaW5nLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZm9ybWF0U2VyaWFsaXphdGlvbkVycm9yKFxuICBjb250ZXh0OiBzdHJpbmcsXG4gIGVycm9yOiB1bmtub3duXG4pOiB7IG1lc3NhZ2U6IHN0cmluZzsgaGludDogc3RyaW5nIH0ge1xuICAvLyBgcmV0dXJuaW5nYCBmb3Igb3V0cHV0cywgYHBhc3NpbmdgIGZvciBldmVyeXRoaW5nIHRoYXQgY3Jvc3NlcyB0aGVcbiAgLy8gYm91bmRhcnkgdGhlIG90aGVyIHdheSAoYXJndW1lbnRzLCBzdHJlYW0gbWVzc2FnZXMsIGV0Yy4pLlxuICBjb25zdCB2ZXJiID0gY29udGV4dC5pbmNsdWRlcygncmV0dXJuIHZhbHVlJykgPyAncmV0dXJuaW5nJyA6ICdwYXNzaW5nJztcbiAgbGV0IG1lc3NhZ2UgPSBgRmFpbGVkIHRvIHNlcmlhbGl6ZSAke2NvbnRleHR9YDtcbiAgaWYgKGVycm9yIGluc3RhbmNlb2YgRGV2YWx1ZUVycm9yICYmIGVycm9yLnBhdGgpIHtcbiAgICBtZXNzYWdlICs9IGAgYXQgcGF0aCBcIiR7ZXJyb3IucGF0aH1cImA7XG4gIH1cbiAgLy8gV29ya2Zsb3cgY2FuIHNlcmlhbGl6ZSBhIG11Y2ggcmljaGVyIHNldCB0aGFuIHRoZSBkZXZhbHVlIGRlZmF1bHRzIOKAlFxuICAvLyBjbGFzc2VzIHJlZ2lzdGVyZWQgdmlhIGBXT1JLRkxPV19TRVJJQUxJWkVgLCBGYXRhbEVycm9yIC8gUmV0cnlhYmxlRXJyb3JcbiAgLy8gc3ViY2xhc3NlcywgQWJvcnRTaWduYWwsIGV0Yy4gUG9pbnRpbmcgYXQgdGhlIGZvdW5kYXRpb25zIGRvYyBrZWVwc1xuICAvLyB0aGlzIGhpbnQgYWNjdXJhdGUgYXMgdGhlIHN1cHBvcnRlZCBzZXQgZ3Jvd3MsIGluc3RlYWQgb2YgcmVwZWF0aW5nXG4gIC8vIGEgaGFyZGNvZGVkIGxpc3QgdGhhdCBkcmlmdHMgb3V0IG9mIHN5bmMuXG4gIGNvbnN0IGhpbnQgPSBgRW5zdXJlIHlvdSdyZSAke3ZlcmJ9IHdvcmtmbG93IHNlcmlhbGl6YWJsZSB0eXBlcy4gQ2hlY2sgdGhlIHNlcmlhbGl6YXRpb24gZG9jcyB0byBzZWUgd2hhdCdzIHNlcmlhbGl6YWJsZTogaHR0cHM6Ly93b3JrZmxvdy1zZGsuZGV2L2RvY3MvZm91bmRhdGlvbnMvc2VyaWFsaXphdGlvbmA7XG4gIGlmIChlcnJvciBpbnN0YW5jZW9mIERldmFsdWVFcnJvciAmJiBlcnJvci52YWx1ZSAhPT0gdW5kZWZpbmVkKSB7XG4gICAgcnVudGltZUxvZ2dlci5lcnJvcignU2VyaWFsaXphdGlvbiBmYWlsZWQnLCB7XG4gICAgICBjb250ZXh0LFxuICAgICAgcHJvYmxlbWF0aWNWYWx1ZTogZXJyb3IudmFsdWUsXG4gICAgfSk7XG4gIH1cbiAgcmV0dXJuIHsgbWVzc2FnZSwgaGludCB9O1xufVxuIl19

package/dist/serialization/format.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Format prefix system for serialized payloads.
+ *
+ * All serialized payloads are prefixed with a 4-byte format identifier that
+ * allows the deserializer to determine how to decode the payload. This enables:
+ *
+ * 1. Self-describing payloads — the World layer is agnostic to serialization format
+ * 2. Gradual migration — old runs keep working, new runs can use new formats
+ * 3. Composability — encryption can wrap any format ("encr" wrapping "devl")
+ * 4. Debugging — raw data inspection immediately reveals the format
+ *
+ * Format: [4 bytes: format identifier][payload]
+ *
+ * The format prefix is open-ended — any 4-character [a-z0-9] string is valid.
+ * This allows new codecs to be added without modifying this module.
+ */
+import { type FormatPrefix } from './types.js';
+/**
+ * Encode a payload with a format prefix.
+ *
+ * @param format - The format identifier (4 chars, [a-z0-9])
+ * @param payload - The serialized payload bytes
+ * @returns A new Uint8Array with format prefix prepended
+ */
+export declare function encodeWithFormatPrefix(format: FormatPrefix, payload: Uint8Array | unknown): Uint8Array | unknown;
+/**
+ * Peek at the format prefix without consuming it.
+ *
+ * Returns the prefix if it's a valid format prefix ([a-z0-9]{4}),
+ * or null if the data is legacy/non-binary or doesn't start with a
+ * valid prefix.
+ *
+ * @param data - The format-prefixed data
+ * @returns The format prefix, or null
+ */
+export declare function peekFormatPrefix(data: Uint8Array | unknown): FormatPrefix | null;
+/**
+ * Check if data is encrypted (has 'encr' format prefix).
+ */
+export declare function isEncrypted(data: Uint8Array | unknown): boolean;
+/**
+ * Decode a format-prefixed payload.
+ *
+ * Unlike the legacy implementation which only accepted known formats
+ * (`devl`, `encr`), this function accepts any valid format prefix
+ * (`[a-z0-9]{4}`). This is intentional for forward compatibility —
+ * new codecs (e.g. `cbor`) can be added without modifying this module.
+ * Callers are responsible for checking whether they support the returned
+ * format and throwing an appropriate error if not (e.g. "Unsupported
+ * serialization format").
+ *
+ * @param data - The format-prefixed data
+ * @returns An object with the format prefix and payload
+ * @throws Error if the data is too short or has an invalid prefix
+ */
+export declare function decodeFormatPrefix(data: Uint8Array | unknown): {
+    format: FormatPrefix;
+    payload: Uint8Array;
+};
+//# sourceMappingURL=format.d.ts.map

package/dist/serialization/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/serialization/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,YAAY,CAAC;AAQpB;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,UAAU,GAAG,OAAO,GAC5B,UAAU,GAAG,OAAO,CAUtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,GAAG,OAAO,GACzB,YAAY,GAAG,IAAI,CAOrB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG;IAC9D,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,UAAU,CAAC;CACrB,CA0BA"}

package/dist/serialization/format.js

@@ -0,0 +1,97 @@
+/**
+ * Format prefix system for serialized payloads.
+ *
+ * All serialized payloads are prefixed with a 4-byte format identifier that
+ * allows the deserializer to determine how to decode the payload. This enables:
+ *
+ * 1. Self-describing payloads — the World layer is agnostic to serialization format
+ * 2. Gradual migration — old runs keep working, new runs can use new formats
+ * 3. Composability — encryption can wrap any format ("encr" wrapping "devl")
+ * 4. Debugging — raw data inspection immediately reveals the format
+ *
+ * Format: [4 bytes: format identifier][payload]
+ *
+ * The format prefix is open-ended — any 4-character [a-z0-9] string is valid.
+ * This allows new codecs to be added without modifying this module.
+ */
+import { isFormatPrefix, SerializationFormat, } from './types.js';
+/** Length of the format prefix in bytes */
+const FORMAT_PREFIX_LENGTH = 4;
+const formatEncoder = new TextEncoder();
+const formatDecoder = new TextDecoder();
+/**
+ * Encode a payload with a format prefix.
+ *
+ * @param format - The format identifier (4 chars, [a-z0-9])
+ * @param payload - The serialized payload bytes
+ * @returns A new Uint8Array with format prefix prepended
+ */
+export function encodeWithFormatPrefix(format, payload) {
+    if (!(payload instanceof Uint8Array)) {
+        return payload;
+    }
+    const prefixBytes = formatEncoder.encode(format);
+    const result = new Uint8Array(FORMAT_PREFIX_LENGTH + payload.length);
+    result.set(prefixBytes, 0);
+    result.set(payload, FORMAT_PREFIX_LENGTH);
+    return result;
+}
+/**
+ * Peek at the format prefix without consuming it.
+ *
+ * Returns the prefix if it's a valid format prefix ([a-z0-9]{4}),
+ * or null if the data is legacy/non-binary or doesn't start with a
+ * valid prefix.
+ *
+ * @param data - The format-prefixed data
+ * @returns The format prefix, or null
+ */
+export function peekFormatPrefix(data) {
+    if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH) {
+        return null;
+    }
+    const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH);
+    const str = formatDecoder.decode(prefixBytes);
+    return isFormatPrefix(str) ? str : null;
+}
+/**
+ * Check if data is encrypted (has 'encr' format prefix).
+ */
+export function isEncrypted(data) {
+    return peekFormatPrefix(data) === SerializationFormat.ENCRYPTED;
+}
+/**
+ * Decode a format-prefixed payload.
+ *
+ * Unlike the legacy implementation which only accepted known formats
+ * (`devl`, `encr`), this function accepts any valid format prefix
+ * (`[a-z0-9]{4}`). This is intentional for forward compatibility —
+ * new codecs (e.g. `cbor`) can be added without modifying this module.
+ * Callers are responsible for checking whether they support the returned
+ * format and throwing an appropriate error if not (e.g. "Unsupported
+ * serialization format").
+ *
+ * @param data - The format-prefixed data
+ * @returns An object with the format prefix and payload
+ * @throws Error if the data is too short or has an invalid prefix
+ */
+export function decodeFormatPrefix(data) {
+    // Compat for legacy specVersion 1 runs that don't have a format prefix
+    if (!(data instanceof Uint8Array)) {
+        return {
+            format: SerializationFormat.DEVALUE_V1,
+            payload: new TextEncoder().encode(JSON.stringify(data)),
+        };
+    }
+    if (data.length < FORMAT_PREFIX_LENGTH) {
+        throw new Error(`Data too short to contain format prefix: expected at least ${FORMAT_PREFIX_LENGTH} bytes, got ${data.length}`);
+    }
+    const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH);
+    const str = formatDecoder.decode(prefixBytes);
+    if (!isFormatPrefix(str)) {
+        throw new Error(`Invalid format prefix: "${str}". Must be 4 characters of [a-z0-9].`);
+    }
+    const payload = data.subarray(FORMAT_PREFIX_LENGTH);
+    return { format: str, payload };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9ybWF0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcmlhbGl6YXRpb24vZm9ybWF0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUVILE9BQU8sRUFFTCxjQUFjLEVBQ2QsbUJBQW1CLEdBQ3BCLE1BQU0sWUFBWSxDQUFDO0FBRXBCLDJDQUEyQztBQUMzQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsQ0FBQztBQUUvQixNQUFNLGFBQWEsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sYUFBYSxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFFeEM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUNwQyxNQUFvQixFQUNwQixPQUE2QjtJQUU3QixJQUFJLENBQUMsQ0FBQyxPQUFPLFlBQVksVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNyQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRCxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxvQkFBb0IsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDckUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDM0IsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztJQUMxQyxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUM5QixJQUEwQjtJQUUxQixJQUFJLENBQUMsQ0FBQyxJQUFJLFlBQVksVUFBVSxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3hFLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLG9CQUFvQixDQUFDLENBQUM7SUFDM0QsTUFBTSxHQUFHLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM5QyxPQUFPLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDMUMsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxVQUFVLFdBQVcsQ0FBQyxJQUEwQjtJQUNwRCxPQUFPLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLG1CQUFtQixDQUFDLFNBQVMsQ0FBQztBQUNsRSxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQUMsSUFBMEI7SUFJM0QsdUVBQXVFO0lBQ3ZFLElBQUksQ0FBQyxDQUFDLElBQUksWUFBWSxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU87WUFDTCxNQUFNLEVBQUUsbUJBQW1CLENBQUMsVUFBVTtZQUN0QyxPQUFPLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztTQUN4RCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sSUFBSSxLQUFLLENBQ2IsOERBQThELG9CQUFvQixlQUFlLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FDL0csQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO0lBQzNELE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7SUFFOUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQ2IsMkJBQTJCLEdBQUcsc0NBQXNDLENBQ3JFLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQ2xDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEZvcm1hdCBwcmVmaXggc3lzdGVtIGZvciBzZXJpYWxpemVkIHBheWxvYWRzLlxuICpcbiAqIEFsbCBzZXJpYWxpemVkIHBheWxvYWRzIGFyZSBwcmVmaXhlZCB3aXRoIGEgNC1ieXRlIGZvcm1hdCBpZGVudGlmaWVyIHRoYXRcbiAqIGFsbG93cyB0aGUgZGVzZXJpYWxpemVyIHRvIGRldGVybWluZSBob3cgdG8gZGVjb2RlIHRoZSBwYXlsb2FkLiBUaGlzIGVuYWJsZXM6XG4gKlxuICogMS4gU2VsZi1kZXNjcmliaW5nIHBheWxvYWRzIOKAlCB0aGUgV29ybGQgbGF5ZXIgaXMgYWdub3N0aWMgdG8gc2VyaWFsaXphdGlvbiBmb3JtYXRcbiAqIDIuIEdyYWR1YWwgbWlncmF0aW9uIOKAlCBvbGQgcnVucyBrZWVwIHdvcmtpbmcsIG5ldyBydW5zIGNhbiB1c2UgbmV3IGZvcm1hdHNcbiAqIDMuIENvbXBvc2FiaWxpdHkg4oCUIGVuY3J5cHRpb24gY2FuIHdyYXAgYW55IGZvcm1hdCAoXCJlbmNyXCIgd3JhcHBpbmcgXCJkZXZsXCIpXG4gKiA0LiBEZWJ1Z2dpbmcg4oCUIHJhdyBkYXRhIGluc3BlY3Rpb24gaW1tZWRpYXRlbHkgcmV2ZWFscyB0aGUgZm9ybWF0XG4gKlxuICogRm9ybWF0OiBbNCBieXRlczogZm9ybWF0IGlkZW50aWZpZXJdW3BheWxvYWRdXG4gKlxuICogVGhlIGZvcm1hdCBwcmVmaXggaXMgb3Blbi1lbmRlZCDigJQgYW55IDQtY2hhcmFjdGVyIFthLXowLTldIHN0cmluZyBpcyB2YWxpZC5cbiAqIFRoaXMgYWxsb3dzIG5ldyBjb2RlY3MgdG8gYmUgYWRkZWQgd2l0aG91dCBtb2RpZnlpbmcgdGhpcyBtb2R1bGUuXG4gKi9cblxuaW1wb3J0IHtcbiAgdHlwZSBGb3JtYXRQcmVmaXgsXG4gIGlzRm9ybWF0UHJlZml4LFxuICBTZXJpYWxpemF0aW9uRm9ybWF0LFxufSBmcm9tICcuL3R5cGVzLmpzJztcblxuLyoqIExlbmd0aCBvZiB0aGUgZm9ybWF0IHByZWZpeCBpbiBieXRlcyAqL1xuY29uc3QgRk9STUFUX1BSRUZJWF9MRU5HVEggPSA0O1xuXG5jb25zdCBmb3JtYXRFbmNvZGVyID0gbmV3IFRleHRFbmNvZGVyKCk7XG5jb25zdCBmb3JtYXREZWNvZGVyID0gbmV3IFRleHREZWNvZGVyKCk7XG5cbi8qKlxuICogRW5jb2RlIGEgcGF5bG9hZCB3aXRoIGEgZm9ybWF0IHByZWZpeC5cbiAqXG4gKiBAcGFyYW0gZm9ybWF0IC0gVGhlIGZvcm1hdCBpZGVudGlmaWVyICg0IGNoYXJzLCBbYS16MC05XSlcbiAqIEBwYXJhbSBwYXlsb2FkIC0gVGhlIHNlcmlhbGl6ZWQgcGF5bG9hZCBieXRlc1xuICogQHJldHVybnMgQSBuZXcgVWludDhBcnJheSB3aXRoIGZvcm1hdCBwcmVmaXggcHJlcGVuZGVkXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBlbmNvZGVXaXRoRm9ybWF0UHJlZml4KFxuICBmb3JtYXQ6IEZvcm1hdFByZWZpeCxcbiAgcGF5bG9hZDogVWludDhBcnJheSB8IHVua25vd25cbik6IFVpbnQ4QXJyYXkgfCB1bmtub3duIHtcbiAgaWYgKCEocGF5bG9hZCBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSB7XG4gICAgcmV0dXJuIHBheWxvYWQ7XG4gIH1cblxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGZvcm1hdEVuY29kZXIuZW5jb2RlKGZvcm1hdCk7XG4gIGNvbnN0IHJlc3VsdCA9IG5ldyBVaW50OEFycmF5KEZPUk1BVF9QUkVGSVhfTEVOR1RIICsgcGF5bG9hZC5sZW5ndGgpO1xuICByZXN1bHQuc2V0KHByZWZpeEJ5dGVzLCAwKTtcbiAgcmVzdWx0LnNldChwYXlsb2FkLCBGT1JNQVRfUFJFRklYX0xFTkdUSCk7XG4gIHJldHVybiByZXN1bHQ7XG59XG5cbi8qKlxuICogUGVlayBhdCB0aGUgZm9ybWF0IHByZWZpeCB3aXRob3V0IGNvbnN1bWluZyBpdC5cbiAqXG4gKiBSZXR1cm5zIHRoZSBwcmVmaXggaWYgaXQncyBhIHZhbGlkIGZvcm1hdCBwcmVmaXggKFthLXowLTldezR9KSxcbiAqIG9yIG51bGwgaWYgdGhlIGRhdGEgaXMgbGVnYWN5L25vbi1iaW5hcnkgb3IgZG9lc24ndCBzdGFydCB3aXRoIGFcbiAqIHZhbGlkIHByZWZpeC5cbiAqXG4gKiBAcGFyYW0gZGF0YSAtIFRoZSBmb3JtYXQtcHJlZml4ZWQgZGF0YVxuICogQHJldHVybnMgVGhlIGZvcm1hdCBwcmVmaXgsIG9yIG51bGxcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHBlZWtGb3JtYXRQcmVmaXgoXG4gIGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duXG4pOiBGb3JtYXRQcmVmaXggfCBudWxsIHtcbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpIHx8IGRhdGEubGVuZ3RoIDwgRk9STUFUX1BSRUZJWF9MRU5HVEgpIHtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGRhdGEuc3ViYXJyYXkoMCwgRk9STUFUX1BSRUZJWF9MRU5HVEgpO1xuICBjb25zdCBzdHIgPSBmb3JtYXREZWNvZGVyLmRlY29kZShwcmVmaXhCeXRlcyk7XG4gIHJldHVybiBpc0Zvcm1hdFByZWZpeChzdHIpID8gc3RyIDogbnVsbDtcbn1cblxuLyoqXG4gKiBDaGVjayBpZiBkYXRhIGlzIGVuY3J5cHRlZCAoaGFzICdlbmNyJyBmb3JtYXQgcHJlZml4KS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzRW5jcnlwdGVkKGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duKTogYm9vbGVhbiB7XG4gIHJldHVybiBwZWVrRm9ybWF0UHJlZml4KGRhdGEpID09PSBTZXJpYWxpemF0aW9uRm9ybWF0LkVOQ1JZUFRFRDtcbn1cblxuLyoqXG4gKiBEZWNvZGUgYSBmb3JtYXQtcHJlZml4ZWQgcGF5bG9hZC5cbiAqXG4gKiBVbmxpa2UgdGhlIGxlZ2FjeSBpbXBsZW1lbnRhdGlvbiB3aGljaCBvbmx5IGFjY2VwdGVkIGtub3duIGZvcm1hdHNcbiAqIChgZGV2bGAsIGBlbmNyYCksIHRoaXMgZnVuY3Rpb24gYWNjZXB0cyBhbnkgdmFsaWQgZm9ybWF0IHByZWZpeFxuICogKGBbYS16MC05XXs0fWApLiBUaGlzIGlzIGludGVudGlvbmFsIGZvciBmb3J3YXJkIGNvbXBhdGliaWxpdHkg4oCUXG4gKiBuZXcgY29kZWNzIChlLmcuIGBjYm9yYCkgY2FuIGJlIGFkZGVkIHdpdGhvdXQgbW9kaWZ5aW5nIHRoaXMgbW9kdWxlLlxuICogQ2FsbGVycyBhcmUgcmVzcG9uc2libGUgZm9yIGNoZWNraW5nIHdoZXRoZXIgdGhleSBzdXBwb3J0IHRoZSByZXR1cm5lZFxuICogZm9ybWF0IGFuZCB0aHJvd2luZyBhbiBhcHByb3ByaWF0ZSBlcnJvciBpZiBub3QgKGUuZy4gXCJVbnN1cHBvcnRlZFxuICogc2VyaWFsaXphdGlvbiBmb3JtYXRcIikuXG4gKlxuICogQHBhcmFtIGRhdGEgLSBUaGUgZm9ybWF0LXByZWZpeGVkIGRhdGFcbiAqIEByZXR1cm5zIEFuIG9iamVjdCB3aXRoIHRoZSBmb3JtYXQgcHJlZml4IGFuZCBwYXlsb2FkXG4gKiBAdGhyb3dzIEVycm9yIGlmIHRoZSBkYXRhIGlzIHRvbyBzaG9ydCBvciBoYXMgYW4gaW52YWxpZCBwcmVmaXhcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGRlY29kZUZvcm1hdFByZWZpeChkYXRhOiBVaW50OEFycmF5IHwgdW5rbm93bik6IHtcbiAgZm9ybWF0OiBGb3JtYXRQcmVmaXg7XG4gIHBheWxvYWQ6IFVpbnQ4QXJyYXk7XG59IHtcbiAgLy8gQ29tcGF0IGZvciBsZWdhY3kgc3BlY1ZlcnNpb24gMSBydW5zIHRoYXQgZG9uJ3QgaGF2ZSBhIGZvcm1hdCBwcmVmaXhcbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGZvcm1hdDogU2VyaWFsaXphdGlvbkZvcm1hdC5ERVZBTFVFX1YxLFxuICAgICAgcGF5bG9hZDogbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKEpTT04uc3RyaW5naWZ5KGRhdGEpKSxcbiAgICB9O1xuICB9XG5cbiAgaWYgKGRhdGEubGVuZ3RoIDwgRk9STUFUX1BSRUZJWF9MRU5HVEgpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICBgRGF0YSB0b28gc2hvcnQgdG8gY29udGFpbiBmb3JtYXQgcHJlZml4OiBleHBlY3RlZCBhdCBsZWFzdCAke0ZPUk1BVF9QUkVGSVhfTEVOR1RIfSBieXRlcywgZ290ICR7ZGF0YS5sZW5ndGh9YFxuICAgICk7XG4gIH1cblxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGRhdGEuc3ViYXJyYXkoMCwgRk9STUFUX1BSRUZJWF9MRU5HVEgpO1xuICBjb25zdCBzdHIgPSBmb3JtYXREZWNvZGVyLmRlY29kZShwcmVmaXhCeXRlcyk7XG5cbiAgaWYgKCFpc0Zvcm1hdFByZWZpeChzdHIpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYEludmFsaWQgZm9ybWF0IHByZWZpeDogXCIke3N0cn1cIi4gTXVzdCBiZSA0IGNoYXJhY3RlcnMgb2YgW2EtejAtOV0uYFxuICAgICk7XG4gIH1cblxuICBjb25zdCBwYXlsb2FkID0gZGF0YS5zdWJhcnJheShGT1JNQVRfUFJFRklYX0xFTkdUSCk7XG4gIHJldHVybiB7IGZvcm1hdDogc3RyLCBwYXlsb2FkIH07XG59XG4iXX0=