@workflow/core 5.0.0-beta.5 → 5.0.0-beta.50

package/dist/serialization/compression.js

@@ -0,0 +1,261 @@
+/**
+ * Composable compression layer for serialized data.
+ *
+ * Wraps/unwraps serialized payloads with a compression codec, using the
+ * format prefix system to mark compressed data (e.g. 'zstd' or 'gzip'
+ * wrapping the inner format: 'zstd' + zstd('devl' + payload)).
+ *
+ * Codec selection (write side): zstd is preferred because it is markedly
+ * faster than gzip at a comparable-or-better ratio (see scripts/README.md),
+ * and compression runs at every step boundary so the write CPU is a
+ * per-step tax. zstd requires `node:zlib` >= 22.15 (Web
+ * `CompressionStream` has no zstd), so on a runtime without it we fall back
+ * to gzip via the portable
+ * `CompressionStream`. `WORKFLOW_COMPRESSION_CODEC=gzip` forces the
+ * portable codec.
+ *
+ * Read side: dispatch on the format prefix, so both 'zstd' and 'gzip'
+ * payloads are always decodable regardless of which codec wrote them.
+ * (The browser o11y read path decodes zstd via a registered WASM decoder,
+ * see `serialization-format.ts`; this module's `decompress` is the Node
+ * runtime/replay path and uses `node:zlib`.)
+ *
+ * Layering order with encryption: compression is applied BEFORE
+ * encryption (encr(zstd(devl))): encrypted bytes are high-entropy and
+ * do not compress, so the reverse order would be a no-op.
+ *
+ * Compression is conditional:
+ * - Payloads smaller than {@link COMPRESSION_MIN_BYTES} are passed
+ *   through unchanged (codec overhead isn't worth it).
+ * - If the compressed result isn't meaningfully smaller than the
+ *   original (see {@link COMPRESSION_MIN_SAVINGS_RATIO}), the original
+ *   is kept. This protects already-compressed binary payloads (images,
+ *   archives, etc.) from wasted CPU and size inflation.
+ */
+import { decodeFormatPrefix, encodeWithFormatPrefix, peekFormatPrefix, } from './format.js';
+import { SerializationFormat } from './types.js';
+/**
+ * Payloads below this size are never compressed. The 4-byte format
+ * prefix + codec header/trailer overhead means small payloads gain
+ * nothing, and tiny ones would grow.
+ */
+export const COMPRESSION_MIN_BYTES = 1024;
+/**
+ * Compression must shave off at least this fraction of the payload
+ * size to be kept; otherwise the uncompressed original is stored.
+ * Guards against incompressible (already-compressed / high-entropy)
+ * data paying a permanent decompression tax for a negligible win.
+ */
+export const COMPRESSION_MIN_SAVINGS_RATIO = 0.05;
+/** Default zstd compression level: the sweet spot of speed vs ratio. */
+const ZSTD_LEVEL = 3;
+/**
+ * Escape hatch: set WORKFLOW_DISABLE_COMPRESSION=1 to disable
+ * write-side compression entirely. Reads are unaffected: payloads
+ * that were already written compressed remain readable.
+ */
+function isCompressionDisabledByEnv() {
+    try {
+        return (typeof process !== 'undefined' &&
+            process.env?.WORKFLOW_DISABLE_COMPRESSION === '1');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Optional codec override (`WORKFLOW_COMPRESSION_CODEC=gzip|zstd`). Lets an
+ * operator pin the portable codec (gzip), useful for A/B comparisons or
+ * runtimes where zstd read support isn't yet everywhere.
+ */
+function codecOverrideFromEnv() {
+    try {
+        const v = process.env?.WORKFLOW_COMPRESSION_CODEC;
+        return v === 'gzip' || v === 'zstd' ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve `node:zlib` via `process.getBuiltinModule`: no static import, so
+ * this module stays bundler-safe for browser/edge targets (where it returns
+ * undefined and we fall back to gzip).
+ */
+function getNodeZlib() {
+    try {
+        return globalThis.process?.getBuiltinModule?.('node:zlib');
+    }
+    catch {
+        return undefined;
+    }
+}
+function isZstdAvailable() {
+    const z = getNodeZlib();
+    return (typeof z?.zstdCompressSync === 'function' &&
+        typeof z?.zstdDecompressSync === 'function');
+}
+/**
+ * gzip via the web-standard `CompressionStream` (Node 18+, browsers, edge).
+ */
+function isGzipAvailable() {
+    return (typeof CompressionStream === 'function' &&
+        typeof DecompressionStream === 'function');
+}
+/**
+ * Pipe bytes through a (De)CompressionStream and collect the output.
+ */
+async function pipeThroughTransform(data, transform) {
+    const writer = transform.writable.getWriter();
+    // Don't await the write before reading: the transform's internal
+    // queue can fill up on large payloads, deadlocking writer vs reader.
+    const writePromise = writer.write(data).then(() => writer.close());
+    // If the transform errors, the reader.read() below rejects first and
+    // propagates; mark the write side as handled so the mirrored rejection
+    // doesn't surface as an unhandled rejection.
+    writePromise.catch(() => { });
+    const chunks = [];
+    let total = 0;
+    const reader = transform.readable.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value);
+        total += value.length;
+    }
+    await writePromise;
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return out;
+}
+async function gzipBytes(data) {
+    return pipeThroughTransform(data, new CompressionStream('gzip'));
+}
+async function gunzipBytes(data) {
+    return pipeThroughTransform(data, new DecompressionStream('gzip'));
+}
+function zstdBytes(data) {
+    const z = getNodeZlib();
+    const level = z?.constants?.ZSTD_c_compressionLevel;
+    const opts = level !== undefined ? { params: { [level]: ZSTD_LEVEL } } : undefined;
+    // biome-ignore lint/style/noNonNullAssertion: guarded by isZstdAvailable()
+    return new Uint8Array(z.zstdCompressSync(data, opts));
+}
+function unzstdBytes(data) {
+    const z = getNodeZlib();
+    if (!z?.zstdDecompressSync) {
+        throw new Error('Compressed (zstd) workflow data encountered but node:zlib zstd ' +
+            'support is not available in this runtime (requires Node.js 22.15+). ' +
+            'In the browser, register a zstd decoder via registerZstdDecoder ' +
+            '(serialization-format.ts).');
+    }
+    return new Uint8Array(z.zstdDecompressSync(data));
+}
+function recordStats(stats, codec, uncompressedBytes, storedBytes) {
+    if (!stats)
+        return;
+    stats.recorded = true;
+    stats.compressed = codec !== 'none';
+    stats.codec = codec;
+    stats.uncompressedBytes = uncompressedBytes;
+    stats.storedBytes = storedBytes;
+}
+/**
+ * Choose the write-side codec given runtime availability and the optional
+ * env override. zstd is preferred; gzip is the portable fallback.
+ */
+function selectWriteCodec() {
+    const override = codecOverrideFromEnv();
+    if (override === 'gzip')
+        return isGzipAvailable() ? 'gzip' : 'none';
+    // Default and explicit 'zstd' both prefer zstd, then fall back to gzip.
+    if (isZstdAvailable())
+        return 'zstd';
+    if (isGzipAvailable())
+        return 'gzip';
+    return 'none';
+}
+/**
+ * Compress a format-prefixed payload if compression is enabled for the
+ * target run and the payload is worth compressing.
+ *
+ * @param data - The format-prefixed serialized data (e.g. 'devl' + bytes)
+ * @param enabled - Whether the target run supports compressed payloads
+ *   (run specVersion >= SPEC_VERSION_SUPPORTS_COMPRESSION, and for
+ *   cross-deployment writes, the target deployment's capabilities; see
+ *   `getRunCapabilities` in capabilities.ts). zstd and gzip read
+ *   support co-ship, so a single boolean is sufficient.
+ * @param stats - Optional telemetry sink; populated when `data` is binary.
+ * @returns The compressed data with a codec prefix, or the original data
+ *   when compression is disabled, unavailable, or not worthwhile.
+ */
+export async function compress(data, enabled, stats) {
+    if (!(data instanceof Uint8Array))
+        return data;
+    // From here `data` is binary, so every return path records stats.
+    if (!enabled ||
+        data.length < COMPRESSION_MIN_BYTES ||
+        isCompressionDisabledByEnv()) {
+        recordStats(stats, 'none', data.length, data.length);
+        return data;
+    }
+    const codec = selectWriteCodec();
+    if (codec === 'none') {
+        recordStats(stats, 'none', data.length, data.length);
+        return data;
+    }
+    const compressed = codec === 'zstd' ? zstdBytes(data) : await gzipBytes(data);
+    const format = codec === 'zstd' ? SerializationFormat.ZSTD : SerializationFormat.GZIP;
+    const wrappedLength = 4 + compressed.length; // format prefix + payload
+    if (wrappedLength >= data.length * (1 - COMPRESSION_MIN_SAVINGS_RATIO)) {
+        recordStats(stats, 'none', data.length, data.length);
+        return data;
+    }
+    recordStats(stats, codec, data.length, wrappedLength);
+    return encodeWithFormatPrefix(format, compressed);
+}
+/**
+ * Decompress a format-prefixed payload if it's compressed.
+ * Dispatches on the prefix ('zstd' or 'gzip') and inflates the inner
+ * payload (which carries its own format prefix, e.g. 'devl').
+ *
+ * Non-compressed data (including non-binary legacy data) is returned
+ * unchanged, so this is safe to apply unconditionally on read paths.
+ */
+export async function decompress(data, stats) {
+    if (!(data instanceof Uint8Array))
+        return data;
+    const prefix = peekFormatPrefix(data);
+    if (prefix === SerializationFormat.ZSTD) {
+        const { payload } = decodeFormatPrefix(data);
+        const inflated = unzstdBytes(payload);
+        recordStats(stats, 'zstd', inflated.length, data.length);
+        return inflated;
+    }
+    if (prefix === SerializationFormat.GZIP) {
+        if (!isGzipAvailable()) {
+            throw new Error('Compressed (gzip) workflow data encountered but DecompressionStream ' +
+                'is not available in this runtime. Node.js 18+, browsers, and edge ' +
+                'runtimes all support it.');
+        }
+        const { payload } = decodeFormatPrefix(data);
+        const inflated = await gunzipBytes(payload);
+        recordStats(stats, 'gzip', inflated.length, data.length);
+        return inflated;
+    }
+    recordStats(stats, 'none', data.length, data.length);
+    return data;
+}
+/**
+ * Check if data is compressed (has a 'zstd' or 'gzip' format prefix).
+ */
+export function isCompressed(data) {
+    const prefix = peekFormatPrefix(data);
+    return (prefix === SerializationFormat.ZSTD || prefix === SerializationFormat.GZIP);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcHJlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VyaWFsaXphdGlvbi9jb21wcmVzc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBaUNHO0FBRUgsT0FBTyxFQUNMLGtCQUFrQixFQUNsQixzQkFBc0IsRUFDdEIsZ0JBQWdCLEdBQ2pCLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUVqRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxDQUFDO0FBRTFDOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsSUFBSSxDQUFDO0FBRWxELHdFQUF3RTtBQUN4RSxNQUFNLFVBQVUsR0FBRyxDQUFDLENBQUM7QUFLckI7Ozs7R0FJRztBQUNILFNBQVMsMEJBQTBCO0lBQ2pDLElBQUksQ0FBQztRQUNILE9BQU8sQ0FDTCxPQUFPLE9BQU8sS0FBSyxXQUFXO1lBQzlCLE9BQU8sQ0FBQyxHQUFHLEVBQUUsNEJBQTRCLEtBQUssR0FBRyxDQUNsRCxDQUFDO0lBQ0osQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBUyxvQkFBb0I7SUFDM0IsSUFBSSxDQUFDO1FBQ0gsTUFBTSxDQUFDLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSwwQkFBMEIsQ0FBQztRQUNsRCxPQUFPLENBQUMsS0FBSyxNQUFNLElBQUksQ0FBQyxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDO0FBUUQ7Ozs7R0FJRztBQUNILFNBQVMsV0FBVztJQUNsQixJQUFJLENBQUM7UUFDSCxPQUNFLFVBR0QsQ0FBQyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM3QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLGVBQWU7SUFDdEIsTUFBTSxDQUFDLEdBQUcsV0FBVyxFQUFFLENBQUM7SUFDeEIsT0FBTyxDQUNMLE9BQU8sQ0FBQyxFQUFFLGdCQUFnQixLQUFLLFVBQVU7UUFDekMsT0FBTyxDQUFDLEVBQUUsa0JBQWtCLEtBQUssVUFBVSxDQUM1QyxDQUFDO0FBQ0osQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBUyxlQUFlO0lBQ3RCLE9BQU8sQ0FDTCxPQUFPLGlCQUFpQixLQUFLLFVBQVU7UUFDdkMsT0FBTyxtQkFBbUIsS0FBSyxVQUFVLENBQzFDLENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxLQUFLLFVBQVUsb0JBQW9CLENBQ2pDLElBQWdCLEVBQ2hCLFNBR0M7SUFFRCxNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDO0lBQzlDLGlFQUFpRTtJQUNqRSxxRUFBcUU7SUFDckUsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDbkUscUVBQXFFO0lBQ3JFLHVFQUF1RTtJQUN2RSw2Q0FBNkM7SUFDN0MsWUFBWSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztJQUM3QixNQUFNLE1BQU0sR0FBaUIsRUFBRSxDQUFDO0lBQ2hDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDOUMsU0FBUyxDQUFDO1FBQ1IsTUFBTSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUM1QyxJQUFJLElBQUk7WUFBRSxNQUFNO1FBQ2hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkIsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7SUFDeEIsQ0FBQztJQUNELE1BQU0sWUFBWSxDQUFDO0lBQ25CLE1BQU0sR0FBRyxHQUFHLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xDLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztJQUNmLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7UUFDM0IsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7SUFDekIsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQUVELEtBQUssVUFBVSxTQUFTLENBQUMsSUFBZ0I7SUFDdkMsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLEVBQUUsSUFBSSxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBQ25FLENBQUM7QUFFRCxLQUFLLFVBQVUsV0FBVyxDQUFDLElBQWdCO0lBQ3pDLE9BQU8sb0JBQW9CLENBQUMsSUFBSSxFQUFFLElBQUksbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUNyRSxDQUFDO0FBRUQsU0FBUyxTQUFTLENBQUMsSUFBZ0I7SUFDakMsTUFBTSxDQUFDLEdBQUcsV0FBVyxFQUFFLENBQUM7SUFDeEIsTUFBTSxLQUFLLEdBQUcsQ0FBQyxFQUFFLFNBQVMsRUFBRSx1QkFBdUIsQ0FBQztJQUNwRCxNQUFNLElBQUksR0FDUixLQUFLLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3hFLDJFQUEyRTtJQUMzRSxPQUFPLElBQUksVUFBVSxDQUFDLENBQUUsQ0FBQyxnQkFBaUIsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUMxRCxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsSUFBZ0I7SUFDbkMsTUFBTSxDQUFDLEdBQUcsV0FBVyxFQUFFLENBQUM7SUFDeEIsSUFBSSxDQUFDLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQ2IsaUVBQWlFO1lBQy9ELHNFQUFzRTtZQUN0RSxrRUFBa0U7WUFDbEUsNEJBQTRCLENBQy9CLENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUNwRCxDQUFDO0FBOEJELFNBQVMsV0FBVyxDQUNsQixLQUFtQyxFQUNuQyxLQUF1QixFQUN2QixpQkFBeUIsRUFDekIsV0FBbUI7SUFFbkIsSUFBSSxDQUFDLEtBQUs7UUFBRSxPQUFPO0lBQ25CLEtBQUssQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO0lBQ3RCLEtBQUssQ0FBQyxVQUFVLEdBQUcsS0FBSyxLQUFLLE1BQU0sQ0FBQztJQUNwQyxLQUFLLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztJQUNwQixLQUFLLENBQUMsaUJBQWlCLEdBQUcsaUJBQWlCLENBQUM7SUFDNUMsS0FBSyxDQUFDLFdBQVcsR0FBRyxXQUFXLENBQUM7QUFDbEMsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQVMsZ0JBQWdCO0lBQ3ZCLE1BQU0sUUFBUSxHQUFHLG9CQUFvQixFQUFFLENBQUM7SUFDeEMsSUFBSSxRQUFRLEtBQUssTUFBTTtRQUFFLE9BQU8sZUFBZSxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3BFLHdFQUF3RTtJQUN4RSxJQUFJLGVBQWUsRUFBRTtRQUFFLE9BQU8sTUFBTSxDQUFDO0lBQ3JDLElBQUksZUFBZSxFQUFFO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDckMsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLFFBQVEsQ0FDNUIsSUFBMEIsRUFDMUIsT0FBZ0IsRUFDaEIsS0FBd0I7SUFFeEIsSUFBSSxDQUFDLENBQUMsSUFBSSxZQUFZLFVBQVUsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQy9DLGtFQUFrRTtJQUNsRSxJQUNFLENBQUMsT0FBTztRQUNSLElBQUksQ0FBQyxNQUFNLEdBQUcscUJBQXFCO1FBQ25DLDBCQUEwQixFQUFFLEVBQzVCLENBQUM7UUFDRCxXQUFXLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNyRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxnQkFBZ0IsRUFBRSxDQUFDO0lBQ2pDLElBQUksS0FBSyxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3JCLFdBQVcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3JELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLEtBQUssS0FBSyxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDOUUsTUFBTSxNQUFNLEdBQ1YsS0FBSyxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUM7SUFDekUsTUFBTSxhQUFhLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQywwQkFBMEI7SUFDdkUsSUFBSSxhQUFhLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsR0FBRyw2QkFBNkIsQ0FBQyxFQUFFLENBQUM7UUFDdkUsV0FBVyxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDckQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsV0FBVyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxhQUFhLENBQUMsQ0FBQztJQUN0RCxPQUFPLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxVQUFVLENBQUMsQ0FBQztBQUNwRCxDQUFDO0FBRUQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsVUFBVSxDQUM5QixJQUEwQixFQUMxQixLQUF3QjtJQUV4QixJQUFJLENBQUMsQ0FBQyxJQUFJLFlBQVksVUFBVSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDL0MsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdEMsSUFBSSxNQUFNLEtBQUssbUJBQW1CLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEMsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdDLE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN0QyxXQUFXLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6RCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRUQsSUFBSSxNQUFNLEtBQUssbUJBQW1CLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEMsSUFBSSxDQUFDLGVBQWUsRUFBRSxFQUFFLENBQUM7WUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FDYixzRUFBc0U7Z0JBQ3BFLG9FQUFvRTtnQkFDcEUsMEJBQTBCLENBQzdCLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdDLE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFRCxXQUFXLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNyRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRDs7R0FFRztBQUNILE1BQU0sVUFBVSxZQUFZLENBQUMsSUFBMEI7SUFDckQsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdEMsT0FBTyxDQUNMLE1BQU0sS0FBSyxtQkFBbUIsQ0FBQyxJQUFJLElBQUksTUFBTSxLQUFLLG1CQUFtQixDQUFDLElBQUksQ0FDM0UsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIENvbXBvc2FibGUgY29tcHJlc3Npb24gbGF5ZXIgZm9yIHNlcmlhbGl6ZWQgZGF0YS5cbiAqXG4gKiBXcmFwcy91bndyYXBzIHNlcmlhbGl6ZWQgcGF5bG9hZHMgd2l0aCBhIGNvbXByZXNzaW9uIGNvZGVjLCB1c2luZyB0aGVcbiAqIGZvcm1hdCBwcmVmaXggc3lzdGVtIHRvIG1hcmsgY29tcHJlc3NlZCBkYXRhIChlLmcuICd6c3RkJyBvciAnZ3ppcCdcbiAqIHdyYXBwaW5nIHRoZSBpbm5lciBmb3JtYXQ6ICd6c3RkJyArIHpzdGQoJ2RldmwnICsgcGF5bG9hZCkpLlxuICpcbiAqIENvZGVjIHNlbGVjdGlvbiAod3JpdGUgc2lkZSk6IHpzdGQgaXMgcHJlZmVycmVkIGJlY2F1c2UgaXQgaXMgbWFya2VkbHlcbiAqIGZhc3RlciB0aGFuIGd6aXAgYXQgYSBjb21wYXJhYmxlLW9yLWJldHRlciByYXRpbyAoc2VlIHNjcmlwdHMvUkVBRE1FLm1kKSxcbiAqIGFuZCBjb21wcmVzc2lvbiBydW5zIGF0IGV2ZXJ5IHN0ZXAgYm91bmRhcnkgc28gdGhlIHdyaXRlIENQVSBpcyBhXG4gKiBwZXItc3RlcCB0YXguIHpzdGQgcmVxdWlyZXMgYG5vZGU6emxpYmAgPj0gMjIuMTUgKFdlYlxuICogYENvbXByZXNzaW9uU3RyZWFtYCBoYXMgbm8genN0ZCksIHNvIG9uIGEgcnVudGltZSB3aXRob3V0IGl0IHdlIGZhbGwgYmFja1xuICogdG8gZ3ppcCB2aWEgdGhlIHBvcnRhYmxlXG4gKiBgQ29tcHJlc3Npb25TdHJlYW1gLiBgV09SS0ZMT1dfQ09NUFJFU1NJT05fQ09ERUM9Z3ppcGAgZm9yY2VzIHRoZVxuICogcG9ydGFibGUgY29kZWMuXG4gKlxuICogUmVhZCBzaWRlOiBkaXNwYXRjaCBvbiB0aGUgZm9ybWF0IHByZWZpeCwgc28gYm90aCAnenN0ZCcgYW5kICdnemlwJ1xuICogcGF5bG9hZHMgYXJlIGFsd2F5cyBkZWNvZGFibGUgcmVnYXJkbGVzcyBvZiB3aGljaCBjb2RlYyB3cm90ZSB0aGVtLlxuICogKFRoZSBicm93c2VyIG8xMXkgcmVhZCBwYXRoIGRlY29kZXMgenN0ZCB2aWEgYSByZWdpc3RlcmVkIFdBU00gZGVjb2RlcixcbiAqIHNlZSBgc2VyaWFsaXphdGlvbi1mb3JtYXQudHNgOyB0aGlzIG1vZHVsZSdzIGBkZWNvbXByZXNzYCBpcyB0aGUgTm9kZVxuICogcnVudGltZS9yZXBsYXkgcGF0aCBhbmQgdXNlcyBgbm9kZTp6bGliYC4pXG4gKlxuICogTGF5ZXJpbmcgb3JkZXIgd2l0aCBlbmNyeXB0aW9uOiBjb21wcmVzc2lvbiBpcyBhcHBsaWVkIEJFRk9SRVxuICogZW5jcnlwdGlvbiAoZW5jcih6c3RkKGRldmwpKSk6IGVuY3J5cHRlZCBieXRlcyBhcmUgaGlnaC1lbnRyb3B5IGFuZFxuICogZG8gbm90IGNvbXByZXNzLCBzbyB0aGUgcmV2ZXJzZSBvcmRlciB3b3VsZCBiZSBhIG5vLW9wLlxuICpcbiAqIENvbXByZXNzaW9uIGlzIGNvbmRpdGlvbmFsOlxuICogLSBQYXlsb2FkcyBzbWFsbGVyIHRoYW4ge0BsaW5rIENPTVBSRVNTSU9OX01JTl9CWVRFU30gYXJlIHBhc3NlZFxuICogICB0aHJvdWdoIHVuY2hhbmdlZCAoY29kZWMgb3ZlcmhlYWQgaXNuJ3Qgd29ydGggaXQpLlxuICogLSBJZiB0aGUgY29tcHJlc3NlZCByZXN1bHQgaXNuJ3QgbWVhbmluZ2Z1bGx5IHNtYWxsZXIgdGhhbiB0aGVcbiAqICAgb3JpZ2luYWwgKHNlZSB7QGxpbmsgQ09NUFJFU1NJT05fTUlOX1NBVklOR1NfUkFUSU99KSwgdGhlIG9yaWdpbmFsXG4gKiAgIGlzIGtlcHQuIFRoaXMgcHJvdGVjdHMgYWxyZWFkeS1jb21wcmVzc2VkIGJpbmFyeSBwYXlsb2FkcyAoaW1hZ2VzLFxuICogICBhcmNoaXZlcywgZXRjLikgZnJvbSB3YXN0ZWQgQ1BVIGFuZCBzaXplIGluZmxhdGlvbi5cbiAqL1xuXG5pbXBvcnQge1xuICBkZWNvZGVGb3JtYXRQcmVmaXgsXG4gIGVuY29kZVdpdGhGb3JtYXRQcmVmaXgsXG4gIHBlZWtGb3JtYXRQcmVmaXgsXG59IGZyb20gJy4vZm9ybWF0LmpzJztcbmltcG9ydCB7IFNlcmlhbGl6YXRpb25Gb3JtYXQgfSBmcm9tICcuL3R5cGVzLmpzJztcblxuLyoqXG4gKiBQYXlsb2FkcyBiZWxvdyB0aGlzIHNpemUgYXJlIG5ldmVyIGNvbXByZXNzZWQuIFRoZSA0LWJ5dGUgZm9ybWF0XG4gKiBwcmVmaXggKyBjb2RlYyBoZWFkZXIvdHJhaWxlciBvdmVyaGVhZCBtZWFucyBzbWFsbCBwYXlsb2FkcyBnYWluXG4gKiBub3RoaW5nLCBhbmQgdGlueSBvbmVzIHdvdWxkIGdyb3cuXG4gKi9cbmV4cG9ydCBjb25zdCBDT01QUkVTU0lPTl9NSU5fQllURVMgPSAxMDI0O1xuXG4vKipcbiAqIENvbXByZXNzaW9uIG11c3Qgc2hhdmUgb2ZmIGF0IGxlYXN0IHRoaXMgZnJhY3Rpb24gb2YgdGhlIHBheWxvYWRcbiAqIHNpemUgdG8gYmUga2VwdDsgb3RoZXJ3aXNlIHRoZSB1bmNvbXByZXNzZWQgb3JpZ2luYWwgaXMgc3RvcmVkLlxuICogR3VhcmRzIGFnYWluc3QgaW5jb21wcmVzc2libGUgKGFscmVhZHktY29tcHJlc3NlZCAvIGhpZ2gtZW50cm9weSlcbiAqIGRhdGEgcGF5aW5nIGEgcGVybWFuZW50IGRlY29tcHJlc3Npb24gdGF4IGZvciBhIG5lZ2xpZ2libGUgd2luLlxuICovXG5leHBvcnQgY29uc3QgQ09NUFJFU1NJT05fTUlOX1NBVklOR1NfUkFUSU8gPSAwLjA1O1xuXG4vKiogRGVmYXVsdCB6c3RkIGNvbXByZXNzaW9uIGxldmVsOiB0aGUgc3dlZXQgc3BvdCBvZiBzcGVlZCB2cyByYXRpby4gKi9cbmNvbnN0IFpTVERfTEVWRUwgPSAzO1xuXG4vKiogV2hpY2ggY29kZWMgY29tcHJlc3NlZCBhIHBheWxvYWQgKG9yIGBub25lYCB3aGVuIHN0b3JlZCB1bmNvbXByZXNzZWQpLiAqL1xuZXhwb3J0IHR5cGUgQ29tcHJlc3Npb25Db2RlYyA9ICd6c3RkJyB8ICdnemlwJyB8ICdub25lJztcblxuLyoqXG4gKiBFc2NhcGUgaGF0Y2g6IHNldCBXT1JLRkxPV19ESVNBQkxFX0NPTVBSRVNTSU9OPTEgdG8gZGlzYWJsZVxuICogd3JpdGUtc2lkZSBjb21wcmVzc2lvbiBlbnRpcmVseS4gUmVhZHMgYXJlIHVuYWZmZWN0ZWQ6IHBheWxvYWRzXG4gKiB0aGF0IHdlcmUgYWxyZWFkeSB3cml0dGVuIGNvbXByZXNzZWQgcmVtYWluIHJlYWRhYmxlLlxuICovXG5mdW5jdGlvbiBpc0NvbXByZXNzaW9uRGlzYWJsZWRCeUVudigpOiBib29sZWFuIHtcbiAgdHJ5IHtcbiAgICByZXR1cm4gKFxuICAgICAgdHlwZW9mIHByb2Nlc3MgIT09ICd1bmRlZmluZWQnICYmXG4gICAgICBwcm9jZXNzLmVudj8uV09SS0ZMT1dfRElTQUJMRV9DT01QUkVTU0lPTiA9PT0gJzEnXG4gICAgKTtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG59XG5cbi8qKlxuICogT3B0aW9uYWwgY29kZWMgb3ZlcnJpZGUgKGBXT1JLRkxPV19DT01QUkVTU0lPTl9DT0RFQz1nemlwfHpzdGRgKS4gTGV0cyBhblxuICogb3BlcmF0b3IgcGluIHRoZSBwb3J0YWJsZSBjb2RlYyAoZ3ppcCksIHVzZWZ1bCBmb3IgQS9CIGNvbXBhcmlzb25zIG9yXG4gKiBydW50aW1lcyB3aGVyZSB6c3RkIHJlYWQgc3VwcG9ydCBpc24ndCB5ZXQgZXZlcnl3aGVyZS5cbiAqL1xuZnVuY3Rpb24gY29kZWNPdmVycmlkZUZyb21FbnYoKTogJ2d6aXAnIHwgJ3pzdGQnIHwgdW5kZWZpbmVkIHtcbiAgdHJ5IHtcbiAgICBjb25zdCB2ID0gcHJvY2Vzcy5lbnY/LldPUktGTE9XX0NPTVBSRVNTSU9OX0NPREVDO1xuICAgIHJldHVybiB2ID09PSAnZ3ppcCcgfHwgdiA9PT0gJ3pzdGQnID8gdiA6IHVuZGVmaW5lZDtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuXG5pbnRlcmZhY2UgTm9kZVpsaWIge1xuICB6c3RkQ29tcHJlc3NTeW5jPzogKGRhdGE6IFVpbnQ4QXJyYXksIG9wdHM/OiB1bmtub3duKSA9PiBVaW50OEFycmF5O1xuICB6c3RkRGVjb21wcmVzc1N5bmM/OiAoZGF0YTogVWludDhBcnJheSkgPT4gVWludDhBcnJheTtcbiAgY29uc3RhbnRzPzogUmVjb3JkPHN0cmluZywgbnVtYmVyPjtcbn1cblxuLyoqXG4gKiBSZXNvbHZlIGBub2RlOnpsaWJgIHZpYSBgcHJvY2Vzcy5nZXRCdWlsdGluTW9kdWxlYDogbm8gc3RhdGljIGltcG9ydCwgc29cbiAqIHRoaXMgbW9kdWxlIHN0YXlzIGJ1bmRsZXItc2FmZSBmb3IgYnJvd3Nlci9lZGdlIHRhcmdldHMgKHdoZXJlIGl0IHJldHVybnNcbiAqIHVuZGVmaW5lZCBhbmQgd2UgZmFsbCBiYWNrIHRvIGd6aXApLlxuICovXG5mdW5jdGlvbiBnZXROb2RlWmxpYigpOiBOb2RlWmxpYiB8IHVuZGVmaW5lZCB7XG4gIHRyeSB7XG4gICAgcmV0dXJuIChcbiAgICAgIGdsb2JhbFRoaXMgYXMge1xuICAgICAgICBwcm9jZXNzPzogeyBnZXRCdWlsdGluTW9kdWxlPzogKGlkOiBzdHJpbmcpID0+IE5vZGVabGliIH07XG4gICAgICB9XG4gICAgKS5wcm9jZXNzPy5nZXRCdWlsdGluTW9kdWxlPy4oJ25vZGU6emxpYicpO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gdW5kZWZpbmVkO1xuICB9XG59XG5cbmZ1bmN0aW9uIGlzWnN0ZEF2YWlsYWJsZSgpOiBib29sZWFuIHtcbiAgY29uc3QgeiA9IGdldE5vZGVabGliKCk7XG4gIHJldHVybiAoXG4gICAgdHlwZW9mIHo/LnpzdGRDb21wcmVzc1N5bmMgPT09ICdmdW5jdGlvbicgJiZcbiAgICB0eXBlb2Ygej8uenN0ZERlY29tcHJlc3NTeW5jID09PSAnZnVuY3Rpb24nXG4gICk7XG59XG5cbi8qKlxuICogZ3ppcCB2aWEgdGhlIHdlYi1zdGFuZGFyZCBgQ29tcHJlc3Npb25TdHJlYW1gIChOb2RlIDE4KywgYnJvd3NlcnMsIGVkZ2UpLlxuICovXG5mdW5jdGlvbiBpc0d6aXBBdmFpbGFibGUoKTogYm9vbGVhbiB7XG4gIHJldHVybiAoXG4gICAgdHlwZW9mIENvbXByZXNzaW9uU3RyZWFtID09PSAnZnVuY3Rpb24nICYmXG4gICAgdHlwZW9mIERlY29tcHJlc3Npb25TdHJlYW0gPT09ICdmdW5jdGlvbidcbiAgKTtcbn1cblxuLyoqXG4gKiBQaXBlIGJ5dGVzIHRocm91Z2ggYSAoRGUpQ29tcHJlc3Npb25TdHJlYW0gYW5kIGNvbGxlY3QgdGhlIG91dHB1dC5cbiAqL1xuYXN5bmMgZnVuY3Rpb24gcGlwZVRocm91Z2hUcmFuc2Zvcm0oXG4gIGRhdGE6IFVpbnQ4QXJyYXksXG4gIHRyYW5zZm9ybToge1xuICAgIHJlYWRhYmxlOiBSZWFkYWJsZVN0cmVhbTxVaW50OEFycmF5PjtcbiAgICB3cml0YWJsZTogV3JpdGFibGVTdHJlYW08VWludDhBcnJheT47XG4gIH1cbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICBjb25zdCB3cml0ZXIgPSB0cmFuc2Zvcm0ud3JpdGFibGUuZ2V0V3JpdGVyKCk7XG4gIC8vIERvbid0IGF3YWl0IHRoZSB3cml0ZSBiZWZvcmUgcmVhZGluZzogdGhlIHRyYW5zZm9ybSdzIGludGVybmFsXG4gIC8vIHF1ZXVlIGNhbiBmaWxsIHVwIG9uIGxhcmdlIHBheWxvYWRzLCBkZWFkbG9ja2luZyB3cml0ZXIgdnMgcmVhZGVyLlxuICBjb25zdCB3cml0ZVByb21pc2UgPSB3cml0ZXIud3JpdGUoZGF0YSkudGhlbigoKSA9PiB3cml0ZXIuY2xvc2UoKSk7XG4gIC8vIElmIHRoZSB0cmFuc2Zvcm0gZXJyb3JzLCB0aGUgcmVhZGVyLnJlYWQoKSBiZWxvdyByZWplY3RzIGZpcnN0IGFuZFxuICAvLyBwcm9wYWdhdGVzOyBtYXJrIHRoZSB3cml0ZSBzaWRlIGFzIGhhbmRsZWQgc28gdGhlIG1pcnJvcmVkIHJlamVjdGlvblxuICAvLyBkb2Vzbid0IHN1cmZhY2UgYXMgYW4gdW5oYW5kbGVkIHJlamVjdGlvbi5cbiAgd3JpdGVQcm9taXNlLmNhdGNoKCgpID0+IHt9KTtcbiAgY29uc3QgY2h1bmtzOiBVaW50OEFycmF5W10gPSBbXTtcbiAgbGV0IHRvdGFsID0gMDtcbiAgY29uc3QgcmVhZGVyID0gdHJhbnNmb3JtLnJlYWRhYmxlLmdldFJlYWRlcigpO1xuICBmb3IgKDs7KSB7XG4gICAgY29uc3QgeyBkb25lLCB2YWx1ZSB9ID0gYXdhaXQgcmVhZGVyLnJlYWQoKTtcbiAgICBpZiAoZG9uZSkgYnJlYWs7XG4gICAgY2h1bmtzLnB1c2godmFsdWUpO1xuICAgIHRvdGFsICs9IHZhbHVlLmxlbmd0aDtcbiAgfVxuICBhd2FpdCB3cml0ZVByb21pc2U7XG4gIGNvbnN0IG91dCA9IG5ldyBVaW50OEFycmF5KHRvdGFsKTtcbiAgbGV0IG9mZnNldCA9IDA7XG4gIGZvciAoY29uc3QgY2h1bmsgb2YgY2h1bmtzKSB7XG4gICAgb3V0LnNldChjaHVuaywgb2Zmc2V0KTtcbiAgICBvZmZzZXQgKz0gY2h1bmsubGVuZ3RoO1xuICB9XG4gIHJldHVybiBvdXQ7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIGd6aXBCeXRlcyhkYXRhOiBVaW50OEFycmF5KTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gIHJldHVybiBwaXBlVGhyb3VnaFRyYW5zZm9ybShkYXRhLCBuZXcgQ29tcHJlc3Npb25TdHJlYW0oJ2d6aXAnKSk7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIGd1bnppcEJ5dGVzKGRhdGE6IFVpbnQ4QXJyYXkpOiBQcm9taXNlPFVpbnQ4QXJyYXk+IHtcbiAgcmV0dXJuIHBpcGVUaHJvdWdoVHJhbnNmb3JtKGRhdGEsIG5ldyBEZWNvbXByZXNzaW9uU3RyZWFtKCdnemlwJykpO1xufVxuXG5mdW5jdGlvbiB6c3RkQnl0ZXMoZGF0YTogVWludDhBcnJheSk6IFVpbnQ4QXJyYXkge1xuICBjb25zdCB6ID0gZ2V0Tm9kZVpsaWIoKTtcbiAgY29uc3QgbGV2ZWwgPSB6Py5jb25zdGFudHM/LlpTVERfY19jb21wcmVzc2lvbkxldmVsO1xuICBjb25zdCBvcHRzID1cbiAgICBsZXZlbCAhPT0gdW5kZWZpbmVkID8geyBwYXJhbXM6IHsgW2xldmVsXTogWlNURF9MRVZFTCB9IH0gOiB1bmRlZmluZWQ7XG4gIC8vIGJpb21lLWlnbm9yZSBsaW50L3N0eWxlL25vTm9uTnVsbEFzc2VydGlvbjogZ3VhcmRlZCBieSBpc1pzdGRBdmFpbGFibGUoKVxuICByZXR1cm4gbmV3IFVpbnQ4QXJyYXkoeiEuenN0ZENvbXByZXNzU3luYyEoZGF0YSwgb3B0cykpO1xufVxuXG5mdW5jdGlvbiB1bnpzdGRCeXRlcyhkYXRhOiBVaW50OEFycmF5KTogVWludDhBcnJheSB7XG4gIGNvbnN0IHogPSBnZXROb2RlWmxpYigpO1xuICBpZiAoIXo/LnpzdGREZWNvbXByZXNzU3luYykge1xuICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICdDb21wcmVzc2VkICh6c3RkKSB3b3JrZmxvdyBkYXRhIGVuY291bnRlcmVkIGJ1dCBub2RlOnpsaWIgenN0ZCAnICtcbiAgICAgICAgJ3N1cHBvcnQgaXMgbm90IGF2YWlsYWJsZSBpbiB0aGlzIHJ1bnRpbWUgKHJlcXVpcmVzIE5vZGUuanMgMjIuMTUrKS4gJyArXG4gICAgICAgICdJbiB0aGUgYnJvd3NlciwgcmVnaXN0ZXIgYSB6c3RkIGRlY29kZXIgdmlhIHJlZ2lzdGVyWnN0ZERlY29kZXIgJyArXG4gICAgICAgICcoc2VyaWFsaXphdGlvbi1mb3JtYXQudHMpLidcbiAgICApO1xuICB9XG4gIHJldHVybiBuZXcgVWludDhBcnJheSh6LnpzdGREZWNvbXByZXNzU3luYyhkYXRhKSk7XG59XG5cbi8qKlxuICogVGVsZW1ldHJ5IHNpbmsgZGVzY3JpYmluZyB3aGF0IHRoZSBjb21wcmVzc2lvbiBsYXllciBkaWQgdG8gYSBwYXlsb2FkLlxuICogUG9wdWxhdGVkIGJ5IHtAbGluayBjb21wcmVzc30gKHdyaXRlKSBhbmQge0BsaW5rIGRlY29tcHJlc3N9IChyZWFkKSB3aGVuXG4gKiBhIGBzdGF0c2Agb2JqZWN0IGlzIHBhc3NlZC4gU2l6ZXMgYXJlIG1lYXN1cmVkIGF0IHRoZSBjb21wcmVzc2lvblxuICogYm91bmRhcnkgKGkuZS4gYmVmb3JlIGVuY3J5cHRpb24gaXMgbGF5ZXJlZCBvbiB0aGUgd3JpdGUgc2lkZSBhbmQgYWZ0ZXJcbiAqIGRlY3J5cHRpb24gb24gdGhlIHJlYWQgc2lkZSksIHNvIHRoZXkgcmVmbGVjdCBjb21wcmVzc2lvbidzIGVmZmVjdCwgbm90XG4gKiB0aGUgYXQtcmVzdCBzaXplICh3aGljaCBhbHNvIGluY2x1ZGVzIHRoZSBgZW5jcmAgZW52ZWxvcGUgYW5kLCBvbiBzb21lXG4gKiBiYWNrZW5kcywgYmFzZTY0IGV4cGFuc2lvbikuXG4gKlxuICogRmllbGQgbWVhbmluZ3MgYXJlIGlkZW50aWNhbCBmb3IgYm90aCBkaXJlY3Rpb25zOlxuICogLSBgdW5jb21wcmVzc2VkQnl0ZXNgOiB0aGUgbG9naWNhbCAoZGV2YWx1ZS1wcmVmaXhlZCkgcGF5bG9hZCBzaXplLlxuICogLSBgc3RvcmVkQnl0ZXNgOiB0aGUgc2l6ZSBoYW5kZWQgdG8gLyByZWFkIGZyb20gc3RvcmFnZSAoY29tcHJlc3NlZCB3aGVuXG4gKiAgIGEgY29kZWMgYXBwbGllZCwgb3RoZXJ3aXNlIGVxdWFsIHRvIGB1bmNvbXByZXNzZWRCeXRlc2ApLlxuICogLSBgY29kZWNgOiB3aGljaCBjb2RlYyBhcHBsaWVkIChgbm9uZWAgd2hlbiBzdG9yZWQgdW5jb21wcmVzc2VkKS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDb21wcmVzc2lvblN0YXRzIHtcbiAgLyoqIFRydWUgb25jZSB0aGUgY29tcHJlc3Npb24gbGF5ZXIgcmFuIChpLmUuIHNhdyBiaW5hcnkgZGF0YSkuICovXG4gIHJlY29yZGVkPzogYm9vbGVhbjtcbiAgLyoqIFdoZXRoZXIgYSBjb2RlYyB3YXMgYXBwbGllZCAod3JpdGUpIG9yIHByZXNlbnQgKHJlYWQpLiAqL1xuICBjb21wcmVzc2VkPzogYm9vbGVhbjtcbiAgLyoqIFdoaWNoIGNvZGVjIGFwcGxpZWQgLyB3YXMgcHJlc2VudC4gKi9cbiAgY29kZWM/OiBDb21wcmVzc2lvbkNvZGVjO1xuICAvKiogTG9naWNhbCwgdW5jb21wcmVzc2VkIHBheWxvYWQgc2l6ZSBpbiBieXRlcy4gKi9cbiAgdW5jb21wcmVzc2VkQnl0ZXM/OiBudW1iZXI7XG4gIC8qKiBTdG9yZWQgKHBvc3QtY29tcHJlc3Npb24pIHBheWxvYWQgc2l6ZSBpbiBieXRlcy4gKi9cbiAgc3RvcmVkQnl0ZXM/OiBudW1iZXI7XG59XG5cbmZ1bmN0aW9uIHJlY29yZFN0YXRzKFxuICBzdGF0czogQ29tcHJlc3Npb25TdGF0cyB8IHVuZGVmaW5lZCxcbiAgY29kZWM6IENvbXByZXNzaW9uQ29kZWMsXG4gIHVuY29tcHJlc3NlZEJ5dGVzOiBudW1iZXIsXG4gIHN0b3JlZEJ5dGVzOiBudW1iZXJcbik6IHZvaWQge1xuICBpZiAoIXN0YXRzKSByZXR1cm47XG4gIHN0YXRzLnJlY29yZGVkID0gdHJ1ZTtcbiAgc3RhdHMuY29tcHJlc3NlZCA9IGNvZGVjICE9PSAnbm9uZSc7XG4gIHN0YXRzLmNvZGVjID0gY29kZWM7XG4gIHN0YXRzLnVuY29tcHJlc3NlZEJ5dGVzID0gdW5jb21wcmVzc2VkQnl0ZXM7XG4gIHN0YXRzLnN0b3JlZEJ5dGVzID0gc3RvcmVkQnl0ZXM7XG59XG5cbi8qKlxuICogQ2hvb3NlIHRoZSB3cml0ZS1zaWRlIGNvZGVjIGdpdmVuIHJ1bnRpbWUgYXZhaWxhYmlsaXR5IGFuZCB0aGUgb3B0aW9uYWxcbiAqIGVudiBvdmVycmlkZS4genN0ZCBpcyBwcmVmZXJyZWQ7IGd6aXAgaXMgdGhlIHBvcnRhYmxlIGZhbGxiYWNrLlxuICovXG5mdW5jdGlvbiBzZWxlY3RXcml0ZUNvZGVjKCk6ICd6c3RkJyB8ICdnemlwJyB8ICdub25lJyB7XG4gIGNvbnN0IG92ZXJyaWRlID0gY29kZWNPdmVycmlkZUZyb21FbnYoKTtcbiAgaWYgKG92ZXJyaWRlID09PSAnZ3ppcCcpIHJldHVybiBpc0d6aXBBdmFpbGFibGUoKSA/ICdnemlwJyA6ICdub25lJztcbiAgLy8gRGVmYXVsdCBhbmQgZXhwbGljaXQgJ3pzdGQnIGJvdGggcHJlZmVyIHpzdGQsIHRoZW4gZmFsbCBiYWNrIHRvIGd6aXAuXG4gIGlmIChpc1pzdGRBdmFpbGFibGUoKSkgcmV0dXJuICd6c3RkJztcbiAgaWYgKGlzR3ppcEF2YWlsYWJsZSgpKSByZXR1cm4gJ2d6aXAnO1xuICByZXR1cm4gJ25vbmUnO1xufVxuXG4vKipcbiAqIENvbXByZXNzIGEgZm9ybWF0LXByZWZpeGVkIHBheWxvYWQgaWYgY29tcHJlc3Npb24gaXMgZW5hYmxlZCBmb3IgdGhlXG4gKiB0YXJnZXQgcnVuIGFuZCB0aGUgcGF5bG9hZCBpcyB3b3J0aCBjb21wcmVzc2luZy5cbiAqXG4gKiBAcGFyYW0gZGF0YSAtIFRoZSBmb3JtYXQtcHJlZml4ZWQgc2VyaWFsaXplZCBkYXRhIChlLmcuICdkZXZsJyArIGJ5dGVzKVxuICogQHBhcmFtIGVuYWJsZWQgLSBXaGV0aGVyIHRoZSB0YXJnZXQgcnVuIHN1cHBvcnRzIGNvbXByZXNzZWQgcGF5bG9hZHNcbiAqICAgKHJ1biBzcGVjVmVyc2lvbiA+PSBTUEVDX1ZFUlNJT05fU1VQUE9SVFNfQ09NUFJFU1NJT04sIGFuZCBmb3JcbiAqICAgY3Jvc3MtZGVwbG95bWVudCB3cml0ZXMsIHRoZSB0YXJnZXQgZGVwbG95bWVudCdzIGNhcGFiaWxpdGllczsgc2VlXG4gKiAgIGBnZXRSdW5DYXBhYmlsaXRpZXNgIGluIGNhcGFiaWxpdGllcy50cykuIHpzdGQgYW5kIGd6aXAgcmVhZFxuICogICBzdXBwb3J0IGNvLXNoaXAsIHNvIGEgc2luZ2xlIGJvb2xlYW4gaXMgc3VmZmljaWVudC5cbiAqIEBwYXJhbSBzdGF0cyAtIE9wdGlvbmFsIHRlbGVtZXRyeSBzaW5rOyBwb3B1bGF0ZWQgd2hlbiBgZGF0YWAgaXMgYmluYXJ5LlxuICogQHJldHVybnMgVGhlIGNvbXByZXNzZWQgZGF0YSB3aXRoIGEgY29kZWMgcHJlZml4LCBvciB0aGUgb3JpZ2luYWwgZGF0YVxuICogICB3aGVuIGNvbXByZXNzaW9uIGlzIGRpc2FibGVkLCB1bmF2YWlsYWJsZSwgb3Igbm90IHdvcnRod2hpbGUuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBjb21wcmVzcyhcbiAgZGF0YTogVWludDhBcnJheSB8IHVua25vd24sXG4gIGVuYWJsZWQ6IGJvb2xlYW4sXG4gIHN0YXRzPzogQ29tcHJlc3Npb25TdGF0c1xuKTogUHJvbWlzZTxVaW50OEFycmF5IHwgdW5rbm93bj4ge1xuICBpZiAoIShkYXRhIGluc3RhbmNlb2YgVWludDhBcnJheSkpIHJldHVybiBkYXRhO1xuICAvLyBGcm9tIGhlcmUgYGRhdGFgIGlzIGJpbmFyeSwgc28gZXZlcnkgcmV0dXJuIHBhdGggcmVjb3JkcyBzdGF0cy5cbiAgaWYgKFxuICAgICFlbmFibGVkIHx8XG4gICAgZGF0YS5sZW5ndGggPCBDT01QUkVTU0lPTl9NSU5fQllURVMgfHxcbiAgICBpc0NvbXByZXNzaW9uRGlzYWJsZWRCeUVudigpXG4gICkge1xuICAgIHJlY29yZFN0YXRzKHN0YXRzLCAnbm9uZScsIGRhdGEubGVuZ3RoLCBkYXRhLmxlbmd0aCk7XG4gICAgcmV0dXJuIGRhdGE7XG4gIH1cblxuICBjb25zdCBjb2RlYyA9IHNlbGVjdFdyaXRlQ29kZWMoKTtcbiAgaWYgKGNvZGVjID09PSAnbm9uZScpIHtcbiAgICByZWNvcmRTdGF0cyhzdGF0cywgJ25vbmUnLCBkYXRhLmxlbmd0aCwgZGF0YS5sZW5ndGgpO1xuICAgIHJldHVybiBkYXRhO1xuICB9XG5cbiAgY29uc3QgY29tcHJlc3NlZCA9IGNvZGVjID09PSAnenN0ZCcgPyB6c3RkQnl0ZXMoZGF0YSkgOiBhd2FpdCBnemlwQnl0ZXMoZGF0YSk7XG4gIGNvbnN0IGZvcm1hdCA9XG4gICAgY29kZWMgPT09ICd6c3RkJyA/IFNlcmlhbGl6YXRpb25Gb3JtYXQuWlNURCA6IFNlcmlhbGl6YXRpb25Gb3JtYXQuR1pJUDtcbiAgY29uc3Qgd3JhcHBlZExlbmd0aCA9IDQgKyBjb21wcmVzc2VkLmxlbmd0aDsgLy8gZm9ybWF0IHByZWZpeCArIHBheWxvYWRcbiAgaWYgKHdyYXBwZWRMZW5ndGggPj0gZGF0YS5sZW5ndGggKiAoMSAtIENPTVBSRVNTSU9OX01JTl9TQVZJTkdTX1JBVElPKSkge1xuICAgIHJlY29yZFN0YXRzKHN0YXRzLCAnbm9uZScsIGRhdGEubGVuZ3RoLCBkYXRhLmxlbmd0aCk7XG4gICAgcmV0dXJuIGRhdGE7XG4gIH1cbiAgcmVjb3JkU3RhdHMoc3RhdHMsIGNvZGVjLCBkYXRhLmxlbmd0aCwgd3JhcHBlZExlbmd0aCk7XG4gIHJldHVybiBlbmNvZGVXaXRoRm9ybWF0UHJlZml4KGZvcm1hdCwgY29tcHJlc3NlZCk7XG59XG5cbi8qKlxuICogRGVjb21wcmVzcyBhIGZvcm1hdC1wcmVmaXhlZCBwYXlsb2FkIGlmIGl0J3MgY29tcHJlc3NlZC5cbiAqIERpc3BhdGNoZXMgb24gdGhlIHByZWZpeCAoJ3pzdGQnIG9yICdnemlwJykgYW5kIGluZmxhdGVzIHRoZSBpbm5lclxuICogcGF5bG9hZCAod2hpY2ggY2FycmllcyBpdHMgb3duIGZvcm1hdCBwcmVmaXgsIGUuZy4gJ2RldmwnKS5cbiAqXG4gKiBOb24tY29tcHJlc3NlZCBkYXRhIChpbmNsdWRpbmcgbm9uLWJpbmFyeSBsZWdhY3kgZGF0YSkgaXMgcmV0dXJuZWRcbiAqIHVuY2hhbmdlZCwgc28gdGhpcyBpcyBzYWZlIHRvIGFwcGx5IHVuY29uZGl0aW9uYWxseSBvbiByZWFkIHBhdGhzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZGVjb21wcmVzcyhcbiAgZGF0YTogVWludDhBcnJheSB8IHVua25vd24sXG4gIHN0YXRzPzogQ29tcHJlc3Npb25TdGF0c1xuKTogUHJvbWlzZTxVaW50OEFycmF5IHwgdW5rbm93bj4ge1xuICBpZiAoIShkYXRhIGluc3RhbmNlb2YgVWludDhBcnJheSkpIHJldHVybiBkYXRhO1xuICBjb25zdCBwcmVmaXggPSBwZWVrRm9ybWF0UHJlZml4KGRhdGEpO1xuXG4gIGlmIChwcmVmaXggPT09IFNlcmlhbGl6YXRpb25Gb3JtYXQuWlNURCkge1xuICAgIGNvbnN0IHsgcGF5bG9hZCB9ID0gZGVjb2RlRm9ybWF0UHJlZml4KGRhdGEpO1xuICAgIGNvbnN0IGluZmxhdGVkID0gdW56c3RkQnl0ZXMocGF5bG9hZCk7XG4gICAgcmVjb3JkU3RhdHMoc3RhdHMsICd6c3RkJywgaW5mbGF0ZWQubGVuZ3RoLCBkYXRhLmxlbmd0aCk7XG4gICAgcmV0dXJuIGluZmxhdGVkO1xuICB9XG5cbiAgaWYgKHByZWZpeCA9PT0gU2VyaWFsaXphdGlvbkZvcm1hdC5HWklQKSB7XG4gICAgaWYgKCFpc0d6aXBBdmFpbGFibGUoKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAnQ29tcHJlc3NlZCAoZ3ppcCkgd29ya2Zsb3cgZGF0YSBlbmNvdW50ZXJlZCBidXQgRGVjb21wcmVzc2lvblN0cmVhbSAnICtcbiAgICAgICAgICAnaXMgbm90IGF2YWlsYWJsZSBpbiB0aGlzIHJ1bnRpbWUuIE5vZGUuanMgMTgrLCBicm93c2VycywgYW5kIGVkZ2UgJyArXG4gICAgICAgICAgJ3J1bnRpbWVzIGFsbCBzdXBwb3J0IGl0LidcbiAgICAgICk7XG4gICAgfVxuICAgIGNvbnN0IHsgcGF5bG9hZCB9ID0gZGVjb2RlRm9ybWF0UHJlZml4KGRhdGEpO1xuICAgIGNvbnN0IGluZmxhdGVkID0gYXdhaXQgZ3VuemlwQnl0ZXMocGF5bG9hZCk7XG4gICAgcmVjb3JkU3RhdHMoc3RhdHMsICdnemlwJywgaW5mbGF0ZWQubGVuZ3RoLCBkYXRhLmxlbmd0aCk7XG4gICAgcmV0dXJuIGluZmxhdGVkO1xuICB9XG5cbiAgcmVjb3JkU3RhdHMoc3RhdHMsICdub25lJywgZGF0YS5sZW5ndGgsIGRhdGEubGVuZ3RoKTtcbiAgcmV0dXJuIGRhdGE7XG59XG5cbi8qKlxuICogQ2hlY2sgaWYgZGF0YSBpcyBjb21wcmVzc2VkIChoYXMgYSAnenN0ZCcgb3IgJ2d6aXAnIGZvcm1hdCBwcmVmaXgpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNDb21wcmVzc2VkKGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duKTogYm9vbGVhbiB7XG4gIGNvbnN0IHByZWZpeCA9IHBlZWtGb3JtYXRQcmVmaXgoZGF0YSk7XG4gIHJldHVybiAoXG4gICAgcHJlZml4ID09PSBTZXJpYWxpemF0aW9uRm9ybWF0LlpTVEQgfHwgcHJlZml4ID09PSBTZXJpYWxpemF0aW9uRm9ybWF0LkdaSVBcbiAgKTtcbn1cbiJdfQ==

package/dist/serialization/encryption.d.ts

@@ -1,32 +1,134 @@
 /**
  * Composable encryption layer for serialized data.
  *
- * Wraps/unwraps serialized payloads with AES-256-GCM encryption,
- * using the format prefix system to mark encrypted data.
+ * Wraps/unwraps serialized payloads with either symmetric AES-256-GCM
+ * encryption (`encr`) or an asymmetric sealed box (`encp`), using the format
+ * prefix system to mark which. See {@link PayloadKey} for how a caller
+ * declares which capabilities it holds.
  */
 import { type CryptoKey } from '../encryption.js';
-export type { CryptoKey };
+import { type RunKeyPair } from '../sealed-box.js';
+export type { CryptoKey, RunKeyPair };
+/**
+ * Brands distinguishing the structured key variants from a bare `CryptoKey`.
+ *
+ * `Symbol.for` rather than `Symbol()` because these values cross realm
+ * boundaries (host ↔ workflow VM), and the global symbol registry is shared
+ * across realms while unique symbols are not.
+ */
+declare const SEAL_TARGET_BRAND: unique symbol;
+declare const RUN_KEYS_BRAND: unique symbol;
+/**
+ * A write-only capability: seal payloads to a run's X25519 public key.
+ *
+ * This is what a *cross-run* writer holds: a hook resumption targeting
+ * another run, or a child workflow writing into a parent's forwarded stream.
+ * It carries no ability to decrypt anything, and because it is a distinct
+ * nominal type it cannot be mistaken for symmetric key material.
+ *
+ * That last property matters more than it looks: a raw 32-byte X25519 public
+ * key is a *structurally valid* AES-256 key, so handing one to
+ * `importKey(..., 'AES-GCM')` succeeds and silently produces ciphertext that
+ * nobody can ever open. Routing public keys exclusively through
+ * {@link sealTo} makes that mistake unrepresentable rather than merely
+ * discouraged.
+ */
+export interface SealTarget {
+    readonly [SEAL_TARGET_BRAND]: true;
+    /** The recipient run's raw 32-byte X25519 public key. */
+    readonly recipientPublicKey: Uint8Array;
+    /** Additional authenticated data binding the payload to the recipient run. */
+    readonly aad?: Uint8Array;
+}
+/**
+ * The full key capability of a run's *own* runtime (and of o11y tooling
+ * acting on its behalf): the symmetric key for its own payloads, plus the
+ * keypair needed to open sealed payloads that other runs wrote to it.
+ */
+export interface RunPayloadKeys {
+    readonly [RUN_KEYS_BRAND]: true;
+    /** Symmetric AES-256-GCM key: the run's own `encr` payloads. */
+    readonly aes: CryptoKey;
+    /** X25519 keypair: opens `encp` payloads sealed to this run. */
+    readonly keyPair: RunKeyPair;
+    /** Additional authenticated data expected on sealed payloads. */
+    readonly aad?: Uint8Array;
+}
+/**
+ * A resolved key for reading or writing a serialized payload.
+ *
+ * The bare `CryptoKey` variant is the historical shape and remains valid: it
+ * means "symmetric only", which is exactly right for a run that predates
+ * sealed boxes or for any same-run payload. The structured variants are
+ * additive:
+ *
+ * | Variant            | Writes  | Reads          | Held by                  |
+ * | ------------------ | ------- | -------------- | ------------------------ |
+ * | `CryptoKey`        | `encr`  | `encr`         | same-run (legacy shape)  |
+ * | {@link RunPayloadKeys} | `encr`  | `encr`, `encp` | the owning run, o11y     |
+ * | {@link SealTarget} | `encp`  | (none)         | cross-run writers        |
+ *
+ * A run's own payloads deliberately stay symmetric even when the writer could
+ * seal: sealing costs a fresh ECDH per envelope and 32 extra bytes, and buys
+ * nothing when the writer already holds the decryption key.
+ */
+export type PayloadKey = CryptoKey | SealTarget | RunPayloadKeys;
+/**
+ * The subset of {@link PayloadKey} that can actually *read* a payload.
+ *
+ * Excludes {@link SealTarget}, which is write-only by construction: it holds a
+ * public key, so it can open neither `encp` (needs the private scalar) nor
+ * `encr` (needs the symmetric key). Decrypt-side signatures should take this
+ * rather than `PayloadKey`, so passing a seal target is a compile error instead
+ * of a guaranteed runtime failure.
+ */
+export type DecryptionKey = CryptoKey | RunPayloadKeys;
+/**
+ * Build a write-only seal capability for a recipient run's public key.
+ *
+ * @param recipientPublicKey - The recipient run's raw 32-byte X25519 public key
+ * @param aad - Additional authenticated data, conventionally `runAad(projectId, runId)`
+ */
+export declare function sealTo(recipientPublicKey: Uint8Array, aad?: Uint8Array): SealTarget;
+/**
+ * Bundle a run's symmetric key with the keypair that opens payloads sealed
+ * to it.
+ */
+export declare function runPayloadKeys(aes: CryptoKey, keyPair: RunKeyPair, aad?: Uint8Array): RunPayloadKeys;
+/**
+ * Build the full key capability for a run from its raw 32-byte key material,
+ * the value `World.getEncryptionKeyForRun()` returns.
+ *
+ * Use this anywhere a run reads its own event log: it yields a key that opens
+ * both its own symmetric (`encr`) payloads and sealed (`encp`) payloads other
+ * runs wrote to it. Resolving only `importKey(material)` would leave the
+ * reader unable to open sealed writes.
+ */
+export declare function deriveRunPayloadKeys(runKeyMaterial: Uint8Array): Promise<RunPayloadKeys>;
+export declare function isSealTarget(value: unknown): value is SealTarget;
+export declare function isRunPayloadKeys(value: unknown): value is RunPayloadKeys;
+/**
+ * The symmetric key to use for `encr` operations, or undefined when this key
+ * has no symmetric capability (i.e. it is a seal-only target).
+ */
+export declare function aesKeyOf(key: PayloadKey | undefined): CryptoKey | undefined;
 /**
  * Encryption key parameter type. Accepts a resolved key, undefined (no encryption),
- * or a promise that resolves to either.
+ * a promise, or a resolver that can defer fetching the key until data needs it.
  */
-export type EncryptionKeyParam = CryptoKey | undefined | Promise<CryptoKey | undefined>;
+export type EncryptionKeyParam = PayloadKey | undefined | Promise<PayloadKey | undefined> | (() => Promise<PayloadKey | undefined>);
+export declare function resolveEncryptionKey(key: EncryptionKeyParam): Promise<PayloadKey | undefined>;
 /**
  * Encrypt a format-prefixed payload if a key is provided.
- * Wraps the data with the 'encr' format prefix.
+ *
+ * Wraps the data with the `encr` prefix for symmetric keys, or the `encp`
+ * prefix when handed a {@link SealTarget}, a cross-run writer that holds
+ * only the recipient's public key.
  *
  * @param data - The format-prefixed serialized data
  * @param key - Encryption key (undefined to skip encryption)
- * @returns The encrypted data with 'encr' prefix, or the original data if no key
- */
-export declare function encrypt(data: Uint8Array | unknown, key: CryptoKey | undefined): Promise<Uint8Array | unknown>;
-/**
- * Decrypt a format-prefixed payload if it's encrypted.
- * Strips the 'encr' format prefix and decrypts the inner payload.
- *
- * @param data - The potentially encrypted data
- * @param key - Encryption key (undefined to skip decryption)
- * @returns The decrypted inner payload, or the original data if not encrypted
+ * @returns The encrypted data with its format prefix, or the original data if no key
  */
-export declare function decrypt(data: Uint8Array | unknown, key: CryptoKey | undefined): Promise<Uint8Array | unknown>;
+export declare function encrypt(data: Uint8Array | unknown, key: PayloadKey | undefined): Promise<Uint8Array | unknown>;
+export declare function decrypt(data: Uint8Array | unknown, key: PayloadKey | undefined): Promise<Uint8Array | unknown>;
 //# sourceMappingURL=encryption.d.ts.map

package/dist/serialization/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/serialization/encryption.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAQ1B,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAEnC;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,EAC1B,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,CAI/B;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,EAC1B,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,CAqB/B"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/serialization/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAGL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,KAAK,UAAU,EAEhB,MAAM,kBAAkB,CAAC;AAQ1B,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAEtC;;;;;;GAMG;AACH,QAAA,MAAM,iBAAiB,eAAkD,CAAC;AAC1E,QAAA,MAAM,cAAc,eAA+C,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,yDAAyD;IACzD,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,cAAc,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,MAAM,CACpB,kBAAkB,EAAE,UAAU,EAC9B,GAAG,CAAC,EAAE,UAAU,GACf,UAAU,CAEZ;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,CAAC,EAAE,UAAU,GACf,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAMhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAMxE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAK3E;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,SAAS,GACT,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAC/B,CAAC,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;AAE5C,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,EAC1B,GAAG,EAAE,UAAU,GAAG,SAAS,GAC1B,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,CAa/B;AAoDD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,EAC1B,GAAG,EAAE,UAAU,GAAG,SAAS,GAC1B,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,CA0C/B"}