@workflow/core 5.0.0-beta.5 → 5.0.0-beta.50

package/dist/serialization/encryption.js

@@ -1,51 +1,186 @@
 /**
  * Composable encryption layer for serialized data.
  *
- * Wraps/unwraps serialized payloads with AES-256-GCM encryption,
- * using the format prefix system to mark encrypted data.
+ * Wraps/unwraps serialized payloads with either symmetric AES-256-GCM
+ * encryption (`encr`) or an asymmetric sealed box (`encp`), using the format
+ * prefix system to mark which. See {@link PayloadKey} for how a caller
+ * declares which capabilities it holds.
  */
-import { WorkflowRuntimeError } from '@workflow/errors';
-import { decrypt as aesGcmDecrypt, encrypt as aesGcmEncrypt, } from '../encryption.js';
+import { RuntimeDecryptionError } from '@workflow/errors';
+import { decrypt as aesGcmDecrypt, encrypt as aesGcmEncrypt, importKey as importAesKey, } from '../encryption.js';
+import { deriveRunKeyPair, open as openSealed, seal as sealToPublicKey, } from '../sealed-box.js';
 import { decodeFormatPrefix, encodeWithFormatPrefix, peekFormatPrefix, } from './format.js';
 import { SerializationFormat } from './types.js';
+/**
+ * Brands distinguishing the structured key variants from a bare `CryptoKey`.
+ *
+ * `Symbol.for` rather than `Symbol()` because these values cross realm
+ * boundaries (host ↔ workflow VM), and the global symbol registry is shared
+ * across realms while unique symbols are not.
+ */
+const SEAL_TARGET_BRAND = Symbol.for('workflow.serialization.sealTarget');
+const RUN_KEYS_BRAND = Symbol.for('workflow.serialization.runKeys');
+/**
+ * Build a write-only seal capability for a recipient run's public key.
+ *
+ * @param recipientPublicKey - The recipient run's raw 32-byte X25519 public key
+ * @param aad - Additional authenticated data, conventionally `runAad(projectId, runId)`
+ */
+export function sealTo(recipientPublicKey, aad) {
+    return { [SEAL_TARGET_BRAND]: true, recipientPublicKey, aad };
+}
+/**
+ * Bundle a run's symmetric key with the keypair that opens payloads sealed
+ * to it.
+ */
+export function runPayloadKeys(aes, keyPair, aad) {
+    return { [RUN_KEYS_BRAND]: true, aes, keyPair, aad };
+}
+/**
+ * Build the full key capability for a run from its raw 32-byte key material,
+ * the value `World.getEncryptionKeyForRun()` returns.
+ *
+ * Use this anywhere a run reads its own event log: it yields a key that opens
+ * both its own symmetric (`encr`) payloads and sealed (`encp`) payloads other
+ * runs wrote to it. Resolving only `importKey(material)` would leave the
+ * reader unable to open sealed writes.
+ */
+export async function deriveRunPayloadKeys(runKeyMaterial) {
+    const [aes, keyPair] = await Promise.all([
+        importAesKey(runKeyMaterial),
+        deriveRunKeyPair(runKeyMaterial),
+    ]);
+    return runPayloadKeys(aes, keyPair);
+}
+export function isSealTarget(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value[SEAL_TARGET_BRAND] === true);
+}
+export function isRunPayloadKeys(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value[RUN_KEYS_BRAND] === true);
+}
+/**
+ * The symmetric key to use for `encr` operations, or undefined when this key
+ * has no symmetric capability (i.e. it is a seal-only target).
+ */
+export function aesKeyOf(key) {
+    if (!key)
+        return undefined;
+    if (isRunPayloadKeys(key))
+        return key.aes;
+    if (isSealTarget(key))
+        return undefined;
+    return key;
+}
+export async function resolveEncryptionKey(key) {
+    return typeof key === 'function' ? key() : key;
+}
 /**
  * Encrypt a format-prefixed payload if a key is provided.
- * Wraps the data with the 'encr' format prefix.
+ *
+ * Wraps the data with the `encr` prefix for symmetric keys, or the `encp`
+ * prefix when handed a {@link SealTarget}, a cross-run writer that holds
+ * only the recipient's public key.
  *
  * @param data - The format-prefixed serialized data
  * @param key - Encryption key (undefined to skip encryption)
- * @returns The encrypted data with 'encr' prefix, or the original data if no key
+ * @returns The encrypted data with its format prefix, or the original data if no key
  */
 export async function encrypt(data, key) {
     if (!key || !(data instanceof Uint8Array))
         return data;
-    const encrypted = await aesGcmEncrypt(key, data);
+    if (isSealTarget(key)) {
+        const sealed = await sealToPublicKey(key.recipientPublicKey, data, key.aad);
+        return encodeWithFormatPrefix(SerializationFormat.SEALED, sealed);
+    }
+    // Symmetric path: a run's own payloads, including when the caller holds
+    // the full `RunPayloadKeys` bundle and *could* seal. See `PayloadKey`.
+    const aesKey = isRunPayloadKeys(key) ? key.aes : key;
+    const encrypted = await aesGcmEncrypt(aesKey, data);
     return encodeWithFormatPrefix(SerializationFormat.ENCRYPTED, encrypted);
 }
 /**
- * Decrypt a format-prefixed payload if it's encrypted.
- * Strips the 'encr' format prefix and decrypts the inner payload.
+ * Decrypt a format-prefixed payload if it's encrypted or sealed.
+ *
+ * Strips the `encr`/`encp` format prefix and recovers the inner payload.
+ * Opening a sealed (`encp`) payload requires the run's X25519 keypair, so the
+ * caller must supply {@link RunPayloadKeys}; a bare symmetric key cannot do
+ * it, and neither can a {@link SealTarget} (which is write-only by design).
  *
  * @param data - The potentially encrypted data
  * @param key - Encryption key (undefined to skip decryption)
  * @returns The decrypted inner payload, or the original data if not encrypted
  */
+/**
+ * Open a sealed (`encp`) envelope. Split out from {@link decrypt} to keep
+ * each scheme's error handling readable on its own.
+ */
+async function openSealedEnvelope(data, key) {
+    // Sealed payloads need the private scalar. Anything else (no key, a bare
+    // symmetric key, or a write-only seal target) cannot open them.
+    if (!isRunPayloadKeys(key)) {
+        throw new RuntimeDecryptionError('Sealed data encountered but no run keypair is available. ' +
+            "Opening a sealed payload requires the run's own encryption key " +
+            'material; a symmetric key or a seal-only target cannot decrypt it.', {
+            context: {
+                operation: 'decrypt',
+                byteLength: data.byteLength,
+                formatPrefix: 'encp',
+            },
+        });
+    }
+    const { payload } = decodeFormatPrefix(data);
+    try {
+        return await openSealed(key.keyPair, payload, key.aad);
+    }
+    catch (error) {
+        // The sealed-box layer only sees the stripped payload, so it cannot
+        // record the outer envelope prefix. Enrich it here before rethrowing.
+        if (RuntimeDecryptionError.is(error) && error.context) {
+            error.context.formatPrefix = SerializationFormat.SEALED;
+        }
+        throw error;
+    }
+}
 export async function decrypt(data, key) {
     // Non-binary data is returned as-is.
     if (!(data instanceof Uint8Array))
         return data;
     const format = peekFormatPrefix(data);
-    // If the data is encrypted but no key was provided, fail fast.
-    // Uses WorkflowRuntimeError to preserve the error contract from the
-    // legacy maybeDecrypt() implementation that callers may rely on.
-    if (format === SerializationFormat.ENCRYPTED && !key) {
-        throw new WorkflowRuntimeError('Encrypted data encountered but no encryption key is available. ' +
-            'Encryption is not configured or no key was provided for this run.');
+    if (format === SerializationFormat.SEALED) {
+        return openSealedEnvelope(data, key);
     }
     // If the data is not encrypted, return it unchanged.
     if (format !== SerializationFormat.ENCRYPTED)
         return data;
+    // If the data is encrypted but no symmetric key is available, fail fast.
+    const aesKey = aesKeyOf(key);
+    if (!aesKey) {
+        throw new RuntimeDecryptionError('Encrypted data encountered but no encryption key is available. ' +
+            'Encryption is not configured or no key was provided for this run.', {
+            context: {
+                operation: 'decrypt',
+                byteLength: data.byteLength,
+                formatPrefix: 'encr',
+            },
+        });
+    }
     const { payload } = decodeFormatPrefix(data);
-    return aesGcmDecrypt(key, payload);
+    try {
+        return await aesGcmDecrypt(aesKey, payload);
+    }
+    catch (error) {
+        // The low-level AES layer only sees the stripped payload, so it cannot
+        // record the outer envelope prefix. This layer peeked it (`encr`), so
+        // enrich the diagnostic context with the real format prefix before
+        // rethrowing.
+        if (RuntimeDecryptionError.is(error) && error.context) {
+            error.context.formatPrefix = format;
+        }
+        throw error;
+    }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJpYWxpemF0aW9uL2VuY3J5cHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7O0dBS0c7QUFFSCxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUN4RCxPQUFPLEVBQ0wsT0FBTyxJQUFJLGFBQWEsRUFDeEIsT0FBTyxJQUFJLGFBQWEsR0FFekIsTUFBTSxrQkFBa0IsQ0FBQztBQUMxQixPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLHNCQUFzQixFQUN0QixnQkFBZ0IsR0FDakIsTUFBTSxhQUFhLENBQUM7QUFDckIsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sWUFBWSxDQUFDO0FBYWpEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDM0IsSUFBMEIsRUFDMUIsR0FBMEI7SUFFMUIsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsSUFBSSxZQUFZLFVBQVUsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ3ZELE1BQU0sU0FBUyxHQUFHLE1BQU0sYUFBYSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUNqRCxPQUFPLHNCQUFzQixDQUFDLG1CQUFtQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsT0FBTyxDQUMzQixJQUEwQixFQUMxQixHQUEwQjtJQUUxQixxQ0FBcUM7SUFDckMsSUFBSSxDQUFDLENBQUMsSUFBSSxZQUFZLFVBQVUsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRS9DLE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXRDLCtEQUErRDtJQUMvRCxvRUFBb0U7SUFDcEUsaUVBQWlFO0lBQ2pFLElBQUksTUFBTSxLQUFLLG1CQUFtQixDQUFDLFNBQVMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3JELE1BQU0sSUFBSSxvQkFBb0IsQ0FDNUIsaUVBQWlFO1lBQy9ELG1FQUFtRSxDQUN0RSxDQUFDO0lBQ0osQ0FBQztJQUVELHFEQUFxRDtJQUNyRCxJQUFJLE1BQU0sS0FBSyxtQkFBbUIsQ0FBQyxTQUFTO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFMUQsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdDLE9BQU8sYUFBYSxDQUFDLEdBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztBQUN0QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBDb21wb3NhYmxlIGVuY3J5cHRpb24gbGF5ZXIgZm9yIHNlcmlhbGl6ZWQgZGF0YS5cbiAqXG4gKiBXcmFwcy91bndyYXBzIHNlcmlhbGl6ZWQgcGF5bG9hZHMgd2l0aCBBRVMtMjU2LUdDTSBlbmNyeXB0aW9uLFxuICogdXNpbmcgdGhlIGZvcm1hdCBwcmVmaXggc3lzdGVtIHRvIG1hcmsgZW5jcnlwdGVkIGRhdGEuXG4gKi9cblxuaW1wb3J0IHsgV29ya2Zsb3dSdW50aW1lRXJyb3IgfSBmcm9tICdAd29ya2Zsb3cvZXJyb3JzJztcbmltcG9ydCB7XG4gIGRlY3J5cHQgYXMgYWVzR2NtRGVjcnlwdCxcbiAgZW5jcnlwdCBhcyBhZXNHY21FbmNyeXB0LFxuICB0eXBlIENyeXB0b0tleSxcbn0gZnJvbSAnLi4vZW5jcnlwdGlvbi5qcyc7XG5pbXBvcnQge1xuICBkZWNvZGVGb3JtYXRQcmVmaXgsXG4gIGVuY29kZVdpdGhGb3JtYXRQcmVmaXgsXG4gIHBlZWtGb3JtYXRQcmVmaXgsXG59IGZyb20gJy4vZm9ybWF0LmpzJztcbmltcG9ydCB7IFNlcmlhbGl6YXRpb25Gb3JtYXQgfSBmcm9tICcuL3R5cGVzLmpzJztcblxuZXhwb3J0IHR5cGUgeyBDcnlwdG9LZXkgfTtcblxuLyoqXG4gKiBFbmNyeXB0aW9uIGtleSBwYXJhbWV0ZXIgdHlwZS4gQWNjZXB0cyBhIHJlc29sdmVkIGtleSwgdW5kZWZpbmVkIChubyBlbmNyeXB0aW9uKSxcbiAqIG9yIGEgcHJvbWlzZSB0aGF0IHJlc29sdmVzIHRvIGVpdGhlci5cbiAqL1xuZXhwb3J0IHR5cGUgRW5jcnlwdGlvbktleVBhcmFtID1cbiAgfCBDcnlwdG9LZXlcbiAgfCB1bmRlZmluZWRcbiAgfCBQcm9taXNlPENyeXB0b0tleSB8IHVuZGVmaW5lZD47XG5cbi8qKlxuICogRW5jcnlwdCBhIGZvcm1hdC1wcmVmaXhlZCBwYXlsb2FkIGlmIGEga2V5IGlzIHByb3ZpZGVkLlxuICogV3JhcHMgdGhlIGRhdGEgd2l0aCB0aGUgJ2VuY3InIGZvcm1hdCBwcmVmaXguXG4gKlxuICogQHBhcmFtIGRhdGEgLSBUaGUgZm9ybWF0LXByZWZpeGVkIHNlcmlhbGl6ZWQgZGF0YVxuICogQHBhcmFtIGtleSAtIEVuY3J5cHRpb24ga2V5ICh1bmRlZmluZWQgdG8gc2tpcCBlbmNyeXB0aW9uKVxuICogQHJldHVybnMgVGhlIGVuY3J5cHRlZCBkYXRhIHdpdGggJ2VuY3InIHByZWZpeCwgb3IgdGhlIG9yaWdpbmFsIGRhdGEgaWYgbm8ga2V5XG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbmNyeXB0KFxuICBkYXRhOiBVaW50OEFycmF5IHwgdW5rbm93bixcbiAga2V5OiBDcnlwdG9LZXkgfCB1bmRlZmluZWRcbik6IFByb21pc2U8VWludDhBcnJheSB8IHVua25vd24+IHtcbiAgaWYgKCFrZXkgfHwgIShkYXRhIGluc3RhbmNlb2YgVWludDhBcnJheSkpIHJldHVybiBkYXRhO1xuICBjb25zdCBlbmNyeXB0ZWQgPSBhd2FpdCBhZXNHY21FbmNyeXB0KGtleSwgZGF0YSk7XG4gIHJldHVybiBlbmNvZGVXaXRoRm9ybWF0UHJlZml4KFNlcmlhbGl6YXRpb25Gb3JtYXQuRU5DUllQVEVELCBlbmNyeXB0ZWQpO1xufVxuXG4vKipcbiAqIERlY3J5cHQgYSBmb3JtYXQtcHJlZml4ZWQgcGF5bG9hZCBpZiBpdCdzIGVuY3J5cHRlZC5cbiAqIFN0cmlwcyB0aGUgJ2VuY3InIGZvcm1hdCBwcmVmaXggYW5kIGRlY3J5cHRzIHRoZSBpbm5lciBwYXlsb2FkLlxuICpcbiAqIEBwYXJhbSBkYXRhIC0gVGhlIHBvdGVudGlhbGx5IGVuY3J5cHRlZCBkYXRhXG4gKiBAcGFyYW0ga2V5IC0gRW5jcnlwdGlvbiBrZXkgKHVuZGVmaW5lZCB0byBza2lwIGRlY3J5cHRpb24pXG4gKiBAcmV0dXJucyBUaGUgZGVjcnlwdGVkIGlubmVyIHBheWxvYWQsIG9yIHRoZSBvcmlnaW5hbCBkYXRhIGlmIG5vdCBlbmNyeXB0ZWRcbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlY3J5cHQoXG4gIGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duLFxuICBrZXk6IENyeXB0b0tleSB8IHVuZGVmaW5lZFxuKTogUHJvbWlzZTxVaW50OEFycmF5IHwgdW5rbm93bj4ge1xuICAvLyBOb24tYmluYXJ5IGRhdGEgaXMgcmV0dXJuZWQgYXMtaXMuXG4gIGlmICghKGRhdGEgaW5zdGFuY2VvZiBVaW50OEFycmF5KSkgcmV0dXJuIGRhdGE7XG5cbiAgY29uc3QgZm9ybWF0ID0gcGVla0Zvcm1hdFByZWZpeChkYXRhKTtcblxuICAvLyBJZiB0aGUgZGF0YSBpcyBlbmNyeXB0ZWQgYnV0IG5vIGtleSB3YXMgcHJvdmlkZWQsIGZhaWwgZmFzdC5cbiAgLy8gVXNlcyBXb3JrZmxvd1J1bnRpbWVFcnJvciB0byBwcmVzZXJ2ZSB0aGUgZXJyb3IgY29udHJhY3QgZnJvbSB0aGVcbiAgLy8gbGVnYWN5IG1heWJlRGVjcnlwdCgpIGltcGxlbWVudGF0aW9uIHRoYXQgY2FsbGVycyBtYXkgcmVseSBvbi5cbiAgaWYgKGZvcm1hdCA9PT0gU2VyaWFsaXphdGlvbkZvcm1hdC5FTkNSWVBURUQgJiYgIWtleSkge1xuICAgIHRocm93IG5ldyBXb3JrZmxvd1J1bnRpbWVFcnJvcihcbiAgICAgICdFbmNyeXB0ZWQgZGF0YSBlbmNvdW50ZXJlZCBidXQgbm8gZW5jcnlwdGlvbiBrZXkgaXMgYXZhaWxhYmxlLiAnICtcbiAgICAgICAgJ0VuY3J5cHRpb24gaXMgbm90IGNvbmZpZ3VyZWQgb3Igbm8ga2V5IHdhcyBwcm92aWRlZCBmb3IgdGhpcyBydW4uJ1xuICAgICk7XG4gIH1cblxuICAvLyBJZiB0aGUgZGF0YSBpcyBub3QgZW5jcnlwdGVkLCByZXR1cm4gaXQgdW5jaGFuZ2VkLlxuICBpZiAoZm9ybWF0ICE9PSBTZXJpYWxpemF0aW9uRm9ybWF0LkVOQ1JZUFRFRCkgcmV0dXJuIGRhdGE7XG5cbiAgY29uc3QgeyBwYXlsb2FkIH0gPSBkZWNvZGVGb3JtYXRQcmVmaXgoZGF0YSk7XG4gIHJldHVybiBhZXNHY21EZWNyeXB0KGtleSEsIHBheWxvYWQpO1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJpYWxpemF0aW9uL2VuY3J5cHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7R0FPRztBQUVILE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQzFELE9BQU8sRUFDTCxPQUFPLElBQUksYUFBYSxFQUN4QixPQUFPLElBQUksYUFBYSxFQUV4QixTQUFTLElBQUksWUFBWSxHQUMxQixNQUFNLGtCQUFrQixDQUFDO0FBQzFCLE9BQU8sRUFDTCxnQkFBZ0IsRUFDaEIsSUFBSSxJQUFJLFVBQVUsRUFFbEIsSUFBSSxJQUFJLGVBQWUsR0FDeEIsTUFBTSxrQkFBa0IsQ0FBQztBQUMxQixPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLHNCQUFzQixFQUN0QixnQkFBZ0IsR0FDakIsTUFBTSxhQUFhLENBQUM7QUFDckIsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sWUFBWSxDQUFDO0FBSWpEOzs7Ozs7R0FNRztBQUNILE1BQU0saUJBQWlCLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0FBQzFFLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztBQXVFcEU7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsTUFBTSxDQUNwQixrQkFBOEIsRUFDOUIsR0FBZ0I7SUFFaEIsT0FBTyxFQUFFLENBQUMsaUJBQWlCLENBQUMsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsR0FBRyxFQUFFLENBQUM7QUFDaEUsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxjQUFjLENBQzVCLEdBQWMsRUFDZCxPQUFtQixFQUNuQixHQUFnQjtJQUVoQixPQUFPLEVBQUUsQ0FBQyxjQUFjLENBQUMsRUFBRSxJQUFJLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQztBQUN2RCxDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLG9CQUFvQixDQUN4QyxjQUEwQjtJQUUxQixNQUFNLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN2QyxZQUFZLENBQUMsY0FBYyxDQUFDO1FBQzVCLGdCQUFnQixDQUFDLGNBQWMsQ0FBQztLQUNqQyxDQUFDLENBQUM7SUFDSCxPQUFPLGNBQWMsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDdEMsQ0FBQztBQUVELE1BQU0sVUFBVSxZQUFZLENBQUMsS0FBYztJQUN6QyxPQUFPLENBQ0wsT0FBTyxLQUFLLEtBQUssUUFBUTtRQUN6QixLQUFLLEtBQUssSUFBSTtRQUNiLEtBQTZCLENBQUMsaUJBQWlCLENBQUMsS0FBSyxJQUFJLENBQzNELENBQUM7QUFDSixDQUFDO0FBRUQsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWM7SUFDN0MsT0FBTyxDQUNMLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFDekIsS0FBSyxLQUFLLElBQUk7UUFDYixLQUFpQyxDQUFDLGNBQWMsQ0FBQyxLQUFLLElBQUksQ0FDNUQsQ0FBQztBQUNKLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFDLEdBQTJCO0lBQ2xELElBQUksQ0FBQyxHQUFHO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDM0IsSUFBSSxnQkFBZ0IsQ0FBQyxHQUFHLENBQUM7UUFBRSxPQUFPLEdBQUcsQ0FBQyxHQUFHLENBQUM7SUFDMUMsSUFBSSxZQUFZLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDeEMsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDO0FBWUQsTUFBTSxDQUFDLEtBQUssVUFBVSxvQkFBb0IsQ0FDeEMsR0FBdUI7SUFFdkIsT0FBTyxPQUFPLEdBQUcsS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7QUFDakQsQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDM0IsSUFBMEIsRUFDMUIsR0FBMkI7SUFFM0IsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsSUFBSSxZQUFZLFVBQVUsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXZELElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxlQUFlLENBQUMsR0FBRyxDQUFDLGtCQUFrQixFQUFFLElBQUksRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDNUUsT0FBTyxzQkFBc0IsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUVELHdFQUF3RTtJQUN4RSx1RUFBdUU7SUFDdkUsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztJQUNyRCxNQUFNLFNBQVMsR0FBRyxNQUFNLGFBQWEsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDcEQsT0FBTyxzQkFBc0IsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFDMUUsQ0FBQztBQUVEOzs7Ozs7Ozs7OztHQVdHO0FBQ0g7OztHQUdHO0FBQ0gsS0FBSyxVQUFVLGtCQUFrQixDQUMvQixJQUFnQixFQUNoQixHQUEyQjtJQUUzQix5RUFBeUU7SUFDekUsZ0VBQWdFO0lBQ2hFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxzQkFBc0IsQ0FDOUIsMkRBQTJEO1lBQ3pELGlFQUFpRTtZQUNqRSxvRUFBb0UsRUFDdEU7WUFDRSxPQUFPLEVBQUU7Z0JBQ1AsU0FBUyxFQUFFLFNBQVM7Z0JBQ3BCLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDM0IsWUFBWSxFQUFFLE1BQU07YUFDckI7U0FDRixDQUNGLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdDLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxVQUFVLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2Ysb0VBQW9FO1FBQ3BFLHNFQUFzRTtRQUN0RSxJQUFJLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLElBQTBCLEVBQzFCLEdBQTJCO0lBRTNCLHFDQUFxQztJQUNyQyxJQUFJLENBQUMsQ0FBQyxJQUFJLFlBQVksVUFBVSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFL0MsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFdEMsSUFBSSxNQUFNLEtBQUssbUJBQW1CLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUMsT0FBTyxrQkFBa0IsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDdkMsQ0FBQztJQUVELHFEQUFxRDtJQUNyRCxJQUFJLE1BQU0sS0FBSyxtQkFBbUIsQ0FBQyxTQUFTO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFMUQseUVBQXlFO0lBQ3pFLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM3QixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUksc0JBQXNCLENBQzlCLGlFQUFpRTtZQUMvRCxtRUFBbUUsRUFDckU7WUFDRSxPQUFPLEVBQUU7Z0JBQ1AsU0FBUyxFQUFFLFNBQVM7Z0JBQ3BCLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDM0IsWUFBWSxFQUFFLE1BQU07YUFDckI7U0FDRixDQUNGLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdDLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxhQUFhLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsdUVBQXVFO1FBQ3ZFLHNFQUFzRTtRQUN0RSxtRUFBbUU7UUFDbkUsY0FBYztRQUNkLElBQUksc0JBQXNCLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN0RCxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksR0FBRyxNQUFNLENBQUM7UUFDdEMsQ0FBQztRQUNELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIENvbXBvc2FibGUgZW5jcnlwdGlvbiBsYXllciBmb3Igc2VyaWFsaXplZCBkYXRhLlxuICpcbiAqIFdyYXBzL3Vud3JhcHMgc2VyaWFsaXplZCBwYXlsb2FkcyB3aXRoIGVpdGhlciBzeW1tZXRyaWMgQUVTLTI1Ni1HQ01cbiAqIGVuY3J5cHRpb24gKGBlbmNyYCkgb3IgYW4gYXN5bW1ldHJpYyBzZWFsZWQgYm94IChgZW5jcGApLCB1c2luZyB0aGUgZm9ybWF0XG4gKiBwcmVmaXggc3lzdGVtIHRvIG1hcmsgd2hpY2guIFNlZSB7QGxpbmsgUGF5bG9hZEtleX0gZm9yIGhvdyBhIGNhbGxlclxuICogZGVjbGFyZXMgd2hpY2ggY2FwYWJpbGl0aWVzIGl0IGhvbGRzLlxuICovXG5cbmltcG9ydCB7IFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IgfSBmcm9tICdAd29ya2Zsb3cvZXJyb3JzJztcbmltcG9ydCB7XG4gIGRlY3J5cHQgYXMgYWVzR2NtRGVjcnlwdCxcbiAgZW5jcnlwdCBhcyBhZXNHY21FbmNyeXB0LFxuICB0eXBlIENyeXB0b0tleSxcbiAgaW1wb3J0S2V5IGFzIGltcG9ydEFlc0tleSxcbn0gZnJvbSAnLi4vZW5jcnlwdGlvbi5qcyc7XG5pbXBvcnQge1xuICBkZXJpdmVSdW5LZXlQYWlyLFxuICBvcGVuIGFzIG9wZW5TZWFsZWQsXG4gIHR5cGUgUnVuS2V5UGFpcixcbiAgc2VhbCBhcyBzZWFsVG9QdWJsaWNLZXksXG59IGZyb20gJy4uL3NlYWxlZC1ib3guanMnO1xuaW1wb3J0IHtcbiAgZGVjb2RlRm9ybWF0UHJlZml4LFxuICBlbmNvZGVXaXRoRm9ybWF0UHJlZml4LFxuICBwZWVrRm9ybWF0UHJlZml4LFxufSBmcm9tICcuL2Zvcm1hdC5qcyc7XG5pbXBvcnQgeyBTZXJpYWxpemF0aW9uRm9ybWF0IH0gZnJvbSAnLi90eXBlcy5qcyc7XG5cbmV4cG9ydCB0eXBlIHsgQ3J5cHRvS2V5LCBSdW5LZXlQYWlyIH07XG5cbi8qKlxuICogQnJhbmRzIGRpc3Rpbmd1aXNoaW5nIHRoZSBzdHJ1Y3R1cmVkIGtleSB2YXJpYW50cyBmcm9tIGEgYmFyZSBgQ3J5cHRvS2V5YC5cbiAqXG4gKiBgU3ltYm9sLmZvcmAgcmF0aGVyIHRoYW4gYFN5bWJvbCgpYCBiZWNhdXNlIHRoZXNlIHZhbHVlcyBjcm9zcyByZWFsbVxuICogYm91bmRhcmllcyAoaG9zdCDihpQgd29ya2Zsb3cgVk0pLCBhbmQgdGhlIGdsb2JhbCBzeW1ib2wgcmVnaXN0cnkgaXMgc2hhcmVkXG4gKiBhY3Jvc3MgcmVhbG1zIHdoaWxlIHVuaXF1ZSBzeW1ib2xzIGFyZSBub3QuXG4gKi9cbmNvbnN0IFNFQUxfVEFSR0VUX0JSQU5EID0gU3ltYm9sLmZvcignd29ya2Zsb3cuc2VyaWFsaXphdGlvbi5zZWFsVGFyZ2V0Jyk7XG5jb25zdCBSVU5fS0VZU19CUkFORCA9IFN5bWJvbC5mb3IoJ3dvcmtmbG93LnNlcmlhbGl6YXRpb24ucnVuS2V5cycpO1xuXG4vKipcbiAqIEEgd3JpdGUtb25seSBjYXBhYmlsaXR5OiBzZWFsIHBheWxvYWRzIHRvIGEgcnVuJ3MgWDI1NTE5IHB1YmxpYyBrZXkuXG4gKlxuICogVGhpcyBpcyB3aGF0IGEgKmNyb3NzLXJ1biogd3JpdGVyIGhvbGRzOiBhIGhvb2sgcmVzdW1wdGlvbiB0YXJnZXRpbmdcbiAqIGFub3RoZXIgcnVuLCBvciBhIGNoaWxkIHdvcmtmbG93IHdyaXRpbmcgaW50byBhIHBhcmVudCdzIGZvcndhcmRlZCBzdHJlYW0uXG4gKiBJdCBjYXJyaWVzIG5vIGFiaWxpdHkgdG8gZGVjcnlwdCBhbnl0aGluZywgYW5kIGJlY2F1c2UgaXQgaXMgYSBkaXN0aW5jdFxuICogbm9taW5hbCB0eXBlIGl0IGNhbm5vdCBiZSBtaXN0YWtlbiBmb3Igc3ltbWV0cmljIGtleSBtYXRlcmlhbC5cbiAqXG4gKiBUaGF0IGxhc3QgcHJvcGVydHkgbWF0dGVycyBtb3JlIHRoYW4gaXQgbG9va3M6IGEgcmF3IDMyLWJ5dGUgWDI1NTE5IHB1YmxpY1xuICoga2V5IGlzIGEgKnN0cnVjdHVyYWxseSB2YWxpZCogQUVTLTI1NiBrZXksIHNvIGhhbmRpbmcgb25lIHRvXG4gKiBgaW1wb3J0S2V5KC4uLiwgJ0FFUy1HQ00nKWAgc3VjY2VlZHMgYW5kIHNpbGVudGx5IHByb2R1Y2VzIGNpcGhlcnRleHQgdGhhdFxuICogbm9ib2R5IGNhbiBldmVyIG9wZW4uIFJvdXRpbmcgcHVibGljIGtleXMgZXhjbHVzaXZlbHkgdGhyb3VnaFxuICoge0BsaW5rIHNlYWxUb30gbWFrZXMgdGhhdCBtaXN0YWtlIHVucmVwcmVzZW50YWJsZSByYXRoZXIgdGhhbiBtZXJlbHlcbiAqIGRpc2NvdXJhZ2VkLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFNlYWxUYXJnZXQge1xuICByZWFkb25seSBbU0VBTF9UQVJHRVRfQlJBTkRdOiB0cnVlO1xuICAvKiogVGhlIHJlY2lwaWVudCBydW4ncyByYXcgMzItYnl0ZSBYMjU1MTkgcHVibGljIGtleS4gKi9cbiAgcmVhZG9ubHkgcmVjaXBpZW50UHVibGljS2V5OiBVaW50OEFycmF5O1xuICAvKiogQWRkaXRpb25hbCBhdXRoZW50aWNhdGVkIGRhdGEgYmluZGluZyB0aGUgcGF5bG9hZCB0byB0aGUgcmVjaXBpZW50IHJ1bi4gKi9cbiAgcmVhZG9ubHkgYWFkPzogVWludDhBcnJheTtcbn1cblxuLyoqXG4gKiBUaGUgZnVsbCBrZXkgY2FwYWJpbGl0eSBvZiBhIHJ1bidzICpvd24qIHJ1bnRpbWUgKGFuZCBvZiBvMTF5IHRvb2xpbmdcbiAqIGFjdGluZyBvbiBpdHMgYmVoYWxmKTogdGhlIHN5bW1ldHJpYyBrZXkgZm9yIGl0cyBvd24gcGF5bG9hZHMsIHBsdXMgdGhlXG4gKiBrZXlwYWlyIG5lZWRlZCB0byBvcGVuIHNlYWxlZCBwYXlsb2FkcyB0aGF0IG90aGVyIHJ1bnMgd3JvdGUgdG8gaXQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUnVuUGF5bG9hZEtleXMge1xuICByZWFkb25seSBbUlVOX0tFWVNfQlJBTkRdOiB0cnVlO1xuICAvKiogU3ltbWV0cmljIEFFUy0yNTYtR0NNIGtleTogdGhlIHJ1bidzIG93biBgZW5jcmAgcGF5bG9hZHMuICovXG4gIHJlYWRvbmx5IGFlczogQ3J5cHRvS2V5O1xuICAvKiogWDI1NTE5IGtleXBhaXI6IG9wZW5zIGBlbmNwYCBwYXlsb2FkcyBzZWFsZWQgdG8gdGhpcyBydW4uICovXG4gIHJlYWRvbmx5IGtleVBhaXI6IFJ1bktleVBhaXI7XG4gIC8qKiBBZGRpdGlvbmFsIGF1dGhlbnRpY2F0ZWQgZGF0YSBleHBlY3RlZCBvbiBzZWFsZWQgcGF5bG9hZHMuICovXG4gIHJlYWRvbmx5IGFhZD86IFVpbnQ4QXJyYXk7XG59XG5cbi8qKlxuICogQSByZXNvbHZlZCBrZXkgZm9yIHJlYWRpbmcgb3Igd3JpdGluZyBhIHNlcmlhbGl6ZWQgcGF5bG9hZC5cbiAqXG4gKiBUaGUgYmFyZSBgQ3J5cHRvS2V5YCB2YXJpYW50IGlzIHRoZSBoaXN0b3JpY2FsIHNoYXBlIGFuZCByZW1haW5zIHZhbGlkOiBpdFxuICogbWVhbnMgXCJzeW1tZXRyaWMgb25seVwiLCB3aGljaCBpcyBleGFjdGx5IHJpZ2h0IGZvciBhIHJ1biB0aGF0IHByZWRhdGVzXG4gKiBzZWFsZWQgYm94ZXMgb3IgZm9yIGFueSBzYW1lLXJ1biBwYXlsb2FkLiBUaGUgc3RydWN0dXJlZCB2YXJpYW50cyBhcmVcbiAqIGFkZGl0aXZlOlxuICpcbiAqIHwgVmFyaWFudCAgICAgICAgICAgIHwgV3JpdGVzICB8IFJlYWRzICAgICAgICAgIHwgSGVsZCBieSAgICAgICAgICAgICAgICAgIHxcbiAqIHwgLS0tLS0tLS0tLS0tLS0tLS0tIHwgLS0tLS0tLSB8IC0tLS0tLS0tLS0tLS0tIHwgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIHxcbiAqIHwgYENyeXB0b0tleWAgICAgICAgIHwgYGVuY3JgICB8IGBlbmNyYCAgICAgICAgIHwgc2FtZS1ydW4gKGxlZ2FjeSBzaGFwZSkgIHxcbiAqIHwge0BsaW5rIFJ1blBheWxvYWRLZXlzfSB8IGBlbmNyYCAgfCBgZW5jcmAsIGBlbmNwYCB8IHRoZSBvd25pbmcgcnVuLCBvMTF5ICAgICB8XG4gKiB8IHtAbGluayBTZWFsVGFyZ2V0fSB8IGBlbmNwYCAgfCAobm9uZSkgICAgICAgICB8IGNyb3NzLXJ1biB3cml0ZXJzICAgICAgICB8XG4gKlxuICogQSBydW4ncyBvd24gcGF5bG9hZHMgZGVsaWJlcmF0ZWx5IHN0YXkgc3ltbWV0cmljIGV2ZW4gd2hlbiB0aGUgd3JpdGVyIGNvdWxkXG4gKiBzZWFsOiBzZWFsaW5nIGNvc3RzIGEgZnJlc2ggRUNESCBwZXIgZW52ZWxvcGUgYW5kIDMyIGV4dHJhIGJ5dGVzLCBhbmQgYnV5c1xuICogbm90aGluZyB3aGVuIHRoZSB3cml0ZXIgYWxyZWFkeSBob2xkcyB0aGUgZGVjcnlwdGlvbiBrZXkuXG4gKi9cbmV4cG9ydCB0eXBlIFBheWxvYWRLZXkgPSBDcnlwdG9LZXkgfCBTZWFsVGFyZ2V0IHwgUnVuUGF5bG9hZEtleXM7XG5cbi8qKlxuICogVGhlIHN1YnNldCBvZiB7QGxpbmsgUGF5bG9hZEtleX0gdGhhdCBjYW4gYWN0dWFsbHkgKnJlYWQqIGEgcGF5bG9hZC5cbiAqXG4gKiBFeGNsdWRlcyB7QGxpbmsgU2VhbFRhcmdldH0sIHdoaWNoIGlzIHdyaXRlLW9ubHkgYnkgY29uc3RydWN0aW9uOiBpdCBob2xkcyBhXG4gKiBwdWJsaWMga2V5LCBzbyBpdCBjYW4gb3BlbiBuZWl0aGVyIGBlbmNwYCAobmVlZHMgdGhlIHByaXZhdGUgc2NhbGFyKSBub3JcbiAqIGBlbmNyYCAobmVlZHMgdGhlIHN5bW1ldHJpYyBrZXkpLiBEZWNyeXB0LXNpZGUgc2lnbmF0dXJlcyBzaG91bGQgdGFrZSB0aGlzXG4gKiByYXRoZXIgdGhhbiBgUGF5bG9hZEtleWAsIHNvIHBhc3NpbmcgYSBzZWFsIHRhcmdldCBpcyBhIGNvbXBpbGUgZXJyb3IgaW5zdGVhZFxuICogb2YgYSBndWFyYW50ZWVkIHJ1bnRpbWUgZmFpbHVyZS5cbiAqL1xuZXhwb3J0IHR5cGUgRGVjcnlwdGlvbktleSA9IENyeXB0b0tleSB8IFJ1blBheWxvYWRLZXlzO1xuXG4vKipcbiAqIEJ1aWxkIGEgd3JpdGUtb25seSBzZWFsIGNhcGFiaWxpdHkgZm9yIGEgcmVjaXBpZW50IHJ1bidzIHB1YmxpYyBrZXkuXG4gKlxuICogQHBhcmFtIHJlY2lwaWVudFB1YmxpY0tleSAtIFRoZSByZWNpcGllbnQgcnVuJ3MgcmF3IDMyLWJ5dGUgWDI1NTE5IHB1YmxpYyBrZXlcbiAqIEBwYXJhbSBhYWQgLSBBZGRpdGlvbmFsIGF1dGhlbnRpY2F0ZWQgZGF0YSwgY29udmVudGlvbmFsbHkgYHJ1bkFhZChwcm9qZWN0SWQsIHJ1bklkKWBcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNlYWxUbyhcbiAgcmVjaXBpZW50UHVibGljS2V5OiBVaW50OEFycmF5LFxuICBhYWQ/OiBVaW50OEFycmF5XG4pOiBTZWFsVGFyZ2V0IHtcbiAgcmV0dXJuIHsgW1NFQUxfVEFSR0VUX0JSQU5EXTogdHJ1ZSwgcmVjaXBpZW50UHVibGljS2V5LCBhYWQgfTtcbn1cblxuLyoqXG4gKiBCdW5kbGUgYSBydW4ncyBzeW1tZXRyaWMga2V5IHdpdGggdGhlIGtleXBhaXIgdGhhdCBvcGVucyBwYXlsb2FkcyBzZWFsZWRcbiAqIHRvIGl0LlxuICovXG5leHBvcnQgZnVuY3Rpb24gcnVuUGF5bG9hZEtleXMoXG4gIGFlczogQ3J5cHRvS2V5LFxuICBrZXlQYWlyOiBSdW5LZXlQYWlyLFxuICBhYWQ/OiBVaW50OEFycmF5XG4pOiBSdW5QYXlsb2FkS2V5cyB7XG4gIHJldHVybiB7IFtSVU5fS0VZU19CUkFORF06IHRydWUsIGFlcywga2V5UGFpciwgYWFkIH07XG59XG5cbi8qKlxuICogQnVpbGQgdGhlIGZ1bGwga2V5IGNhcGFiaWxpdHkgZm9yIGEgcnVuIGZyb20gaXRzIHJhdyAzMi1ieXRlIGtleSBtYXRlcmlhbCxcbiAqIHRoZSB2YWx1ZSBgV29ybGQuZ2V0RW5jcnlwdGlvbktleUZvclJ1bigpYCByZXR1cm5zLlxuICpcbiAqIFVzZSB0aGlzIGFueXdoZXJlIGEgcnVuIHJlYWRzIGl0cyBvd24gZXZlbnQgbG9nOiBpdCB5aWVsZHMgYSBrZXkgdGhhdCBvcGVuc1xuICogYm90aCBpdHMgb3duIHN5bW1ldHJpYyAoYGVuY3JgKSBwYXlsb2FkcyBhbmQgc2VhbGVkIChgZW5jcGApIHBheWxvYWRzIG90aGVyXG4gKiBydW5zIHdyb3RlIHRvIGl0LiBSZXNvbHZpbmcgb25seSBgaW1wb3J0S2V5KG1hdGVyaWFsKWAgd291bGQgbGVhdmUgdGhlXG4gKiByZWFkZXIgdW5hYmxlIHRvIG9wZW4gc2VhbGVkIHdyaXRlcy5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlcml2ZVJ1blBheWxvYWRLZXlzKFxuICBydW5LZXlNYXRlcmlhbDogVWludDhBcnJheVxuKTogUHJvbWlzZTxSdW5QYXlsb2FkS2V5cz4ge1xuICBjb25zdCBbYWVzLCBrZXlQYWlyXSA9IGF3YWl0IFByb21pc2UuYWxsKFtcbiAgICBpbXBvcnRBZXNLZXkocnVuS2V5TWF0ZXJpYWwpLFxuICAgIGRlcml2ZVJ1bktleVBhaXIocnVuS2V5TWF0ZXJpYWwpLFxuICBdKTtcbiAgcmV0dXJuIHJ1blBheWxvYWRLZXlzKGFlcywga2V5UGFpcik7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBpc1NlYWxUYXJnZXQodmFsdWU6IHVua25vd24pOiB2YWx1ZSBpcyBTZWFsVGFyZ2V0IHtcbiAgcmV0dXJuIChcbiAgICB0eXBlb2YgdmFsdWUgPT09ICdvYmplY3QnICYmXG4gICAgdmFsdWUgIT09IG51bGwgJiZcbiAgICAodmFsdWUgYXMgUGFydGlhbDxTZWFsVGFyZ2V0PilbU0VBTF9UQVJHRVRfQlJBTkRdID09PSB0cnVlXG4gICk7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBpc1J1blBheWxvYWRLZXlzKHZhbHVlOiB1bmtub3duKTogdmFsdWUgaXMgUnVuUGF5bG9hZEtleXMge1xuICByZXR1cm4gKFxuICAgIHR5cGVvZiB2YWx1ZSA9PT0gJ29iamVjdCcgJiZcbiAgICB2YWx1ZSAhPT0gbnVsbCAmJlxuICAgICh2YWx1ZSBhcyBQYXJ0aWFsPFJ1blBheWxvYWRLZXlzPilbUlVOX0tFWVNfQlJBTkRdID09PSB0cnVlXG4gICk7XG59XG5cbi8qKlxuICogVGhlIHN5bW1ldHJpYyBrZXkgdG8gdXNlIGZvciBgZW5jcmAgb3BlcmF0aW9ucywgb3IgdW5kZWZpbmVkIHdoZW4gdGhpcyBrZXlcbiAqIGhhcyBubyBzeW1tZXRyaWMgY2FwYWJpbGl0eSAoaS5lLiBpdCBpcyBhIHNlYWwtb25seSB0YXJnZXQpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gYWVzS2V5T2Yoa2V5OiBQYXlsb2FkS2V5IHwgdW5kZWZpbmVkKTogQ3J5cHRvS2V5IHwgdW5kZWZpbmVkIHtcbiAgaWYgKCFrZXkpIHJldHVybiB1bmRlZmluZWQ7XG4gIGlmIChpc1J1blBheWxvYWRLZXlzKGtleSkpIHJldHVybiBrZXkuYWVzO1xuICBpZiAoaXNTZWFsVGFyZ2V0KGtleSkpIHJldHVybiB1bmRlZmluZWQ7XG4gIHJldHVybiBrZXk7XG59XG5cbi8qKlxuICogRW5jcnlwdGlvbiBrZXkgcGFyYW1ldGVyIHR5cGUuIEFjY2VwdHMgYSByZXNvbHZlZCBrZXksIHVuZGVmaW5lZCAobm8gZW5jcnlwdGlvbiksXG4gKiBhIHByb21pc2UsIG9yIGEgcmVzb2x2ZXIgdGhhdCBjYW4gZGVmZXIgZmV0Y2hpbmcgdGhlIGtleSB1bnRpbCBkYXRhIG5lZWRzIGl0LlxuICovXG5leHBvcnQgdHlwZSBFbmNyeXB0aW9uS2V5UGFyYW0gPVxuICB8IFBheWxvYWRLZXlcbiAgfCB1bmRlZmluZWRcbiAgfCBQcm9taXNlPFBheWxvYWRLZXkgfCB1bmRlZmluZWQ+XG4gIHwgKCgpID0+IFByb21pc2U8UGF5bG9hZEtleSB8IHVuZGVmaW5lZD4pO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZUVuY3J5cHRpb25LZXkoXG4gIGtleTogRW5jcnlwdGlvbktleVBhcmFtXG4pOiBQcm9taXNlPFBheWxvYWRLZXkgfCB1bmRlZmluZWQ+IHtcbiAgcmV0dXJuIHR5cGVvZiBrZXkgPT09ICdmdW5jdGlvbicgPyBrZXkoKSA6IGtleTtcbn1cblxuLyoqXG4gKiBFbmNyeXB0IGEgZm9ybWF0LXByZWZpeGVkIHBheWxvYWQgaWYgYSBrZXkgaXMgcHJvdmlkZWQuXG4gKlxuICogV3JhcHMgdGhlIGRhdGEgd2l0aCB0aGUgYGVuY3JgIHByZWZpeCBmb3Igc3ltbWV0cmljIGtleXMsIG9yIHRoZSBgZW5jcGBcbiAqIHByZWZpeCB3aGVuIGhhbmRlZCBhIHtAbGluayBTZWFsVGFyZ2V0fSwgYSBjcm9zcy1ydW4gd3JpdGVyIHRoYXQgaG9sZHNcbiAqIG9ubHkgdGhlIHJlY2lwaWVudCdzIHB1YmxpYyBrZXkuXG4gKlxuICogQHBhcmFtIGRhdGEgLSBUaGUgZm9ybWF0LXByZWZpeGVkIHNlcmlhbGl6ZWQgZGF0YVxuICogQHBhcmFtIGtleSAtIEVuY3J5cHRpb24ga2V5ICh1bmRlZmluZWQgdG8gc2tpcCBlbmNyeXB0aW9uKVxuICogQHJldHVybnMgVGhlIGVuY3J5cHRlZCBkYXRhIHdpdGggaXRzIGZvcm1hdCBwcmVmaXgsIG9yIHRoZSBvcmlnaW5hbCBkYXRhIGlmIG5vIGtleVxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZW5jcnlwdChcbiAgZGF0YTogVWludDhBcnJheSB8IHVua25vd24sXG4gIGtleTogUGF5bG9hZEtleSB8IHVuZGVmaW5lZFxuKTogUHJvbWlzZTxVaW50OEFycmF5IHwgdW5rbm93bj4ge1xuICBpZiAoIWtleSB8fCAhKGRhdGEgaW5zdGFuY2VvZiBVaW50OEFycmF5KSkgcmV0dXJuIGRhdGE7XG5cbiAgaWYgKGlzU2VhbFRhcmdldChrZXkpKSB7XG4gICAgY29uc3Qgc2VhbGVkID0gYXdhaXQgc2VhbFRvUHVibGljS2V5KGtleS5yZWNpcGllbnRQdWJsaWNLZXksIGRhdGEsIGtleS5hYWQpO1xuICAgIHJldHVybiBlbmNvZGVXaXRoRm9ybWF0UHJlZml4KFNlcmlhbGl6YXRpb25Gb3JtYXQuU0VBTEVELCBzZWFsZWQpO1xuICB9XG5cbiAgLy8gU3ltbWV0cmljIHBhdGg6IGEgcnVuJ3Mgb3duIHBheWxvYWRzLCBpbmNsdWRpbmcgd2hlbiB0aGUgY2FsbGVyIGhvbGRzXG4gIC8vIHRoZSBmdWxsIGBSdW5QYXlsb2FkS2V5c2AgYnVuZGxlIGFuZCAqY291bGQqIHNlYWwuIFNlZSBgUGF5bG9hZEtleWAuXG4gIGNvbnN0IGFlc0tleSA9IGlzUnVuUGF5bG9hZEtleXMoa2V5KSA/IGtleS5hZXMgOiBrZXk7XG4gIGNvbnN0IGVuY3J5cHRlZCA9IGF3YWl0IGFlc0djbUVuY3J5cHQoYWVzS2V5LCBkYXRhKTtcbiAgcmV0dXJuIGVuY29kZVdpdGhGb3JtYXRQcmVmaXgoU2VyaWFsaXphdGlvbkZvcm1hdC5FTkNSWVBURUQsIGVuY3J5cHRlZCk7XG59XG5cbi8qKlxuICogRGVjcnlwdCBhIGZvcm1hdC1wcmVmaXhlZCBwYXlsb2FkIGlmIGl0J3MgZW5jcnlwdGVkIG9yIHNlYWxlZC5cbiAqXG4gKiBTdHJpcHMgdGhlIGBlbmNyYC9gZW5jcGAgZm9ybWF0IHByZWZpeCBhbmQgcmVjb3ZlcnMgdGhlIGlubmVyIHBheWxvYWQuXG4gKiBPcGVuaW5nIGEgc2VhbGVkIChgZW5jcGApIHBheWxvYWQgcmVxdWlyZXMgdGhlIHJ1bidzIFgyNTUxOSBrZXlwYWlyLCBzbyB0aGVcbiAqIGNhbGxlciBtdXN0IHN1cHBseSB7QGxpbmsgUnVuUGF5bG9hZEtleXN9OyBhIGJhcmUgc3ltbWV0cmljIGtleSBjYW5ub3QgZG9cbiAqIGl0LCBhbmQgbmVpdGhlciBjYW4gYSB7QGxpbmsgU2VhbFRhcmdldH0gKHdoaWNoIGlzIHdyaXRlLW9ubHkgYnkgZGVzaWduKS5cbiAqXG4gKiBAcGFyYW0gZGF0YSAtIFRoZSBwb3RlbnRpYWxseSBlbmNyeXB0ZWQgZGF0YVxuICogQHBhcmFtIGtleSAtIEVuY3J5cHRpb24ga2V5ICh1bmRlZmluZWQgdG8gc2tpcCBkZWNyeXB0aW9uKVxuICogQHJldHVybnMgVGhlIGRlY3J5cHRlZCBpbm5lciBwYXlsb2FkLCBvciB0aGUgb3JpZ2luYWwgZGF0YSBpZiBub3QgZW5jcnlwdGVkXG4gKi9cbi8qKlxuICogT3BlbiBhIHNlYWxlZCAoYGVuY3BgKSBlbnZlbG9wZS4gU3BsaXQgb3V0IGZyb20ge0BsaW5rIGRlY3J5cHR9IHRvIGtlZXBcbiAqIGVhY2ggc2NoZW1lJ3MgZXJyb3IgaGFuZGxpbmcgcmVhZGFibGUgb24gaXRzIG93bi5cbiAqL1xuYXN5bmMgZnVuY3Rpb24gb3BlblNlYWxlZEVudmVsb3BlKFxuICBkYXRhOiBVaW50OEFycmF5LFxuICBrZXk6IFBheWxvYWRLZXkgfCB1bmRlZmluZWRcbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICAvLyBTZWFsZWQgcGF5bG9hZHMgbmVlZCB0aGUgcHJpdmF0ZSBzY2FsYXIuIEFueXRoaW5nIGVsc2UgKG5vIGtleSwgYSBiYXJlXG4gIC8vIHN5bW1ldHJpYyBrZXksIG9yIGEgd3JpdGUtb25seSBzZWFsIHRhcmdldCkgY2Fubm90IG9wZW4gdGhlbS5cbiAgaWYgKCFpc1J1blBheWxvYWRLZXlzKGtleSkpIHtcbiAgICB0aHJvdyBuZXcgUnVudGltZURlY3J5cHRpb25FcnJvcihcbiAgICAgICdTZWFsZWQgZGF0YSBlbmNvdW50ZXJlZCBidXQgbm8gcnVuIGtleXBhaXIgaXMgYXZhaWxhYmxlLiAnICtcbiAgICAgICAgXCJPcGVuaW5nIGEgc2VhbGVkIHBheWxvYWQgcmVxdWlyZXMgdGhlIHJ1bidzIG93biBlbmNyeXB0aW9uIGtleSBcIiArXG4gICAgICAgICdtYXRlcmlhbDsgYSBzeW1tZXRyaWMga2V5IG9yIGEgc2VhbC1vbmx5IHRhcmdldCBjYW5ub3QgZGVjcnlwdCBpdC4nLFxuICAgICAge1xuICAgICAgICBjb250ZXh0OiB7XG4gICAgICAgICAgb3BlcmF0aW9uOiAnZGVjcnlwdCcsXG4gICAgICAgICAgYnl0ZUxlbmd0aDogZGF0YS5ieXRlTGVuZ3RoLFxuICAgICAgICAgIGZvcm1hdFByZWZpeDogJ2VuY3AnLFxuICAgICAgICB9LFxuICAgICAgfVxuICAgICk7XG4gIH1cblxuICBjb25zdCB7IHBheWxvYWQgfSA9IGRlY29kZUZvcm1hdFByZWZpeChkYXRhKTtcbiAgdHJ5IHtcbiAgICByZXR1cm4gYXdhaXQgb3BlblNlYWxlZChrZXkua2V5UGFpciwgcGF5bG9hZCwga2V5LmFhZCk7XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgLy8gVGhlIHNlYWxlZC1ib3ggbGF5ZXIgb25seSBzZWVzIHRoZSBzdHJpcHBlZCBwYXlsb2FkLCBzbyBpdCBjYW5ub3RcbiAgICAvLyByZWNvcmQgdGhlIG91dGVyIGVudmVsb3BlIHByZWZpeC4gRW5yaWNoIGl0IGhlcmUgYmVmb3JlIHJldGhyb3dpbmcuXG4gICAgaWYgKFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IuaXMoZXJyb3IpICYmIGVycm9yLmNvbnRleHQpIHtcbiAgICAgIGVycm9yLmNvbnRleHQuZm9ybWF0UHJlZml4ID0gU2VyaWFsaXphdGlvbkZvcm1hdC5TRUFMRUQ7XG4gICAgfVxuICAgIHRocm93IGVycm9yO1xuICB9XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBkZWNyeXB0KFxuICBkYXRhOiBVaW50OEFycmF5IHwgdW5rbm93bixcbiAga2V5OiBQYXlsb2FkS2V5IHwgdW5kZWZpbmVkXG4pOiBQcm9taXNlPFVpbnQ4QXJyYXkgfCB1bmtub3duPiB7XG4gIC8vIE5vbi1iaW5hcnkgZGF0YSBpcyByZXR1cm5lZCBhcy1pcy5cbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSByZXR1cm4gZGF0YTtcblxuICBjb25zdCBmb3JtYXQgPSBwZWVrRm9ybWF0UHJlZml4KGRhdGEpO1xuXG4gIGlmIChmb3JtYXQgPT09IFNlcmlhbGl6YXRpb25Gb3JtYXQuU0VBTEVEKSB7XG4gICAgcmV0dXJuIG9wZW5TZWFsZWRFbnZlbG9wZShkYXRhLCBrZXkpO1xuICB9XG5cbiAgLy8gSWYgdGhlIGRhdGEgaXMgbm90IGVuY3J5cHRlZCwgcmV0dXJuIGl0IHVuY2hhbmdlZC5cbiAgaWYgKGZvcm1hdCAhPT0gU2VyaWFsaXphdGlvbkZvcm1hdC5FTkNSWVBURUQpIHJldHVybiBkYXRhO1xuXG4gIC8vIElmIHRoZSBkYXRhIGlzIGVuY3J5cHRlZCBidXQgbm8gc3ltbWV0cmljIGtleSBpcyBhdmFpbGFibGUsIGZhaWwgZmFzdC5cbiAgY29uc3QgYWVzS2V5ID0gYWVzS2V5T2Yoa2V5KTtcbiAgaWYgKCFhZXNLZXkpIHtcbiAgICB0aHJvdyBuZXcgUnVudGltZURlY3J5cHRpb25FcnJvcihcbiAgICAgICdFbmNyeXB0ZWQgZGF0YSBlbmNvdW50ZXJlZCBidXQgbm8gZW5jcnlwdGlvbiBrZXkgaXMgYXZhaWxhYmxlLiAnICtcbiAgICAgICAgJ0VuY3J5cHRpb24gaXMgbm90IGNvbmZpZ3VyZWQgb3Igbm8ga2V5IHdhcyBwcm92aWRlZCBmb3IgdGhpcyBydW4uJyxcbiAgICAgIHtcbiAgICAgICAgY29udGV4dDoge1xuICAgICAgICAgIG9wZXJhdGlvbjogJ2RlY3J5cHQnLFxuICAgICAgICAgIGJ5dGVMZW5ndGg6IGRhdGEuYnl0ZUxlbmd0aCxcbiAgICAgICAgICBmb3JtYXRQcmVmaXg6ICdlbmNyJyxcbiAgICAgICAgfSxcbiAgICAgIH1cbiAgICApO1xuICB9XG5cbiAgY29uc3QgeyBwYXlsb2FkIH0gPSBkZWNvZGVGb3JtYXRQcmVmaXgoZGF0YSk7XG4gIHRyeSB7XG4gICAgcmV0dXJuIGF3YWl0IGFlc0djbURlY3J5cHQoYWVzS2V5LCBwYXlsb2FkKTtcbiAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAvLyBUaGUgbG93LWxldmVsIEFFUyBsYXllciBvbmx5IHNlZXMgdGhlIHN0cmlwcGVkIHBheWxvYWQsIHNvIGl0IGNhbm5vdFxuICAgIC8vIHJlY29yZCB0aGUgb3V0ZXIgZW52ZWxvcGUgcHJlZml4LiBUaGlzIGxheWVyIHBlZWtlZCBpdCAoYGVuY3JgKSwgc29cbiAgICAvLyBlbnJpY2ggdGhlIGRpYWdub3N0aWMgY29udGV4dCB3aXRoIHRoZSByZWFsIGZvcm1hdCBwcmVmaXggYmVmb3JlXG4gICAgLy8gcmV0aHJvd2luZy5cbiAgICBpZiAoUnVudGltZURlY3J5cHRpb25FcnJvci5pcyhlcnJvcikgJiYgZXJyb3IuY29udGV4dCkge1xuICAgICAgZXJyb3IuY29udGV4dC5mb3JtYXRQcmVmaXggPSBmb3JtYXQ7XG4gICAgfVxuICAgIHRocm93IGVycm9yO1xuICB9XG59XG4iXX0=

package/dist/serialization/errors.d.ts

@@ -9,6 +9,19 @@
  * through the standard friendly-errors framing instead of being baked
  * into the message string.
  */
+/**
+ * Rethrow SDK runtime errors that must not be reframed as
+ * `SerializationError`.
+ *
+ * The serialize/dehydrate wrappers catch every throw and reframe it as a
+ * `SerializationError` (which classifies as `USER_ERROR`). That's correct
+ * for genuine serialization failures, but a `RuntimeDecryptionError` from
+ * the AES-GCM layer is an SDK-internal failure that must keep its identity
+ * so the run-failure classifier routes it to `RUNTIME_ERROR`. Call this at
+ * the top of each serialize catch block to let those errors propagate
+ * unchanged.
+ */
+export declare function rethrowIfRuntimeError(error: unknown): void;
 /**
  * Format a serialization error with context about what failed.
  * Extracts path, value, and reason from devalue's DevalueError when available.

package/dist/serialization/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/serialization/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAqBnC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/serialization/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAI1D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAqBnC"}

package/dist/serialization/errors.js

@@ -9,8 +9,26 @@
  * through the standard friendly-errors framing instead of being baked
  * into the message string.
  */
+import { RuntimeDecryptionError } from '@workflow/errors';
 import { DevalueError } from 'devalue';
 import { runtimeLogger } from '../logger.js';
+/**
+ * Rethrow SDK runtime errors that must not be reframed as
+ * `SerializationError`.
+ *
+ * The serialize/dehydrate wrappers catch every throw and reframe it as a
+ * `SerializationError` (which classifies as `USER_ERROR`). That's correct
+ * for genuine serialization failures, but a `RuntimeDecryptionError` from
+ * the AES-GCM layer is an SDK-internal failure that must keep its identity
+ * so the run-failure classifier routes it to `RUNTIME_ERROR`. Call this at
+ * the top of each serialize catch block to let those errors propagate
+ * unchanged.
+ */
+export function rethrowIfRuntimeError(error) {
+    if (RuntimeDecryptionError.is(error)) {
+        throw error;
+    }
+}
 /**
  * Format a serialization error with context about what failed.
  * Extracts path, value, and reason from devalue's DevalueError when available.
@@ -24,7 +42,7 @@ export function formatSerializationError(context, error) {
     if (error instanceof DevalueError && error.path) {
         message += ` at path "${error.path}"`;
     }
-    // Workflow can serialize a much richer set than the devalue defaults —
+    // Workflow can serialize a much richer set than the devalue defaults:
     // classes registered via `WORKFLOW_SERIALIZE`, FatalError / RetryableError
     // subclasses, AbortSignal, etc. Pointing at the foundations doc keeps
     // this hint accurate as the supported set grows, instead of repeating
@@ -38,4 +56,4 @@ export function formatSerializationError(context, error) {
     }
     return { message, hint };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcmlhbGl6YXRpb24vZXJyb3JzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7O0dBVUc7QUFFSCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQ3ZDLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFN0M7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSx3QkFBd0IsQ0FDdEMsT0FBZSxFQUNmLEtBQWM7SUFFZCxxRUFBcUU7SUFDckUsNkRBQTZEO0lBQzdELE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3hFLElBQUksT0FBTyxHQUFHLHVCQUF1QixPQUFPLEVBQUUsQ0FBQztJQUMvQyxJQUFJLEtBQUssWUFBWSxZQUFZLElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hELE9BQU8sSUFBSSxhQUFhLEtBQUssQ0FBQyxJQUFJLEdBQUcsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsdUVBQXVFO0lBQ3ZFLDJFQUEyRTtJQUMzRSxzRUFBc0U7SUFDdEUsc0VBQXNFO0lBQ3RFLDRDQUE0QztJQUM1QyxNQUFNLElBQUksR0FBRyxpQkFBaUIsSUFBSSxnSkFBZ0osQ0FBQztJQUNuTCxJQUFJLEtBQUssWUFBWSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMvRCxhQUFhLENBQUMsS0FBSyxDQUFDLHNCQUFzQixFQUFFO1lBQzFDLE9BQU87WUFDUCxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsS0FBSztTQUM5QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUMzQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBTaGFyZWQgZXJyb3IgZm9ybWF0dGluZyB1dGlsaXR5IGZvciBzZXJpYWxpemF0aW9uIGZhaWx1cmVzLlxuICpcbiAqIFVzZWQgYnkgdGhlIG1vZGUtc3BlY2lmaWMgc2VyaWFsaXplcnMgKHdvcmtmbG93LCBzdGVwLCBjbGllbnQpIHRvXG4gKiBwcm9kdWNlIGNvbnNpc3RlbnQgZXJyb3IgbWVzc2FnZXMgd2l0aCBkZXZhbHVlIHBhdGggaW5mb3JtYXRpb24uXG4gKlxuICogUmV0dXJucyBhIGB7IG1lc3NhZ2UsIGhpbnQgfWAgcGFpciBzbyBjYWxsZXJzIGNhbiB0aHJvdyBhXG4gKiBgU2VyaWFsaXphdGlvbkVycm9yKG1lc3NhZ2UsIHsgaGludCwgY2F1c2UgfSlgIGFuZCBoYXZlIHRoZSBoaW50IGZsb3dcbiAqIHRocm91Z2ggdGhlIHN0YW5kYXJkIGZyaWVuZGx5LWVycm9ycyBmcmFtaW5nIGluc3RlYWQgb2YgYmVpbmcgYmFrZWRcbiAqIGludG8gdGhlIG1lc3NhZ2Ugc3RyaW5nLlxuICovXG5cbmltcG9ydCB7IERldmFsdWVFcnJvciB9IGZyb20gJ2RldmFsdWUnO1xuaW1wb3J0IHsgcnVudGltZUxvZ2dlciB9IGZyb20gJy4uL2xvZ2dlci5qcyc7XG5cbi8qKlxuICogRm9ybWF0IGEgc2VyaWFsaXphdGlvbiBlcnJvciB3aXRoIGNvbnRleHQgYWJvdXQgd2hhdCBmYWlsZWQuXG4gKiBFeHRyYWN0cyBwYXRoLCB2YWx1ZSwgYW5kIHJlYXNvbiBmcm9tIGRldmFsdWUncyBEZXZhbHVlRXJyb3Igd2hlbiBhdmFpbGFibGUuXG4gKiBMb2dzIHRoZSBwcm9ibGVtYXRpYyB2YWx1ZSB0byB0aGUgY29uc29sZSBmb3IgYmV0dGVyIGRlYnVnZ2luZy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGZvcm1hdFNlcmlhbGl6YXRpb25FcnJvcihcbiAgY29udGV4dDogc3RyaW5nLFxuICBlcnJvcjogdW5rbm93blxuKTogeyBtZXNzYWdlOiBzdHJpbmc7IGhpbnQ6IHN0cmluZyB9IHtcbiAgLy8gYHJldHVybmluZ2AgZm9yIG91dHB1dHMsIGBwYXNzaW5nYCBmb3IgZXZlcnl0aGluZyB0aGF0IGNyb3NzZXMgdGhlXG4gIC8vIGJvdW5kYXJ5IHRoZSBvdGhlciB3YXkgKGFyZ3VtZW50cywgc3RyZWFtIG1lc3NhZ2VzLCBldGMuKS5cbiAgY29uc3QgdmVyYiA9IGNvbnRleHQuaW5jbHVkZXMoJ3JldHVybiB2YWx1ZScpID8gJ3JldHVybmluZycgOiAncGFzc2luZyc7XG4gIGxldCBtZXNzYWdlID0gYEZhaWxlZCB0byBzZXJpYWxpemUgJHtjb250ZXh0fWA7XG4gIGlmIChlcnJvciBpbnN0YW5jZW9mIERldmFsdWVFcnJvciAmJiBlcnJvci5wYXRoKSB7XG4gICAgbWVzc2FnZSArPSBgIGF0IHBhdGggXCIke2Vycm9yLnBhdGh9XCJgO1xuICB9XG4gIC8vIFdvcmtmbG93IGNhbiBzZXJpYWxpemUgYSBtdWNoIHJpY2hlciBzZXQgdGhhbiB0aGUgZGV2YWx1ZSBkZWZhdWx0cyDigJRcbiAgLy8gY2xhc3NlcyByZWdpc3RlcmVkIHZpYSBgV09SS0ZMT1dfU0VSSUFMSVpFYCwgRmF0YWxFcnJvciAvIFJldHJ5YWJsZUVycm9yXG4gIC8vIHN1YmNsYXNzZXMsIEFib3J0U2lnbmFsLCBldGMuIFBvaW50aW5nIGF0IHRoZSBmb3VuZGF0aW9ucyBkb2Mga2VlcHNcbiAgLy8gdGhpcyBoaW50IGFjY3VyYXRlIGFzIHRoZSBzdXBwb3J0ZWQgc2V0IGdyb3dzLCBpbnN0ZWFkIG9mIHJlcGVhdGluZ1xuICAvLyBhIGhhcmRjb2RlZCBsaXN0IHRoYXQgZHJpZnRzIG91dCBvZiBzeW5jLlxuICBjb25zdCBoaW50ID0gYEVuc3VyZSB5b3UncmUgJHt2ZXJifSB3b3JrZmxvdyBzZXJpYWxpemFibGUgdHlwZXMuIENoZWNrIHRoZSBzZXJpYWxpemF0aW9uIGRvY3MgdG8gc2VlIHdoYXQncyBzZXJpYWxpemFibGU6IGh0dHBzOi8vd29ya2Zsb3ctc2RrLmRldi9kb2NzL2ZvdW5kYXRpb25zL3NlcmlhbGl6YXRpb25gO1xuICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBEZXZhbHVlRXJyb3IgJiYgZXJyb3IudmFsdWUgIT09IHVuZGVmaW5lZCkge1xuICAgIHJ1bnRpbWVMb2dnZXIuZXJyb3IoJ1NlcmlhbGl6YXRpb24gZmFpbGVkJywge1xuICAgICAgY29udGV4dCxcbiAgICAgIHByb2JsZW1hdGljVmFsdWU6IGVycm9yLnZhbHVlLFxuICAgIH0pO1xuICB9XG4gIHJldHVybiB7IG1lc3NhZ2UsIGhpbnQgfTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcmlhbGl6YXRpb24vZXJyb3JzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7O0dBVUc7QUFFSCxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUMxRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQ3ZDLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFN0M7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUMsS0FBYztJQUNsRCxJQUFJLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLHdCQUF3QixDQUN0QyxPQUFlLEVBQ2YsS0FBYztJQUVkLHFFQUFxRTtJQUNyRSw2REFBNkQ7SUFDN0QsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDeEUsSUFBSSxPQUFPLEdBQUcsdUJBQXVCLE9BQU8sRUFBRSxDQUFDO0lBQy9DLElBQUksS0FBSyxZQUFZLFlBQVksSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEQsT0FBTyxJQUFJLGFBQWEsS0FBSyxDQUFDLElBQUksR0FBRyxDQUFDO0lBQ3hDLENBQUM7SUFDRCxzRUFBc0U7SUFDdEUsMkVBQTJFO0lBQzNFLHNFQUFzRTtJQUN0RSxzRUFBc0U7SUFDdEUsNENBQTRDO0lBQzVDLE1BQU0sSUFBSSxHQUFHLGlCQUFpQixJQUFJLGdKQUFnSixDQUFDO0lBQ25MLElBQUksS0FBSyxZQUFZLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9ELGFBQWEsQ0FBQyxLQUFLLENBQUMsc0JBQXNCLEVBQUU7WUFDMUMsT0FBTztZQUNQLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxLQUFLO1NBQzlCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQzNCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFNoYXJlZCBlcnJvciBmb3JtYXR0aW5nIHV0aWxpdHkgZm9yIHNlcmlhbGl6YXRpb24gZmFpbHVyZXMuXG4gKlxuICogVXNlZCBieSB0aGUgbW9kZS1zcGVjaWZpYyBzZXJpYWxpemVycyAod29ya2Zsb3csIHN0ZXAsIGNsaWVudCkgdG9cbiAqIHByb2R1Y2UgY29uc2lzdGVudCBlcnJvciBtZXNzYWdlcyB3aXRoIGRldmFsdWUgcGF0aCBpbmZvcm1hdGlvbi5cbiAqXG4gKiBSZXR1cm5zIGEgYHsgbWVzc2FnZSwgaGludCB9YCBwYWlyIHNvIGNhbGxlcnMgY2FuIHRocm93IGFcbiAqIGBTZXJpYWxpemF0aW9uRXJyb3IobWVzc2FnZSwgeyBoaW50LCBjYXVzZSB9KWAgYW5kIGhhdmUgdGhlIGhpbnQgZmxvd1xuICogdGhyb3VnaCB0aGUgc3RhbmRhcmQgZnJpZW5kbHktZXJyb3JzIGZyYW1pbmcgaW5zdGVhZCBvZiBiZWluZyBiYWtlZFxuICogaW50byB0aGUgbWVzc2FnZSBzdHJpbmcuXG4gKi9cblxuaW1wb3J0IHsgUnVudGltZURlY3J5cHRpb25FcnJvciB9IGZyb20gJ0B3b3JrZmxvdy9lcnJvcnMnO1xuaW1wb3J0IHsgRGV2YWx1ZUVycm9yIH0gZnJvbSAnZGV2YWx1ZSc7XG5pbXBvcnQgeyBydW50aW1lTG9nZ2VyIH0gZnJvbSAnLi4vbG9nZ2VyLmpzJztcblxuLyoqXG4gKiBSZXRocm93IFNESyBydW50aW1lIGVycm9ycyB0aGF0IG11c3Qgbm90IGJlIHJlZnJhbWVkIGFzXG4gKiBgU2VyaWFsaXphdGlvbkVycm9yYC5cbiAqXG4gKiBUaGUgc2VyaWFsaXplL2RlaHlkcmF0ZSB3cmFwcGVycyBjYXRjaCBldmVyeSB0aHJvdyBhbmQgcmVmcmFtZSBpdCBhcyBhXG4gKiBgU2VyaWFsaXphdGlvbkVycm9yYCAod2hpY2ggY2xhc3NpZmllcyBhcyBgVVNFUl9FUlJPUmApLiBUaGF0J3MgY29ycmVjdFxuICogZm9yIGdlbnVpbmUgc2VyaWFsaXphdGlvbiBmYWlsdXJlcywgYnV0IGEgYFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3JgIGZyb21cbiAqIHRoZSBBRVMtR0NNIGxheWVyIGlzIGFuIFNESy1pbnRlcm5hbCBmYWlsdXJlIHRoYXQgbXVzdCBrZWVwIGl0cyBpZGVudGl0eVxuICogc28gdGhlIHJ1bi1mYWlsdXJlIGNsYXNzaWZpZXIgcm91dGVzIGl0IHRvIGBSVU5USU1FX0VSUk9SYC4gQ2FsbCB0aGlzIGF0XG4gKiB0aGUgdG9wIG9mIGVhY2ggc2VyaWFsaXplIGNhdGNoIGJsb2NrIHRvIGxldCB0aG9zZSBlcnJvcnMgcHJvcGFnYXRlXG4gKiB1bmNoYW5nZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXRocm93SWZSdW50aW1lRXJyb3IoZXJyb3I6IHVua25vd24pOiB2b2lkIHtcbiAgaWYgKFJ1bnRpbWVEZWNyeXB0aW9uRXJyb3IuaXMoZXJyb3IpKSB7XG4gICAgdGhyb3cgZXJyb3I7XG4gIH1cbn1cblxuLyoqXG4gKiBGb3JtYXQgYSBzZXJpYWxpemF0aW9uIGVycm9yIHdpdGggY29udGV4dCBhYm91dCB3aGF0IGZhaWxlZC5cbiAqIEV4dHJhY3RzIHBhdGgsIHZhbHVlLCBhbmQgcmVhc29uIGZyb20gZGV2YWx1ZSdzIERldmFsdWVFcnJvciB3aGVuIGF2YWlsYWJsZS5cbiAqIExvZ3MgdGhlIHByb2JsZW1hdGljIHZhbHVlIHRvIHRoZSBjb25zb2xlIGZvciBiZXR0ZXIgZGVidWdnaW5nLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZm9ybWF0U2VyaWFsaXphdGlvbkVycm9yKFxuICBjb250ZXh0OiBzdHJpbmcsXG4gIGVycm9yOiB1bmtub3duXG4pOiB7IG1lc3NhZ2U6IHN0cmluZzsgaGludDogc3RyaW5nIH0ge1xuICAvLyBgcmV0dXJuaW5nYCBmb3Igb3V0cHV0cywgYHBhc3NpbmdgIGZvciBldmVyeXRoaW5nIHRoYXQgY3Jvc3NlcyB0aGVcbiAgLy8gYm91bmRhcnkgdGhlIG90aGVyIHdheSAoYXJndW1lbnRzLCBzdHJlYW0gbWVzc2FnZXMsIGV0Yy4pLlxuICBjb25zdCB2ZXJiID0gY29udGV4dC5pbmNsdWRlcygncmV0dXJuIHZhbHVlJykgPyAncmV0dXJuaW5nJyA6ICdwYXNzaW5nJztcbiAgbGV0IG1lc3NhZ2UgPSBgRmFpbGVkIHRvIHNlcmlhbGl6ZSAke2NvbnRleHR9YDtcbiAgaWYgKGVycm9yIGluc3RhbmNlb2YgRGV2YWx1ZUVycm9yICYmIGVycm9yLnBhdGgpIHtcbiAgICBtZXNzYWdlICs9IGAgYXQgcGF0aCBcIiR7ZXJyb3IucGF0aH1cImA7XG4gIH1cbiAgLy8gV29ya2Zsb3cgY2FuIHNlcmlhbGl6ZSBhIG11Y2ggcmljaGVyIHNldCB0aGFuIHRoZSBkZXZhbHVlIGRlZmF1bHRzOlxuICAvLyBjbGFzc2VzIHJlZ2lzdGVyZWQgdmlhIGBXT1JLRkxPV19TRVJJQUxJWkVgLCBGYXRhbEVycm9yIC8gUmV0cnlhYmxlRXJyb3JcbiAgLy8gc3ViY2xhc3NlcywgQWJvcnRTaWduYWwsIGV0Yy4gUG9pbnRpbmcgYXQgdGhlIGZvdW5kYXRpb25zIGRvYyBrZWVwc1xuICAvLyB0aGlzIGhpbnQgYWNjdXJhdGUgYXMgdGhlIHN1cHBvcnRlZCBzZXQgZ3Jvd3MsIGluc3RlYWQgb2YgcmVwZWF0aW5nXG4gIC8vIGEgaGFyZGNvZGVkIGxpc3QgdGhhdCBkcmlmdHMgb3V0IG9mIHN5bmMuXG4gIGNvbnN0IGhpbnQgPSBgRW5zdXJlIHlvdSdyZSAke3ZlcmJ9IHdvcmtmbG93IHNlcmlhbGl6YWJsZSB0eXBlcy4gQ2hlY2sgdGhlIHNlcmlhbGl6YXRpb24gZG9jcyB0byBzZWUgd2hhdCdzIHNlcmlhbGl6YWJsZTogaHR0cHM6Ly93b3JrZmxvdy1zZGsuZGV2L2RvY3MvZm91bmRhdGlvbnMvc2VyaWFsaXphdGlvbmA7XG4gIGlmIChlcnJvciBpbnN0YW5jZW9mIERldmFsdWVFcnJvciAmJiBlcnJvci52YWx1ZSAhPT0gdW5kZWZpbmVkKSB7XG4gICAgcnVudGltZUxvZ2dlci5lcnJvcignU2VyaWFsaXphdGlvbiBmYWlsZWQnLCB7XG4gICAgICBjb250ZXh0LFxuICAgICAgcHJvYmxlbWF0aWNWYWx1ZTogZXJyb3IudmFsdWUsXG4gICAgfSk7XG4gIH1cbiAgcmV0dXJuIHsgbWVzc2FnZSwgaGludCB9O1xufVxuIl19

package/dist/serialization/format.d.ts

@@ -4,14 +4,14 @@
  * All serialized payloads are prefixed with a 4-byte format identifier that
  * allows the deserializer to determine how to decode the payload. This enables:
  *
- * 1. Self-describing payloads — the World layer is agnostic to serialization format
- * 2. Gradual migration — old runs keep working, new runs can use new formats
- * 3. Composability — encryption can wrap any format ("encr" wrapping "devl")
- * 4. Debugging — raw data inspection immediately reveals the format
+ * 1. Self-describing payloads: the World layer is agnostic to serialization format
+ * 2. Gradual migration: old runs keep working, new runs can use new formats
+ * 3. Composability: encryption can wrap any format ("encr" wrapping "devl")
+ * 4. Debugging: raw data inspection immediately reveals the format
  *
  * Format: [4 bytes: format identifier][payload]
  *
- * The format prefix is open-ended — any 4-character [a-z0-9] string is valid.
+ * The format prefix is open-ended: any 4-character [a-z0-9] string is valid.
  * This allows new codecs to be added without modifying this module.
  */
 import { type FormatPrefix } from './types.js';
@@ -43,7 +43,7 @@ export declare function isEncrypted(data: Uint8Array | unknown): boolean;
  *
  * Unlike the legacy implementation which only accepted known formats
  * (`devl`, `encr`), this function accepts any valid format prefix
- * (`[a-z0-9]{4}`). This is intentional for forward compatibility —
+ * (`[a-z0-9]{4}`). This is intentional for forward compatibility, so
  * new codecs (e.g. `cbor`) can be added without modifying this module.
  * Callers are responsible for checking whether they support the returned
  * format and throwing an appropriate error if not (e.g. "Unsupported

package/dist/serialization/format.js

@@ -4,14 +4,14 @@
  * All serialized payloads are prefixed with a 4-byte format identifier that
  * allows the deserializer to determine how to decode the payload. This enables:
  *
- * 1. Self-describing payloads — the World layer is agnostic to serialization format
- * 2. Gradual migration — old runs keep working, new runs can use new formats
- * 3. Composability — encryption can wrap any format ("encr" wrapping "devl")
- * 4. Debugging — raw data inspection immediately reveals the format
+ * 1. Self-describing payloads: the World layer is agnostic to serialization format
+ * 2. Gradual migration: old runs keep working, new runs can use new formats
+ * 3. Composability: encryption can wrap any format ("encr" wrapping "devl")
+ * 4. Debugging: raw data inspection immediately reveals the format
  *
  * Format: [4 bytes: format identifier][payload]
  *
- * The format prefix is open-ended — any 4-character [a-z0-9] string is valid.
+ * The format prefix is open-ended: any 4-character [a-z0-9] string is valid.
  * This allows new codecs to be added without modifying this module.
  */
 import { isFormatPrefix, SerializationFormat, } from './types.js';
@@ -65,7 +65,7 @@ export function isEncrypted(data) {
  *
  * Unlike the legacy implementation which only accepted known formats
  * (`devl`, `encr`), this function accepts any valid format prefix
- * (`[a-z0-9]{4}`). This is intentional for forward compatibility —
+ * (`[a-z0-9]{4}`). This is intentional for forward compatibility, so
  * new codecs (e.g. `cbor`) can be added without modifying this module.
  * Callers are responsible for checking whether they support the returned
  * format and throwing an appropriate error if not (e.g. "Unsupported
@@ -94,4 +94,4 @@ export function decodeFormatPrefix(data) {
     const payload = data.subarray(FORMAT_PREFIX_LENGTH);
     return { format: str, payload };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9ybWF0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcmlhbGl6YXRpb24vZm9ybWF0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUVILE9BQU8sRUFFTCxjQUFjLEVBQ2QsbUJBQW1CLEdBQ3BCLE1BQU0sWUFBWSxDQUFDO0FBRXBCLDJDQUEyQztBQUMzQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsQ0FBQztBQUUvQixNQUFNLGFBQWEsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sYUFBYSxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFFeEM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUNwQyxNQUFvQixFQUNwQixPQUE2QjtJQUU3QixJQUFJLENBQUMsQ0FBQyxPQUFPLFlBQVksVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNyQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRCxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxvQkFBb0IsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDckUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDM0IsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztJQUMxQyxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUM5QixJQUEwQjtJQUUxQixJQUFJLENBQUMsQ0FBQyxJQUFJLFlBQVksVUFBVSxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3hFLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLG9CQUFvQixDQUFDLENBQUM7SUFDM0QsTUFBTSxHQUFHLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM5QyxPQUFPLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDMUMsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxVQUFVLFdBQVcsQ0FBQyxJQUEwQjtJQUNwRCxPQUFPLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLG1CQUFtQixDQUFDLFNBQVMsQ0FBQztBQUNsRSxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQUMsSUFBMEI7SUFJM0QsdUVBQXVFO0lBQ3ZFLElBQUksQ0FBQyxDQUFDLElBQUksWUFBWSxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU87WUFDTCxNQUFNLEVBQUUsbUJBQW1CLENBQUMsVUFBVTtZQUN0QyxPQUFPLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztTQUN4RCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sSUFBSSxLQUFLLENBQ2IsOERBQThELG9CQUFvQixlQUFlLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FDL0csQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO0lBQzNELE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7SUFFOUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQ2IsMkJBQTJCLEdBQUcsc0NBQXNDLENBQ3JFLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQ2xDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEZvcm1hdCBwcmVmaXggc3lzdGVtIGZvciBzZXJpYWxpemVkIHBheWxvYWRzLlxuICpcbiAqIEFsbCBzZXJpYWxpemVkIHBheWxvYWRzIGFyZSBwcmVmaXhlZCB3aXRoIGEgNC1ieXRlIGZvcm1hdCBpZGVudGlmaWVyIHRoYXRcbiAqIGFsbG93cyB0aGUgZGVzZXJpYWxpemVyIHRvIGRldGVybWluZSBob3cgdG8gZGVjb2RlIHRoZSBwYXlsb2FkLiBUaGlzIGVuYWJsZXM6XG4gKlxuICogMS4gU2VsZi1kZXNjcmliaW5nIHBheWxvYWRzIOKAlCB0aGUgV29ybGQgbGF5ZXIgaXMgYWdub3N0aWMgdG8gc2VyaWFsaXphdGlvbiBmb3JtYXRcbiAqIDIuIEdyYWR1YWwgbWlncmF0aW9uIOKAlCBvbGQgcnVucyBrZWVwIHdvcmtpbmcsIG5ldyBydW5zIGNhbiB1c2UgbmV3IGZvcm1hdHNcbiAqIDMuIENvbXBvc2FiaWxpdHkg4oCUIGVuY3J5cHRpb24gY2FuIHdyYXAgYW55IGZvcm1hdCAoXCJlbmNyXCIgd3JhcHBpbmcgXCJkZXZsXCIpXG4gKiA0LiBEZWJ1Z2dpbmcg4oCUIHJhdyBkYXRhIGluc3BlY3Rpb24gaW1tZWRpYXRlbHkgcmV2ZWFscyB0aGUgZm9ybWF0XG4gKlxuICogRm9ybWF0OiBbNCBieXRlczogZm9ybWF0IGlkZW50aWZpZXJdW3BheWxvYWRdXG4gKlxuICogVGhlIGZvcm1hdCBwcmVmaXggaXMgb3Blbi1lbmRlZCDigJQgYW55IDQtY2hhcmFjdGVyIFthLXowLTldIHN0cmluZyBpcyB2YWxpZC5cbiAqIFRoaXMgYWxsb3dzIG5ldyBjb2RlY3MgdG8gYmUgYWRkZWQgd2l0aG91dCBtb2RpZnlpbmcgdGhpcyBtb2R1bGUuXG4gKi9cblxuaW1wb3J0IHtcbiAgdHlwZSBGb3JtYXRQcmVmaXgsXG4gIGlzRm9ybWF0UHJlZml4LFxuICBTZXJpYWxpemF0aW9uRm9ybWF0LFxufSBmcm9tICcuL3R5cGVzLmpzJztcblxuLyoqIExlbmd0aCBvZiB0aGUgZm9ybWF0IHByZWZpeCBpbiBieXRlcyAqL1xuY29uc3QgRk9STUFUX1BSRUZJWF9MRU5HVEggPSA0O1xuXG5jb25zdCBmb3JtYXRFbmNvZGVyID0gbmV3IFRleHRFbmNvZGVyKCk7XG5jb25zdCBmb3JtYXREZWNvZGVyID0gbmV3IFRleHREZWNvZGVyKCk7XG5cbi8qKlxuICogRW5jb2RlIGEgcGF5bG9hZCB3aXRoIGEgZm9ybWF0IHByZWZpeC5cbiAqXG4gKiBAcGFyYW0gZm9ybWF0IC0gVGhlIGZvcm1hdCBpZGVudGlmaWVyICg0IGNoYXJzLCBbYS16MC05XSlcbiAqIEBwYXJhbSBwYXlsb2FkIC0gVGhlIHNlcmlhbGl6ZWQgcGF5bG9hZCBieXRlc1xuICogQHJldHVybnMgQSBuZXcgVWludDhBcnJheSB3aXRoIGZvcm1hdCBwcmVmaXggcHJlcGVuZGVkXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBlbmNvZGVXaXRoRm9ybWF0UHJlZml4KFxuICBmb3JtYXQ6IEZvcm1hdFByZWZpeCxcbiAgcGF5bG9hZDogVWludDhBcnJheSB8IHVua25vd25cbik6IFVpbnQ4QXJyYXkgfCB1bmtub3duIHtcbiAgaWYgKCEocGF5bG9hZCBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSB7XG4gICAgcmV0dXJuIHBheWxvYWQ7XG4gIH1cblxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGZvcm1hdEVuY29kZXIuZW5jb2RlKGZvcm1hdCk7XG4gIGNvbnN0IHJlc3VsdCA9IG5ldyBVaW50OEFycmF5KEZPUk1BVF9QUkVGSVhfTEVOR1RIICsgcGF5bG9hZC5sZW5ndGgpO1xuICByZXN1bHQuc2V0KHByZWZpeEJ5dGVzLCAwKTtcbiAgcmVzdWx0LnNldChwYXlsb2FkLCBGT1JNQVRfUFJFRklYX0xFTkdUSCk7XG4gIHJldHVybiByZXN1bHQ7XG59XG5cbi8qKlxuICogUGVlayBhdCB0aGUgZm9ybWF0IHByZWZpeCB3aXRob3V0IGNvbnN1bWluZyBpdC5cbiAqXG4gKiBSZXR1cm5zIHRoZSBwcmVmaXggaWYgaXQncyBhIHZhbGlkIGZvcm1hdCBwcmVmaXggKFthLXowLTldezR9KSxcbiAqIG9yIG51bGwgaWYgdGhlIGRhdGEgaXMgbGVnYWN5L25vbi1iaW5hcnkgb3IgZG9lc24ndCBzdGFydCB3aXRoIGFcbiAqIHZhbGlkIHByZWZpeC5cbiAqXG4gKiBAcGFyYW0gZGF0YSAtIFRoZSBmb3JtYXQtcHJlZml4ZWQgZGF0YVxuICogQHJldHVybnMgVGhlIGZvcm1hdCBwcmVmaXgsIG9yIG51bGxcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHBlZWtGb3JtYXRQcmVmaXgoXG4gIGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duXG4pOiBGb3JtYXRQcmVmaXggfCBudWxsIHtcbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpIHx8IGRhdGEubGVuZ3RoIDwgRk9STUFUX1BSRUZJWF9MRU5HVEgpIHtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGRhdGEuc3ViYXJyYXkoMCwgRk9STUFUX1BSRUZJWF9MRU5HVEgpO1xuICBjb25zdCBzdHIgPSBmb3JtYXREZWNvZGVyLmRlY29kZShwcmVmaXhCeXRlcyk7XG4gIHJldHVybiBpc0Zvcm1hdFByZWZpeChzdHIpID8gc3RyIDogbnVsbDtcbn1cblxuLyoqXG4gKiBDaGVjayBpZiBkYXRhIGlzIGVuY3J5cHRlZCAoaGFzICdlbmNyJyBmb3JtYXQgcHJlZml4KS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzRW5jcnlwdGVkKGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duKTogYm9vbGVhbiB7XG4gIHJldHVybiBwZWVrRm9ybWF0UHJlZml4KGRhdGEpID09PSBTZXJpYWxpemF0aW9uRm9ybWF0LkVOQ1JZUFRFRDtcbn1cblxuLyoqXG4gKiBEZWNvZGUgYSBmb3JtYXQtcHJlZml4ZWQgcGF5bG9hZC5cbiAqXG4gKiBVbmxpa2UgdGhlIGxlZ2FjeSBpbXBsZW1lbnRhdGlvbiB3aGljaCBvbmx5IGFjY2VwdGVkIGtub3duIGZvcm1hdHNcbiAqIChgZGV2bGAsIGBlbmNyYCksIHRoaXMgZnVuY3Rpb24gYWNjZXB0cyBhbnkgdmFsaWQgZm9ybWF0IHByZWZpeFxuICogKGBbYS16MC05XXs0fWApLiBUaGlzIGlzIGludGVudGlvbmFsIGZvciBmb3J3YXJkIGNvbXBhdGliaWxpdHkg4oCUXG4gKiBuZXcgY29kZWNzIChlLmcuIGBjYm9yYCkgY2FuIGJlIGFkZGVkIHdpdGhvdXQgbW9kaWZ5aW5nIHRoaXMgbW9kdWxlLlxuICogQ2FsbGVycyBhcmUgcmVzcG9uc2libGUgZm9yIGNoZWNraW5nIHdoZXRoZXIgdGhleSBzdXBwb3J0IHRoZSByZXR1cm5lZFxuICogZm9ybWF0IGFuZCB0aHJvd2luZyBhbiBhcHByb3ByaWF0ZSBlcnJvciBpZiBub3QgKGUuZy4gXCJVbnN1cHBvcnRlZFxuICogc2VyaWFsaXphdGlvbiBmb3JtYXRcIikuXG4gKlxuICogQHBhcmFtIGRhdGEgLSBUaGUgZm9ybWF0LXByZWZpeGVkIGRhdGFcbiAqIEByZXR1cm5zIEFuIG9iamVjdCB3aXRoIHRoZSBmb3JtYXQgcHJlZml4IGFuZCBwYXlsb2FkXG4gKiBAdGhyb3dzIEVycm9yIGlmIHRoZSBkYXRhIGlzIHRvbyBzaG9ydCBvciBoYXMgYW4gaW52YWxpZCBwcmVmaXhcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGRlY29kZUZvcm1hdFByZWZpeChkYXRhOiBVaW50OEFycmF5IHwgdW5rbm93bik6IHtcbiAgZm9ybWF0OiBGb3JtYXRQcmVmaXg7XG4gIHBheWxvYWQ6IFVpbnQ4QXJyYXk7XG59IHtcbiAgLy8gQ29tcGF0IGZvciBsZWdhY3kgc3BlY1ZlcnNpb24gMSBydW5zIHRoYXQgZG9uJ3QgaGF2ZSBhIGZvcm1hdCBwcmVmaXhcbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGZvcm1hdDogU2VyaWFsaXphdGlvbkZvcm1hdC5ERVZBTFVFX1YxLFxuICAgICAgcGF5bG9hZDogbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKEpTT04uc3RyaW5naWZ5KGRhdGEpKSxcbiAgICB9O1xuICB9XG5cbiAgaWYgKGRhdGEubGVuZ3RoIDwgRk9STUFUX1BSRUZJWF9MRU5HVEgpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICBgRGF0YSB0b28gc2hvcnQgdG8gY29udGFpbiBmb3JtYXQgcHJlZml4OiBleHBlY3RlZCBhdCBsZWFzdCAke0ZPUk1BVF9QUkVGSVhfTEVOR1RIfSBieXRlcywgZ290ICR7ZGF0YS5sZW5ndGh9YFxuICAgICk7XG4gIH1cblxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGRhdGEuc3ViYXJyYXkoMCwgRk9STUFUX1BSRUZJWF9MRU5HVEgpO1xuICBjb25zdCBzdHIgPSBmb3JtYXREZWNvZGVyLmRlY29kZShwcmVmaXhCeXRlcyk7XG5cbiAgaWYgKCFpc0Zvcm1hdFByZWZpeChzdHIpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYEludmFsaWQgZm9ybWF0IHByZWZpeDogXCIke3N0cn1cIi4gTXVzdCBiZSA0IGNoYXJhY3RlcnMgb2YgW2EtejAtOV0uYFxuICAgICk7XG4gIH1cblxuICBjb25zdCBwYXlsb2FkID0gZGF0YS5zdWJhcnJheShGT1JNQVRfUFJFRklYX0xFTkdUSCk7XG4gIHJldHVybiB7IGZvcm1hdDogc3RyLCBwYXlsb2FkIH07XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9ybWF0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcmlhbGl6YXRpb24vZm9ybWF0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUVILE9BQU8sRUFFTCxjQUFjLEVBQ2QsbUJBQW1CLEdBQ3BCLE1BQU0sWUFBWSxDQUFDO0FBRXBCLDJDQUEyQztBQUMzQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsQ0FBQztBQUUvQixNQUFNLGFBQWEsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO0FBQ3hDLE1BQU0sYUFBYSxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFFeEM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUNwQyxNQUFvQixFQUNwQixPQUE2QjtJQUU3QixJQUFJLENBQUMsQ0FBQyxPQUFPLFlBQVksVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNyQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRCxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxvQkFBb0IsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDckUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDM0IsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztJQUMxQyxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUM5QixJQUEwQjtJQUUxQixJQUFJLENBQUMsQ0FBQyxJQUFJLFlBQVksVUFBVSxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3hFLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLG9CQUFvQixDQUFDLENBQUM7SUFDM0QsTUFBTSxHQUFHLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM5QyxPQUFPLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDMUMsQ0FBQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxVQUFVLFdBQVcsQ0FBQyxJQUEwQjtJQUNwRCxPQUFPLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLG1CQUFtQixDQUFDLFNBQVMsQ0FBQztBQUNsRSxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQUMsSUFBMEI7SUFJM0QsdUVBQXVFO0lBQ3ZFLElBQUksQ0FBQyxDQUFDLElBQUksWUFBWSxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU87WUFDTCxNQUFNLEVBQUUsbUJBQW1CLENBQUMsVUFBVTtZQUN0QyxPQUFPLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztTQUN4RCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sSUFBSSxLQUFLLENBQ2IsOERBQThELG9CQUFvQixlQUFlLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FDL0csQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO0lBQzNELE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7SUFFOUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQ2IsMkJBQTJCLEdBQUcsc0NBQXNDLENBQ3JFLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQ2xDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEZvcm1hdCBwcmVmaXggc3lzdGVtIGZvciBzZXJpYWxpemVkIHBheWxvYWRzLlxuICpcbiAqIEFsbCBzZXJpYWxpemVkIHBheWxvYWRzIGFyZSBwcmVmaXhlZCB3aXRoIGEgNC1ieXRlIGZvcm1hdCBpZGVudGlmaWVyIHRoYXRcbiAqIGFsbG93cyB0aGUgZGVzZXJpYWxpemVyIHRvIGRldGVybWluZSBob3cgdG8gZGVjb2RlIHRoZSBwYXlsb2FkLiBUaGlzIGVuYWJsZXM6XG4gKlxuICogMS4gU2VsZi1kZXNjcmliaW5nIHBheWxvYWRzOiB0aGUgV29ybGQgbGF5ZXIgaXMgYWdub3N0aWMgdG8gc2VyaWFsaXphdGlvbiBmb3JtYXRcbiAqIDIuIEdyYWR1YWwgbWlncmF0aW9uOiBvbGQgcnVucyBrZWVwIHdvcmtpbmcsIG5ldyBydW5zIGNhbiB1c2UgbmV3IGZvcm1hdHNcbiAqIDMuIENvbXBvc2FiaWxpdHk6IGVuY3J5cHRpb24gY2FuIHdyYXAgYW55IGZvcm1hdCAoXCJlbmNyXCIgd3JhcHBpbmcgXCJkZXZsXCIpXG4gKiA0LiBEZWJ1Z2dpbmc6IHJhdyBkYXRhIGluc3BlY3Rpb24gaW1tZWRpYXRlbHkgcmV2ZWFscyB0aGUgZm9ybWF0XG4gKlxuICogRm9ybWF0OiBbNCBieXRlczogZm9ybWF0IGlkZW50aWZpZXJdW3BheWxvYWRdXG4gKlxuICogVGhlIGZvcm1hdCBwcmVmaXggaXMgb3Blbi1lbmRlZDogYW55IDQtY2hhcmFjdGVyIFthLXowLTldIHN0cmluZyBpcyB2YWxpZC5cbiAqIFRoaXMgYWxsb3dzIG5ldyBjb2RlY3MgdG8gYmUgYWRkZWQgd2l0aG91dCBtb2RpZnlpbmcgdGhpcyBtb2R1bGUuXG4gKi9cblxuaW1wb3J0IHtcbiAgdHlwZSBGb3JtYXRQcmVmaXgsXG4gIGlzRm9ybWF0UHJlZml4LFxuICBTZXJpYWxpemF0aW9uRm9ybWF0LFxufSBmcm9tICcuL3R5cGVzLmpzJztcblxuLyoqIExlbmd0aCBvZiB0aGUgZm9ybWF0IHByZWZpeCBpbiBieXRlcyAqL1xuY29uc3QgRk9STUFUX1BSRUZJWF9MRU5HVEggPSA0O1xuXG5jb25zdCBmb3JtYXRFbmNvZGVyID0gbmV3IFRleHRFbmNvZGVyKCk7XG5jb25zdCBmb3JtYXREZWNvZGVyID0gbmV3IFRleHREZWNvZGVyKCk7XG5cbi8qKlxuICogRW5jb2RlIGEgcGF5bG9hZCB3aXRoIGEgZm9ybWF0IHByZWZpeC5cbiAqXG4gKiBAcGFyYW0gZm9ybWF0IC0gVGhlIGZvcm1hdCBpZGVudGlmaWVyICg0IGNoYXJzLCBbYS16MC05XSlcbiAqIEBwYXJhbSBwYXlsb2FkIC0gVGhlIHNlcmlhbGl6ZWQgcGF5bG9hZCBieXRlc1xuICogQHJldHVybnMgQSBuZXcgVWludDhBcnJheSB3aXRoIGZvcm1hdCBwcmVmaXggcHJlcGVuZGVkXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBlbmNvZGVXaXRoRm9ybWF0UHJlZml4KFxuICBmb3JtYXQ6IEZvcm1hdFByZWZpeCxcbiAgcGF5bG9hZDogVWludDhBcnJheSB8IHVua25vd25cbik6IFVpbnQ4QXJyYXkgfCB1bmtub3duIHtcbiAgaWYgKCEocGF5bG9hZCBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSB7XG4gICAgcmV0dXJuIHBheWxvYWQ7XG4gIH1cblxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGZvcm1hdEVuY29kZXIuZW5jb2RlKGZvcm1hdCk7XG4gIGNvbnN0IHJlc3VsdCA9IG5ldyBVaW50OEFycmF5KEZPUk1BVF9QUkVGSVhfTEVOR1RIICsgcGF5bG9hZC5sZW5ndGgpO1xuICByZXN1bHQuc2V0KHByZWZpeEJ5dGVzLCAwKTtcbiAgcmVzdWx0LnNldChwYXlsb2FkLCBGT1JNQVRfUFJFRklYX0xFTkdUSCk7XG4gIHJldHVybiByZXN1bHQ7XG59XG5cbi8qKlxuICogUGVlayBhdCB0aGUgZm9ybWF0IHByZWZpeCB3aXRob3V0IGNvbnN1bWluZyBpdC5cbiAqXG4gKiBSZXR1cm5zIHRoZSBwcmVmaXggaWYgaXQncyBhIHZhbGlkIGZvcm1hdCBwcmVmaXggKFthLXowLTldezR9KSxcbiAqIG9yIG51bGwgaWYgdGhlIGRhdGEgaXMgbGVnYWN5L25vbi1iaW5hcnkgb3IgZG9lc24ndCBzdGFydCB3aXRoIGFcbiAqIHZhbGlkIHByZWZpeC5cbiAqXG4gKiBAcGFyYW0gZGF0YSAtIFRoZSBmb3JtYXQtcHJlZml4ZWQgZGF0YVxuICogQHJldHVybnMgVGhlIGZvcm1hdCBwcmVmaXgsIG9yIG51bGxcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHBlZWtGb3JtYXRQcmVmaXgoXG4gIGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duXG4pOiBGb3JtYXRQcmVmaXggfCBudWxsIHtcbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpIHx8IGRhdGEubGVuZ3RoIDwgRk9STUFUX1BSRUZJWF9MRU5HVEgpIHtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGRhdGEuc3ViYXJyYXkoMCwgRk9STUFUX1BSRUZJWF9MRU5HVEgpO1xuICBjb25zdCBzdHIgPSBmb3JtYXREZWNvZGVyLmRlY29kZShwcmVmaXhCeXRlcyk7XG4gIHJldHVybiBpc0Zvcm1hdFByZWZpeChzdHIpID8gc3RyIDogbnVsbDtcbn1cblxuLyoqXG4gKiBDaGVjayBpZiBkYXRhIGlzIGVuY3J5cHRlZCAoaGFzICdlbmNyJyBmb3JtYXQgcHJlZml4KS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzRW5jcnlwdGVkKGRhdGE6IFVpbnQ4QXJyYXkgfCB1bmtub3duKTogYm9vbGVhbiB7XG4gIHJldHVybiBwZWVrRm9ybWF0UHJlZml4KGRhdGEpID09PSBTZXJpYWxpemF0aW9uRm9ybWF0LkVOQ1JZUFRFRDtcbn1cblxuLyoqXG4gKiBEZWNvZGUgYSBmb3JtYXQtcHJlZml4ZWQgcGF5bG9hZC5cbiAqXG4gKiBVbmxpa2UgdGhlIGxlZ2FjeSBpbXBsZW1lbnRhdGlvbiB3aGljaCBvbmx5IGFjY2VwdGVkIGtub3duIGZvcm1hdHNcbiAqIChgZGV2bGAsIGBlbmNyYCksIHRoaXMgZnVuY3Rpb24gYWNjZXB0cyBhbnkgdmFsaWQgZm9ybWF0IHByZWZpeFxuICogKGBbYS16MC05XXs0fWApLiBUaGlzIGlzIGludGVudGlvbmFsIGZvciBmb3J3YXJkIGNvbXBhdGliaWxpdHksIHNvXG4gKiBuZXcgY29kZWNzIChlLmcuIGBjYm9yYCkgY2FuIGJlIGFkZGVkIHdpdGhvdXQgbW9kaWZ5aW5nIHRoaXMgbW9kdWxlLlxuICogQ2FsbGVycyBhcmUgcmVzcG9uc2libGUgZm9yIGNoZWNraW5nIHdoZXRoZXIgdGhleSBzdXBwb3J0IHRoZSByZXR1cm5lZFxuICogZm9ybWF0IGFuZCB0aHJvd2luZyBhbiBhcHByb3ByaWF0ZSBlcnJvciBpZiBub3QgKGUuZy4gXCJVbnN1cHBvcnRlZFxuICogc2VyaWFsaXphdGlvbiBmb3JtYXRcIikuXG4gKlxuICogQHBhcmFtIGRhdGEgLSBUaGUgZm9ybWF0LXByZWZpeGVkIGRhdGFcbiAqIEByZXR1cm5zIEFuIG9iamVjdCB3aXRoIHRoZSBmb3JtYXQgcHJlZml4IGFuZCBwYXlsb2FkXG4gKiBAdGhyb3dzIEVycm9yIGlmIHRoZSBkYXRhIGlzIHRvbyBzaG9ydCBvciBoYXMgYW4gaW52YWxpZCBwcmVmaXhcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGRlY29kZUZvcm1hdFByZWZpeChkYXRhOiBVaW50OEFycmF5IHwgdW5rbm93bik6IHtcbiAgZm9ybWF0OiBGb3JtYXRQcmVmaXg7XG4gIHBheWxvYWQ6IFVpbnQ4QXJyYXk7XG59IHtcbiAgLy8gQ29tcGF0IGZvciBsZWdhY3kgc3BlY1ZlcnNpb24gMSBydW5zIHRoYXQgZG9uJ3QgaGF2ZSBhIGZvcm1hdCBwcmVmaXhcbiAgaWYgKCEoZGF0YSBpbnN0YW5jZW9mIFVpbnQ4QXJyYXkpKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGZvcm1hdDogU2VyaWFsaXphdGlvbkZvcm1hdC5ERVZBTFVFX1YxLFxuICAgICAgcGF5bG9hZDogbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKEpTT04uc3RyaW5naWZ5KGRhdGEpKSxcbiAgICB9O1xuICB9XG5cbiAgaWYgKGRhdGEubGVuZ3RoIDwgRk9STUFUX1BSRUZJWF9MRU5HVEgpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICBgRGF0YSB0b28gc2hvcnQgdG8gY29udGFpbiBmb3JtYXQgcHJlZml4OiBleHBlY3RlZCBhdCBsZWFzdCAke0ZPUk1BVF9QUkVGSVhfTEVOR1RIfSBieXRlcywgZ290ICR7ZGF0YS5sZW5ndGh9YFxuICAgICk7XG4gIH1cblxuICBjb25zdCBwcmVmaXhCeXRlcyA9IGRhdGEuc3ViYXJyYXkoMCwgRk9STUFUX1BSRUZJWF9MRU5HVEgpO1xuICBjb25zdCBzdHIgPSBmb3JtYXREZWNvZGVyLmRlY29kZShwcmVmaXhCeXRlcyk7XG5cbiAgaWYgKCFpc0Zvcm1hdFByZWZpeChzdHIpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYEludmFsaWQgZm9ybWF0IHByZWZpeDogXCIke3N0cn1cIi4gTXVzdCBiZSA0IGNoYXJhY3RlcnMgb2YgW2EtejAtOV0uYFxuICAgICk7XG4gIH1cblxuICBjb25zdCBwYXlsb2FkID0gZGF0YS5zdWJhcnJheShGT1JNQVRfUFJFRklYX0xFTkdUSCk7XG4gIHJldHVybiB7IGZvcm1hdDogc3RyLCBwYXlsb2FkIH07XG59XG4iXX0=

package/dist/serialization/hardened.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Hardened introspection for serializing values that may originate inside a
+ * workflow VM (`node:vm`) sandbox realm.
+ *
+ * Serialization runs on the host, but the values it inspects were
+ * constructed by workflow code, so a naive dynamic operation like
+ * `value.toISOString()`, `Array.from(map)`, or `Object.prototype.toString`
+ * dispatches into the sandbox realm and executes workflow code (patched
+ * prototype methods, getters, proxy traps, `Symbol.toStringTag` accessors).
+ * That is a determinism hazard: serialization happens exactly once per
+ * payload (never again on replay), so any workflow-visible side effect it
+ * triggers exists only on the live execution path and diverges from replay.
+ *
+ * This module makes serialization side-effect free wherever the data allows
+ * it, and *observable* where it does not:
+ *
+ * - **Classification** uses engine-level brand checks (`node:util` `types`,
+ *   internal-slot probes) instead of `instanceof` / `Object.prototype.toString`,
+ *   which makes it immune to `Symbol.hasInstance`, `Symbol.toStringTag`, and
+ *   reassigned globals.
+ * - **Extraction** goes through intrinsics captured at module load (host
+ *   boot, before any workflow code runs). Internal slots are realm-agnostic,
+ *   so host intrinsics read VM-realm objects without touching the sandbox's
+ *   (patchable) prototypes.
+ * - **Property access** reads through descriptors, so plain data never
+ *   invokes anything. Where workflow code *must* run because the data itself
+ *   lives behind it (getters, proxies, custom `[WORKFLOW_SERIALIZE]`
+ *   methods, `toString()` on toStringTag-branded objects such as Temporal
+ *   polyfills), the execution is preserved for compatibility and recorded
+ *   in the active {@link GuestCodeStats} sink, so callers (e.g. a retained-VM
+ *   gate) can react.
+ *
+ * **Recording is not prevention.** For the recorded cases the determinism
+ * hazard is still live: a getter that calls `Math.random()` advances the
+ * run's seeded PRNG during serialization, and because serialization happens
+ * exactly once and is never replayed, every subsequent draw (including the
+ * correlation ids derived from that stream) shifts relative to replay. The
+ * report is the only trace of that; acting on it (warning, demoting a
+ * retained VM to replay) is left to the caller.
+ *
+ * The recorder is ambient module state, set for the duration of a
+ * synchronous `stringify` call via {@link withGuestCodeStats}. devalue's
+ * `stringify` is fully synchronous, so this is safe without async context.
+ */
+import type { StringifyOperations } from 'devalue';
+/**
+ * A single instance of workflow (guest) code executing during serialization.
+ */
+export interface GuestCodeExecution {
+    /**
+     * What forced the execution:
+     * - `getter`: an accessor property was invoked to read data
+     * - `proxy`: a proxy was introspected, firing its traps. Note this also
+     *   implies a **shape change**: brand checks answer "not that type" for a
+     *   proxy, so a proxied `Map` serializes as a plain object rather than as a
+     *   `Map`, and this report is the only evidence of it. (Such values were
+     *   never serializable before, since the internal-slot reads in the previous
+     *   implementation threw on them, so the shape change replaces a crash,
+     *   but it is silent.)
+     * - `method`: a workflow-defined function was invoked (e.g. a custom
+     *   `[WORKFLOW_SERIALIZE]` serializer, `toString()` on a
+     *   `Symbol.toStringTag`-branded object, a duck-typed `getTime()`, or a
+     *   `__closureVarsFn` this package did not generate)
+     */
+    kind: 'getter' | 'proxy' | 'method';
+    /** Best-effort context: the property key, method name, or tag involved. */
+    detail?: string;
+}
+/**
+ * Mutable sink recording workflow-code execution serialization could not
+ * avoid. `executions` contains the first five samples and `totalExecutions`
+ * is the exact count.
+ */
+export interface GuestCodeStats {
+    executions: GuestCodeExecution[];
+    totalExecutions?: number;
+}
+export declare const GUEST_CODE_EXECUTION_SAMPLE_LIMIT = 5;
+/**
+ * Runs `fn` (synchronously) with `stats` as the active guest-code sink.
+ * Nested calls stack correctly; a `null`/`undefined` sink disables
+ * recording without disabling hardening.
+ */
+export declare function withGuestCodeStats<T>(stats: GuestCodeStats | undefined, fn: () => T): T;
+/** Marks a function as having been passed to `useStep`. */
+export declare function markUseStepClosureFn<T extends object>(fn: T): T;
+/** Whether `fn` was marked by {@link markUseStepClosureFn}. */
+export declare function isUseStepClosureFn(fn: unknown): boolean;
+export declare function recordGuestCode(kind: GuestCodeExecution['kind'], detail?: string): void;
+/** `Date.prototype.getDate`, for invalid-date checks. */
+export declare const dateGetDate: (thisArg: unknown) => number;
+/** `Date.prototype.getTime`. */
+export declare const dateGetTime: (thisArg: unknown) => number;
+/** `Date.prototype.toISOString`. */
+export declare const dateToISOString: (thisArg: unknown) => string;
+/** `RegExp.prototype.source` getter. */
+export declare const regExpSource: (value: unknown) => string;
+/** `RegExp.prototype.flags` getter. */
+export declare const regExpFlags: (value: unknown) => string;
+/** `ArrayBuffer.prototype.byteLength` getter (internal slot read). */
+export declare const arrayBufferByteLength: (value: unknown) => number;
+/**
+ * Reads `value[key]` with `[[Get]]` semantics, but through descriptors:
+ * plain data properties never invoke anything; accessor properties are
+ * invoked (the data lives behind them) and recorded; proxies fall back to
+ * a plain read (their traps are the only access path) and are recorded.
+ */
+export declare function readProperty(value: unknown, key: PropertyKey): unknown;
+/**
+ * `key in value` semantics without firing proxy traps for ordinary
+ * objects. Proxies fall back to the `in` operator and are recorded.
+ */
+export declare function hasProperty(value: unknown, key: PropertyKey): boolean;
+/**
+ * `value instanceof C` semantics for a known `C.prototype`, without
+ * consulting `Symbol.hasInstance` (which workflow code can define). Used
+ * for host classes that are injected into the sandbox (Headers, URL,
+ * URLSearchParams, DOMException), where the instances (from any realm the
+ * host handed the class to) carry the host prototype in their chain.
+ *
+ * Proxies are walked rather than rejected: `Reflect.getPrototypeOf` fires
+ * the proxy's `getPrototypeOf` trap, matching `instanceof` semantics, and
+ * real values depend on that: Next.js hands the runtime a proxied
+ * `NextRequest`, and answering "not a Request" for it would silently break
+ * webhooks. The traps are guest-observable, so the proxy is recorded.
+ */
+export declare function isInstanceOfPrototype(value: unknown, prototype: object | undefined): boolean;
+/** `URL.prototype.href` getter. */
+export declare function urlHref(value: URL): string;
+/** `URLSearchParams.prototype.toString`: returns `''` iff empty. */
+export declare function urlSearchParamsToString(value: URLSearchParams): string;
+/**
+ * Iterates a Headers instance through the captured host iterator, so the
+ * iterator object, and its `next`, are host-realm.
+ */
+export declare function headersToEntries(value: Headers): [string, string][];
+/**
+ * Iterates a genuine Map's entries entirely through host intrinsics: the
+ * iterator object is created by the host `Map.prototype.entries`, so its
+ * realm, and therefore its `next`, is the host's, not the sandbox's.
+ */
+export declare function mapToEntries(value: Map<unknown, unknown>): [unknown, unknown][];
+/** See {@link mapToEntries}. */
+export declare function setToValues(value: Set<unknown>): unknown[];
+/**
+ * The bytes of an `ArrayBufferView`, read via internal-slot getters, so
+ * own-property shadowing and prototype patches cannot change which bytes
+ * are serialized.
+ */
+export declare function viewInfo(value: ArrayBufferView): {
+    buffer: ArrayBufferLike;
+    byteOffset: number;
+    byteLength: number;
+};
+export declare const hardenedStringifyOperations: Partial<StringifyOperations>;
+//# sourceMappingURL=hardened.d.ts.map

package/dist/serialization/hardened.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardened.d.ts","sourceRoot":"","sources":["../../src/serialization/hardened.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAKnD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAUnD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAWH;AAyBD,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAG/D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAChC,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAUN;AAwCD,yDAAyD;AACzD,eAAO,MAAM,WAAW,8BAAsC,CAAC;AAC/D,gCAAgC;AAChC,eAAO,MAAM,WAAW,8BAAsC,CAAC;AAC/D,oCAAoC;AACpC,eAAO,MAAM,eAAe,8BAA0C,CAAC;AACvE,wCAAwC;AACxC,eAAO,MAAM,YAAY,UAlBd,OAAO,WAkByD,CAAC;AAC5E,uCAAuC;AACvC,eAAO,MAAM,WAAW,UApBb,OAAO,WAoBuD,CAAC;AAC1E,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,UAtBvB,OAAO,WAyBjB,CAAC;AAiGF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAiCtE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAsBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAWT;AASD,mCAAmC;AACnC,wBAAgB,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAM1C;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAMtE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAMnE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAC3B,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAEtB;AAED,gCAAgC;AAChC,wBAAgB,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG;IAChD,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAaA;AAyFD,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,mBAAmB,CAgFpE,CAAC"}