@cipherstash/stack 0.4.0 → 0.5.0

package/dist/supabase/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/supabase/helpers.ts","../../src/supabase/query-builder.ts","../../src/supabase/index.ts"],"sourcesContent":["import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { QueryTypeName } from '@/types'\nimport type { FilterOp, PendingOrCondition } from './types'\n\n/**\n * Get the names of all encrypted columns defined in a table schema.\n */\nexport function getEncryptedColumnNames(\n  schema: EncryptedTable<EncryptedTableColumn>,\n): string[] {\n  const built = schema.build()\n  return Object.keys(built.columns)\n}\n\n/**\n * Check whether a column name refers to an encrypted column in the schema.\n */\nexport function isEncryptedColumn(\n  columnName: string,\n  encryptedColumnNames: string[],\n): boolean {\n  return encryptedColumnNames.includes(columnName)\n}\n\n/**\n * Parse a Supabase select string and add `::jsonb` casts to encrypted columns.\n *\n * Input:  `'id, email, name'`\n * Output: `'id, email::jsonb, name::jsonb'`  (if email and name are encrypted)\n *\n * Handles whitespace, already-cast columns, and embedded functions.\n */\nexport function addJsonbCasts(\n  columns: string,\n  encryptedColumnNames: string[],\n): string {\n  return columns\n    .split(',')\n    .map((col) => {\n      const trimmed = col.trim()\n\n      // Skip empty segments\n      if (!trimmed) return col\n\n      // If it already has a cast (e.g. `email::jsonb`), skip\n      if (trimmed.includes('::')) return col\n\n      // If it contains parens (function call) or dots (foreign table), skip\n      if (trimmed.includes('(') || trimmed.includes('.')) return col\n\n      // Check if the column name (possibly with alias) is encrypted\n      // Handle `column_name` or `column_name as alias`\n      const parts = trimmed.split(/\\s+/)\n      const colName = parts[0]\n\n      if (isEncryptedColumn(colName, encryptedColumnNames)) {\n        // Preserve original whitespace before the column\n        const leadingWhitespace = col.match(/^(\\s*)/)?.[1] ?? ''\n        if (parts.length > 1) {\n          // Has alias: `email as e` -> `email::jsonb as e`\n          return `${leadingWhitespace}${colName}::jsonb ${parts.slice(1).join(' ')}`\n        }\n        return `${leadingWhitespace}${colName}::jsonb`\n      }\n\n      return col\n    })\n    .join(',')\n}\n\n/**\n * Map a Supabase filter operation to a CipherStash query type.\n */\nexport function mapFilterOpToQueryType(op: FilterOp): QueryTypeName {\n  switch (op) {\n    case 'eq':\n    case 'neq':\n    case 'in':\n    case 'is':\n      return 'equality'\n    case 'like':\n    case 'ilike':\n      return 'freeTextSearch'\n    case 'gt':\n    case 'gte':\n    case 'lt':\n    case 'lte':\n      return 'orderAndRange'\n    default:\n      return 'equality'\n  }\n}\n\n/**\n * Parse a Supabase `.or()` filter string into structured conditions.\n *\n * Input: `'email.eq.john@example.com,name.ilike.%john%'`\n * Output: `[{ column: 'email', op: 'eq', value: 'john@example.com' }, { column: 'name', op: 'ilike', value: '%john%' }]`\n */\nexport function parseOrString(orString: string): PendingOrCondition[] {\n  const conditions: PendingOrCondition[] = []\n  // Split on commas that are not inside parentheses (nested or/and)\n  const parts = splitOrString(orString)\n\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (!trimmed) continue\n\n    // Format: column.op.value\n    const firstDot = trimmed.indexOf('.')\n    if (firstDot === -1) continue\n\n    const column = trimmed.slice(0, firstDot)\n    const rest = trimmed.slice(firstDot + 1)\n\n    const secondDot = rest.indexOf('.')\n    if (secondDot === -1) continue\n\n    const op = rest.slice(0, secondDot) as FilterOp\n    const value = rest.slice(secondDot + 1)\n\n    // Handle special value formats\n    const parsedValue = parseOrValue(value)\n\n    conditions.push({ column, op, value: parsedValue })\n  }\n\n  return conditions\n}\n\n/**\n * Rebuild an `.or()` string from structured conditions.\n */\nexport function rebuildOrString(conditions: PendingOrCondition[]): string {\n  return conditions\n    .map((c) => {\n      const value = formatOrValue(c.value)\n      return `${c.column}.${c.op}.${value}`\n    })\n    .join(',')\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction splitOrString(input: string): string[] {\n  const parts: string[] = []\n  let current = ''\n  let depth = 0\n\n  for (const char of input) {\n    if (char === '(') {\n      depth++\n      current += char\n    } else if (char === ')') {\n      depth--\n      current += char\n    } else if (char === ',' && depth === 0) {\n      parts.push(current)\n      current = ''\n    } else {\n      current += char\n    }\n  }\n\n  if (current) {\n    parts.push(current)\n  }\n\n  return parts\n}\n\nfunction parseOrValue(value: string): unknown {\n  // Handle parenthesized lists: (val1,val2,val3)\n  if (value.startsWith('(') && value.endsWith(')')) {\n    return value\n      .slice(1, -1)\n      .split(',')\n      .map((v) => v.trim())\n  }\n\n  // Handle booleans\n  if (value === 'true') return true\n  if (value === 'false') return false\n\n  // Handle null\n  if (value === 'null') return null\n\n  return value\n}\n\nfunction formatOrValue(value: unknown): string {\n  if (Array.isArray(value)) {\n    return `(${value.join(',')})`\n  }\n  if (value === null) return 'null'\n  if (value === true) return 'true'\n  if (value === false) return 'false'\n  return String(value)\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { AuditConfig } from '@/encryption/operations/base-operation'\nimport {\n  bulkModelsToEncryptedPgComposites,\n  modelToEncryptedPgComposites,\n} from '@/encryption/helpers'\nimport type { LockContext } from '@/identity'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { EncryptedColumn } from '@/schema'\nimport type { ScalarQueryTerm } from '@/types'\nimport type { JsPlaintext } from '@cipherstash/protect-ffi'\nimport {\n  addJsonbCasts,\n  getEncryptedColumnNames,\n  isEncryptedColumn,\n  mapFilterOpToQueryType,\n  parseOrString,\n  rebuildOrString,\n} from './helpers'\nimport type {\n  EncryptedSupabaseError,\n  EncryptedSupabaseResponse,\n  FilterOp,\n  MutationOp,\n  PendingFilter,\n  PendingMatchFilter,\n  PendingNotFilter,\n  PendingOrCondition,\n  PendingOrFilter,\n  PendingRawFilter,\n  ResultMode,\n  SupabaseClientLike,\n  SupabaseQueryBuilder,\n  TransformOp,\n} from './types'\n\n/**\n * A deferred query builder that wraps Supabase's query builder to automatically\n * handle encryption and decryption of data.\n *\n * All chained operations are recorded synchronously. When the builder is awaited,\n * it encrypts mutation data, adds `::jsonb` casts, batch-encrypts filter values,\n * executes the real Supabase query, and decrypts results.\n */\nexport class EncryptedQueryBuilderImpl<\n  T extends Record<string, unknown> = Record<string, unknown>,\n> {\n  private tableName: string\n  private schema: EncryptedTable<EncryptedTableColumn>\n  private encryptionClient: EncryptionClient\n  private supabaseClient: SupabaseClientLike\n  private encryptedColumnNames: string[]\n\n  // Recorded operations\n  private mutation: MutationOp | null = null\n  private selectColumns: string | null = null\n  private selectOptions:\n    | { head?: boolean; count?: 'exact' | 'planned' | 'estimated' }\n    | undefined = undefined\n  private filters: PendingFilter[] = []\n  private orFilters: PendingOrFilter[] = []\n  private matchFilters: PendingMatchFilter[] = []\n  private notFilters: PendingNotFilter[] = []\n  private rawFilters: PendingRawFilter[] = []\n  private transforms: TransformOp[] = []\n  private resultMode: ResultMode = 'array'\n  private shouldThrowOnError = false\n\n  // Encryption-specific state\n  private lockContext: LockContext | null = null\n  private auditConfig: AuditConfig | null = null\n\n  constructor(\n    tableName: string,\n    schema: EncryptedTable<EncryptedTableColumn>,\n    encryptionClient: EncryptionClient,\n    supabaseClient: SupabaseClientLike,\n  ) {\n    this.tableName = tableName\n    this.schema = schema\n    this.encryptionClient = encryptionClient\n    this.supabaseClient = supabaseClient\n    this.encryptedColumnNames = getEncryptedColumnNames(schema)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Mutation methods\n  // ---------------------------------------------------------------------------\n\n  select(\n    columns: string,\n    options?: { head?: boolean; count?: 'exact' | 'planned' | 'estimated' },\n  ): this {\n    if (columns === '*') {\n      throw new Error(\n        \"encryptedSupabase does not support select('*'). Please list columns explicitly so that encrypted columns can be cast with ::jsonb.\",\n      )\n    }\n    this.selectColumns = columns\n    this.selectOptions = options\n    return this\n  }\n\n  insert(\n    data: Partial<T> | Partial<T>[],\n    options?: {\n      count?: 'exact' | 'planned' | 'estimated'\n      defaultToNull?: boolean\n      onConflict?: string\n    },\n  ): this {\n    this.mutation = {\n      kind: 'insert',\n      data: data as Record<string, unknown> | Record<string, unknown>[],\n      options,\n    }\n    return this\n  }\n\n  update(\n    data: Partial<T>,\n    options?: { count?: 'exact' | 'planned' | 'estimated' },\n  ): this {\n    this.mutation = {\n      kind: 'update',\n      data: data as Record<string, unknown>,\n      options,\n    }\n    return this\n  }\n\n  upsert(\n    data: Partial<T> | Partial<T>[],\n    options?: {\n      count?: 'exact' | 'planned' | 'estimated'\n      onConflict?: string\n      ignoreDuplicates?: boolean\n      defaultToNull?: boolean\n    },\n  ): this {\n    this.mutation = {\n      kind: 'upsert',\n      data: data as Record<string, unknown> | Record<string, unknown>[],\n      options,\n    }\n    return this\n  }\n\n  delete(options?: { count?: 'exact' | 'planned' | 'estimated' }): this {\n    this.mutation = { kind: 'delete', options }\n    return this\n  }\n\n  // ---------------------------------------------------------------------------\n  // Filter methods\n  // ---------------------------------------------------------------------------\n\n  eq(column: string, value: unknown): this {\n    this.filters.push({ op: 'eq', column, value })\n    return this\n  }\n\n  neq(column: string, value: unknown): this {\n    this.filters.push({ op: 'neq', column, value })\n    return this\n  }\n\n  gt(column: string, value: unknown): this {\n    this.filters.push({ op: 'gt', column, value })\n    return this\n  }\n\n  gte(column: string, value: unknown): this {\n    this.filters.push({ op: 'gte', column, value })\n    return this\n  }\n\n  lt(column: string, value: unknown): this {\n    this.filters.push({ op: 'lt', column, value })\n    return this\n  }\n\n  lte(column: string, value: unknown): this {\n    this.filters.push({ op: 'lte', column, value })\n    return this\n  }\n\n  like(column: string, pattern: string): this {\n    this.filters.push({ op: 'like', column, value: pattern })\n    return this\n  }\n\n  ilike(column: string, pattern: string): this {\n    this.filters.push({ op: 'ilike', column, value: pattern })\n    return this\n  }\n\n  is(column: string, value: null | boolean): this {\n    this.filters.push({ op: 'is', column, value })\n    return this\n  }\n\n  in(column: string, values: unknown[]): this {\n    this.filters.push({ op: 'in', column, value: values })\n    return this\n  }\n\n  filter(column: string, operator: string, value: unknown): this {\n    this.rawFilters.push({ column, operator, value })\n    return this\n  }\n\n  not(column: string, operator: string, value: unknown): this {\n    this.notFilters.push({ column, op: operator as FilterOp, value })\n    return this\n  }\n\n  or(\n    filtersOrConditions: string | PendingOrCondition[],\n    options?: { referencedTable?: string; foreignTable?: string },\n  ): this {\n    if (typeof filtersOrConditions === 'string') {\n      this.orFilters.push({\n        kind: 'string',\n        value: filtersOrConditions,\n        referencedTable: options?.referencedTable ?? options?.foreignTable,\n      })\n    } else {\n      this.orFilters.push({\n        kind: 'structured',\n        conditions: filtersOrConditions,\n      })\n    }\n    return this\n  }\n\n  match(query: Record<string, unknown>): this {\n    this.matchFilters.push({ query })\n    return this\n  }\n\n  // ---------------------------------------------------------------------------\n  // Transform methods (passthrough)\n  // ---------------------------------------------------------------------------\n\n  order(\n    column: string,\n    options?: {\n      ascending?: boolean\n      nullsFirst?: boolean\n      referencedTable?: string\n      foreignTable?: string\n    },\n  ): this {\n    this.transforms.push({ kind: 'order', column, options })\n    return this\n  }\n\n  limit(\n    count: number,\n    options?: { referencedTable?: string; foreignTable?: string },\n  ): this {\n    this.transforms.push({ kind: 'limit', count, options })\n    return this\n  }\n\n  range(\n    from: number,\n    to: number,\n    options?: { referencedTable?: string; foreignTable?: string },\n  ): this {\n    this.transforms.push({ kind: 'range', from, to, options })\n    return this\n  }\n\n  single(): this {\n    this.resultMode = 'single'\n    this.transforms.push({ kind: 'single' })\n    return this\n  }\n\n  maybeSingle(): this {\n    this.resultMode = 'maybeSingle'\n    this.transforms.push({ kind: 'maybeSingle' })\n    return this\n  }\n\n  csv(): this {\n    this.transforms.push({ kind: 'csv' })\n    return this\n  }\n\n  abortSignal(signal: AbortSignal): this {\n    this.transforms.push({ kind: 'abortSignal', signal })\n    return this\n  }\n\n  throwOnError(): this {\n    this.shouldThrowOnError = true\n    this.transforms.push({ kind: 'throwOnError' })\n    return this\n  }\n\n  returns<U extends Record<string, unknown>>(): EncryptedQueryBuilderImpl<U> {\n    // Type-level cast only; builder state is preserved\n    return this as unknown as EncryptedQueryBuilderImpl<U>\n  }\n\n  // ---------------------------------------------------------------------------\n  // Encryption-specific methods\n  // ---------------------------------------------------------------------------\n\n  withLockContext(lockContext: LockContext): this {\n    this.lockContext = lockContext\n    return this\n  }\n\n  audit(config: AuditConfig): this {\n    this.auditConfig = config\n    return this\n  }\n\n  // ---------------------------------------------------------------------------\n  // PromiseLike implementation (deferred execution)\n  // ---------------------------------------------------------------------------\n\n  then<TResult1 = EncryptedSupabaseResponse<T[]>, TResult2 = never>(\n    onfulfilled?:\n      | ((\n          value: EncryptedSupabaseResponse<T[]>,\n        ) => TResult1 | PromiseLike<TResult1>)\n      | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): Promise<TResult1 | TResult2> {\n    return this.execute().then(onfulfilled, onrejected)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Core execution\n  // ---------------------------------------------------------------------------\n\n  private async execute(): Promise<EncryptedSupabaseResponse<T[]>> {\n    try {\n      // 1. Encrypt mutation data\n      const encryptedMutation = await this.encryptMutationData()\n\n      // 2. Build select string with ::jsonb casts\n      const selectString = this.buildSelectString()\n\n      // 3. Batch-encrypt filter values\n      const encryptedFilters = await this.encryptFilterValues()\n\n      // 4. Build and execute real Supabase query\n      const result = await this.buildAndExecuteQuery(\n        encryptedMutation,\n        selectString,\n        encryptedFilters,\n      )\n\n      // 5. Decrypt results\n      return await this.decryptResults(result)\n    } catch (err) {\n      const error: EncryptedSupabaseError = {\n        message: err instanceof Error ? err.message : String(err),\n        encryptionError: undefined,\n      }\n\n      if (this.shouldThrowOnError) {\n        throw err\n      }\n\n      return {\n        data: null,\n        error,\n        count: null,\n        status: 500,\n        statusText: 'Encryption Error',\n      }\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 1: Encrypt mutation data\n  // ---------------------------------------------------------------------------\n\n  private async encryptMutationData(): Promise<\n    Record<string, unknown> | Record<string, unknown>[] | null\n  > {\n    if (!this.mutation) return null\n\n    if (this.mutation.kind === 'delete') return null\n\n    const data = this.mutation.data\n\n    if (Array.isArray(data)) {\n      // Bulk encrypt\n      const baseOp = this.encryptionClient.bulkEncryptModels(data, this.schema)\n      const op = this.lockContext\n        ? baseOp.withLockContext(this.lockContext)\n        : baseOp\n      if (this.auditConfig) op.audit(this.auditConfig)\n\n      const result = await op\n      if (result.failure) {\n        throw new EncryptionFailedError(\n          `Failed to encrypt models: ${result.failure.message}`,\n          result.failure,\n        )\n      }\n\n      return bulkModelsToEncryptedPgComposites(result.data)\n    }\n\n    // Single model\n    const baseOp = this.encryptionClient.encryptModel(data, this.schema)\n    const op = this.lockContext\n      ? baseOp.withLockContext(this.lockContext)\n      : baseOp\n    if (this.auditConfig) op.audit(this.auditConfig)\n\n    const result = await op\n    if (result.failure) {\n      throw new EncryptionFailedError(\n        `Failed to encrypt model: ${result.failure.message}`,\n        result.failure,\n      )\n    }\n\n    return modelToEncryptedPgComposites(result.data)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 2: Build select string with casts\n  // ---------------------------------------------------------------------------\n\n  private buildSelectString(): string | null {\n    if (this.selectColumns === null) return null\n    return addJsonbCasts(this.selectColumns, this.encryptedColumnNames)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 3: Encrypt filter values\n  // ---------------------------------------------------------------------------\n\n  private async encryptFilterValues(): Promise<EncryptedFilterState> {\n    // Collect all terms that need encryption\n    const terms: ScalarQueryTerm[] = []\n    const termMap: TermMapping[] = []\n\n    const tableColumns = this.getColumnMap()\n\n    // Regular filters\n    for (let i = 0; i < this.filters.length; i++) {\n      const f = this.filters[i]\n      if (!isEncryptedColumn(f.column, this.encryptedColumnNames)) continue\n\n      const column = tableColumns[f.column]\n      if (!column) continue\n\n      if (f.op === 'in' && Array.isArray(f.value)) {\n        // For `in` filters, encrypt each value separately\n        for (let j = 0; j < f.value.length; j++) {\n          terms.push({\n            value: f.value[j] as JsPlaintext,\n            column,\n            table: this.schema,\n            queryType: mapFilterOpToQueryType(f.op),\n            returnType: 'composite-literal',\n          })\n          termMap.push({ source: 'filter', filterIndex: i, inIndex: j })\n        }\n      } else if (f.op === 'is') {\n        // `is` is used for null/boolean checks — don't encrypt\n        continue\n      } else {\n        terms.push({\n          value: f.value as JsPlaintext,\n          column,\n          table: this.schema,\n          queryType: mapFilterOpToQueryType(f.op),\n          returnType: 'composite-literal',\n        })\n        termMap.push({ source: 'filter', filterIndex: i })\n      }\n    }\n\n    // Match filters\n    for (let i = 0; i < this.matchFilters.length; i++) {\n      const mf = this.matchFilters[i]\n      for (const [colName, value] of Object.entries(mf.query)) {\n        if (!isEncryptedColumn(colName, this.encryptedColumnNames)) continue\n        const column = tableColumns[colName]\n        if (!column) continue\n\n        terms.push({\n          value: value as JsPlaintext,\n          column,\n          table: this.schema,\n          queryType: 'equality',\n          returnType: 'composite-literal',\n        })\n        termMap.push({ source: 'match', matchIndex: i, column: colName })\n      }\n    }\n\n    // Not filters\n    for (let i = 0; i < this.notFilters.length; i++) {\n      const nf = this.notFilters[i]\n      if (!isEncryptedColumn(nf.column, this.encryptedColumnNames)) continue\n      const column = tableColumns[nf.column]\n      if (!column) continue\n\n      terms.push({\n        value: nf.value as JsPlaintext,\n        column,\n        table: this.schema,\n        queryType: mapFilterOpToQueryType(nf.op),\n        returnType: 'composite-literal',\n      })\n      termMap.push({ source: 'not', notIndex: i })\n    }\n\n    // Or filters (string form parsed into conditions)\n    for (let i = 0; i < this.orFilters.length; i++) {\n      const of_ = this.orFilters[i]\n      if (of_.kind === 'string') {\n        const parsed = parseOrString(of_.value)\n        for (let j = 0; j < parsed.length; j++) {\n          const cond = parsed[j]\n          if (!isEncryptedColumn(cond.column, this.encryptedColumnNames))\n            continue\n          const column = tableColumns[cond.column]\n          if (!column) continue\n\n          terms.push({\n            value: cond.value as JsPlaintext,\n            column,\n            table: this.schema,\n            queryType: mapFilterOpToQueryType(cond.op),\n            returnType: 'composite-literal',\n          })\n          termMap.push({ source: 'or-string', orIndex: i, conditionIndex: j })\n        }\n      } else {\n        for (let j = 0; j < of_.conditions.length; j++) {\n          const cond = of_.conditions[j]\n          if (!isEncryptedColumn(cond.column, this.encryptedColumnNames))\n            continue\n          const column = tableColumns[cond.column]\n          if (!column) continue\n\n          terms.push({\n            value: cond.value as JsPlaintext,\n            column,\n            table: this.schema,\n            queryType: mapFilterOpToQueryType(cond.op),\n            returnType: 'composite-literal',\n          })\n          termMap.push({\n            source: 'or-structured',\n            orIndex: i,\n            conditionIndex: j,\n          })\n        }\n      }\n    }\n\n    // Raw filters\n    for (let i = 0; i < this.rawFilters.length; i++) {\n      const rf = this.rawFilters[i]\n      if (!isEncryptedColumn(rf.column, this.encryptedColumnNames)) continue\n      const column = tableColumns[rf.column]\n      if (!column) continue\n\n      terms.push({\n        value: rf.value as JsPlaintext,\n        column,\n        table: this.schema,\n        queryType: 'equality',\n        returnType: 'composite-literal',\n      })\n      termMap.push({ source: 'raw', rawIndex: i })\n    }\n\n    if (terms.length === 0) {\n      return { encryptedValues: [], termMap: [] }\n    }\n\n    // Batch encrypt all terms in one call\n    const baseOp = this.encryptionClient.encryptQuery(terms)\n    const op = this.lockContext\n      ? baseOp.withLockContext(this.lockContext)\n      : baseOp\n    if (this.auditConfig) op.audit(this.auditConfig)\n\n    const result = await op\n    if (result.failure) {\n      throw new EncryptionFailedError(\n        `Failed to encrypt query terms: ${result.failure.message}`,\n        result.failure,\n      )\n    }\n\n    return { encryptedValues: result.data, termMap }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 4: Build and execute real Supabase query\n  // ---------------------------------------------------------------------------\n\n  private async buildAndExecuteQuery(\n    encryptedMutation:\n      | Record<string, unknown>\n      | Record<string, unknown>[]\n      | null,\n    selectString: string | null,\n    encryptedFilters: EncryptedFilterState,\n  ): Promise<RawSupabaseResult> {\n    let query: SupabaseQueryBuilder = this.supabaseClient.from(this.tableName)\n\n    // Apply mutation\n    if (this.mutation) {\n      switch (this.mutation.kind) {\n        case 'insert':\n          query = query.insert(encryptedMutation!, this.mutation.options)\n          break\n        case 'update':\n          query = query.update(encryptedMutation!, this.mutation.options)\n          break\n        case 'upsert':\n          query = query.upsert(encryptedMutation!, this.mutation.options)\n          break\n        case 'delete':\n          query = query.delete(this.mutation.options)\n          break\n      }\n    }\n\n    // Apply select\n    if (selectString !== null) {\n      query = query.select(selectString, this.selectOptions)\n    } else if (!this.mutation) {\n      // Default select without explicit columns - shouldn't happen but fallback\n      query = query.select('*', this.selectOptions)\n    }\n\n    // Apply resolved filters\n    query = this.applyFilters(query, encryptedFilters)\n\n    // Apply transforms\n    for (const t of this.transforms) {\n      switch (t.kind) {\n        case 'order':\n          query = query.order(t.column, t.options)\n          break\n        case 'limit':\n          query = query.limit(t.count, t.options)\n          break\n        case 'range':\n          query = query.range(t.from, t.to, t.options)\n          break\n        case 'single':\n          query = query.single()\n          break\n        case 'maybeSingle':\n          query = query.maybeSingle()\n          break\n        case 'csv':\n          query = query.csv()\n          break\n        case 'abortSignal':\n          query = query.abortSignal(t.signal)\n          break\n        case 'throwOnError':\n          query = query.throwOnError()\n          break\n      }\n    }\n\n    const result = (await query) as unknown as RawSupabaseResult\n    return result\n  }\n\n  // ---------------------------------------------------------------------------\n  // Apply filters with encrypted values substituted\n  // ---------------------------------------------------------------------------\n\n  private applyFilters(\n    query: SupabaseQueryBuilder,\n    encryptedFilters: EncryptedFilterState,\n  ): SupabaseQueryBuilder {\n    let q = query\n\n    // Build lookup maps for quick access to encrypted values\n    const filterValueMap = new Map<number, unknown>()\n    const filterInMap = new Map<string, unknown>() // \"filterIndex:inIndex\" -> value\n    const matchValueMap = new Map<string, unknown>() // \"matchIndex:column\" -> value\n    const notValueMap = new Map<number, unknown>()\n    const rawValueMap = new Map<number, unknown>()\n    const orStringConditionMap = new Map<string, unknown>() // \"orIndex:condIndex\" -> value\n    const orStructuredConditionMap = new Map<string, unknown>()\n\n    for (let i = 0; i < encryptedFilters.termMap.length; i++) {\n      const mapping = encryptedFilters.termMap[i]\n      const encValue = encryptedFilters.encryptedValues[i]\n\n      switch (mapping.source) {\n        case 'filter':\n          if (mapping.inIndex !== undefined) {\n            filterInMap.set(\n              `${mapping.filterIndex}:${mapping.inIndex}`,\n              encValue,\n            )\n          } else {\n            filterValueMap.set(mapping.filterIndex, encValue)\n          }\n          break\n        case 'match':\n          matchValueMap.set(`${mapping.matchIndex}:${mapping.column}`, encValue)\n          break\n        case 'not':\n          notValueMap.set(mapping.notIndex, encValue)\n          break\n        case 'raw':\n          rawValueMap.set(mapping.rawIndex, encValue)\n          break\n        case 'or-string':\n          orStringConditionMap.set(\n            `${mapping.orIndex}:${mapping.conditionIndex}`,\n            encValue,\n          )\n          break\n        case 'or-structured':\n          orStructuredConditionMap.set(\n            `${mapping.orIndex}:${mapping.conditionIndex}`,\n            encValue,\n          )\n          break\n      }\n    }\n\n    // Apply regular filters\n    for (let i = 0; i < this.filters.length; i++) {\n      const f = this.filters[i]\n      let value = f.value\n\n      if (filterValueMap.has(i)) {\n        value = filterValueMap.get(i)\n      } else if (f.op === 'in' && Array.isArray(f.value)) {\n        // Reconstruct array with encrypted values substituted\n        value = f.value.map((v, j) => {\n          const key = `${i}:${j}`\n          return filterInMap.has(key) ? filterInMap.get(key) : v\n        })\n      }\n\n      switch (f.op) {\n        case 'eq':\n          q = q.eq(f.column, value)\n          break\n        case 'neq':\n          q = q.neq(f.column, value)\n          break\n        case 'gt':\n          q = q.gt(f.column, value)\n          break\n        case 'gte':\n          q = q.gte(f.column, value)\n          break\n        case 'lt':\n          q = q.lt(f.column, value)\n          break\n        case 'lte':\n          q = q.lte(f.column, value)\n          break\n        case 'like':\n          q = q.like(f.column, value as string)\n          break\n        case 'ilike':\n          q = q.ilike(f.column, value as string)\n          break\n        case 'is':\n          q = q.is(f.column, value)\n          break\n        case 'in':\n          q = q.in(f.column, value as unknown[])\n          break\n      }\n    }\n\n    // Apply match filters\n    for (let i = 0; i < this.matchFilters.length; i++) {\n      const mf = this.matchFilters[i]\n      const resolvedQuery: Record<string, unknown> = {}\n\n      for (const [colName, originalValue] of Object.entries(mf.query)) {\n        const key = `${i}:${colName}`\n        resolvedQuery[colName] = matchValueMap.has(key)\n          ? matchValueMap.get(key)\n          : originalValue\n      }\n\n      q = q.match(resolvedQuery)\n    }\n\n    // Apply not filters\n    for (let i = 0; i < this.notFilters.length; i++) {\n      const nf = this.notFilters[i]\n      const value = notValueMap.has(i) ? notValueMap.get(i) : nf.value\n      q = q.not(nf.column, nf.op, value)\n    }\n\n    // Apply or filters\n    for (let i = 0; i < this.orFilters.length; i++) {\n      const of_ = this.orFilters[i]\n\n      if (of_.kind === 'string') {\n        const parsed = parseOrString(of_.value)\n        let hasEncrypted = false\n\n        for (let j = 0; j < parsed.length; j++) {\n          const key = `${i}:${j}`\n          if (orStringConditionMap.has(key)) {\n            parsed[j] = { ...parsed[j], value: orStringConditionMap.get(key) }\n            hasEncrypted = true\n          }\n        }\n\n        if (hasEncrypted) {\n          q = q.or(rebuildOrString(parsed), {\n            referencedTable: of_.referencedTable,\n          })\n        } else {\n          q = q.or(of_.value, { referencedTable: of_.referencedTable })\n        }\n      } else {\n        // Structured: convert to string\n        const conditions = of_.conditions.map((cond, j) => {\n          const key = `${i}:${j}`\n          if (orStructuredConditionMap.has(key)) {\n            return { ...cond, value: orStructuredConditionMap.get(key) }\n          }\n          return cond\n        })\n\n        q = q.or(rebuildOrString(conditions))\n      }\n    }\n\n    // Apply raw filters\n    for (let i = 0; i < this.rawFilters.length; i++) {\n      const rf = this.rawFilters[i]\n      const value = rawValueMap.has(i) ? rawValueMap.get(i) : rf.value\n      q = q.filter(rf.column, rf.operator, value)\n    }\n\n    return q\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 5: Decrypt results\n  // ---------------------------------------------------------------------------\n\n  private async decryptResults(\n    result: RawSupabaseResult,\n  ): Promise<EncryptedSupabaseResponse<T[]>> {\n    // If there's an error from Supabase, pass it through\n    if (result.error) {\n      return {\n        data: null,\n        error: {\n          message: result.error.message,\n          details: result.error.details,\n          hint: result.error.hint,\n          code: result.error.code,\n        },\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // No data to decrypt\n    if (result.data === null || result.data === undefined) {\n      return {\n        data: null,\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // Determine if we need to decrypt\n    const hasSelect = this.selectColumns !== null\n    const hasMutationWithReturning = this.mutation !== null && hasSelect\n\n    if (!hasSelect && !hasMutationWithReturning) {\n      // No select means no data to decrypt (e.g., insert without .select())\n      return {\n        data: result.data as T[],\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // Decrypt based on result mode\n    if (this.resultMode === 'single' || this.resultMode === 'maybeSingle') {\n      if (result.data === null) {\n        return {\n          data: null,\n          error: null,\n          count: result.count ?? null,\n          status: result.status,\n          statusText: result.statusText,\n        }\n      }\n\n      // Single result — decrypt one model\n      const baseDecryptOp = this.encryptionClient.decryptModel(\n        result.data as Record<string, unknown>,\n      )\n      const decryptOp = this.lockContext\n        ? baseDecryptOp.withLockContext(this.lockContext)\n        : baseDecryptOp\n      if (this.auditConfig) decryptOp.audit(this.auditConfig)\n\n      const decrypted = await decryptOp\n      if (decrypted.failure) {\n        throw new EncryptionFailedError(\n          `Failed to decrypt model: ${decrypted.failure.message}`,\n          decrypted.failure,\n        )\n      }\n\n      return {\n        data: decrypted.data as unknown as T[],\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // Array result — bulk decrypt\n    const dataArray = result.data as Record<string, unknown>[]\n    if (dataArray.length === 0) {\n      return {\n        data: [] as unknown as T[],\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    const baseBulkDecryptOp = this.encryptionClient.bulkDecryptModels(dataArray)\n    const bulkDecryptOp = this.lockContext\n      ? baseBulkDecryptOp.withLockContext(this.lockContext)\n      : baseBulkDecryptOp\n    if (this.auditConfig) bulkDecryptOp.audit(this.auditConfig)\n\n    const decrypted = await bulkDecryptOp\n    if (decrypted.failure) {\n      throw new EncryptionFailedError(\n        `Failed to decrypt models: ${decrypted.failure.message}`,\n        decrypted.failure,\n      )\n    }\n\n    return {\n      data: decrypted.data as unknown as T[],\n      error: null,\n      count: result.count ?? null,\n      status: result.status,\n      statusText: result.statusText,\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getColumnMap(): Record<string, EncryptedColumn> {\n    const map: Record<string, EncryptedColumn> = {}\n    const schema = this.schema as unknown as Record<string, unknown>\n\n    for (const colName of this.encryptedColumnNames) {\n      const col = schema[colName]\n      if (col instanceof EncryptedColumn) {\n        map[colName] = col\n      }\n    }\n\n    return map\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Internal types\n// ---------------------------------------------------------------------------\n\ntype TermMapping =\n  | { source: 'filter'; filterIndex: number; inIndex?: number }\n  | { source: 'match'; matchIndex: number; column: string }\n  | { source: 'not'; notIndex: number }\n  | { source: 'raw'; rawIndex: number }\n  | { source: 'or-string'; orIndex: number; conditionIndex: number }\n  | { source: 'or-structured'; orIndex: number; conditionIndex: number }\n\ntype EncryptedFilterState = {\n  encryptedValues: unknown[]\n  termMap: TermMapping[]\n}\n\ntype RawSupabaseResult = {\n  data: unknown\n  error: {\n    message: string\n    details?: string\n    hint?: string\n    code?: string\n  } | null\n  count?: number | null\n  status: number\n  statusText: string\n}\n\nclass EncryptionFailedError extends Error {\n  public encryptionError: unknown\n\n  constructor(message: string, encryptionError: unknown) {\n    super(message)\n    this.name = 'EncryptionFailedError'\n    this.encryptionError = encryptionError\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { EncryptedQueryBuilderImpl } from './query-builder'\nimport type {\n  EncryptedSupabaseConfig,\n  EncryptedSupabaseInstance,\n} from './types'\n\n/**\n * Create an encrypted Supabase wrapper that transparently handles encryption\n * and decryption for queries on encrypted columns.\n *\n * @param config - Configuration containing the encryption client and Supabase client.\n * @returns An object with a `from()` method that mirrors `supabase.from()` but\n *   auto-encrypts mutations, adds `::jsonb` casts, encrypts filter values, and\n *   decrypts results.\n *\n * @example\n * ```typescript\n * import { Encryption } from '@cipherstash/stack'\n * import { encryptedSupabase } from '@cipherstash/stack/supabase'\n * import { encryptedTable, encryptedColumn } from '@cipherstash/stack/schema'\n *\n * const users = encryptedTable('users', {\n *   name: encryptedColumn('name').freeTextSearch().equality(),\n *   email: encryptedColumn('email').freeTextSearch().equality(),\n * })\n *\n * const client = await Encryption({ schemas: [users] })\n * const eSupabase = encryptedSupabase({ encryptionClient: client, supabaseClient: supabase })\n *\n * // INSERT - auto-encrypts, auto-converts to PG composite\n * await eSupabase.from('users', users)\n *   .insert({ name: 'John', email: 'john@example.com', age: 30 })\n *\n * // SELECT with filter - auto-casts ::jsonb, auto-encrypts search term, auto-decrypts\n * const { data } = await eSupabase.from('users', users)\n *   .select('id, email, name')\n *   .eq('email', 'john@example.com')\n * ```\n */\nexport function encryptedSupabase(\n  config: EncryptedSupabaseConfig,\n): EncryptedSupabaseInstance {\n  const { encryptionClient, supabaseClient } = config\n\n  return {\n    from<T extends Record<string, unknown> = Record<string, unknown>>(\n      tableName: string,\n      schema: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new EncryptedQueryBuilderImpl<T>(\n        tableName,\n        schema,\n        encryptionClient,\n        supabaseClient,\n      )\n    },\n  }\n}\n\nexport type {\n  EncryptedSupabaseConfig,\n  EncryptedSupabaseInstance,\n  EncryptedSupabaseResponse,\n  EncryptedSupabaseError,\n  EncryptedQueryBuilder,\n  PendingOrCondition,\n  SupabaseClientLike,\n} from './types'\n"],"mappings":";;;;;;;;;AAOO,SAAS,wBACd,QACU;AACV,QAAM,QAAQ,OAAO,MAAM;AAC3B,SAAO,OAAO,KAAK,MAAM,OAAO;AAClC;AAKO,SAAS,kBACd,YACA,sBACS;AACT,SAAO,qBAAqB,SAAS,UAAU;AACjD;AAUO,SAAS,cACd,SACA,sBACQ;AACR,SAAO,QACJ,MAAM,GAAG,EACT,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAU,IAAI,KAAK;AAGzB,QAAI,CAAC,QAAS,QAAO;AAGrB,QAAI,QAAQ,SAAS,IAAI,EAAG,QAAO;AAGnC,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO;AAI3D,UAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,UAAM,UAAU,MAAM,CAAC;AAEvB,QAAI,kBAAkB,SAAS,oBAAoB,GAAG;AAEpD,YAAM,oBAAoB,IAAI,MAAM,QAAQ,IAAI,CAAC,KAAK;AACtD,UAAI,MAAM,SAAS,GAAG;AAEpB,eAAO,GAAG,iBAAiB,GAAG,OAAO,WAAW,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC1E;AACA,aAAO,GAAG,iBAAiB,GAAG,OAAO;AAAA,IACvC;AAEA,WAAO;AAAA,EACT,CAAC,EACA,KAAK,GAAG;AACb;AAKO,SAAS,uBAAuB,IAA6B;AAClE,UAAQ,IAAI;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,cAAc,UAAwC;AACpE,QAAM,aAAmC,CAAC;AAE1C,QAAM,QAAQ,cAAc,QAAQ;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,QAAS;AAGd,UAAM,WAAW,QAAQ,QAAQ,GAAG;AACpC,QAAI,aAAa,GAAI;AAErB,UAAM,SAAS,QAAQ,MAAM,GAAG,QAAQ;AACxC,UAAM,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEvC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,cAAc,GAAI;AAEtB,UAAM,KAAK,KAAK,MAAM,GAAG,SAAS;AAClC,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC;AAGtC,UAAM,cAAc,aAAa,KAAK;AAEtC,eAAW,KAAK,EAAE,QAAQ,IAAI,OAAO,YAAY,CAAC;AAAA,EACpD;AAEA,SAAO;AACT;AAKO,SAAS,gBAAgB,YAA0C;AACxE,SAAO,WACJ,IAAI,CAAC,MAAM;AACV,UAAM,QAAQ,cAAc,EAAE,KAAK;AACnC,WAAO,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAMA,SAAS,cAAc,OAAyB;AAC9C,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AAEZ,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,KAAK;AAChB;AACA,iBAAW;AAAA,IACb,WAAW,SAAS,KAAK;AACvB;AACA,iBAAW;AAAA,IACb,WAAW,SAAS,OAAO,UAAU,GAAG;AACtC,YAAM,KAAK,OAAO;AAClB,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,MAAI,SAAS;AACX,UAAM,KAAK,OAAO;AAAA,EACpB;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAE5C,MAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AAChD,WAAO,MACJ,MAAM,GAAG,EAAE,EACX,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAAA,EACxB;AAGA,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAG9B,MAAI,UAAU,OAAQ,QAAO;AAE7B,SAAO;AACT;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAAA,EAC5B;AACA,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,MAAO,QAAO;AAC5B,SAAO,OAAO,KAAK;AACrB;;;AC5JO,IAAM,4BAAN,MAEL;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA,WAA8B;AAAA,EAC9B,gBAA+B;AAAA,EAC/B,gBAEQ;AAAA,EACR,UAA2B,CAAC;AAAA,EAC5B,YAA+B,CAAC;AAAA,EAChC,eAAqC,CAAC;AAAA,EACtC,aAAiC,CAAC;AAAA,EAClC,aAAiC,CAAC;AAAA,EAClC,aAA4B,CAAC;AAAA,EAC7B,aAAyB;AAAA,EACzB,qBAAqB;AAAA;AAAA,EAGrB,cAAkC;AAAA,EAClC,cAAkC;AAAA,EAE1C,YACE,WACA,QACA,kBACA,gBACA;AACA,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,mBAAmB;AACxB,SAAK,iBAAiB;AACtB,SAAK,uBAAuB,wBAAwB,MAAM;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,SACA,SACM;AACN,QAAI,YAAY,KAAK;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,gBAAgB;AACrB,SAAK,gBAAgB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,OACE,MACA,SAKM;AACN,SAAK,WAAW;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OACE,MACA,SACM;AACN,SAAK,WAAW;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OACE,MACA,SAMM;AACN,SAAK,WAAW;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAA+D;AACpE,SAAK,WAAW,EAAE,MAAM,UAAU,QAAQ;AAC1C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,GAAG,QAAgB,OAAsB;AACvC,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAsB;AACxC,SAAK,QAAQ,KAAK,EAAE,IAAI,OAAO,QAAQ,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAAsB;AACvC,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAsB;AACxC,SAAK,QAAQ,KAAK,EAAE,IAAI,OAAO,QAAQ,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAAsB;AACvC,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAsB;AACxC,SAAK,QAAQ,KAAK,EAAE,IAAI,OAAO,QAAQ,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,KAAK,QAAgB,SAAuB;AAC1C,SAAK,QAAQ,KAAK,EAAE,IAAI,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAgB,SAAuB;AAC3C,SAAK,QAAQ,KAAK,EAAE,IAAI,SAAS,QAAQ,OAAO,QAAQ,CAAC;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAA6B;AAC9C,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,QAAyB;AAC1C,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,QAAgB,UAAkB,OAAsB;AAC7D,SAAK,WAAW,KAAK,EAAE,QAAQ,UAAU,MAAM,CAAC;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,UAAkB,OAAsB;AAC1D,SAAK,WAAW,KAAK,EAAE,QAAQ,IAAI,UAAsB,MAAM,CAAC;AAChE,WAAO;AAAA,EACT;AAAA,EAEA,GACE,qBACA,SACM;AACN,QAAI,OAAO,wBAAwB,UAAU;AAC3C,WAAK,UAAU,KAAK;AAAA,QAClB,MAAM;AAAA,QACN,OAAO;AAAA,QACP,iBAAiB,SAAS,mBAAmB,SAAS;AAAA,MACxD,CAAC;AAAA,IACH,OAAO;AACL,WAAK,UAAU,KAAK;AAAA,QAClB,MAAM;AAAA,QACN,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAsC;AAC1C,SAAK,aAAa,KAAK,EAAE,MAAM,CAAC;AAChC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MACE,QACA,SAMM;AACN,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,CAAC;AACvD,WAAO;AAAA,EACT;AAAA,EAEA,MACE,OACA,SACM;AACN,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,OAAO,QAAQ,CAAC;AACtD,WAAO;AAAA,EACT;AAAA,EAEA,MACE,MACA,IACA,SACM;AACN,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,MAAM,IAAI,QAAQ,CAAC;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,SAAe;AACb,SAAK,aAAa;AAClB,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,CAAC;AACvC,WAAO;AAAA,EACT;AAAA,EAEA,cAAoB;AAClB,SAAK,aAAa;AAClB,SAAK,WAAW,KAAK,EAAE,MAAM,cAAc,CAAC;AAC5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAY;AACV,SAAK,WAAW,KAAK,EAAE,MAAM,MAAM,CAAC;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,YAAY,QAA2B;AACrC,SAAK,WAAW,KAAK,EAAE,MAAM,eAAe,OAAO,CAAC;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,eAAqB;AACnB,SAAK,qBAAqB;AAC1B,SAAK,WAAW,KAAK,EAAE,MAAM,eAAe,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,UAA2E;AAEzE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,aAAgC;AAC9C,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAA2B;AAC/B,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,KACE,aAKA,YAC8B;AAC9B,WAAO,KAAK,QAAQ,EAAE,KAAK,aAAa,UAAU;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,UAAmD;AAC/D,QAAI;AAEF,YAAM,oBAAoB,MAAM,KAAK,oBAAoB;AAGzD,YAAM,eAAe,KAAK,kBAAkB;AAG5C,YAAM,mBAAmB,MAAM,KAAK,oBAAoB;AAGxD,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAGA,aAAO,MAAM,KAAK,eAAe,MAAM;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,QAAgC;AAAA,QACpC,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACxD,iBAAiB;AAAA,MACnB;AAEA,UAAI,KAAK,oBAAoB;AAC3B,cAAM;AAAA,MACR;AAEA,aAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAEZ;AACA,QAAI,CAAC,KAAK,SAAU,QAAO;AAE3B,QAAI,KAAK,SAAS,SAAS,SAAU,QAAO;AAE5C,UAAM,OAAO,KAAK,SAAS;AAE3B,QAAI,MAAM,QAAQ,IAAI,GAAG;AAEvB,YAAMA,UAAS,KAAK,iBAAiB,kBAAkB,MAAM,KAAK,MAAM;AACxE,YAAMC,MAAK,KAAK,cACZD,QAAO,gBAAgB,KAAK,WAAW,IACvCA;AACJ,UAAI,KAAK,YAAa,CAAAC,IAAG,MAAM,KAAK,WAAW;AAE/C,YAAMC,UAAS,MAAMD;AACrB,UAAIC,QAAO,SAAS;AAClB,cAAM,IAAI;AAAA,UACR,6BAA6BA,QAAO,QAAQ,OAAO;AAAA,UACnDA,QAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO,kCAAkCA,QAAO,IAAI;AAAA,IACtD;AAGA,UAAM,SAAS,KAAK,iBAAiB,aAAa,MAAM,KAAK,MAAM;AACnE,UAAM,KAAK,KAAK,cACZ,OAAO,gBAAgB,KAAK,WAAW,IACvC;AACJ,QAAI,KAAK,YAAa,IAAG,MAAM,KAAK,WAAW;AAE/C,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,SAAS;AAClB,YAAM,IAAI;AAAA,QACR,4BAA4B,OAAO,QAAQ,OAAO;AAAA,QAClD,OAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO,6BAA6B,OAAO,IAAI;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAmC;AACzC,QAAI,KAAK,kBAAkB,KAAM,QAAO;AACxC,WAAO,cAAc,KAAK,eAAe,KAAK,oBAAoB;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAqD;AAEjE,UAAM,QAA2B,CAAC;AAClC,UAAM,UAAyB,CAAC;AAEhC,UAAM,eAAe,KAAK,aAAa;AAGvC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC5C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,CAAC,kBAAkB,EAAE,QAAQ,KAAK,oBAAoB,EAAG;AAE7D,YAAM,SAAS,aAAa,EAAE,MAAM;AACpC,UAAI,CAAC,OAAQ;AAEb,UAAI,EAAE,OAAO,QAAQ,MAAM,QAAQ,EAAE,KAAK,GAAG;AAE3C,iBAAS,IAAI,GAAG,IAAI,EAAE,MAAM,QAAQ,KAAK;AACvC,gBAAM,KAAK;AAAA,YACT,OAAO,EAAE,MAAM,CAAC;AAAA,YAChB;AAAA,YACA,OAAO,KAAK;AAAA,YACZ,WAAW,uBAAuB,EAAE,EAAE;AAAA,YACtC,YAAY;AAAA,UACd,CAAC;AACD,kBAAQ,KAAK,EAAE,QAAQ,UAAU,aAAa,GAAG,SAAS,EAAE,CAAC;AAAA,QAC/D;AAAA,MACF,WAAW,EAAE,OAAO,MAAM;AAExB;AAAA,MACF,OAAO;AACL,cAAM,KAAK;AAAA,UACT,OAAO,EAAE;AAAA,UACT;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,WAAW,uBAAuB,EAAE,EAAE;AAAA,UACtC,YAAY;AAAA,QACd,CAAC;AACD,gBAAQ,KAAK,EAAE,QAAQ,UAAU,aAAa,EAAE,CAAC;AAAA,MACnD;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,aAAa,QAAQ,KAAK;AACjD,YAAM,KAAK,KAAK,aAAa,CAAC;AAC9B,iBAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,GAAG,KAAK,GAAG;AACvD,YAAI,CAAC,kBAAkB,SAAS,KAAK,oBAAoB,EAAG;AAC5D,cAAM,SAAS,aAAa,OAAO;AACnC,YAAI,CAAC,OAAQ;AAEb,cAAM,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,WAAW;AAAA,UACX,YAAY;AAAA,QACd,CAAC;AACD,gBAAQ,KAAK,EAAE,QAAQ,SAAS,YAAY,GAAG,QAAQ,QAAQ,CAAC;AAAA,MAClE;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAI,CAAC,kBAAkB,GAAG,QAAQ,KAAK,oBAAoB,EAAG;AAC9D,YAAM,SAAS,aAAa,GAAG,MAAM;AACrC,UAAI,CAAC,OAAQ;AAEb,YAAM,KAAK;AAAA,QACT,OAAO,GAAG;AAAA,QACV;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,WAAW,uBAAuB,GAAG,EAAE;AAAA,QACvC,YAAY;AAAA,MACd,CAAC;AACD,cAAQ,KAAK,EAAE,QAAQ,OAAO,UAAU,EAAE,CAAC;AAAA,IAC7C;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;AAC9C,YAAM,MAAM,KAAK,UAAU,CAAC;AAC5B,UAAI,IAAI,SAAS,UAAU;AACzB,cAAM,SAAS,cAAc,IAAI,KAAK;AACtC,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAM,OAAO,OAAO,CAAC;AACrB,cAAI,CAAC,kBAAkB,KAAK,QAAQ,KAAK,oBAAoB;AAC3D;AACF,gBAAM,SAAS,aAAa,KAAK,MAAM;AACvC,cAAI,CAAC,OAAQ;AAEb,gBAAM,KAAK;AAAA,YACT,OAAO,KAAK;AAAA,YACZ;AAAA,YACA,OAAO,KAAK;AAAA,YACZ,WAAW,uBAAuB,KAAK,EAAE;AAAA,YACzC,YAAY;AAAA,UACd,CAAC;AACD,kBAAQ,KAAK,EAAE,QAAQ,aAAa,SAAS,GAAG,gBAAgB,EAAE,CAAC;AAAA,QACrE;AAAA,MACF,OAAO;AACL,iBAAS,IAAI,GAAG,IAAI,IAAI,WAAW,QAAQ,KAAK;AAC9C,gBAAM,OAAO,IAAI,WAAW,CAAC;AAC7B,cAAI,CAAC,kBAAkB,KAAK,QAAQ,KAAK,oBAAoB;AAC3D;AACF,gBAAM,SAAS,aAAa,KAAK,MAAM;AACvC,cAAI,CAAC,OAAQ;AAEb,gBAAM,KAAK;AAAA,YACT,OAAO,KAAK;AAAA,YACZ;AAAA,YACA,OAAO,KAAK;AAAA,YACZ,WAAW,uBAAuB,KAAK,EAAE;AAAA,YACzC,YAAY;AAAA,UACd,CAAC;AACD,kBAAQ,KAAK;AAAA,YACX,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAI,CAAC,kBAAkB,GAAG,QAAQ,KAAK,oBAAoB,EAAG;AAC9D,YAAM,SAAS,aAAa,GAAG,MAAM;AACrC,UAAI,CAAC,OAAQ;AAEb,YAAM,KAAK;AAAA,QACT,OAAO,GAAG;AAAA,QACV;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,WAAW;AAAA,QACX,YAAY;AAAA,MACd,CAAC;AACD,cAAQ,KAAK,EAAE,QAAQ,OAAO,UAAU,EAAE,CAAC;AAAA,IAC7C;AAEA,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO,EAAE,iBAAiB,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC5C;AAGA,UAAM,SAAS,KAAK,iBAAiB,aAAa,KAAK;AACvD,UAAM,KAAK,KAAK,cACZ,OAAO,gBAAgB,KAAK,WAAW,IACvC;AACJ,QAAI,KAAK,YAAa,IAAG,MAAM,KAAK,WAAW;AAE/C,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,SAAS;AAClB,YAAM,IAAI;AAAA,QACR,kCAAkC,OAAO,QAAQ,OAAO;AAAA,QACxD,OAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO,EAAE,iBAAiB,OAAO,MAAM,QAAQ;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,qBACZ,mBAIA,cACA,kBAC4B;AAC5B,QAAI,QAA8B,KAAK,eAAe,KAAK,KAAK,SAAS;AAGzE,QAAI,KAAK,UAAU;AACjB,cAAQ,KAAK,SAAS,MAAM;AAAA,QAC1B,KAAK;AACH,kBAAQ,MAAM,OAAO,mBAAoB,KAAK,SAAS,OAAO;AAC9D;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO,mBAAoB,KAAK,SAAS,OAAO;AAC9D;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO,mBAAoB,KAAK,SAAS,OAAO;AAC9D;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO,KAAK,SAAS,OAAO;AAC1C;AAAA,MACJ;AAAA,IACF;AAGA,QAAI,iBAAiB,MAAM;AACzB,cAAQ,MAAM,OAAO,cAAc,KAAK,aAAa;AAAA,IACvD,WAAW,CAAC,KAAK,UAAU;AAEzB,cAAQ,MAAM,OAAO,KAAK,KAAK,aAAa;AAAA,IAC9C;AAGA,YAAQ,KAAK,aAAa,OAAO,gBAAgB;AAGjD,eAAW,KAAK,KAAK,YAAY;AAC/B,cAAQ,EAAE,MAAM;AAAA,QACd,KAAK;AACH,kBAAQ,MAAM,MAAM,EAAE,QAAQ,EAAE,OAAO;AACvC;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,MAAM,EAAE,OAAO,EAAE,OAAO;AACtC;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;AAC3C;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO;AACrB;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,YAAY;AAC1B;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,IAAI;AAClB;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,YAAY,EAAE,MAAM;AAClC;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,aAAa;AAC3B;AAAA,MACJ;AAAA,IACF;AAEA,UAAM,SAAU,MAAM;AACtB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,aACN,OACA,kBACsB;AACtB,QAAI,IAAI;AAGR,UAAM,iBAAiB,oBAAI,IAAqB;AAChD,UAAM,cAAc,oBAAI,IAAqB;AAC7C,UAAM,gBAAgB,oBAAI,IAAqB;AAC/C,UAAM,cAAc,oBAAI,IAAqB;AAC7C,UAAM,cAAc,oBAAI,IAAqB;AAC7C,UAAM,uBAAuB,oBAAI,IAAqB;AACtD,UAAM,2BAA2B,oBAAI,IAAqB;AAE1D,aAAS,IAAI,GAAG,IAAI,iBAAiB,QAAQ,QAAQ,KAAK;AACxD,YAAM,UAAU,iBAAiB,QAAQ,CAAC;AAC1C,YAAM,WAAW,iBAAiB,gBAAgB,CAAC;AAEnD,cAAQ,QAAQ,QAAQ;AAAA,QACtB,KAAK;AACH,cAAI,QAAQ,YAAY,QAAW;AACjC,wBAAY;AAAA,cACV,GAAG,QAAQ,WAAW,IAAI,QAAQ,OAAO;AAAA,cACzC;AAAA,YACF;AAAA,UACF,OAAO;AACL,2BAAe,IAAI,QAAQ,aAAa,QAAQ;AAAA,UAClD;AACA;AAAA,QACF,KAAK;AACH,wBAAc,IAAI,GAAG,QAAQ,UAAU,IAAI,QAAQ,MAAM,IAAI,QAAQ;AACrE;AAAA,QACF,KAAK;AACH,sBAAY,IAAI,QAAQ,UAAU,QAAQ;AAC1C;AAAA,QACF,KAAK;AACH,sBAAY,IAAI,QAAQ,UAAU,QAAQ;AAC1C;AAAA,QACF,KAAK;AACH,+BAAqB;AAAA,YACnB,GAAG,QAAQ,OAAO,IAAI,QAAQ,cAAc;AAAA,YAC5C;AAAA,UACF;AACA;AAAA,QACF,KAAK;AACH,mCAAyB;AAAA,YACvB,GAAG,QAAQ,OAAO,IAAI,QAAQ,cAAc;AAAA,YAC5C;AAAA,UACF;AACA;AAAA,MACJ;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC5C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,QAAQ,EAAE;AAEd,UAAI,eAAe,IAAI,CAAC,GAAG;AACzB,gBAAQ,eAAe,IAAI,CAAC;AAAA,MAC9B,WAAW,EAAE,OAAO,QAAQ,MAAM,QAAQ,EAAE,KAAK,GAAG;AAElD,gBAAQ,EAAE,MAAM,IAAI,CAAC,GAAG,MAAM;AAC5B,gBAAM,MAAM,GAAG,CAAC,IAAI,CAAC;AACrB,iBAAO,YAAY,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,IAAI;AAAA,QACvD,CAAC;AAAA,MACH;AAEA,cAAQ,EAAE,IAAI;AAAA,QACZ,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,IAAI,EAAE,QAAQ,KAAK;AACzB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,IAAI,EAAE,QAAQ,KAAK;AACzB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,IAAI,EAAE,QAAQ,KAAK;AACzB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,KAAK,EAAE,QAAQ,KAAe;AACpC;AAAA,QACF,KAAK;AACH,cAAI,EAAE,MAAM,EAAE,QAAQ,KAAe;AACrC;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAkB;AACrC;AAAA,MACJ;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,aAAa,QAAQ,KAAK;AACjD,YAAM,KAAK,KAAK,aAAa,CAAC;AAC9B,YAAM,gBAAyC,CAAC;AAEhD,iBAAW,CAAC,SAAS,aAAa,KAAK,OAAO,QAAQ,GAAG,KAAK,GAAG;AAC/D,cAAM,MAAM,GAAG,CAAC,IAAI,OAAO;AAC3B,sBAAc,OAAO,IAAI,cAAc,IAAI,GAAG,IAC1C,cAAc,IAAI,GAAG,IACrB;AAAA,MACN;AAEA,UAAI,EAAE,MAAM,aAAa;AAAA,IAC3B;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,YAAM,QAAQ,YAAY,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,GAAG;AAC3D,UAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,KAAK;AAAA,IACnC;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;AAC9C,YAAM,MAAM,KAAK,UAAU,CAAC;AAE5B,UAAI,IAAI,SAAS,UAAU;AACzB,cAAM,SAAS,cAAc,IAAI,KAAK;AACtC,YAAI,eAAe;AAEnB,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAM,MAAM,GAAG,CAAC,IAAI,CAAC;AACrB,cAAI,qBAAqB,IAAI,GAAG,GAAG;AACjC,mBAAO,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,qBAAqB,IAAI,GAAG,EAAE;AACjE,2BAAe;AAAA,UACjB;AAAA,QACF;AAEA,YAAI,cAAc;AAChB,cAAI,EAAE,GAAG,gBAAgB,MAAM,GAAG;AAAA,YAChC,iBAAiB,IAAI;AAAA,UACvB,CAAC;AAAA,QACH,OAAO;AACL,cAAI,EAAE,GAAG,IAAI,OAAO,EAAE,iBAAiB,IAAI,gBAAgB,CAAC;AAAA,QAC9D;AAAA,MACF,OAAO;AAEL,cAAM,aAAa,IAAI,WAAW,IAAI,CAAC,MAAM,MAAM;AACjD,gBAAM,MAAM,GAAG,CAAC,IAAI,CAAC;AACrB,cAAI,yBAAyB,IAAI,GAAG,GAAG;AACrC,mBAAO,EAAE,GAAG,MAAM,OAAO,yBAAyB,IAAI,GAAG,EAAE;AAAA,UAC7D;AACA,iBAAO;AAAA,QACT,CAAC;AAED,YAAI,EAAE,GAAG,gBAAgB,UAAU,CAAC;AAAA,MACtC;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,YAAM,QAAQ,YAAY,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,GAAG;AAC3D,UAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,KAAK;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,QACyC;AAEzC,QAAI,OAAO,OAAO;AAChB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO;AAAA,UACL,SAAS,OAAO,MAAM;AAAA,UACtB,SAAS,OAAO,MAAM;AAAA,UACtB,MAAM,OAAO,MAAM;AAAA,UACnB,MAAM,OAAO,MAAM;AAAA,QACrB;AAAA,QACA,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,QAAI,OAAO,SAAS,QAAQ,OAAO,SAAS,QAAW;AACrD,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,kBAAkB;AACzC,UAAM,2BAA2B,KAAK,aAAa,QAAQ;AAE3D,QAAI,CAAC,aAAa,CAAC,0BAA0B;AAE3C,aAAO;AAAA,QACL,MAAM,OAAO;AAAA,QACb,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,QAAI,KAAK,eAAe,YAAY,KAAK,eAAe,eAAe;AACrE,UAAI,OAAO,SAAS,MAAM;AACxB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO;AAAA,UACP,OAAO,OAAO,SAAS;AAAA,UACvB,QAAQ,OAAO;AAAA,UACf,YAAY,OAAO;AAAA,QACrB;AAAA,MACF;AAGA,YAAM,gBAAgB,KAAK,iBAAiB;AAAA,QAC1C,OAAO;AAAA,MACT;AACA,YAAM,YAAY,KAAK,cACnB,cAAc,gBAAgB,KAAK,WAAW,IAC9C;AACJ,UAAI,KAAK,YAAa,WAAU,MAAM,KAAK,WAAW;AAEtD,YAAMC,aAAY,MAAM;AACxB,UAAIA,WAAU,SAAS;AACrB,cAAM,IAAI;AAAA,UACR,4BAA4BA,WAAU,QAAQ,OAAO;AAAA,UACrDA,WAAU;AAAA,QACZ;AAAA,MACF;AAEA,aAAO;AAAA,QACL,MAAMA,WAAU;AAAA,QAChB,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,UAAM,YAAY,OAAO;AACzB,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,MAAM,CAAC;AAAA,QACP,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAEA,UAAM,oBAAoB,KAAK,iBAAiB,kBAAkB,SAAS;AAC3E,UAAM,gBAAgB,KAAK,cACvB,kBAAkB,gBAAgB,KAAK,WAAW,IAClD;AACJ,QAAI,KAAK,YAAa,eAAc,MAAM,KAAK,WAAW;AAE1D,UAAM,YAAY,MAAM;AACxB,QAAI,UAAU,SAAS;AACrB,YAAM,IAAI;AAAA,QACR,6BAA6B,UAAU,QAAQ,OAAO;AAAA,QACtD,UAAU;AAAA,MACZ;AAAA,IACF;AAEA,WAAO;AAAA,MACL,MAAM,UAAU;AAAA,MAChB,OAAO;AAAA,MACP,OAAO,OAAO,SAAS;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAgD;AACtD,UAAM,MAAuC,CAAC;AAC9C,UAAM,SAAS,KAAK;AAEpB,eAAW,WAAW,KAAK,sBAAsB;AAC/C,YAAM,MAAM,OAAO,OAAO;AAC1B,UAAI,eAAe,iBAAiB;AAClC,YAAI,OAAO,IAAI;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAgCA,IAAM,wBAAN,cAAoC,MAAM;AAAA,EACjC;AAAA,EAEP,YAAY,SAAiB,iBAA0B;AACrD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,kBAAkB;AAAA,EACzB;AACF;;;ACt+BO,SAAS,kBACd,QAC2B;AAC3B,QAAM,EAAE,kBAAkB,eAAe,IAAI;AAE7C,SAAO;AAAA,IACL,KACE,WACA,QACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["baseOp","op","result","decrypted"]}
+{"version":3,"sources":["../../src/supabase/helpers.ts","../../src/supabase/query-builder.ts","../../src/supabase/index.ts"],"sourcesContent":["import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { QueryTypeName } from '@/types'\nimport type { FilterOp, PendingOrCondition } from './types'\n\n/**\n * Get the names of all encrypted columns defined in a table schema.\n */\nexport function getEncryptedColumnNames(\n  schema: EncryptedTable<EncryptedTableColumn>,\n): string[] {\n  const built = schema.build()\n  return Object.keys(built.columns)\n}\n\n/**\n * Check whether a column name refers to an encrypted column in the schema.\n */\nexport function isEncryptedColumn(\n  columnName: string,\n  encryptedColumnNames: string[],\n): boolean {\n  return encryptedColumnNames.includes(columnName)\n}\n\n/**\n * Parse a Supabase select string and add `::jsonb` casts to encrypted columns.\n *\n * Input:  `'id, email, name'`\n * Output: `'id, email::jsonb, name::jsonb'`  (if email and name are encrypted)\n *\n * Handles whitespace, already-cast columns, and embedded functions.\n */\nexport function addJsonbCasts(\n  columns: string,\n  encryptedColumnNames: string[],\n): string {\n  return columns\n    .split(',')\n    .map((col) => {\n      const trimmed = col.trim()\n\n      // Skip empty segments\n      if (!trimmed) return col\n\n      // If it already has a cast (e.g. `email::jsonb`), skip\n      if (trimmed.includes('::')) return col\n\n      // If it contains parens (function call) or dots (foreign table), skip\n      if (trimmed.includes('(') || trimmed.includes('.')) return col\n\n      // Check if the column name (possibly with alias) is encrypted\n      // Handle `column_name` or `column_name as alias`\n      const parts = trimmed.split(/\\s+/)\n      const colName = parts[0]\n\n      if (isEncryptedColumn(colName, encryptedColumnNames)) {\n        // Preserve original whitespace before the column\n        const leadingWhitespace = col.match(/^(\\s*)/)?.[1] ?? ''\n        if (parts.length > 1) {\n          // Has alias: `email as e` -> `email::jsonb as e`\n          return `${leadingWhitespace}${colName}::jsonb ${parts.slice(1).join(' ')}`\n        }\n        return `${leadingWhitespace}${colName}::jsonb`\n      }\n\n      return col\n    })\n    .join(',')\n}\n\n/**\n * Map a Supabase filter operation to a CipherStash query type.\n */\nexport function mapFilterOpToQueryType(op: FilterOp): QueryTypeName {\n  switch (op) {\n    case 'eq':\n    case 'neq':\n    case 'in':\n    case 'is':\n      return 'equality'\n    case 'like':\n    case 'ilike':\n      return 'freeTextSearch'\n    case 'gt':\n    case 'gte':\n    case 'lt':\n    case 'lte':\n      return 'orderAndRange'\n    default:\n      return 'equality'\n  }\n}\n\n/**\n * Parse a Supabase `.or()` filter string into structured conditions.\n *\n * Input: `'email.eq.john@example.com,name.ilike.%john%'`\n * Output: `[{ column: 'email', op: 'eq', value: 'john@example.com' }, { column: 'name', op: 'ilike', value: '%john%' }]`\n */\nexport function parseOrString(orString: string): PendingOrCondition[] {\n  const conditions: PendingOrCondition[] = []\n  // Split on commas that are not inside parentheses (nested or/and)\n  const parts = splitOrString(orString)\n\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (!trimmed) continue\n\n    // Format: column.op.value\n    const firstDot = trimmed.indexOf('.')\n    if (firstDot === -1) continue\n\n    const column = trimmed.slice(0, firstDot)\n    const rest = trimmed.slice(firstDot + 1)\n\n    const secondDot = rest.indexOf('.')\n    if (secondDot === -1) continue\n\n    const op = rest.slice(0, secondDot) as FilterOp\n    const value = rest.slice(secondDot + 1)\n\n    // Handle special value formats\n    const parsedValue = parseOrValue(value)\n\n    conditions.push({ column, op, value: parsedValue })\n  }\n\n  return conditions\n}\n\n/**\n * Rebuild an `.or()` string from structured conditions.\n */\nexport function rebuildOrString(conditions: PendingOrCondition[]): string {\n  return conditions\n    .map((c) => {\n      const value = formatOrValue(c.value)\n      return `${c.column}.${c.op}.${value}`\n    })\n    .join(',')\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction splitOrString(input: string): string[] {\n  const parts: string[] = []\n  let current = ''\n  let depth = 0\n\n  for (const char of input) {\n    if (char === '(') {\n      depth++\n      current += char\n    } else if (char === ')') {\n      depth--\n      current += char\n    } else if (char === ',' && depth === 0) {\n      parts.push(current)\n      current = ''\n    } else {\n      current += char\n    }\n  }\n\n  if (current) {\n    parts.push(current)\n  }\n\n  return parts\n}\n\nfunction parseOrValue(value: string): unknown {\n  // Handle parenthesized lists: (val1,val2,val3)\n  if (value.startsWith('(') && value.endsWith(')')) {\n    return value\n      .slice(1, -1)\n      .split(',')\n      .map((v) => v.trim())\n  }\n\n  // Handle booleans\n  if (value === 'true') return true\n  if (value === 'false') return false\n\n  // Handle null\n  if (value === 'null') return null\n\n  return value\n}\n\nfunction formatOrValue(value: unknown): string {\n  if (Array.isArray(value)) {\n    return `(${value.join(',')})`\n  }\n  if (value === null) return 'null'\n  if (value === true) return 'true'\n  if (value === false) return 'false'\n  return String(value)\n}\n","import type { EncryptionClient } from '@/encryption'\nimport {\n  bulkModelsToEncryptedPgComposites,\n  modelToEncryptedPgComposites,\n} from '@/encryption/helpers'\nimport type { AuditConfig } from '@/encryption/operations/base-operation'\nimport type { LockContext } from '@/identity'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { EncryptedColumn } from '@/schema'\nimport type { ScalarQueryTerm } from '@/types'\nimport { logger } from '@/utils/logger'\nimport type { JsPlaintext } from '@cipherstash/protect-ffi'\nimport {\n  addJsonbCasts,\n  getEncryptedColumnNames,\n  isEncryptedColumn,\n  mapFilterOpToQueryType,\n  parseOrString,\n  rebuildOrString,\n} from './helpers'\nimport type {\n  EncryptedSupabaseError,\n  EncryptedSupabaseResponse,\n  FilterOp,\n  MutationOp,\n  PendingFilter,\n  PendingMatchFilter,\n  PendingNotFilter,\n  PendingOrCondition,\n  PendingOrFilter,\n  PendingRawFilter,\n  ResultMode,\n  SupabaseClientLike,\n  SupabaseQueryBuilder,\n  TransformOp,\n} from './types'\n\n/**\n * A deferred query builder that wraps Supabase's query builder to automatically\n * handle encryption and decryption of data.\n *\n * All chained operations are recorded synchronously. When the builder is awaited,\n * it encrypts mutation data, adds `::jsonb` casts, batch-encrypts filter values,\n * executes the real Supabase query, and decrypts results.\n */\nexport class EncryptedQueryBuilderImpl<\n  T extends Record<string, unknown> = Record<string, unknown>,\n> {\n  private tableName: string\n  private schema: EncryptedTable<EncryptedTableColumn>\n  private encryptionClient: EncryptionClient\n  private supabaseClient: SupabaseClientLike\n  private encryptedColumnNames: string[]\n\n  // Recorded operations\n  private mutation: MutationOp | null = null\n  private selectColumns: string | null = null\n  private selectOptions:\n    | { head?: boolean; count?: 'exact' | 'planned' | 'estimated' }\n    | undefined = undefined\n  private filters: PendingFilter[] = []\n  private orFilters: PendingOrFilter[] = []\n  private matchFilters: PendingMatchFilter[] = []\n  private notFilters: PendingNotFilter[] = []\n  private rawFilters: PendingRawFilter[] = []\n  private transforms: TransformOp[] = []\n  private resultMode: ResultMode = 'array'\n  private shouldThrowOnError = false\n\n  // Encryption-specific state\n  private lockContext: LockContext | null = null\n  private auditConfig: AuditConfig | null = null\n\n  constructor(\n    tableName: string,\n    schema: EncryptedTable<EncryptedTableColumn>,\n    encryptionClient: EncryptionClient,\n    supabaseClient: SupabaseClientLike,\n  ) {\n    this.tableName = tableName\n    this.schema = schema\n    this.encryptionClient = encryptionClient\n    this.supabaseClient = supabaseClient\n    this.encryptedColumnNames = getEncryptedColumnNames(schema)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Mutation methods\n  // ---------------------------------------------------------------------------\n\n  select(\n    columns: string,\n    options?: { head?: boolean; count?: 'exact' | 'planned' | 'estimated' },\n  ): this {\n    if (columns === '*') {\n      throw new Error(\n        \"encryptedSupabase does not support select('*'). Please list columns explicitly so that encrypted columns can be cast with ::jsonb.\",\n      )\n    }\n    this.selectColumns = columns\n    this.selectOptions = options\n    return this\n  }\n\n  insert(\n    data: Partial<T> | Partial<T>[],\n    options?: {\n      count?: 'exact' | 'planned' | 'estimated'\n      defaultToNull?: boolean\n      onConflict?: string\n    },\n  ): this {\n    this.mutation = {\n      kind: 'insert',\n      data: data as Record<string, unknown> | Record<string, unknown>[],\n      options,\n    }\n    return this\n  }\n\n  update(\n    data: Partial<T>,\n    options?: { count?: 'exact' | 'planned' | 'estimated' },\n  ): this {\n    this.mutation = {\n      kind: 'update',\n      data: data as Record<string, unknown>,\n      options,\n    }\n    return this\n  }\n\n  upsert(\n    data: Partial<T> | Partial<T>[],\n    options?: {\n      count?: 'exact' | 'planned' | 'estimated'\n      onConflict?: string\n      ignoreDuplicates?: boolean\n      defaultToNull?: boolean\n    },\n  ): this {\n    this.mutation = {\n      kind: 'upsert',\n      data: data as Record<string, unknown> | Record<string, unknown>[],\n      options,\n    }\n    return this\n  }\n\n  delete(options?: { count?: 'exact' | 'planned' | 'estimated' }): this {\n    this.mutation = { kind: 'delete', options }\n    return this\n  }\n\n  // ---------------------------------------------------------------------------\n  // Filter methods\n  // ---------------------------------------------------------------------------\n\n  eq(column: string, value: unknown): this {\n    this.filters.push({ op: 'eq', column, value })\n    return this\n  }\n\n  neq(column: string, value: unknown): this {\n    this.filters.push({ op: 'neq', column, value })\n    return this\n  }\n\n  gt(column: string, value: unknown): this {\n    this.filters.push({ op: 'gt', column, value })\n    return this\n  }\n\n  gte(column: string, value: unknown): this {\n    this.filters.push({ op: 'gte', column, value })\n    return this\n  }\n\n  lt(column: string, value: unknown): this {\n    this.filters.push({ op: 'lt', column, value })\n    return this\n  }\n\n  lte(column: string, value: unknown): this {\n    this.filters.push({ op: 'lte', column, value })\n    return this\n  }\n\n  like(column: string, pattern: string): this {\n    this.filters.push({ op: 'like', column, value: pattern })\n    return this\n  }\n\n  ilike(column: string, pattern: string): this {\n    this.filters.push({ op: 'ilike', column, value: pattern })\n    return this\n  }\n\n  is(column: string, value: null | boolean): this {\n    this.filters.push({ op: 'is', column, value })\n    return this\n  }\n\n  in(column: string, values: unknown[]): this {\n    this.filters.push({ op: 'in', column, value: values })\n    return this\n  }\n\n  filter(column: string, operator: string, value: unknown): this {\n    this.rawFilters.push({ column, operator, value })\n    return this\n  }\n\n  not(column: string, operator: string, value: unknown): this {\n    this.notFilters.push({ column, op: operator as FilterOp, value })\n    return this\n  }\n\n  or(\n    filtersOrConditions: string | PendingOrCondition[],\n    options?: { referencedTable?: string; foreignTable?: string },\n  ): this {\n    if (typeof filtersOrConditions === 'string') {\n      this.orFilters.push({\n        kind: 'string',\n        value: filtersOrConditions,\n        referencedTable: options?.referencedTable ?? options?.foreignTable,\n      })\n    } else {\n      this.orFilters.push({\n        kind: 'structured',\n        conditions: filtersOrConditions,\n      })\n    }\n    return this\n  }\n\n  match(query: Record<string, unknown>): this {\n    this.matchFilters.push({ query })\n    return this\n  }\n\n  // ---------------------------------------------------------------------------\n  // Transform methods (passthrough)\n  // ---------------------------------------------------------------------------\n\n  order(\n    column: string,\n    options?: {\n      ascending?: boolean\n      nullsFirst?: boolean\n      referencedTable?: string\n      foreignTable?: string\n    },\n  ): this {\n    this.transforms.push({ kind: 'order', column, options })\n    return this\n  }\n\n  limit(\n    count: number,\n    options?: { referencedTable?: string; foreignTable?: string },\n  ): this {\n    this.transforms.push({ kind: 'limit', count, options })\n    return this\n  }\n\n  range(\n    from: number,\n    to: number,\n    options?: { referencedTable?: string; foreignTable?: string },\n  ): this {\n    this.transforms.push({ kind: 'range', from, to, options })\n    return this\n  }\n\n  single(): this {\n    this.resultMode = 'single'\n    this.transforms.push({ kind: 'single' })\n    return this\n  }\n\n  maybeSingle(): this {\n    this.resultMode = 'maybeSingle'\n    this.transforms.push({ kind: 'maybeSingle' })\n    return this\n  }\n\n  csv(): this {\n    this.transforms.push({ kind: 'csv' })\n    return this\n  }\n\n  abortSignal(signal: AbortSignal): this {\n    this.transforms.push({ kind: 'abortSignal', signal })\n    return this\n  }\n\n  throwOnError(): this {\n    this.shouldThrowOnError = true\n    this.transforms.push({ kind: 'throwOnError' })\n    return this\n  }\n\n  returns<U extends Record<string, unknown>>(): EncryptedQueryBuilderImpl<U> {\n    // Type-level cast only; builder state is preserved\n    return this as unknown as EncryptedQueryBuilderImpl<U>\n  }\n\n  // ---------------------------------------------------------------------------\n  // Encryption-specific methods\n  // ---------------------------------------------------------------------------\n\n  withLockContext(lockContext: LockContext): this {\n    this.lockContext = lockContext\n    return this\n  }\n\n  audit(config: AuditConfig): this {\n    this.auditConfig = config\n    return this\n  }\n\n  // ---------------------------------------------------------------------------\n  // PromiseLike implementation (deferred execution)\n  // ---------------------------------------------------------------------------\n\n  then<TResult1 = EncryptedSupabaseResponse<T[]>, TResult2 = never>(\n    onfulfilled?:\n      | ((\n          value: EncryptedSupabaseResponse<T[]>,\n        ) => TResult1 | PromiseLike<TResult1>)\n      | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): Promise<TResult1 | TResult2> {\n    return this.execute().then(onfulfilled, onrejected)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Core execution\n  // ---------------------------------------------------------------------------\n\n  private async execute(): Promise<EncryptedSupabaseResponse<T[]>> {\n    try {\n      logger.debug(`Supabase encrypted query on table \"${this.tableName}\".`)\n\n      // 1. Encrypt mutation data\n      const encryptedMutation = await this.encryptMutationData()\n\n      // 2. Build select string with ::jsonb casts\n      const selectString = this.buildSelectString()\n\n      // 3. Batch-encrypt filter values\n      const encryptedFilters = await this.encryptFilterValues()\n\n      // 4. Build and execute real Supabase query\n      const result = await this.buildAndExecuteQuery(\n        encryptedMutation,\n        selectString,\n        encryptedFilters,\n      )\n\n      // 5. Decrypt results\n      return await this.decryptResults(result)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      logger.error(\n        `Supabase encrypted query failed on table \"${this.tableName}\": ${message}`,\n      )\n\n      const error: EncryptedSupabaseError = {\n        message,\n        encryptionError: undefined,\n      }\n\n      if (this.shouldThrowOnError) {\n        throw err\n      }\n\n      return {\n        data: null,\n        error,\n        count: null,\n        status: 500,\n        statusText: 'Encryption Error',\n      }\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 1: Encrypt mutation data\n  // ---------------------------------------------------------------------------\n\n  private async encryptMutationData(): Promise<\n    Record<string, unknown> | Record<string, unknown>[] | null\n  > {\n    if (!this.mutation) return null\n\n    if (this.mutation.kind === 'delete') return null\n\n    const data = this.mutation.data\n\n    if (Array.isArray(data)) {\n      // Bulk encrypt\n      const baseOp = this.encryptionClient.bulkEncryptModels(data, this.schema)\n      const op = this.lockContext\n        ? baseOp.withLockContext(this.lockContext)\n        : baseOp\n      if (this.auditConfig) op.audit(this.auditConfig)\n\n      const result = await op\n      if (result.failure) {\n        logger.error(\n          `Supabase: failed to encrypt models for table \"${this.tableName}\"`,\n        )\n\n        throw new EncryptionFailedError(\n          `Failed to encrypt models: ${result.failure.message}`,\n          result.failure,\n        )\n      }\n\n      return bulkModelsToEncryptedPgComposites(result.data)\n    }\n\n    // Single model\n    const baseOp = this.encryptionClient.encryptModel(data, this.schema)\n    const op = this.lockContext\n      ? baseOp.withLockContext(this.lockContext)\n      : baseOp\n    if (this.auditConfig) op.audit(this.auditConfig)\n\n    const result = await op\n    if (result.failure) {\n      logger.error(\n        `Supabase: failed to encrypt model for table \"${this.tableName}\"`,\n      )\n\n      throw new EncryptionFailedError(\n        `Failed to encrypt model: ${result.failure.message}`,\n        result.failure,\n      )\n    }\n\n    return modelToEncryptedPgComposites(result.data)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 2: Build select string with casts\n  // ---------------------------------------------------------------------------\n\n  private buildSelectString(): string | null {\n    if (this.selectColumns === null) return null\n    return addJsonbCasts(this.selectColumns, this.encryptedColumnNames)\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 3: Encrypt filter values\n  // ---------------------------------------------------------------------------\n\n  private async encryptFilterValues(): Promise<EncryptedFilterState> {\n    // Collect all terms that need encryption\n    const terms: ScalarQueryTerm[] = []\n    const termMap: TermMapping[] = []\n\n    const tableColumns = this.getColumnMap()\n\n    // Regular filters\n    for (let i = 0; i < this.filters.length; i++) {\n      const f = this.filters[i]\n      if (!isEncryptedColumn(f.column, this.encryptedColumnNames)) continue\n\n      const column = tableColumns[f.column]\n      if (!column) continue\n\n      if (f.op === 'in' && Array.isArray(f.value)) {\n        // For `in` filters, encrypt each value separately\n        for (let j = 0; j < f.value.length; j++) {\n          terms.push({\n            value: f.value[j] as JsPlaintext,\n            column,\n            table: this.schema,\n            queryType: mapFilterOpToQueryType(f.op),\n            returnType: 'composite-literal',\n          })\n          termMap.push({ source: 'filter', filterIndex: i, inIndex: j })\n        }\n      } else if (f.op === 'is') {\n        // `is` is used for null/boolean checks — don't encrypt\n        continue\n      } else {\n        terms.push({\n          value: f.value as JsPlaintext,\n          column,\n          table: this.schema,\n          queryType: mapFilterOpToQueryType(f.op),\n          returnType: 'composite-literal',\n        })\n        termMap.push({ source: 'filter', filterIndex: i })\n      }\n    }\n\n    // Match filters\n    for (let i = 0; i < this.matchFilters.length; i++) {\n      const mf = this.matchFilters[i]\n      for (const [colName, value] of Object.entries(mf.query)) {\n        if (!isEncryptedColumn(colName, this.encryptedColumnNames)) continue\n        const column = tableColumns[colName]\n        if (!column) continue\n\n        terms.push({\n          value: value as JsPlaintext,\n          column,\n          table: this.schema,\n          queryType: 'equality',\n          returnType: 'composite-literal',\n        })\n        termMap.push({ source: 'match', matchIndex: i, column: colName })\n      }\n    }\n\n    // Not filters\n    for (let i = 0; i < this.notFilters.length; i++) {\n      const nf = this.notFilters[i]\n      if (!isEncryptedColumn(nf.column, this.encryptedColumnNames)) continue\n      const column = tableColumns[nf.column]\n      if (!column) continue\n\n      terms.push({\n        value: nf.value as JsPlaintext,\n        column,\n        table: this.schema,\n        queryType: mapFilterOpToQueryType(nf.op),\n        returnType: 'composite-literal',\n      })\n      termMap.push({ source: 'not', notIndex: i })\n    }\n\n    // Or filters (string form parsed into conditions)\n    for (let i = 0; i < this.orFilters.length; i++) {\n      const of_ = this.orFilters[i]\n      if (of_.kind === 'string') {\n        const parsed = parseOrString(of_.value)\n        for (let j = 0; j < parsed.length; j++) {\n          const cond = parsed[j]\n          if (!isEncryptedColumn(cond.column, this.encryptedColumnNames))\n            continue\n          const column = tableColumns[cond.column]\n          if (!column) continue\n\n          terms.push({\n            value: cond.value as JsPlaintext,\n            column,\n            table: this.schema,\n            queryType: mapFilterOpToQueryType(cond.op),\n            returnType: 'composite-literal',\n          })\n          termMap.push({ source: 'or-string', orIndex: i, conditionIndex: j })\n        }\n      } else {\n        for (let j = 0; j < of_.conditions.length; j++) {\n          const cond = of_.conditions[j]\n          if (!isEncryptedColumn(cond.column, this.encryptedColumnNames))\n            continue\n          const column = tableColumns[cond.column]\n          if (!column) continue\n\n          terms.push({\n            value: cond.value as JsPlaintext,\n            column,\n            table: this.schema,\n            queryType: mapFilterOpToQueryType(cond.op),\n            returnType: 'composite-literal',\n          })\n          termMap.push({\n            source: 'or-structured',\n            orIndex: i,\n            conditionIndex: j,\n          })\n        }\n      }\n    }\n\n    // Raw filters\n    for (let i = 0; i < this.rawFilters.length; i++) {\n      const rf = this.rawFilters[i]\n      if (!isEncryptedColumn(rf.column, this.encryptedColumnNames)) continue\n      const column = tableColumns[rf.column]\n      if (!column) continue\n\n      terms.push({\n        value: rf.value as JsPlaintext,\n        column,\n        table: this.schema,\n        queryType: 'equality',\n        returnType: 'composite-literal',\n      })\n      termMap.push({ source: 'raw', rawIndex: i })\n    }\n\n    if (terms.length === 0) {\n      return { encryptedValues: [], termMap: [] }\n    }\n\n    // Batch encrypt all terms in one call\n    const baseOp = this.encryptionClient.encryptQuery(terms)\n    const op = this.lockContext\n      ? baseOp.withLockContext(this.lockContext)\n      : baseOp\n    if (this.auditConfig) op.audit(this.auditConfig)\n\n    const result = await op\n    if (result.failure) {\n      logger.error(\n        `Supabase: failed to encrypt query terms for table \"${this.tableName}\"`,\n      )\n\n      throw new EncryptionFailedError(\n        `Failed to encrypt query terms: ${result.failure.message}`,\n        result.failure,\n      )\n    }\n\n    return { encryptedValues: result.data, termMap }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 4: Build and execute real Supabase query\n  // ---------------------------------------------------------------------------\n\n  private async buildAndExecuteQuery(\n    encryptedMutation:\n      | Record<string, unknown>\n      | Record<string, unknown>[]\n      | null,\n    selectString: string | null,\n    encryptedFilters: EncryptedFilterState,\n  ): Promise<RawSupabaseResult> {\n    let query: SupabaseQueryBuilder = this.supabaseClient.from(this.tableName)\n\n    // Apply mutation\n    if (this.mutation) {\n      switch (this.mutation.kind) {\n        case 'insert':\n          query = query.insert(encryptedMutation!, this.mutation.options)\n          break\n        case 'update':\n          query = query.update(encryptedMutation!, this.mutation.options)\n          break\n        case 'upsert':\n          query = query.upsert(encryptedMutation!, this.mutation.options)\n          break\n        case 'delete':\n          query = query.delete(this.mutation.options)\n          break\n      }\n    }\n\n    // Apply select\n    if (selectString !== null) {\n      query = query.select(selectString, this.selectOptions)\n    } else if (!this.mutation) {\n      // Default select without explicit columns - shouldn't happen but fallback\n      query = query.select('*', this.selectOptions)\n    }\n\n    // Apply resolved filters\n    query = this.applyFilters(query, encryptedFilters)\n\n    // Apply transforms\n    for (const t of this.transforms) {\n      switch (t.kind) {\n        case 'order':\n          query = query.order(t.column, t.options)\n          break\n        case 'limit':\n          query = query.limit(t.count, t.options)\n          break\n        case 'range':\n          query = query.range(t.from, t.to, t.options)\n          break\n        case 'single':\n          query = query.single()\n          break\n        case 'maybeSingle':\n          query = query.maybeSingle()\n          break\n        case 'csv':\n          query = query.csv()\n          break\n        case 'abortSignal':\n          query = query.abortSignal(t.signal)\n          break\n        case 'throwOnError':\n          query = query.throwOnError()\n          break\n      }\n    }\n\n    const result = (await query) as unknown as RawSupabaseResult\n    return result\n  }\n\n  // ---------------------------------------------------------------------------\n  // Apply filters with encrypted values substituted\n  // ---------------------------------------------------------------------------\n\n  private applyFilters(\n    query: SupabaseQueryBuilder,\n    encryptedFilters: EncryptedFilterState,\n  ): SupabaseQueryBuilder {\n    let q = query\n\n    // Build lookup maps for quick access to encrypted values\n    const filterValueMap = new Map<number, unknown>()\n    const filterInMap = new Map<string, unknown>() // \"filterIndex:inIndex\" -> value\n    const matchValueMap = new Map<string, unknown>() // \"matchIndex:column\" -> value\n    const notValueMap = new Map<number, unknown>()\n    const rawValueMap = new Map<number, unknown>()\n    const orStringConditionMap = new Map<string, unknown>() // \"orIndex:condIndex\" -> value\n    const orStructuredConditionMap = new Map<string, unknown>()\n\n    for (let i = 0; i < encryptedFilters.termMap.length; i++) {\n      const mapping = encryptedFilters.termMap[i]\n      const encValue = encryptedFilters.encryptedValues[i]\n\n      switch (mapping.source) {\n        case 'filter':\n          if (mapping.inIndex !== undefined) {\n            filterInMap.set(\n              `${mapping.filterIndex}:${mapping.inIndex}`,\n              encValue,\n            )\n          } else {\n            filterValueMap.set(mapping.filterIndex, encValue)\n          }\n          break\n        case 'match':\n          matchValueMap.set(`${mapping.matchIndex}:${mapping.column}`, encValue)\n          break\n        case 'not':\n          notValueMap.set(mapping.notIndex, encValue)\n          break\n        case 'raw':\n          rawValueMap.set(mapping.rawIndex, encValue)\n          break\n        case 'or-string':\n          orStringConditionMap.set(\n            `${mapping.orIndex}:${mapping.conditionIndex}`,\n            encValue,\n          )\n          break\n        case 'or-structured':\n          orStructuredConditionMap.set(\n            `${mapping.orIndex}:${mapping.conditionIndex}`,\n            encValue,\n          )\n          break\n      }\n    }\n\n    // Apply regular filters\n    for (let i = 0; i < this.filters.length; i++) {\n      const f = this.filters[i]\n      let value = f.value\n\n      if (filterValueMap.has(i)) {\n        value = filterValueMap.get(i)\n      } else if (f.op === 'in' && Array.isArray(f.value)) {\n        // Reconstruct array with encrypted values substituted\n        value = f.value.map((v, j) => {\n          const key = `${i}:${j}`\n          return filterInMap.has(key) ? filterInMap.get(key) : v\n        })\n      }\n\n      switch (f.op) {\n        case 'eq':\n          q = q.eq(f.column, value)\n          break\n        case 'neq':\n          q = q.neq(f.column, value)\n          break\n        case 'gt':\n          q = q.gt(f.column, value)\n          break\n        case 'gte':\n          q = q.gte(f.column, value)\n          break\n        case 'lt':\n          q = q.lt(f.column, value)\n          break\n        case 'lte':\n          q = q.lte(f.column, value)\n          break\n        case 'like':\n          q = q.like(f.column, value as string)\n          break\n        case 'ilike':\n          q = q.ilike(f.column, value as string)\n          break\n        case 'is':\n          q = q.is(f.column, value)\n          break\n        case 'in':\n          q = q.in(f.column, value as unknown[])\n          break\n      }\n    }\n\n    // Apply match filters\n    for (let i = 0; i < this.matchFilters.length; i++) {\n      const mf = this.matchFilters[i]\n      const resolvedQuery: Record<string, unknown> = {}\n\n      for (const [colName, originalValue] of Object.entries(mf.query)) {\n        const key = `${i}:${colName}`\n        resolvedQuery[colName] = matchValueMap.has(key)\n          ? matchValueMap.get(key)\n          : originalValue\n      }\n\n      q = q.match(resolvedQuery)\n    }\n\n    // Apply not filters\n    for (let i = 0; i < this.notFilters.length; i++) {\n      const nf = this.notFilters[i]\n      const value = notValueMap.has(i) ? notValueMap.get(i) : nf.value\n      q = q.not(nf.column, nf.op, value)\n    }\n\n    // Apply or filters\n    for (let i = 0; i < this.orFilters.length; i++) {\n      const of_ = this.orFilters[i]\n\n      if (of_.kind === 'string') {\n        const parsed = parseOrString(of_.value)\n        let hasEncrypted = false\n\n        for (let j = 0; j < parsed.length; j++) {\n          const key = `${i}:${j}`\n          if (orStringConditionMap.has(key)) {\n            parsed[j] = { ...parsed[j], value: orStringConditionMap.get(key) }\n            hasEncrypted = true\n          }\n        }\n\n        if (hasEncrypted) {\n          q = q.or(rebuildOrString(parsed), {\n            referencedTable: of_.referencedTable,\n          })\n        } else {\n          q = q.or(of_.value, { referencedTable: of_.referencedTable })\n        }\n      } else {\n        // Structured: convert to string\n        const conditions = of_.conditions.map((cond, j) => {\n          const key = `${i}:${j}`\n          if (orStructuredConditionMap.has(key)) {\n            return { ...cond, value: orStructuredConditionMap.get(key) }\n          }\n          return cond\n        })\n\n        q = q.or(rebuildOrString(conditions))\n      }\n    }\n\n    // Apply raw filters\n    for (let i = 0; i < this.rawFilters.length; i++) {\n      const rf = this.rawFilters[i]\n      const value = rawValueMap.has(i) ? rawValueMap.get(i) : rf.value\n      q = q.filter(rf.column, rf.operator, value)\n    }\n\n    return q\n  }\n\n  // ---------------------------------------------------------------------------\n  // Step 5: Decrypt results\n  // ---------------------------------------------------------------------------\n\n  private async decryptResults(\n    result: RawSupabaseResult,\n  ): Promise<EncryptedSupabaseResponse<T[]>> {\n    // If there's an error from Supabase, pass it through\n    if (result.error) {\n      return {\n        data: null,\n        error: {\n          message: result.error.message,\n          details: result.error.details,\n          hint: result.error.hint,\n          code: result.error.code,\n        },\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // No data to decrypt\n    if (result.data === null || result.data === undefined) {\n      return {\n        data: null,\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // Determine if we need to decrypt\n    const hasSelect = this.selectColumns !== null\n    const hasMutationWithReturning = this.mutation !== null && hasSelect\n\n    if (!hasSelect && !hasMutationWithReturning) {\n      // No select means no data to decrypt (e.g., insert without .select())\n      return {\n        data: result.data as T[],\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // Decrypt based on result mode\n    if (this.resultMode === 'single' || this.resultMode === 'maybeSingle') {\n      if (result.data === null) {\n        return {\n          data: null,\n          error: null,\n          count: result.count ?? null,\n          status: result.status,\n          statusText: result.statusText,\n        }\n      }\n\n      // Single result — decrypt one model\n      const baseDecryptOp = this.encryptionClient.decryptModel(\n        result.data as Record<string, unknown>,\n      )\n      const decryptOp = this.lockContext\n        ? baseDecryptOp.withLockContext(this.lockContext)\n        : baseDecryptOp\n      if (this.auditConfig) decryptOp.audit(this.auditConfig)\n\n      const decrypted = await decryptOp\n      if (decrypted.failure) {\n        logger.error(\n          `Supabase: failed to decrypt model for table \"${this.tableName}\"`,\n        )\n\n        throw new EncryptionFailedError(\n          `Failed to decrypt model: ${decrypted.failure.message}`,\n          decrypted.failure,\n        )\n      }\n\n      return {\n        data: decrypted.data as unknown as T[],\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    // Array result — bulk decrypt\n    const dataArray = result.data as Record<string, unknown>[]\n    if (dataArray.length === 0) {\n      return {\n        data: [] as unknown as T[],\n        error: null,\n        count: result.count ?? null,\n        status: result.status,\n        statusText: result.statusText,\n      }\n    }\n\n    const baseBulkDecryptOp = this.encryptionClient.bulkDecryptModels(dataArray)\n    const bulkDecryptOp = this.lockContext\n      ? baseBulkDecryptOp.withLockContext(this.lockContext)\n      : baseBulkDecryptOp\n    if (this.auditConfig) bulkDecryptOp.audit(this.auditConfig)\n\n    const decrypted = await bulkDecryptOp\n    if (decrypted.failure) {\n      logger.error(\n        `Supabase: failed to decrypt models for table \"${this.tableName}\"`,\n      )\n\n      throw new EncryptionFailedError(\n        `Failed to decrypt models: ${decrypted.failure.message}`,\n        decrypted.failure,\n      )\n    }\n\n    return {\n      data: decrypted.data as unknown as T[],\n      error: null,\n      count: result.count ?? null,\n      status: result.status,\n      statusText: result.statusText,\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Helpers\n  // ---------------------------------------------------------------------------\n\n  private getColumnMap(): Record<string, EncryptedColumn> {\n    const map: Record<string, EncryptedColumn> = {}\n    const schema = this.schema as unknown as Record<string, unknown>\n\n    for (const colName of this.encryptedColumnNames) {\n      const col = schema[colName]\n      if (col instanceof EncryptedColumn) {\n        map[colName] = col\n      }\n    }\n\n    return map\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Internal types\n// ---------------------------------------------------------------------------\n\ntype TermMapping =\n  | { source: 'filter'; filterIndex: number; inIndex?: number }\n  | { source: 'match'; matchIndex: number; column: string }\n  | { source: 'not'; notIndex: number }\n  | { source: 'raw'; rawIndex: number }\n  | { source: 'or-string'; orIndex: number; conditionIndex: number }\n  | { source: 'or-structured'; orIndex: number; conditionIndex: number }\n\ntype EncryptedFilterState = {\n  encryptedValues: unknown[]\n  termMap: TermMapping[]\n}\n\ntype RawSupabaseResult = {\n  data: unknown\n  error: {\n    message: string\n    details?: string\n    hint?: string\n    code?: string\n  } | null\n  count?: number | null\n  status: number\n  statusText: string\n}\n\nclass EncryptionFailedError extends Error {\n  public encryptionError: unknown\n\n  constructor(message: string, encryptionError: unknown) {\n    super(message)\n    this.name = 'EncryptionFailedError'\n    this.encryptionError = encryptionError\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { EncryptedQueryBuilderImpl } from './query-builder'\nimport type {\n  EncryptedSupabaseConfig,\n  EncryptedSupabaseInstance,\n} from './types'\n\n/**\n * Create an encrypted Supabase wrapper that transparently handles encryption\n * and decryption for queries on encrypted columns.\n *\n * @param config - Configuration containing the encryption client and Supabase client.\n * @returns An object with a `from()` method that mirrors `supabase.from()` but\n *   auto-encrypts mutations, adds `::jsonb` casts, encrypts filter values, and\n *   decrypts results.\n *\n * @example\n * ```typescript\n * import { Encryption } from '@cipherstash/stack'\n * import { encryptedSupabase } from '@cipherstash/stack/supabase'\n * import { encryptedTable, encryptedColumn } from '@cipherstash/stack/schema'\n *\n * const users = encryptedTable('users', {\n *   name: encryptedColumn('name').freeTextSearch().equality(),\n *   email: encryptedColumn('email').freeTextSearch().equality(),\n * })\n *\n * const client = await Encryption({ schemas: [users] })\n * const eSupabase = encryptedSupabase({ encryptionClient: client, supabaseClient: supabase })\n *\n * // INSERT - auto-encrypts, auto-converts to PG composite\n * await eSupabase.from('users', users)\n *   .insert({ name: 'John', email: 'john@example.com', age: 30 })\n *\n * // SELECT with filter - auto-casts ::jsonb, auto-encrypts search term, auto-decrypts\n * const { data } = await eSupabase.from('users', users)\n *   .select('id, email, name')\n *   .eq('email', 'john@example.com')\n * ```\n */\nexport function encryptedSupabase(\n  config: EncryptedSupabaseConfig,\n): EncryptedSupabaseInstance {\n  const { encryptionClient, supabaseClient } = config\n\n  return {\n    from<T extends Record<string, unknown> = Record<string, unknown>>(\n      tableName: string,\n      schema: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new EncryptedQueryBuilderImpl<T>(\n        tableName,\n        schema,\n        encryptionClient,\n        supabaseClient,\n      )\n    },\n  }\n}\n\nexport type {\n  EncryptedSupabaseConfig,\n  EncryptedSupabaseInstance,\n  EncryptedSupabaseResponse,\n  EncryptedSupabaseError,\n  EncryptedQueryBuilder,\n  PendingOrCondition,\n  SupabaseClientLike,\n} from './types'\n"],"mappings":";;;;;;;;;;;;AAOO,SAAS,wBACd,QACU;AACV,QAAM,QAAQ,OAAO,MAAM;AAC3B,SAAO,OAAO,KAAK,MAAM,OAAO;AAClC;AAKO,SAAS,kBACd,YACA,sBACS;AACT,SAAO,qBAAqB,SAAS,UAAU;AACjD;AAUO,SAAS,cACd,SACA,sBACQ;AACR,SAAO,QACJ,MAAM,GAAG,EACT,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAU,IAAI,KAAK;AAGzB,QAAI,CAAC,QAAS,QAAO;AAGrB,QAAI,QAAQ,SAAS,IAAI,EAAG,QAAO;AAGnC,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO;AAI3D,UAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,UAAM,UAAU,MAAM,CAAC;AAEvB,QAAI,kBAAkB,SAAS,oBAAoB,GAAG;AAEpD,YAAM,oBAAoB,IAAI,MAAM,QAAQ,IAAI,CAAC,KAAK;AACtD,UAAI,MAAM,SAAS,GAAG;AAEpB,eAAO,GAAG,iBAAiB,GAAG,OAAO,WAAW,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MAC1E;AACA,aAAO,GAAG,iBAAiB,GAAG,OAAO;AAAA,IACvC;AAEA,WAAO;AAAA,EACT,CAAC,EACA,KAAK,GAAG;AACb;AAKO,SAAS,uBAAuB,IAA6B;AAClE,UAAQ,IAAI;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,cAAc,UAAwC;AACpE,QAAM,aAAmC,CAAC;AAE1C,QAAM,QAAQ,cAAc,QAAQ;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,QAAS;AAGd,UAAM,WAAW,QAAQ,QAAQ,GAAG;AACpC,QAAI,aAAa,GAAI;AAErB,UAAM,SAAS,QAAQ,MAAM,GAAG,QAAQ;AACxC,UAAM,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEvC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,cAAc,GAAI;AAEtB,UAAM,KAAK,KAAK,MAAM,GAAG,SAAS;AAClC,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC;AAGtC,UAAM,cAAc,aAAa,KAAK;AAEtC,eAAW,KAAK,EAAE,QAAQ,IAAI,OAAO,YAAY,CAAC;AAAA,EACpD;AAEA,SAAO;AACT;AAKO,SAAS,gBAAgB,YAA0C;AACxE,SAAO,WACJ,IAAI,CAAC,MAAM;AACV,UAAM,QAAQ,cAAc,EAAE,KAAK;AACnC,WAAO,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAMA,SAAS,cAAc,OAAyB;AAC9C,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AAEZ,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,KAAK;AAChB;AACA,iBAAW;AAAA,IACb,WAAW,SAAS,KAAK;AACvB;AACA,iBAAW;AAAA,IACb,WAAW,SAAS,OAAO,UAAU,GAAG;AACtC,YAAM,KAAK,OAAO;AAClB,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,MAAI,SAAS;AACX,UAAM,KAAK,OAAO;AAAA,EACpB;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAE5C,MAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AAChD,WAAO,MACJ,MAAM,GAAG,EAAE,EACX,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAAA,EACxB;AAGA,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAG9B,MAAI,UAAU,OAAQ,QAAO;AAE7B,SAAO;AACT;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAAA,EAC5B;AACA,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,MAAO,QAAO;AAC5B,SAAO,OAAO,KAAK;AACrB;;;AC3JO,IAAM,4BAAN,MAEL;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA,WAA8B;AAAA,EAC9B,gBAA+B;AAAA,EAC/B,gBAEQ;AAAA,EACR,UAA2B,CAAC;AAAA,EAC5B,YAA+B,CAAC;AAAA,EAChC,eAAqC,CAAC;AAAA,EACtC,aAAiC,CAAC;AAAA,EAClC,aAAiC,CAAC;AAAA,EAClC,aAA4B,CAAC;AAAA,EAC7B,aAAyB;AAAA,EACzB,qBAAqB;AAAA;AAAA,EAGrB,cAAkC;AAAA,EAClC,cAAkC;AAAA,EAE1C,YACE,WACA,QACA,kBACA,gBACA;AACA,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,mBAAmB;AACxB,SAAK,iBAAiB;AACtB,SAAK,uBAAuB,wBAAwB,MAAM;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,SACA,SACM;AACN,QAAI,YAAY,KAAK;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,gBAAgB;AACrB,SAAK,gBAAgB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,OACE,MACA,SAKM;AACN,SAAK,WAAW;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OACE,MACA,SACM;AACN,SAAK,WAAW;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OACE,MACA,SAMM;AACN,SAAK,WAAW;AAAA,MACd,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAA+D;AACpE,SAAK,WAAW,EAAE,MAAM,UAAU,QAAQ;AAC1C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,GAAG,QAAgB,OAAsB;AACvC,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAsB;AACxC,SAAK,QAAQ,KAAK,EAAE,IAAI,OAAO,QAAQ,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAAsB;AACvC,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAsB;AACxC,SAAK,QAAQ,KAAK,EAAE,IAAI,OAAO,QAAQ,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAAsB;AACvC,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,OAAsB;AACxC,SAAK,QAAQ,KAAK,EAAE,IAAI,OAAO,QAAQ,MAAM,CAAC;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,KAAK,QAAgB,SAAuB;AAC1C,SAAK,QAAQ,KAAK,EAAE,IAAI,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAgB,SAAuB;AAC3C,SAAK,QAAQ,KAAK,EAAE,IAAI,SAAS,QAAQ,OAAO,QAAQ,CAAC;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,OAA6B;AAC9C,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,MAAM,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,GAAG,QAAgB,QAAyB;AAC1C,SAAK,QAAQ,KAAK,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,QAAgB,UAAkB,OAAsB;AAC7D,SAAK,WAAW,KAAK,EAAE,QAAQ,UAAU,MAAM,CAAC;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,QAAgB,UAAkB,OAAsB;AAC1D,SAAK,WAAW,KAAK,EAAE,QAAQ,IAAI,UAAsB,MAAM,CAAC;AAChE,WAAO;AAAA,EACT;AAAA,EAEA,GACE,qBACA,SACM;AACN,QAAI,OAAO,wBAAwB,UAAU;AAC3C,WAAK,UAAU,KAAK;AAAA,QAClB,MAAM;AAAA,QACN,OAAO;AAAA,QACP,iBAAiB,SAAS,mBAAmB,SAAS;AAAA,MACxD,CAAC;AAAA,IACH,OAAO;AACL,WAAK,UAAU,KAAK;AAAA,QAClB,MAAM;AAAA,QACN,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAsC;AAC1C,SAAK,aAAa,KAAK,EAAE,MAAM,CAAC;AAChC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MACE,QACA,SAMM;AACN,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,CAAC;AACvD,WAAO;AAAA,EACT;AAAA,EAEA,MACE,OACA,SACM;AACN,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,OAAO,QAAQ,CAAC;AACtD,WAAO;AAAA,EACT;AAAA,EAEA,MACE,MACA,IACA,SACM;AACN,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,MAAM,IAAI,QAAQ,CAAC;AACzD,WAAO;AAAA,EACT;AAAA,EAEA,SAAe;AACb,SAAK,aAAa;AAClB,SAAK,WAAW,KAAK,EAAE,MAAM,SAAS,CAAC;AACvC,WAAO;AAAA,EACT;AAAA,EAEA,cAAoB;AAClB,SAAK,aAAa;AAClB,SAAK,WAAW,KAAK,EAAE,MAAM,cAAc,CAAC;AAC5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAY;AACV,SAAK,WAAW,KAAK,EAAE,MAAM,MAAM,CAAC;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,YAAY,QAA2B;AACrC,SAAK,WAAW,KAAK,EAAE,MAAM,eAAe,OAAO,CAAC;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,eAAqB;AACnB,SAAK,qBAAqB;AAC1B,SAAK,WAAW,KAAK,EAAE,MAAM,eAAe,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,UAA2E;AAEzE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,aAAgC;AAC9C,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAA2B;AAC/B,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,KACE,aAKA,YAC8B;AAC9B,WAAO,KAAK,QAAQ,EAAE,KAAK,aAAa,UAAU;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,UAAmD;AAC/D,QAAI;AACF,aAAO,MAAM,sCAAsC,KAAK,SAAS,IAAI;AAGrE,YAAM,oBAAoB,MAAM,KAAK,oBAAoB;AAGzD,YAAM,eAAe,KAAK,kBAAkB;AAG5C,YAAM,mBAAmB,MAAM,KAAK,oBAAoB;AAGxD,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAGA,aAAO,MAAM,KAAK,eAAe,MAAM;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,aAAO;AAAA,QACL,6CAA6C,KAAK,SAAS,MAAM,OAAO;AAAA,MAC1E;AAEA,YAAM,QAAgC;AAAA,QACpC;AAAA,QACA,iBAAiB;AAAA,MACnB;AAEA,UAAI,KAAK,oBAAoB;AAC3B,cAAM;AAAA,MACR;AAEA,aAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAEZ;AACA,QAAI,CAAC,KAAK,SAAU,QAAO;AAE3B,QAAI,KAAK,SAAS,SAAS,SAAU,QAAO;AAE5C,UAAM,OAAO,KAAK,SAAS;AAE3B,QAAI,MAAM,QAAQ,IAAI,GAAG;AAEvB,YAAMA,UAAS,KAAK,iBAAiB,kBAAkB,MAAM,KAAK,MAAM;AACxE,YAAMC,MAAK,KAAK,cACZD,QAAO,gBAAgB,KAAK,WAAW,IACvCA;AACJ,UAAI,KAAK,YAAa,CAAAC,IAAG,MAAM,KAAK,WAAW;AAE/C,YAAMC,UAAS,MAAMD;AACrB,UAAIC,QAAO,SAAS;AAClB,eAAO;AAAA,UACL,iDAAiD,KAAK,SAAS;AAAA,QACjE;AAEA,cAAM,IAAI;AAAA,UACR,6BAA6BA,QAAO,QAAQ,OAAO;AAAA,UACnDA,QAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO,kCAAkCA,QAAO,IAAI;AAAA,IACtD;AAGA,UAAM,SAAS,KAAK,iBAAiB,aAAa,MAAM,KAAK,MAAM;AACnE,UAAM,KAAK,KAAK,cACZ,OAAO,gBAAgB,KAAK,WAAW,IACvC;AACJ,QAAI,KAAK,YAAa,IAAG,MAAM,KAAK,WAAW;AAE/C,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,SAAS;AAClB,aAAO;AAAA,QACL,gDAAgD,KAAK,SAAS;AAAA,MAChE;AAEA,YAAM,IAAI;AAAA,QACR,4BAA4B,OAAO,QAAQ,OAAO;AAAA,QAClD,OAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO,6BAA6B,OAAO,IAAI;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAmC;AACzC,QAAI,KAAK,kBAAkB,KAAM,QAAO;AACxC,WAAO,cAAc,KAAK,eAAe,KAAK,oBAAoB;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAqD;AAEjE,UAAM,QAA2B,CAAC;AAClC,UAAM,UAAyB,CAAC;AAEhC,UAAM,eAAe,KAAK,aAAa;AAGvC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC5C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,CAAC,kBAAkB,EAAE,QAAQ,KAAK,oBAAoB,EAAG;AAE7D,YAAM,SAAS,aAAa,EAAE,MAAM;AACpC,UAAI,CAAC,OAAQ;AAEb,UAAI,EAAE,OAAO,QAAQ,MAAM,QAAQ,EAAE,KAAK,GAAG;AAE3C,iBAAS,IAAI,GAAG,IAAI,EAAE,MAAM,QAAQ,KAAK;AACvC,gBAAM,KAAK;AAAA,YACT,OAAO,EAAE,MAAM,CAAC;AAAA,YAChB;AAAA,YACA,OAAO,KAAK;AAAA,YACZ,WAAW,uBAAuB,EAAE,EAAE;AAAA,YACtC,YAAY;AAAA,UACd,CAAC;AACD,kBAAQ,KAAK,EAAE,QAAQ,UAAU,aAAa,GAAG,SAAS,EAAE,CAAC;AAAA,QAC/D;AAAA,MACF,WAAW,EAAE,OAAO,MAAM;AAExB;AAAA,MACF,OAAO;AACL,cAAM,KAAK;AAAA,UACT,OAAO,EAAE;AAAA,UACT;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,WAAW,uBAAuB,EAAE,EAAE;AAAA,UACtC,YAAY;AAAA,QACd,CAAC;AACD,gBAAQ,KAAK,EAAE,QAAQ,UAAU,aAAa,EAAE,CAAC;AAAA,MACnD;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,aAAa,QAAQ,KAAK;AACjD,YAAM,KAAK,KAAK,aAAa,CAAC;AAC9B,iBAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,GAAG,KAAK,GAAG;AACvD,YAAI,CAAC,kBAAkB,SAAS,KAAK,oBAAoB,EAAG;AAC5D,cAAM,SAAS,aAAa,OAAO;AACnC,YAAI,CAAC,OAAQ;AAEb,cAAM,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,WAAW;AAAA,UACX,YAAY;AAAA,QACd,CAAC;AACD,gBAAQ,KAAK,EAAE,QAAQ,SAAS,YAAY,GAAG,QAAQ,QAAQ,CAAC;AAAA,MAClE;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAI,CAAC,kBAAkB,GAAG,QAAQ,KAAK,oBAAoB,EAAG;AAC9D,YAAM,SAAS,aAAa,GAAG,MAAM;AACrC,UAAI,CAAC,OAAQ;AAEb,YAAM,KAAK;AAAA,QACT,OAAO,GAAG;AAAA,QACV;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,WAAW,uBAAuB,GAAG,EAAE;AAAA,QACvC,YAAY;AAAA,MACd,CAAC;AACD,cAAQ,KAAK,EAAE,QAAQ,OAAO,UAAU,EAAE,CAAC;AAAA,IAC7C;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;AAC9C,YAAM,MAAM,KAAK,UAAU,CAAC;AAC5B,UAAI,IAAI,SAAS,UAAU;AACzB,cAAM,SAAS,cAAc,IAAI,KAAK;AACtC,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAM,OAAO,OAAO,CAAC;AACrB,cAAI,CAAC,kBAAkB,KAAK,QAAQ,KAAK,oBAAoB;AAC3D;AACF,gBAAM,SAAS,aAAa,KAAK,MAAM;AACvC,cAAI,CAAC,OAAQ;AAEb,gBAAM,KAAK;AAAA,YACT,OAAO,KAAK;AAAA,YACZ;AAAA,YACA,OAAO,KAAK;AAAA,YACZ,WAAW,uBAAuB,KAAK,EAAE;AAAA,YACzC,YAAY;AAAA,UACd,CAAC;AACD,kBAAQ,KAAK,EAAE,QAAQ,aAAa,SAAS,GAAG,gBAAgB,EAAE,CAAC;AAAA,QACrE;AAAA,MACF,OAAO;AACL,iBAAS,IAAI,GAAG,IAAI,IAAI,WAAW,QAAQ,KAAK;AAC9C,gBAAM,OAAO,IAAI,WAAW,CAAC;AAC7B,cAAI,CAAC,kBAAkB,KAAK,QAAQ,KAAK,oBAAoB;AAC3D;AACF,gBAAM,SAAS,aAAa,KAAK,MAAM;AACvC,cAAI,CAAC,OAAQ;AAEb,gBAAM,KAAK;AAAA,YACT,OAAO,KAAK;AAAA,YACZ;AAAA,YACA,OAAO,KAAK;AAAA,YACZ,WAAW,uBAAuB,KAAK,EAAE;AAAA,YACzC,YAAY;AAAA,UACd,CAAC;AACD,kBAAQ,KAAK;AAAA,YACX,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAI,CAAC,kBAAkB,GAAG,QAAQ,KAAK,oBAAoB,EAAG;AAC9D,YAAM,SAAS,aAAa,GAAG,MAAM;AACrC,UAAI,CAAC,OAAQ;AAEb,YAAM,KAAK;AAAA,QACT,OAAO,GAAG;AAAA,QACV;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,WAAW;AAAA,QACX,YAAY;AAAA,MACd,CAAC;AACD,cAAQ,KAAK,EAAE,QAAQ,OAAO,UAAU,EAAE,CAAC;AAAA,IAC7C;AAEA,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO,EAAE,iBAAiB,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC5C;AAGA,UAAM,SAAS,KAAK,iBAAiB,aAAa,KAAK;AACvD,UAAM,KAAK,KAAK,cACZ,OAAO,gBAAgB,KAAK,WAAW,IACvC;AACJ,QAAI,KAAK,YAAa,IAAG,MAAM,KAAK,WAAW;AAE/C,UAAM,SAAS,MAAM;AACrB,QAAI,OAAO,SAAS;AAClB,aAAO;AAAA,QACL,sDAAsD,KAAK,SAAS;AAAA,MACtE;AAEA,YAAM,IAAI;AAAA,QACR,kCAAkC,OAAO,QAAQ,OAAO;AAAA,QACxD,OAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO,EAAE,iBAAiB,OAAO,MAAM,QAAQ;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,qBACZ,mBAIA,cACA,kBAC4B;AAC5B,QAAI,QAA8B,KAAK,eAAe,KAAK,KAAK,SAAS;AAGzE,QAAI,KAAK,UAAU;AACjB,cAAQ,KAAK,SAAS,MAAM;AAAA,QAC1B,KAAK;AACH,kBAAQ,MAAM,OAAO,mBAAoB,KAAK,SAAS,OAAO;AAC9D;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO,mBAAoB,KAAK,SAAS,OAAO;AAC9D;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO,mBAAoB,KAAK,SAAS,OAAO;AAC9D;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO,KAAK,SAAS,OAAO;AAC1C;AAAA,MACJ;AAAA,IACF;AAGA,QAAI,iBAAiB,MAAM;AACzB,cAAQ,MAAM,OAAO,cAAc,KAAK,aAAa;AAAA,IACvD,WAAW,CAAC,KAAK,UAAU;AAEzB,cAAQ,MAAM,OAAO,KAAK,KAAK,aAAa;AAAA,IAC9C;AAGA,YAAQ,KAAK,aAAa,OAAO,gBAAgB;AAGjD,eAAW,KAAK,KAAK,YAAY;AAC/B,cAAQ,EAAE,MAAM;AAAA,QACd,KAAK;AACH,kBAAQ,MAAM,MAAM,EAAE,QAAQ,EAAE,OAAO;AACvC;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,MAAM,EAAE,OAAO,EAAE,OAAO;AACtC;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;AAC3C;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,OAAO;AACrB;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,YAAY;AAC1B;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,IAAI;AAClB;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,YAAY,EAAE,MAAM;AAClC;AAAA,QACF,KAAK;AACH,kBAAQ,MAAM,aAAa;AAC3B;AAAA,MACJ;AAAA,IACF;AAEA,UAAM,SAAU,MAAM;AACtB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMQ,aACN,OACA,kBACsB;AACtB,QAAI,IAAI;AAGR,UAAM,iBAAiB,oBAAI,IAAqB;AAChD,UAAM,cAAc,oBAAI,IAAqB;AAC7C,UAAM,gBAAgB,oBAAI,IAAqB;AAC/C,UAAM,cAAc,oBAAI,IAAqB;AAC7C,UAAM,cAAc,oBAAI,IAAqB;AAC7C,UAAM,uBAAuB,oBAAI,IAAqB;AACtD,UAAM,2BAA2B,oBAAI,IAAqB;AAE1D,aAAS,IAAI,GAAG,IAAI,iBAAiB,QAAQ,QAAQ,KAAK;AACxD,YAAM,UAAU,iBAAiB,QAAQ,CAAC;AAC1C,YAAM,WAAW,iBAAiB,gBAAgB,CAAC;AAEnD,cAAQ,QAAQ,QAAQ;AAAA,QACtB,KAAK;AACH,cAAI,QAAQ,YAAY,QAAW;AACjC,wBAAY;AAAA,cACV,GAAG,QAAQ,WAAW,IAAI,QAAQ,OAAO;AAAA,cACzC;AAAA,YACF;AAAA,UACF,OAAO;AACL,2BAAe,IAAI,QAAQ,aAAa,QAAQ;AAAA,UAClD;AACA;AAAA,QACF,KAAK;AACH,wBAAc,IAAI,GAAG,QAAQ,UAAU,IAAI,QAAQ,MAAM,IAAI,QAAQ;AACrE;AAAA,QACF,KAAK;AACH,sBAAY,IAAI,QAAQ,UAAU,QAAQ;AAC1C;AAAA,QACF,KAAK;AACH,sBAAY,IAAI,QAAQ,UAAU,QAAQ;AAC1C;AAAA,QACF,KAAK;AACH,+BAAqB;AAAA,YACnB,GAAG,QAAQ,OAAO,IAAI,QAAQ,cAAc;AAAA,YAC5C;AAAA,UACF;AACA;AAAA,QACF,KAAK;AACH,mCAAyB;AAAA,YACvB,GAAG,QAAQ,OAAO,IAAI,QAAQ,cAAc;AAAA,YAC5C;AAAA,UACF;AACA;AAAA,MACJ;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC5C,YAAM,IAAI,KAAK,QAAQ,CAAC;AACxB,UAAI,QAAQ,EAAE;AAEd,UAAI,eAAe,IAAI,CAAC,GAAG;AACzB,gBAAQ,eAAe,IAAI,CAAC;AAAA,MAC9B,WAAW,EAAE,OAAO,QAAQ,MAAM,QAAQ,EAAE,KAAK,GAAG;AAElD,gBAAQ,EAAE,MAAM,IAAI,CAAC,GAAG,MAAM;AAC5B,gBAAM,MAAM,GAAG,CAAC,IAAI,CAAC;AACrB,iBAAO,YAAY,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,IAAI;AAAA,QACvD,CAAC;AAAA,MACH;AAEA,cAAQ,EAAE,IAAI;AAAA,QACZ,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,IAAI,EAAE,QAAQ,KAAK;AACzB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,IAAI,EAAE,QAAQ,KAAK;AACzB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,IAAI,EAAE,QAAQ,KAAK;AACzB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,KAAK,EAAE,QAAQ,KAAe;AACpC;AAAA,QACF,KAAK;AACH,cAAI,EAAE,MAAM,EAAE,QAAQ,KAAe;AACrC;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,EAAE,GAAG,EAAE,QAAQ,KAAkB;AACrC;AAAA,MACJ;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,aAAa,QAAQ,KAAK;AACjD,YAAM,KAAK,KAAK,aAAa,CAAC;AAC9B,YAAM,gBAAyC,CAAC;AAEhD,iBAAW,CAAC,SAAS,aAAa,KAAK,OAAO,QAAQ,GAAG,KAAK,GAAG;AAC/D,cAAM,MAAM,GAAG,CAAC,IAAI,OAAO;AAC3B,sBAAc,OAAO,IAAI,cAAc,IAAI,GAAG,IAC1C,cAAc,IAAI,GAAG,IACrB;AAAA,MACN;AAEA,UAAI,EAAE,MAAM,aAAa;AAAA,IAC3B;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,YAAM,QAAQ,YAAY,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,GAAG;AAC3D,UAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,KAAK;AAAA,IACnC;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;AAC9C,YAAM,MAAM,KAAK,UAAU,CAAC;AAE5B,UAAI,IAAI,SAAS,UAAU;AACzB,cAAM,SAAS,cAAc,IAAI,KAAK;AACtC,YAAI,eAAe;AAEnB,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAM,MAAM,GAAG,CAAC,IAAI,CAAC;AACrB,cAAI,qBAAqB,IAAI,GAAG,GAAG;AACjC,mBAAO,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,qBAAqB,IAAI,GAAG,EAAE;AACjE,2BAAe;AAAA,UACjB;AAAA,QACF;AAEA,YAAI,cAAc;AAChB,cAAI,EAAE,GAAG,gBAAgB,MAAM,GAAG;AAAA,YAChC,iBAAiB,IAAI;AAAA,UACvB,CAAC;AAAA,QACH,OAAO;AACL,cAAI,EAAE,GAAG,IAAI,OAAO,EAAE,iBAAiB,IAAI,gBAAgB,CAAC;AAAA,QAC9D;AAAA,MACF,OAAO;AAEL,cAAM,aAAa,IAAI,WAAW,IAAI,CAAC,MAAM,MAAM;AACjD,gBAAM,MAAM,GAAG,CAAC,IAAI,CAAC;AACrB,cAAI,yBAAyB,IAAI,GAAG,GAAG;AACrC,mBAAO,EAAE,GAAG,MAAM,OAAO,yBAAyB,IAAI,GAAG,EAAE;AAAA,UAC7D;AACA,iBAAO;AAAA,QACT,CAAC;AAED,YAAI,EAAE,GAAG,gBAAgB,UAAU,CAAC;AAAA,MACtC;AAAA,IACF;AAGA,aAAS,IAAI,GAAG,IAAI,KAAK,WAAW,QAAQ,KAAK;AAC/C,YAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,YAAM,QAAQ,YAAY,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,GAAG;AAC3D,UAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,KAAK;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,QACyC;AAEzC,QAAI,OAAO,OAAO;AAChB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO;AAAA,UACL,SAAS,OAAO,MAAM;AAAA,UACtB,SAAS,OAAO,MAAM;AAAA,UACtB,MAAM,OAAO,MAAM;AAAA,UACnB,MAAM,OAAO,MAAM;AAAA,QACrB;AAAA,QACA,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,QAAI,OAAO,SAAS,QAAQ,OAAO,SAAS,QAAW;AACrD,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,kBAAkB;AACzC,UAAM,2BAA2B,KAAK,aAAa,QAAQ;AAE3D,QAAI,CAAC,aAAa,CAAC,0BAA0B;AAE3C,aAAO;AAAA,QACL,MAAM,OAAO;AAAA,QACb,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,QAAI,KAAK,eAAe,YAAY,KAAK,eAAe,eAAe;AACrE,UAAI,OAAO,SAAS,MAAM;AACxB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO;AAAA,UACP,OAAO,OAAO,SAAS;AAAA,UACvB,QAAQ,OAAO;AAAA,UACf,YAAY,OAAO;AAAA,QACrB;AAAA,MACF;AAGA,YAAM,gBAAgB,KAAK,iBAAiB;AAAA,QAC1C,OAAO;AAAA,MACT;AACA,YAAM,YAAY,KAAK,cACnB,cAAc,gBAAgB,KAAK,WAAW,IAC9C;AACJ,UAAI,KAAK,YAAa,WAAU,MAAM,KAAK,WAAW;AAEtD,YAAMC,aAAY,MAAM;AACxB,UAAIA,WAAU,SAAS;AACrB,eAAO;AAAA,UACL,gDAAgD,KAAK,SAAS;AAAA,QAChE;AAEA,cAAM,IAAI;AAAA,UACR,4BAA4BA,WAAU,QAAQ,OAAO;AAAA,UACrDA,WAAU;AAAA,QACZ;AAAA,MACF;AAEA,aAAO;AAAA,QACL,MAAMA,WAAU;AAAA,QAChB,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAGA,UAAM,YAAY,OAAO;AACzB,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,MAAM,CAAC;AAAA,QACP,OAAO;AAAA,QACP,OAAO,OAAO,SAAS;AAAA,QACvB,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAEA,UAAM,oBAAoB,KAAK,iBAAiB,kBAAkB,SAAS;AAC3E,UAAM,gBAAgB,KAAK,cACvB,kBAAkB,gBAAgB,KAAK,WAAW,IAClD;AACJ,QAAI,KAAK,YAAa,eAAc,MAAM,KAAK,WAAW;AAE1D,UAAM,YAAY,MAAM;AACxB,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,QACL,iDAAiD,KAAK,SAAS;AAAA,MACjE;AAEA,YAAM,IAAI;AAAA,QACR,6BAA6B,UAAU,QAAQ,OAAO;AAAA,QACtD,UAAU;AAAA,MACZ;AAAA,IACF;AAEA,WAAO;AAAA,MACL,MAAM,UAAU;AAAA,MAChB,OAAO;AAAA,MACP,OAAO,OAAO,SAAS;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAgD;AACtD,UAAM,MAAuC,CAAC;AAC9C,UAAM,SAAS,KAAK;AAEpB,eAAW,WAAW,KAAK,sBAAsB;AAC/C,YAAM,MAAM,OAAO,OAAO;AAC1B,UAAI,eAAe,iBAAiB;AAClC,YAAI,OAAO,IAAI;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAgCA,IAAM,wBAAN,cAAoC,MAAM;AAAA,EACjC;AAAA,EAEP,YAAY,SAAiB,iBAA0B;AACrD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,kBAAkB;AAAA,EACzB;AACF;;;AClgCO,SAAS,kBACd,QAC2B;AAC3B,QAAM,EAAE,kBAAkB,eAAe,IAAI;AAE7C,SAAO;AAAA,IACL,KACE,WACA,QACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["baseOp","op","result","decrypted"]}

package/dist/{types-public-Wj6tB_ux.d.ts → types-public-dKxDzTIL.d.cts}

@@ -1,13 +1,6 @@
 import { z } from 'zod';
-import { LoggerConfig } from 'evlog';
 import { Encrypted as Encrypted$1, newClient, JsPlaintext } from '@cipherstash/protect-ffi';
 
-type LoggingConfig = {
-    enabled?: boolean;
-    pretty?: boolean;
-    drain?: LoggerConfig['drain'];
-};
-
 /** Brand symbol for nominal typing */
 declare const __brand: unique symbol;
 /** Creates a branded type that is structurally incompatible with the base type */
@@ -62,7 +55,6 @@ type AtLeastOneCsTable<T> = [T, ...T[]];
 type EncryptionClientConfig = {
     schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>;
     config?: ClientConfig;
-    logging?: LoggingConfig;
 };
 /**
  * Options for single-value encrypt operations.
@@ -1073,4 +1065,4 @@ declare function encryptedField(valueName: string): EncryptedField;
  */
 declare function buildEncryptConfig(...protectTables: Array<EncryptedTable<EncryptedTableColumn>>): EncryptConfig;
 
-export { type SearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedSearchTerm as F, type EncryptedFields as G, type OtherFields as H, type InferPlaintext as I, type DecryptedFields as J, type KeysetIdentifier as K, type DecryptionResult as L, type MatchIndexOpts as M, type LoggingConfig as N, type OreIndexOpts as O, queryTypes as P, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedField as b, type InferEncrypted as c, EncryptedColumn as d, encryptedTable as e, EncryptedTable as f, type EncryptedTableColumn as g, EncryptedField as h, type EncryptedFromSchema as i, type Encrypted as j, type EncryptedValue as k, type EncryptedQueryResult as l, type Client as m, type BulkDecryptPayload as n, type BulkEncryptedData as o, type BulkEncryptPayload as p, type EncryptOptions as q, type EncryptQueryOptions as r, type EncryptedReturnType as s, type EncryptConfig as t, castAsEnum as u, encryptConfigSchema as v, type SteVecIndexOpts as w, type ColumnSchema as x, buildEncryptConfig as y, type ClientConfig as z };
+export { type SearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type Encrypted as E, type EncryptedSearchTerm as F, type EncryptedFields as G, type OtherFields as H, type InferPlaintext as I, type DecryptedFields as J, type KeysetIdentifier as K, type DecryptionResult as L, type MatchIndexOpts as M, queryTypes as N, type OreIndexOpts as O, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedField as b, EncryptedTable as c, type EncryptedTableColumn as d, encryptedTable as e, EncryptedColumn as f, type EncryptedValue as g, type EncryptedQueryResult as h, type Client as i, type BulkDecryptPayload as j, type BulkEncryptedData as k, type BulkEncryptPayload as l, type EncryptOptions as m, EncryptedField as n, type EncryptQueryOptions as o, type EncryptedReturnType as p, type EncryptConfig as q, type EncryptedFromSchema as r, type EncryptionClientConfig as s, type InferEncrypted as t, castAsEnum as u, encryptConfigSchema as v, type SteVecIndexOpts as w, type ColumnSchema as x, buildEncryptConfig as y, type ClientConfig as z };

package/dist/{types-public-Wj6tB_ux.d.cts → types-public-dKxDzTIL.d.ts}

@@ -1,13 +1,6 @@
 import { z } from 'zod';
-import { LoggerConfig } from 'evlog';
 import { Encrypted as Encrypted$1, newClient, JsPlaintext } from '@cipherstash/protect-ffi';
 
-type LoggingConfig = {
-    enabled?: boolean;
-    pretty?: boolean;
-    drain?: LoggerConfig['drain'];
-};
-
 /** Brand symbol for nominal typing */
 declare const __brand: unique symbol;
 /** Creates a branded type that is structurally incompatible with the base type */
@@ -62,7 +55,6 @@ type AtLeastOneCsTable<T> = [T, ...T[]];
 type EncryptionClientConfig = {
     schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>;
     config?: ClientConfig;
-    logging?: LoggingConfig;
 };
 /**
  * Options for single-value encrypt operations.
@@ -1073,4 +1065,4 @@ declare function encryptedField(valueName: string): EncryptedField;
  */
 declare function buildEncryptConfig(...protectTables: Array<EncryptedTable<EncryptedTableColumn>>): EncryptConfig;
 
-export { type SearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedSearchTerm as F, type EncryptedFields as G, type OtherFields as H, type InferPlaintext as I, type DecryptedFields as J, type KeysetIdentifier as K, type DecryptionResult as L, type MatchIndexOpts as M, type LoggingConfig as N, type OreIndexOpts as O, queryTypes as P, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedField as b, type InferEncrypted as c, EncryptedColumn as d, encryptedTable as e, EncryptedTable as f, type EncryptedTableColumn as g, EncryptedField as h, type EncryptedFromSchema as i, type Encrypted as j, type EncryptedValue as k, type EncryptedQueryResult as l, type Client as m, type BulkDecryptPayload as n, type BulkEncryptedData as o, type BulkEncryptPayload as p, type EncryptOptions as q, type EncryptQueryOptions as r, type EncryptedReturnType as s, type EncryptConfig as t, castAsEnum as u, encryptConfigSchema as v, type SteVecIndexOpts as w, type ColumnSchema as x, buildEncryptConfig as y, type ClientConfig as z };
+export { type SearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type Encrypted as E, type EncryptedSearchTerm as F, type EncryptedFields as G, type OtherFields as H, type InferPlaintext as I, type DecryptedFields as J, type KeysetIdentifier as K, type DecryptionResult as L, type MatchIndexOpts as M, queryTypes as N, type OreIndexOpts as O, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedField as b, EncryptedTable as c, type EncryptedTableColumn as d, encryptedTable as e, EncryptedColumn as f, type EncryptedValue as g, type EncryptedQueryResult as h, type Client as i, type BulkDecryptPayload as j, type BulkEncryptedData as k, type BulkEncryptPayload as l, type EncryptOptions as m, EncryptedField as n, type EncryptQueryOptions as o, type EncryptedReturnType as p, type EncryptConfig as q, type EncryptedFromSchema as r, type EncryptionClientConfig as s, type InferEncrypted as t, castAsEnum as u, encryptConfigSchema as v, type SteVecIndexOpts as w, type ColumnSchema as x, buildEncryptConfig as y, type ClientConfig as z };

package/dist/types-public.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Logging\nexport type { LoggingConfig } from '@/utils/logger'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  EncryptedColumn,\n  EncryptedTable,\n  EncryptedTableColumn,\n  EncryptedField,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n  logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]:\n    null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K] ? Encrypted | null : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}
+{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC6NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}

package/dist/types-public.d.cts

@@ -1,4 +1,3 @@
-export { n as BulkDecryptPayload, B as BulkDecryptedData, p as BulkEncryptPayload, o as BulkEncryptedData, m as Client, z as ClientConfig, D as Decrypted, J as DecryptedFields, L as DecryptionResult, q as EncryptOptions, r as EncryptQueryOptions, j as Encrypted, G as EncryptedFields, l as EncryptedQueryResult, s as EncryptedReturnType, F as EncryptedSearchTerm, k as EncryptedValue, E as EncryptionClientConfig, K as KeysetIdentifier, N as LoggingConfig, H as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, A as SearchTerm, P as queryTypes } from './types-public-Wj6tB_ux.cjs';
+export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, z as ClientConfig, D as Decrypted, J as DecryptedFields, L as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, G as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, F as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, H as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, A as SearchTerm, N as queryTypes } from './types-public-dKxDzTIL.cjs';
 import 'zod';
-import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/types-public.d.ts

@@ -1,4 +1,3 @@
-export { n as BulkDecryptPayload, B as BulkDecryptedData, p as BulkEncryptPayload, o as BulkEncryptedData, m as Client, z as ClientConfig, D as Decrypted, J as DecryptedFields, L as DecryptionResult, q as EncryptOptions, r as EncryptQueryOptions, j as Encrypted, G as EncryptedFields, l as EncryptedQueryResult, s as EncryptedReturnType, F as EncryptedSearchTerm, k as EncryptedValue, E as EncryptionClientConfig, K as KeysetIdentifier, N as LoggingConfig, H as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, A as SearchTerm, P as queryTypes } from './types-public-Wj6tB_ux.js';
+export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, z as ClientConfig, D as Decrypted, J as DecryptedFields, L as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, G as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, F as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, H as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, A as SearchTerm, N as queryTypes } from './types-public-dKxDzTIL.js';
 import 'zod';
-import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/types-public.js

@@ -1,6 +1,6 @@
 import {
   queryTypes
-} from "./chunk-KOU2MHXJ.js";
+} from "./chunk-HCL75LXQ.js";
 export {
   queryTypes
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/stack",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "CipherStash Stack for TypeScript and JavaScript",
   "keywords": [
     "encrypted",
@@ -36,6 +36,12 @@
   "types": "./dist/index.d.ts",
   "typesVersions": {
     "*": {
+      "encryption": [
+        "./dist/encryption/index.d.ts"
+      ],
+      "errors": [
+        "./dist/errors/index.d.ts"
+      ],
       "client": [
         "./dist/client.d.ts"
       ],
@@ -153,11 +159,32 @@
         "default": "./dist/supabase/index.cjs"
       }
     },
+    "./encryption": {
+      "import": {
+        "types": "./dist/encryption/index.d.ts",
+        "default": "./dist/encryption/index.js"
+      },
+      "require": {
+        "types": "./dist/encryption/index.d.cts",
+        "default": "./dist/encryption/index.cjs"
+      }
+    },
+    "./errors": {
+      "import": {
+        "types": "./dist/errors/index.d.ts",
+        "default": "./dist/errors/index.js"
+      },
+      "require": {
+        "types": "./dist/errors/index.d.cts",
+        "default": "./dist/errors/index.cjs"
+      }
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {
     "@clack/prompts": "^0.10.1",
     "@supabase/supabase-js": "^2.47.10",
+    "@types/uuid": "^11.0.0",
     "dotenv": "16.4.7",
     "drizzle-orm": ">=0.33",
     "execa": "^9.5.2",
@@ -175,6 +202,7 @@
     "@byteslice/result": "^0.2.0",
     "@cipherstash/protect-ffi": "0.20.2",
     "evlog": "^1.9.0",
+    "uuid": "^13.0.0",
     "zod": "3.24.2"
   },
   "peerDependencies": {

package/dist/chunk-KOU2MHXJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  EncryptedColumn,\n  EncryptedTable,\n  EncryptedTableColumn,\n  EncryptedField,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n  logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]:\n    null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K] ? Encrypted | null : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";AA4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}

package/dist/chunk-OAPLZLR5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors/index.ts","../src/utils/config/index.ts","../src/utils/logger/index.ts"],"sourcesContent":["import type { ProtectErrorCode } from '@cipherstash/protect-ffi'\n\nexport const EncryptionErrorTypes = {\n  ClientInitError: 'ClientInitError',\n  EncryptionError: 'EncryptionError',\n  DecryptionError: 'DecryptionError',\n  LockContextError: 'LockContextError',\n  CtsTokenError: 'CtsTokenError',\n}\n\n/**\n * Base error interface returned by all encryption operations.\n *\n * Every operation that can fail returns `Result<T, EncryptionError>`.\n * Use the `type` field to narrow to a specific error kind, or use\n * {@link StackError} for an exhaustive discriminated union.\n *\n * @example\n * ```typescript\n * const result = await client.encrypt(value, opts)\n * if (result.failure) {\n *   switch (result.failure.type) {\n *     case 'EncryptionError':\n *       console.error('Encryption failed:', result.failure.message)\n *       break\n *     case 'LockContextError':\n *       console.error('Lock context issue:', result.failure.message)\n *       break\n *   }\n * }\n * ```\n */\nexport interface EncryptionError {\n  type: (typeof EncryptionErrorTypes)[keyof typeof EncryptionErrorTypes]\n  message: string\n  code?: ProtectErrorCode\n}\n\n// ---------------------------------------------------------------------------\n// Specific error types (discriminated union members)\n// ---------------------------------------------------------------------------\n\nexport interface ClientInitError {\n  type: typeof EncryptionErrorTypes.ClientInitError\n  message: string\n}\n\nexport interface EncryptionOperationError {\n  type: typeof EncryptionErrorTypes.EncryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface DecryptionOperationError {\n  type: typeof EncryptionErrorTypes.DecryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface LockContextError {\n  type: typeof EncryptionErrorTypes.LockContextError\n  message: string\n}\n\nexport interface CtsTokenError {\n  type: typeof EncryptionErrorTypes.CtsTokenError\n  message: string\n}\n\n/**\n * Discriminated union of all specific error types.\n *\n * Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.\n *\n * @example\n * ```typescript\n * function handleError(error: StackError) {\n *   switch (error.type) {\n *     case 'ClientInitError':\n *       // re-initialize client\n *       break\n *     case 'EncryptionError':\n *     case 'DecryptionError':\n *       // log and retry\n *       break\n *     case 'LockContextError':\n *       // re-authenticate\n *       break\n *     case 'CtsTokenError':\n *       // refresh token\n *       break\n *     default:\n *       error satisfies never\n *   }\n * }\n * ```\n */\nexport type StackError =\n  | ClientInitError\n  | EncryptionOperationError\n  | DecryptionOperationError\n  | LockContextError\n  | CtsTokenError\n\n// ---------------------------------------------------------------------------\n// Error utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Safely extract an error message from an unknown thrown value.\n * Unlike `(error as Error).message`, this handles non-Error values gracefully.\n */\nexport function getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message\n  if (typeof error === 'string') return error\n  return String(error)\n}\n","import fs from 'node:fs'\nimport path from 'node:path'\n\n/**\n * A lightweight function that parses a TOML-like string\n * and returns the `workspace_crn` value found under `[auth]`.\n *\n * @param tomlString The contents of the TOML file as a string.\n * @returns The workspace_crn if found, otherwise undefined.\n */\nfunction getWorkspaceCrn(tomlString: string): string | undefined {\n  let currentSection = ''\n  let workspaceCrn: string | undefined\n\n  const lines = tomlString.split(/\\r?\\n/)\n\n  for (const line of lines) {\n    const trimmedLine = line.trim()\n\n    if (!trimmedLine || trimmedLine.startsWith('#')) {\n      continue\n    }\n\n    const sectionMatch = trimmedLine.match(/^\\[([^\\]]+)\\]$/)\n    if (sectionMatch) {\n      currentSection = sectionMatch[1]\n      continue\n    }\n\n    const kvMatch = trimmedLine.match(/^(\\w+)\\s*=\\s*\"([^\"]+)\"$/)\n    if (kvMatch) {\n      const [_, key, value] = kvMatch\n\n      if (currentSection === 'auth' && key === 'workspace_crn') {\n        workspaceCrn = value\n        break\n      }\n    }\n  }\n\n  return workspaceCrn\n}\n\n/**\n * Extracts the workspace ID from a CRN string.\n * CRN format: crn:region.aws:ID\n *\n * @param crn The CRN string to extract from\n * @returns The workspace ID portion of the CRN\n */\nexport function extractWorkspaceIdFromCrn(crn: string): string {\n  const match = crn.match(/crn:[^:]+:([^:]+)$/)\n  if (!match) {\n    throw new Error('Invalid CRN format')\n  }\n  return match[1]\n}\n\nexport function loadWorkSpaceId(suppliedCrn?: string): string {\n  const configPath = path.join(process.cwd(), 'cipherstash.toml')\n\n  if (suppliedCrn) {\n    return extractWorkspaceIdFromCrn(suppliedCrn)\n  }\n\n  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  // Environment variables take precedence over config files\n  if (process.env.CS_WORKSPACE_CRN) {\n    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN)\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  const tomlString = fs.readFileSync(configPath, 'utf8')\n  const workspaceCrn = getWorkspaceCrn(tomlString)\n\n  if (!workspaceCrn) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  return extractWorkspaceIdFromCrn(workspaceCrn)\n}\n","import { initLogger, createRequestLogger } from 'evlog'\nimport type { LoggerConfig } from 'evlog'\n\nexport type LoggingConfig = {\n  enabled?: boolean\n  pretty?: boolean\n  drain?: LoggerConfig['drain']\n}\n\nfunction samplingFromEnv() {\n  const env = process.env.STASH_LOG_LEVEL\n  if (!env) return undefined\n  const levels = ['debug', 'info', 'warn', 'error'] as const\n  const idx = levels.indexOf(env as (typeof levels)[number])\n  if (idx === -1) return undefined\n  return Object.fromEntries(levels.map((l, i) => [l, i >= idx ? 100 : 0]))\n}\n\nlet initialized = false\n\nexport function initStackLogger(config?: LoggingConfig): void {\n  if (initialized) return\n  initialized = true\n  const rates = samplingFromEnv()\n  initLogger({\n    env: { service: '@cipherstash/stack' },\n    enabled: config?.enabled ?? !!rates,\n    pretty: config?.pretty,\n    ...(rates && { sampling: { rates } }),\n    ...(config?.drain && { drain: config.drain }),\n  })\n}\n\n// Auto-init with defaults on first import\ninitStackLogger()\n\nexport { createRequestLogger }\n\n// Stringify only the first arg (the message string); drop subsequent args\n// which may contain sensitive objects (e.g. encryptConfig, plaintext).\nfunction safeMessage(args: unknown[]): string {\n  return typeof args[0] === 'string' ? args[0] : ''\n}\n\n// Legacy logger for simple one-off logs (used by encryption/ffi/index.ts + identity/index.ts)\nexport const logger = {\n  debug(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({\n      level: 'debug',\n      source: '@cipherstash/stack',\n      message: safeMessage(args),\n    })\n    log.emit()\n  },\n  info(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({ source: '@cipherstash/stack' })\n    log.info(safeMessage(args))\n    log.emit()\n  },\n  warn(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.warn(safeMessage(args))\n    log.emit()\n  },\n  error(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.error(safeMessage(args))\n    log.emit()\n  },\n}\n"],"mappings":";AAEO,IAAM,uBAAuB;AAAA,EAClC,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,eAAe;AACjB;AAwGO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,OAAO,KAAK;AACrB;;;ACpHA,OAAO,QAAQ;AACf,OAAO,UAAU;AASjB,SAAS,gBAAgB,YAAwC;AAC/D,MAAI,iBAAiB;AACrB,MAAI;AAEJ,QAAM,QAAQ,WAAW,MAAM,OAAO;AAEtC,aAAW,QAAQ,OAAO;AACxB,UAAM,cAAc,KAAK,KAAK;AAE9B,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG,GAAG;AAC/C;AAAA,IACF;AAEA,UAAM,eAAe,YAAY,MAAM,gBAAgB;AACvD,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,MAAM,yBAAyB;AAC3D,QAAI,SAAS;AACX,YAAM,CAAC,GAAG,KAAK,KAAK,IAAI;AAExB,UAAI,mBAAmB,UAAU,QAAQ,iBAAiB;AACxD,uBAAe;AACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,0BAA0B,KAAqB;AAC7D,QAAM,QAAQ,IAAI,MAAM,oBAAoB;AAC5C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,SAAO,MAAM,CAAC;AAChB;AAEO,SAAS,gBAAgB,aAA8B;AAC5D,QAAM,aAAa,KAAK,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAE9D,MAAI,aAAa;AACf,WAAO,0BAA0B,WAAW;AAAA,EAC9C;AAEA,MAAI,CAAC,GAAG,WAAW,UAAU,KAAK,CAAC,QAAQ,IAAI,kBAAkB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,IAAI,kBAAkB;AAChC,WAAO,0BAA0B,QAAQ,IAAI,gBAAgB;AAAA,EAC/D;AAEA,MAAI,CAAC,GAAG,WAAW,UAAU,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,GAAG,aAAa,YAAY,MAAM;AACrD,QAAM,eAAe,gBAAgB,UAAU;AAE/C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,0BAA0B,YAAY;AAC/C;;;AC5FA,SAAS,YAAY,2BAA2B;AAShD,SAAS,kBAAkB;AACzB,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,CAAC,SAAS,QAAQ,QAAQ,OAAO;AAChD,QAAM,MAAM,OAAO,QAAQ,GAA8B;AACzD,MAAI,QAAQ,GAAI,QAAO;AACvB,SAAO,OAAO,YAAY,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC;AACzE;AAEA,IAAI,cAAc;AAEX,SAAS,gBAAgB,QAA8B;AAC5D,MAAI,YAAa;AACjB,gBAAc;AACd,QAAM,QAAQ,gBAAgB;AAC9B,aAAW;AAAA,IACT,KAAK,EAAE,SAAS,qBAAqB;AAAA,IACrC,SAAS,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC9B,QAAQ,QAAQ;AAAA,IAChB,GAAI,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;AAAA,IACnC,GAAI,QAAQ,SAAS,EAAE,OAAO,OAAO,MAAM;AAAA,EAC7C,CAAC;AACH;AAGA,gBAAgB;AAMhB,SAAS,YAAY,MAAyB;AAC5C,SAAO,OAAO,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI;AACjD;AAGO,IAAM,SAAS;AAAA,EACpB,SAAS,MAAiB;AACxB,UAAM,MAAM,oBAAoB;AAChC,QAAI,IAAI;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,YAAY,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,MAAM,oBAAoB;AAChC,QAAI,IAAI,EAAE,QAAQ,qBAAqB,CAAC;AACxC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,MAAM,oBAAoB;AAChC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,SAAS,MAAiB;AACxB,UAAM,MAAM,oBAAoB;AAChC,QAAI,MAAM,YAAY,IAAI,CAAC;AAC3B,QAAI,KAAK;AAAA,EACX;AACF;","names":[]}