@forklaunch/core 1.5.1 → 1.5.3

package/lib/persistence/complianceEventSubscriber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceEventSubscriber.d.ts","sourceRoot":"","sources":["../../src/persistence/complianceEventSubscriber.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAwCxE"}

package/lib/persistence/compliancePropertyBuilder.d.ts

@@ -0,0 +1,26 @@
+import { type PropertyBuilders } from '@mikro-orm/core';
+/**
+ * ForkLaunch property builder. Drop-in replacement for MikroORM's `p`
+ * that adds `.compliance(level)` to every scalar property builder
+ * and auto-classifies relation builders as 'none'.
+ *
+ * - Scalar fields: `fp.string().compliance('pii')` — must call `.compliance()`
+ * - Relation fields: `fp.manyToOne(Target)` — auto-classified, no `.compliance()` needed
+ *
+ * @example
+ * ```typescript
+ * import { defineComplianceEntity, fp } from '@forklaunch/core/persistence';
+ *
+ * const User = defineComplianceEntity({
+ *   name: 'User',
+ *   properties: {
+ *     id: fp.uuid().primary().compliance('none'),
+ *     email: fp.string().unique().compliance('pii'),
+ *     medicalRecord: fp.string().nullable().compliance('phi'),
+ *     organization: () => fp.manyToOne(Organization).nullable(),
+ *   }
+ * });
+ * ```
+ */
+export declare const fp: PropertyBuilders;
+//# sourceMappingURL=compliancePropertyBuilder.d.ts.map

package/lib/persistence/compliancePropertyBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliancePropertyBuilder.d.ts","sourceRoot":"","sources":["../../src/persistence/compliancePropertyBuilder.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA8OjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,EAAE,EAAE,gBAsCK,CAAC"}

package/lib/persistence/complianceTypes.d.ts

@@ -0,0 +1,64 @@
+export declare const ComplianceLevel: {
+    readonly pii: 'pii';
+    readonly phi: 'phi';
+    readonly pci: 'pci';
+    readonly none: 'none';
+};
+export type ComplianceLevel = (typeof ComplianceLevel)[keyof typeof ComplianceLevel];
+export declare const COMPLIANCE_KEY: '~compliance';
+export declare function registerEntityCompliance(entityName: string, fields: Map<string, ComplianceLevel>): void;
+export declare function getComplianceMetadata(entityName: string, fieldName: string): ComplianceLevel;
+export declare function getEntityComplianceFields(entityName: string): Map<string, ComplianceLevel> | undefined;
+export declare function entityHasEncryptedFields(entityName: string): boolean;
+export declare const RetentionAction: {
+    readonly delete: 'delete';
+    readonly anonymize: 'anonymize';
+};
+export type RetentionAction = (typeof RetentionAction)[keyof typeof RetentionAction];
+export interface RetentionPolicy {
+    duration: string;
+    action: RetentionAction;
+}
+export declare const RetentionDuration: {
+    readonly days: (n: number) => string;
+    readonly months: (n: number) => string;
+    readonly years: (n: number) => string;
+};
+export interface ParsedDuration {
+    years: number;
+    months: number;
+    days: number;
+}
+/**
+ * Parse an ISO 8601 duration string into calendar units.
+ * Returns structured units to enable calendar-aware date arithmetic.
+ */
+export declare function parseDuration(iso: string): ParsedDuration;
+/**
+ * Subtract a parsed duration from a date using calendar-aware arithmetic.
+ * Handles month-end clamping and leap years correctly.
+ */
+export declare function subtractDuration(from: Date, duration: ParsedDuration): Date;
+export declare function registerEntityUserIdField(entityName: string, field: string): void;
+export declare function getEntityUserIdField(entityName: string): string;
+export declare function getAllUserIdFields(): ReadonlyMap<string, string>;
+export declare function registerEntityRetention(entityName: string, policy: RetentionPolicy): void;
+export declare function getEntityRetention(entityName: string): RetentionPolicy | undefined;
+export declare function getAllRetentionPolicies(): ReadonlyMap<string, RetentionPolicy>;
+/**
+ * Adds `compliance` to PropertyOptions, which flows into IncludeKeys
+ * for all scalar/enum/embedded builders (PropertyOptions is extended by
+ * EnumOptions and EmbeddedOptions). Relation builders use ReferenceOptions
+ * instead, so they don't get .compliance() — which is what we want.
+ */
+declare module '@mikro-orm/core' {
+    interface PropertyOptions<Owner> {
+        compliance?: ComplianceLevel;
+    }
+    interface UniversalPropertyOptionsBuilder<Value, Options, IncludeKeys> {
+        compliance(level: ComplianceLevel): Pick<UniversalPropertyOptionsBuilder<Value, Options & {
+            readonly '~c': true;
+        }, IncludeKeys>, IncludeKeys & keyof UniversalPropertyOptionsBuilder<never, never, never>>;
+    }
+}
+//# sourceMappingURL=complianceTypes.d.ts.map

package/lib/persistence/complianceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceTypes.d.ts","sourceRoot":"","sources":["../../src/persistence/complianceTypes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;aAC1B,GAAG,EAAE,KAAK;aACV,GAAG,EAAE,KAAK;aACV,GAAG,EAAE,KAAK;aACV,IAAI,EAAE,MAAM;CACJ,CAAC;AACX,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,EAAG,aAAsB,CAAC;AAQrD,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACnC,IAAI,CAEN;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,eAAe,CAEjB;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,CAE1C;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAOpE;AAMD,eAAO,MAAM,eAAe;aAC1B,MAAM,EAAE,QAAQ;aAChB,SAAS,EAAE,WAAW;CACd,CAAC;AACX,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,eAAO,MAAM,iBAAiB;aAC5B,IAAI,MAAM,MAAM,KAAG,MAAM;aACzB,MAAM,MAAM,MAAM,KAAG,MAAM;aAC3B,KAAK,MAAM,MAAM,KAAG,MAAM;CAClB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAoBzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAM3E;AAWD,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEhE;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,eAAe,GACtB,IAAI,CAEN;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GACjB,eAAe,GAAG,SAAS,CAE7B;AAED,wBAAgB,uBAAuB,IAAI,WAAW,CACpD,MAAM,EACN,eAAe,CAChB,CAEA;AAMD;;;;;GAKG;AACH,OAAO,QAAQ,iBAAiB,CAAC;IAE/B,UAAU,eAAe,CAAC,KAAK;QAC7B,UAAU,CAAC,EAAE,eAAe,CAAC;KAC9B;IAED,UAAU,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW;QACnE,UAAU,CACR,KAAK,EAAE,eAAe,GACrB,IAAI,CACL,+BAA+B,CAC7B,KAAK,EACL,OAAO,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;SAAE,EACjC,WAAW,CACZ,EACD,WAAW,GAAG,MAAM,+BAA+B,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CACzE,CAAC;KACH;CACF"}

package/lib/persistence/defineComplianceEntity.d.ts

@@ -0,0 +1,19 @@
+import { type EntityMetadataWithProperties, type EntitySchemaWithMeta, type InferEntityFromProperties } from '@mikro-orm/core';
+import { type RetentionPolicy } from './complianceTypes';
+type ValidateProperties<T> = {
+    [K in keyof T]: T[K] extends {
+        '~options': {
+            readonly '~c': true;
+        };
+    } | ((...args: never[]) => unknown) ? T[K] : {
+        '~options': {
+            readonly '~c': true;
+        };
+    };
+};
+export declare function defineComplianceEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, unknown>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties & ValidateProperties<TProperties>, TPK, TBase, TRepository, TForceObject> & {
+    retention?: RetentionPolicy;
+    userIdField?: string;
+}): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject>, TBase, TProperties>;
+export {};
+//# sourceMappingURL=defineComplianceEntity.d.ts.map

package/lib/persistence/defineComplianceEntity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defineComplianceEntity.d.ts","sourceRoot":"","sources":["../../src/persistence/defineComplianceEntity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,KAAK,kBAAkB,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAClB;QAAE,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,GACvE,CAAC,CAAC,CAAC,CAAC,GACJ;QAAE,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE;CAC5C,CAAC;AAQF,wBAAgB,sBAAsB,CACpC,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/B,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjD,KAAK,CAAC,GAAG,SAAS,CAAC,MAAM,WAAW,CAAC,EAAE,GAAG,SAAS,GAAG,SAAS,EAC/D,KAAK,CAAC,KAAK,GAAG,KAAK,EACnB,KAAK,CAAC,WAAW,GAAG,KAAK,EACzB,KAAK,CAAC,YAAY,SAAS,OAAO,GAAG,KAAK,EAE1C,IAAI,EAAE,4BAA4B,CAChC,KAAK,EACL,UAAU,EACV,WAAW,GAAG,kBAAkB,CAAC,WAAW,CAAC,EAC7C,GAAG,EACH,KAAK,EACL,WAAW,EACX,YAAY,CACb,GAAG;IAAE,SAAS,CAAC,EAAE,eAAe,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD,oBAAoB,CACrB,KAAK,EACL,UAAU,EACV,yBAAyB,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,EAC7E,KAAK,EACL,WAAW,CACZ,CAwEA"}

package/lib/persistence/encryptedType.d.ts

@@ -0,0 +1,85 @@
+import { Type, type Platform, type TransformContext } from '@mikro-orm/core';
+import type { FieldEncryptor } from './fieldEncryptor';
+/**
+ * Register the FieldEncryptor instance for use by EncryptedType.
+ * Call this once at application bootstrap (e.g., in mikro-orm.config.ts).
+ */
+export declare function registerEncryptor(encryptor: FieldEncryptor): void;
+/**
+ * Set the encryption tenant ID for the current async context.
+ *
+ * IMPORTANT: this uses `AsyncLocalStorage.enterWith`, which mutates the
+ * current async resource's store. It does NOT reliably propagate through
+ * `pg` connection pool callback async resources — pooled connections are
+ * long-lived async resources created at pool init, and resumption
+ * callbacks run in the pool's resource, not the caller's. As a result,
+ * MikroORM hydration of encrypted columns can read an empty / wrong
+ * tenant id from `getCurrentTenantId()` even when this was called
+ * correctly at the start of the request.
+ *
+ * Prefer `withEncryptionContext(tenantId, fn)` (or the
+ * `wrapEmWithTenantContext` helper) for any code path that hits the
+ * database. `setEncryptionTenantId` remains useful as a best-effort seed
+ * for purely synchronous code paths.
+ */
+export declare function setEncryptionTenantId(tenantId: string): void;
+/**
+ * Run `fn` inside a fresh AsyncLocalStorage scope bound to `tenantId`.
+ *
+ * Unlike `setEncryptionTenantId`, this uses `AsyncLocalStorage.run`, which
+ * creates a new async resource bound to the store. Node's promise hooks
+ * propagate the store forward through pool callback async resources, so
+ * MikroORM hydration of encrypted columns inside `fn` (even after multiple
+ * awaits and a pg pool roundtrip) sees the correct tenant id.
+ *
+ * Most application code should not call this directly — use
+ * `wrapEmWithTenantContext(em, tenantId)` in your DI EntityManager
+ * factory and every method on the returned EM will be wrapped
+ * automatically.
+ */
+export declare function withEncryptionContext<T>(tenantId: string, fn: () => T): T;
+/**
+ * Get the current tenant ID. Returns empty string when no context is set
+ * (startup, seeders, better-auth, background jobs).
+ */
+export declare function getCurrentTenantId(): string;
+/**
+ * Resolve a MikroORM type value (string, constructor, or instance) to a
+ * Type instance. Returns undefined if unresolvable.
+ */
+export declare function resolveTypeInstance(type: unknown): Type<unknown, unknown> | undefined;
+/**
+ * MikroORM custom Type that transparently encrypts/decrypts values.
+ *
+ * Works with any JS type. Non-string values are serialized before
+ * encryption and hydrated after decryption using the original Type's
+ * runtimeType for correct JS type reconstruction.
+ *
+ * DB column is always `text` — the encrypted ciphertext is a string
+ * regardless of the original JS type.
+ *
+ * For array container types, the element type is tracked separately
+ * so each element is hydrated individually after decryption.
+ */
+export declare class EncryptedType extends Type<unknown, string | null> {
+    readonly _elementRuntimeType: string;
+    readonly _isArray: boolean;
+    readonly _enumValues: unknown[] | undefined;
+    /**
+     * @param elementRuntimeType - The runtimeType of the (element) type,
+     *   e.g. 'string', 'number', 'Date', 'bigint', 'Buffer', 'any'.
+     * @param isArray - Whether this is an array container type.
+     * @param enumValues - Optional list of allowed enum values for app-level
+     *   validation (used when an enum field has encrypted compliance).
+     */
+    constructor(elementRuntimeType?: string, isArray?: boolean, enumValues?: unknown[]);
+    convertToDatabaseValue(value: unknown, _platform: Platform, _context?: TransformContext): string | null;
+    convertToJSValue(value: string | null, _platform: Platform): unknown;
+    getColumnType(): string;
+    get runtimeType(): string;
+    ensureComparable(): boolean;
+    private serialize;
+    private deserialize;
+    private tryJsonParse;
+}
+//# sourceMappingURL=encryptedType.d.ts.map

package/lib/persistence/encryptedType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedType.d.ts","sourceRoot":"","sources":["../../src/persistence/encryptedType.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoBvD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAEjE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,SAAS,CAWpC;AAwCD;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,SAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAE5C;;;;;;OAMG;IACH,YACE,kBAAkB,GAAE,MAAiB,EACrC,OAAO,GAAE,OAAe,EACxB,UAAU,CAAC,EAAE,OAAO,EAAE,EAMvB;IAEQ,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,MAAM,GAAG,IAAI,CA4Bf;IAEQ,gBAAgB,CACvB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,QAAQ,GAClB,OAAO,CA2BT;IAEQ,aAAa,IAAI,MAAM,CAE/B;IAED,IAAa,WAAW,IAAI,MAAM,CAGjC;IAEQ,gBAAgB,IAAI,OAAO,CAEnC;IAMD,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,YAAY;CAOrB"}

package/lib/persistence/fieldEncryptor.d.ts

@@ -0,0 +1,48 @@
+export declare class MissingEncryptionKeyError extends Error {
+    readonly name: 'MissingEncryptionKeyError';
+    constructor(message?: string);
+}
+export declare class DecryptionError extends Error {
+    readonly name: 'DecryptionError';
+    constructor(message?: string);
+}
+export declare class EncryptionRequiredError extends Error {
+    readonly name: 'EncryptionRequiredError';
+    constructor(message?: string);
+}
+export declare class FieldEncryptor {
+    private readonly masterKey;
+    constructor(masterKey: string);
+    /**
+     * Derive a per-tenant 32-byte key using HKDF-SHA256.
+     * The master key is used as input key material and the tenantId as info context.
+     */
+    deriveKey(tenantId: string): Buffer;
+    /**
+     * Derive a deterministic IV from the key and plaintext using HMAC-SHA256,
+     * truncated to IV_BYTES. Same plaintext + same key → same IV → same
+     * ciphertext. This enables WHERE clause matching on encrypted columns
+     * while maintaining AES-256-GCM authenticated encryption.
+     *
+     * Meets SOC 2, HIPAA, PCI DSS, GDPR requirements for encryption at rest.
+     */
+    private deriveDeterministicIv;
+    /**
+     * Encrypt a plaintext string.
+     *
+     * Uses deterministic encryption (HMAC-derived IV) so the same plaintext
+     * always produces the same ciphertext. This enables database WHERE clause
+     * matching and UNIQUE constraints on encrypted columns.
+     *
+     * @returns Format: `v2:{base64(iv)}:{base64(authTag)}:{base64(ciphertext)}`
+     */
+    encrypt(plaintext: string | null): string | null;
+    encrypt(plaintext: string | null, tenantId: string): string | null;
+    /**
+     * Decrypt a ciphertext string produced by {@link encrypt}.
+     * Supports both v1 (random IV) and v2 (deterministic IV) formats.
+     */
+    decrypt(ciphertext: string | null): string | null;
+    decrypt(ciphertext: string | null, tenantId: string): string | null;
+}
+//# sourceMappingURL=fieldEncryptor.d.ts.map

package/lib/persistence/fieldEncryptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldEncryptor.d.ts","sourceRoot":"","sources":["../../src/persistence/fieldEncryptor.ts"],"names":[],"mappings":"AAMA,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;IACrD,YAAY,OAAO,SAA2C,EAE7D;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,YACE,OAAO,SAAyE,EAGjF;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;IACnD,YACE,OAAO,SAAmE,EAG3E;CACF;AAgBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,SAAS,EAAE,MAAM,EAK5B;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIlC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;OAQG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAwBnE;;;OAGG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CA+BrE"}