@forklaunch/core 1.5.20 → 1.6.0

package/lib/persistence/fieldEncryptor.d.ts

@@ -10,17 +10,125 @@ export declare class EncryptionRequiredError extends Error {
     readonly name: 'EncryptionRequiredError';
     constructor(message?: string);
 }
+/**
+ * Ciphertext envelopes the encryptor reads. Only `v3` names its key.
+ *
+ *   v1:{iv}:{tag}:{data}            random IV (legacy)
+ *   v2:{iv}:{tag}:{data}            deterministic IV
+ *   v3:{keyId}:{iv}:{tag}:{data}    deterministic IV, stamped with the key fingerprint
+ */
+export declare const ENCRYPTED_PREFIXES: readonly ['v1:', 'v2:', 'v3:'];
+/** True when the string carries one of the encryptor's envelopes. */
+export declare function isEncryptedCiphertext(value: unknown): value is string;
+/**
+ * Which envelope new values are written in.
+ *
+ *   'v2'  unstamped. Default. Byte-compatible with every existing row, so
+ *         equality lookups keep matching rows written before the ring existed.
+ *   'v3'  stamped with the writing key's fingerprint. Reads resolve the key
+ *         directly, a missing key fails by name, and the rows still under a
+ *         key can be counted with a LIKE. Switch to it only after a rotation
+ *         sweep has rewritten every row: a v3 write does not byte-match a v2
+ *         row of the same plaintext, so lookups miss until the sweep is done.
+ */
+export type CiphertextFormat = 'v2' | 'v3';
+/** Environment variable holding the key new values are written with. */
+export declare const ENCRYPTION_KEY_ENV = "ENCRYPTION_KEY";
+/** Environment variable holding every previous key, comma separated. */
+export declare const LEGACY_ENCRYPTION_KEYS_ENV = "LEGACY_ENCRYPTION_KEYS";
+/** Older single-key spelling of {@link LEGACY_ENCRYPTION_KEYS_ENV}; still honoured. */
+export declare const LEGACY_ENCRYPTION_KEY_ENV = "LEGACY_ENCRYPTION_KEY";
+/** Environment variable selecting the write format, `v2` (default) or `v3`. */
+export declare const ENCRYPTION_FORMAT_ENV = "ENCRYPTION_FORMAT";
+/**
+ * Split a key list as it appears in an environment variable: comma,
+ * semicolon or whitespace separated, optionally quoted. Blanks and
+ * duplicates are dropped, order is kept.
+ */
+export declare function parseEncryptionKeyList(...sources: (string | undefined | null)[]): string[];
+/**
+ * A short, non-reversible fingerprint of a master key, for logs, reports
+ * and the `v3` envelope. Two deployments with the same key get the same
+ * id; the id reveals nothing about the key.
+ */
+export declare function encryptionKeyId(masterKey: string): string;
+/**
+ * The key fingerprint a stored value is stamped with, or null for `v1`/`v2`
+ * values, which name no key.
+ */
+export declare function stampedKeyId(ciphertext: string): string | null;
+/** SQL LIKE pattern matching every value stamped with `keyId`. */
+export declare function stampedPrefix(keyId: string): string;
+export interface FieldEncryptorOptions {
+    /**
+     * Keys that data may still be encrypted under, newest first. Values are
+     * never written with these; they are only tried when the current key
+     * cannot open a ciphertext. Keep a key here until a rotation sweep
+     * (`reencryptEncryptedColumns`) reports nothing left under it.
+     */
+    previousKeys?: readonly string[];
+    /** Envelope for new values. See {@link CiphertextFormat}. Default `v2`. */
+    format?: CiphertextFormat;
+}
+/** What {@link FieldEncryptor.open} learned about a ciphertext. */
+export interface OpenedCiphertext {
+    plaintext: string;
+    /** Fingerprint of the key that opened it; see {@link encryptionKeyId}. */
+    keyId: string;
+    /** True when the current key opened it. */
+    current: boolean;
+    /** Envelope the value was stored in. */
+    version: 'v1' | 'v2' | 'v3';
+    /**
+     * True when a rewrite would change the stored bytes: the value is under
+     * a previous key, or it is unstamped while the encryptor writes `v3`.
+     */
+    stale: boolean;
+}
+/**
+ * AES-256-GCM field encryption with per-tenant keys derived by HKDF from a
+ * master key, and a key ring for rotation.
+ *
+ * The ring has one current key and any number of previous keys. Every
+ * write uses the current key. A `v3` value names its key, so a read looks
+ * it up directly and a missing key fails by name. A `v1`/`v2` value names
+ * nothing, so a read tries the current key and then each previous key in
+ * order; AES-GCM's authentication tag makes "this key opens it" a real
+ * check rather than a guess. Either way the master key can change without
+ * a downtime window: add the old key to `previousKeys`, deploy, run the
+ * rotation sweep, then drop the old key.
+ */
 export declare class FieldEncryptor {
-    private readonly masterKey;
-    constructor(masterKey: string);
+    private readonly ring;
+    private readonly byId;
+    private readonly derived;
+    readonly format: CiphertextFormat;
+    constructor(masterKey: string, options?: FieldEncryptorOptions);
+    /**
+     * Build the ring from the environment: `ENCRYPTION_KEY` plus
+     * `LEGACY_ENCRYPTION_KEYS` (comma separated) and the older
+     * `LEGACY_ENCRYPTION_KEY`; `ENCRYPTION_FORMAT` selects the envelope.
+     */
+    static fromEnv(env?: NodeJS.ProcessEnv): FieldEncryptor;
+    /** Fingerprints of the ring, current first. Safe to log. */
+    get keyIds(): {
+        current: string;
+        previous: string[];
+    };
+    /** A copy of this encryptor with a different set of previous keys. */
+    withPreviousKeys(previousKeys: readonly string[]): FieldEncryptor;
+    /** A copy of this encryptor writing a different envelope. */
+    withFormat(format: CiphertextFormat): FieldEncryptor;
     /**
-     * Derive a per-tenant 32-byte key using HKDF-SHA256.
-     * The master key is used as input key material and the tenantId as info context.
+     * Derive a per-tenant 32-byte key using HKDF-SHA256 from the CURRENT
+     * master key. The master key is the input key material and the tenantId
+     * the info context.
      */
     deriveKey(tenantId: string): Buffer;
+    private deriveKeyFor;
     /**
      * Derive a deterministic IV from the key and plaintext using HMAC-SHA256,
-     * truncated to IV_BYTES. Same plaintext + same key → same IV → same
+     * truncated to IV_BYTES. Same plaintext + same key -> same IV -> same
      * ciphertext. This enables WHERE clause matching on encrypted columns
      * while maintaining AES-256-GCM authenticated encryption.
      *
@@ -28,21 +136,41 @@ export declare class FieldEncryptor {
      */
     private deriveDeterministicIv;
     /**
-     * Encrypt a plaintext string.
+     * Encrypt a plaintext string under the current key.
      *
      * Uses deterministic encryption (HMAC-derived IV) so the same plaintext
      * always produces the same ciphertext. This enables database WHERE clause
      * matching and UNIQUE constraints on encrypted columns.
      *
-     * @returns Format: `v2:{base64(iv)}:{base64(authTag)}:{base64(ciphertext)}`
+     * @returns `v2:{iv}:{tag}:{data}`, or `v3:{keyId}:{iv}:{tag}:{data}` when
+     *   the encryptor's format is `v3`. All parts base64.
      */
     encrypt(plaintext: string | null): string | null;
     encrypt(plaintext: string | null, tenantId: string): string | null;
     /**
-     * Decrypt a ciphertext string produced by {@link encrypt}.
-     * Supports both v1 (random IV) and v2 (deterministic IV) formats.
+     * Decrypt a ciphertext string produced by {@link encrypt}, in any
+     * envelope: `v3` by its stamped key, `v1`/`v2` by trying every key in
+     * the ring.
      */
     decrypt(ciphertext: string | null): string | null;
     decrypt(ciphertext: string | null, tenantId: string): string | null;
+    /**
+     * Decrypt and report which key opened the value and whether a rewrite
+     * would change it. Throws {@link DecryptionError} when no key in the
+     * ring does.
+     */
+    open(ciphertext: string, tenantId?: string): OpenedCiphertext;
+    /**
+     * True when a rewrite would change the stored bytes: the value is under
+     * a previous key, or unstamped while this encryptor writes `v3`. Throws
+     * when no key opens it.
+     */
+    needsRotation(ciphertext: string, tenantId?: string): boolean;
+    /**
+     * Rewrite a value under the current key in the current format. Returns
+     * the input unchanged when nothing would change, so callers can compare
+     * to detect writes.
+     */
+    rotate(ciphertext: string | null, tenantId?: string): string | null;
 }
 //# sourceMappingURL=fieldEncryptor.d.ts.map

package/lib/persistence/fieldEncryptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fieldEncryptor.d.ts","sourceRoot":"","sources":["../../src/persistence/fieldEncryptor.ts"],"names":[],"mappings":"AAMA,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;IACrD,YAAY,OAAO,SAA2C,EAE7D;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,YACE,OAAO,SAAyE,EAGjF;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;IACnD,YACE,OAAO,SAAmE,EAG3E;CACF;AAgBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,SAAS,EAAE,MAAM,EAK5B;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIlC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;OAQG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAwBnE;;;OAGG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CA+BrE"}
+{"version":3,"file":"fieldEncryptor.d.ts","sourceRoot":"","sources":["../../src/persistence/fieldEncryptor.ts"],"names":[],"mappings":"AAMA,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;IACrD,YAAY,OAAO,SAA2C,EAE7D;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,YACE,OAAO,SAAyE,EAGjF;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;IACnD,YACE,OAAO,SAAmE,EAG3E;CACF;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,YAAI,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEjE,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKrE;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AACjE,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,GACxC,MAAM,EAAE,CASV;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9D;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,OAAO,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAWD;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAElC,YAAY,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAYjE;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAkBnE;IAED,4DAA4D;IAC5D,IAAI,MAAM,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAKpD;IAED,sEAAsE;IACtE,gBAAgB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAKhE;IAED,6DAA6D;IAC7D,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc,CAKnD;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElC;IAED,OAAO,CAAC,YAAY;IAYpB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IA0BnE;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAQpE;;;;OAIG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,gBAAgB,CA+DxD;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,SAAK,GAAG,OAAO,CAExD;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CAK9D;CACF"}

package/lib/persistence/index.d.ts

@@ -5,7 +5,8 @@ export { fp } from './compliancePropertyBuilder';
 export { defineComplianceEntity } from './defineComplianceEntity';
 export { wrapEmWithNativeQueryBlocking } from './complianceEventSubscriber';
 export { EncryptedType, registerEncryptor, setEncryptionTenantId, withEncryptionContext, getCurrentTenantId } from './encryptedType';
-export { FieldEncryptor, MissingEncryptionKeyError, DecryptionError, EncryptionRequiredError } from './fieldEncryptor';
+export { FieldEncryptor, MissingEncryptionKeyError, DecryptionError, EncryptionRequiredError, parseEncryptionKeyList, encryptionKeyId, stampedKeyId, stampedPrefix, isEncryptedCiphertext, ENCRYPTED_PREFIXES, ENCRYPTION_FORMAT_ENV, ENCRYPTION_KEY_ENV, LEGACY_ENCRYPTION_KEYS_ENV, LEGACY_ENCRYPTION_KEY_ENV, type FieldEncryptorOptions, type OpenedCiphertext, type CiphertextFormat } from './fieldEncryptor';
+export { reencryptEncryptedColumns, classifyEncryptedValue, collectFallbackTenantIds, defaultTenantIdsFor, entityMetadataList, rotationTotals, countValuesByKeyId, isEncryptedValue, type ReencryptOptions, type RotationOutcome, type RotationTableReport, type SqlExecute, type EntityMetadataLike } from './keyRotation';
 export { setupTenantFilter, getSuperAdminContext, createTenantFilterDef, TENANT_FILTER_NAME } from './tenantFilter';
 export { setupRls, RlsEventSubscriber, type RlsConfig } from './rls';
 export type { AnyMikroORM, ResolvedEntity } from './mikroOrm.types';

package/lib/persistence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/persistence/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EAExB,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACrC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACrC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAErE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/persistence/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EAExB,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACrC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACrC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAErE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC"}