@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/lib/encryption/tenantDataEncryptionService.js

@@ -9,10 +9,19 @@ import {
 import { createKmsService } from "./kms.js";
 import { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from "./toggles.js";
 import { createLogger } from "../logger/index.js";
+import {
+  getEncryptionPolicyMemo,
+  invalidateEncryptionPolicyMemos
+} from "./policyMemo.js";
 const logger = createLogger("shared").child({ component: "tenant-encryption" });
-const MAP_MISS_TTL_MS = 5 * 60 * 1e3;
 const DEK_CACHE_TTL_MS = 15 * 60 * 1e3;
-const AGGREGATE_CACHE_TTL_MS = 300 * 1e3;
+function readScopeId(row, column, property) {
+  const value = row[column] ?? row[property];
+  return value == null ? null : String(value).toLowerCase();
+}
+function sameScopeId(value, expected) {
+  return value === (expected == null ? null : expected.toLowerCase());
+}
 function cacheKey(key) {
   return [
     "encmap",
@@ -21,8 +30,8 @@ function cacheKey(key) {
     key.organizationId ?? "null"
   ].join(":");
 }
-function allOrganizationsCacheKey(entityId, tenantId) {
-  return ["encmap-all-orgs", entityId.toLowerCase(), tenantId ?? "null"].join(":");
+function encryptionMapPolicyVersionCacheKey(entityId) {
+  return ["encmap-policy-version", entityId.toLowerCase()].join(":");
 }
 function debug(event, payload) {
   if (!isEncryptionDebugEnabled()) return;
@@ -111,47 +120,27 @@ function readEncryptedFieldsJson(row) {
 function resolveEncryptionKeyId(entityId, keyScope, tenantId) {
   return keyScope === "system" ? `system:${entityId}` : tenantId ?? null;
 }
-function getSqlConnection(em) {
-  const source = em;
-  const conn = source.getConnection?.();
-  if (!conn || typeof conn !== "object") return null;
-  const candidate = conn;
+function getSqlExecutor(em) {
+  const candidate = em;
   if (typeof candidate.execute !== "function") return null;
   return candidate;
 }
 class TenantDataEncryptionService {
   constructor(em, opts) {
     this.em = em;
-    this.memoryCache = TenantDataEncryptionService.globalMemoryCache;
-    this.aggregateMemoryCache = TenantDataEncryptionService.globalAggregateMemoryCache;
     this.dekCache = TenantDataEncryptionService.globalDekCache;
     this.inflightDeks = TenantDataEncryptionService.globalInflightDeks;
-    this.inflightMaps = TenantDataEncryptionService.globalInflightMaps;
-    this.missCache = TenantDataEncryptionService.globalMissCache;
-    this.cache = opts?.cache;
     this.kms = opts?.kms ?? createKmsService();
     this.systemDefaultMaps = new Map(
       (opts?.defaultEncryptionMaps ?? []).filter((map) => map.keyScope === "system").map((map) => [map.entityId, map])
     );
   }
-  static {
-    this.globalMemoryCache = /* @__PURE__ */ new Map();
-  }
-  static {
-    this.globalAggregateMemoryCache = /* @__PURE__ */ new Map();
-  }
-  static {
-    this.globalInflightMaps = /* @__PURE__ */ new Map();
-  }
   static {
     this.globalDekCache = /* @__PURE__ */ new Map();
   }
   static {
     this.globalInflightDeks = /* @__PURE__ */ new Map();
   }
-  static {
-    this.globalMissCache = /* @__PURE__ */ new Map();
-  }
   isEnabled() {
     return isTenantDataEncryptionEnabled() && this.kms.isHealthy();
   }
@@ -206,80 +195,50 @@ class TenantDataEncryptionService {
     if (dek) this.dekCache.set(tenantId, dek);
     return dek;
   }
-  async fetchMap(key) {
-    const conn = getSqlConnection(this.em);
-    if (!conn) return null;
+  /**
+   * Reads every row that can decide the policy for `key` in ONE statement: the exact scope, the
+   * tenant-wide scope, and the global scope — plus, at the tenant-wide scope, every
+   * organization-scoped map of the tenant for the all-organizations aggregate (#5949). Precedence
+   * and duplicate merging happen in JS so the result is identical to resolving the fallback chain
+   * one scope at a time.
+   */
+  async loadPolicy(key, em) {
+    const conn = getSqlExecutor(em ?? this.em);
+    if (!conn) {
+      throw new Error("[internal] Encryption policy lookup requires an EntityManager that can execute SQL");
+    }
+    const includeAllOrganizations = key.organizationId == null;
+    const scopeClause = includeAllOrganizations ? "tenant_id is not distinct from ?" : "(tenant_id is not distinct from ? and (organization_id = ? or organization_id is null))";
     const sql = `
-      select entity_id, fields_json
+      select entity_id, tenant_id, organization_id, fields_json
       from encryption_maps
       where entity_id = ?
-        and tenant_id is not distinct from ?
-        and organization_id is not distinct from ?
         and is_active = true
         and deleted_at is null
-      limit 1
+        and (${scopeClause} or (tenant_id is null and organization_id is null))
+      order by organization_id asc, created_at asc, id asc
     `;
-    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null]);
-    const row = Array.isArray(rows) && rows.length && rows[0] && typeof rows[0] === "object" ? rows[0] : null;
-    if (!row) return null;
-    return {
-      entityId: String(row.entity_id ?? row.entityId ?? key.entityId),
-      fields: readEncryptedFieldsJson(row)
-    };
-  }
-  applySystemDefault(record, entityId) {
-    const declared = this.systemDefaultMaps.get(entityId);
-    if (!declared) return record;
-    const fields = declared.fields.map((field) => ({
-      field: field.field,
-      hashField: field.hashField ?? null
-    }));
-    const declaredFields = new Set(fields.map((field) => field.field));
-    for (const field of record?.fields ?? []) {
-      if (!declaredFields.has(field.field)) fields.push(field);
-    }
-    return {
-      entityId,
-      keyScope: "system",
-      fields
-    };
+    const params = includeAllOrganizations ? [key.entityId, key.tenantId] : [key.entityId, key.tenantId, key.organizationId];
+    const rows = await conn.execute(sql, params);
+    const records = Array.isArray(rows) ? rows.filter((row) => Boolean(row) && typeof row === "object") : [];
+    const map = this.applySystemDefault(this.pickMostSpecificMap(key, records), key.entityId);
+    const mapRules = normalizeEncryptedFieldRules(map?.fields);
+    if (!includeAllOrganizations) return { map, fields: mapRules };
+    const organizationRows = records.filter((record) => sameScopeId(readScopeId(record, "tenant_id", "tenantId"), key.tenantId) && readScopeId(record, "organization_id", "organizationId") !== null);
+    const organizationRules = mergeEncryptedFieldRules(
+      organizationRows.map((record) => normalizeEncryptedFieldRules(readEncryptedFieldsJson(record)))
+    );
+    return { map, fields: mergeEncryptedFieldRules([mapRules, organizationRules]) };
   }
-  async getMap(key) {
-    const shouldSkipLookup = (tag) => {
-      const expiresAt = this.missCache.get(tag);
-      if (!expiresAt) return false;
-      if (expiresAt > Date.now()) return true;
-      this.missCache.delete(tag);
-      return false;
-    };
-    const recordMiss = (tag) => {
-      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS);
-    };
+  pickMostSpecificMap(key, records) {
     const candidates = [
       key,
-      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },
+      { entityId: key.entityId, tenantId: key.tenantId, organizationId: null },
       { entityId: key.entityId, tenantId: null, organizationId: null }
     ];
     for (const candidate of candidates) {
-      const tag = cacheKey(candidate);
-      if (shouldSkipLookup(tag)) continue;
-      if (this.inflightMaps.has(tag)) {
-        const pending2 = this.inflightMaps.get(tag);
-        const resolved = await pending2;
-        if (resolved) return this.applySystemDefault(resolved, key.entityId);
-      }
-      const mem = this.memoryCache.get(tag);
-      if (mem) return this.applySystemDefault(mem, key.entityId);
-      if (this.cache && typeof this.cache.get === "function") {
-        const cached = await this.cache.get(tag);
-        if (cached) return this.applySystemDefault(cached, key.entityId);
-      }
-      const pending = this.fetchMap(candidate);
-      this.inflightMaps.set(tag, pending);
-      const loaded = await pending;
-      this.inflightMaps.delete(tag);
-      if (!loaded) {
-        recordMiss(tag);
+      const matches = records.filter((record) => sameScopeId(readScopeId(record, "tenant_id", "tenantId"), candidate.tenantId) && sameScopeId(readScopeId(record, "organization_id", "organizationId"), candidate.organizationId));
+      if (!matches.length) {
         debug("\u{1F50D} encmap.miss", {
           entityId: candidate.entityId,
           tenantId: candidate.tenantId,
@@ -287,110 +246,72 @@ class TenantDataEncryptionService {
         });
         continue;
       }
-      this.missCache.delete(tag);
-      this.memoryCache.set(tag, loaded);
-      if (this.cache && typeof this.cache.set === "function") {
-        await this.cache.set(tag, loaded, { ttl: 300 });
+      if (matches.length > 1) {
+        logger.warn("Duplicate live encryption maps detected; merging field rules fail-safe", {
+          entityId: candidate.entityId,
+          tenantId: candidate.tenantId,
+          organizationId: candidate.organizationId,
+          count: matches.length
+        });
       }
-      return this.applySystemDefault(loaded, key.entityId);
+      return {
+        entityId: String(matches[0].entity_id ?? matches[0].entityId ?? key.entityId),
+        fields: mergeEncryptedFieldRules(matches.map((record) => normalizeEncryptedFieldRules(readEncryptedFieldsJson(record))))
+      };
     }
-    return this.applySystemDefault(null, key.entityId);
+    return null;
   }
-  async fetchAllOrganizationFieldRules(entityId, tenantId) {
-    const conn = getSqlConnection(this.em);
-    if (!conn) return [];
-    const sql = `
-      select fields_json
-      from encryption_maps
-      where entity_id = ?
-        and tenant_id is not distinct from ?
-        and organization_id is not null
-        and is_active = true
-        and deleted_at is null
-    `;
-    const rows = await conn.execute(sql, [entityId, tenantId]);
-    if (!Array.isArray(rows) || rows.length === 0) return [];
-    const groups = [];
-    for (const row of rows) {
-      if (!row || typeof row !== "object") continue;
-      groups.push(normalizeEncryptedFieldRules(readEncryptedFieldsJson(row)));
+  applySystemDefault(record, entityId) {
+    const declared = this.systemDefaultMaps.get(entityId);
+    if (!declared) return record;
+    const fields = declared.fields.map((field) => ({
+      field: field.field,
+      hashField: field.hashField ?? null
+    }));
+    const declaredFields = new Set(fields.map((field) => field.field));
+    for (const field of record?.fields ?? []) {
+      if (!declaredFields.has(field.field)) fields.push(field);
     }
-    return mergeEncryptedFieldRules(groups);
+    return {
+      entityId,
+      keyScope: "system",
+      fields
+    };
   }
   /**
-   * Cached aggregate of every organization-scoped map for an entity/tenant. `encryptEntityPayload`
-   * and `decryptEntityPayload` consult it on every row at the tenant-wide scope, so the uncached
-   * read this used to be would add a round-trip per flush and per load (#5949).
+   * Resolve policy from the canonical table. Nothing is retained across units of work: no
+   * invalidation protocol can make process-local state authoritative after an independent worker
+   * commits a map mutation.
+   *
+   * Within one unit of work — the caller's EntityManager, or its open transaction — repeated
+   * decisions for the same scope share a single read, so loading N rows or running the before/after
+   * hooks of one flush costs one query instead of one per row and hook. That memo dies with the
+   * EntityManager/transaction, is dropped for the EntityManager that writes a map
+   * (`forgetEncryptionPolicyMemo`) and after its flush, and for every EntityManager when this
+   * process invalidates a map. Calls that do not hand in an EntityManager fall back to the
+   * long-lived service EntityManager and are never memoized.
    */
-  async getAllOrganizationFieldRules(entityId, tenantId) {
-    const tag = allOrganizationsCacheKey(entityId, tenantId);
-    const missExpiresAt = this.missCache.get(tag);
-    if (missExpiresAt) {
-      if (missExpiresAt > Date.now()) return [];
-      this.missCache.delete(tag);
-    }
-    const mem = this.aggregateMemoryCache.get(tag);
-    if (mem) {
-      if (mem.at + AGGREGATE_CACHE_TTL_MS > Date.now()) return mem.record.fields;
-      this.aggregateMemoryCache.delete(tag);
-    }
-    if (this.cache && typeof this.cache.get === "function") {
-      const cached = await this.cache.get(tag);
-      if (cached) {
-        const record = cached;
-        this.aggregateMemoryCache.set(tag, { at: Date.now(), record });
-        return record.fields;
-      }
-    }
-    const inflight = this.inflightMaps.get(tag);
-    if (inflight) return (await inflight)?.fields ?? [];
-    const pending = (async () => {
-      const fields = await this.fetchAllOrganizationFieldRules(entityId, tenantId);
-      return fields.length ? { entityId, fields } : null;
-    })();
-    this.inflightMaps.set(tag, pending);
-    let loaded;
-    try {
-      loaded = await pending;
-    } finally {
-      this.inflightMaps.delete(tag);
-    }
-    if (!loaded) {
-      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS);
-      return [];
-    }
-    this.missCache.delete(tag);
-    this.aggregateMemoryCache.set(tag, { at: Date.now(), record: loaded });
-    if (this.cache && typeof this.cache.set === "function") {
-      await this.cache.set(tag, loaded, { ttl: 300 });
-    }
-    return loaded.fields;
+  resolvePolicy(key, em) {
+    if (!em) return this.loadPolicy(key);
+    const memo = getEncryptionPolicyMemo(em);
+    const tag = cacheKey(key);
+    const pending = memo.get(tag);
+    if (pending) return pending;
+    const loading = this.loadPolicy(key, em);
+    memo.set(tag, loading);
+    loading.catch(() => {
+      if (memo.get(tag) === loading) memo.delete(tag);
+    });
+    return loading;
   }
   /**
-   * The field rules that are actually encrypted at rest for a scope.
-   *
-   * At the tenant-wide scope (`organizationId == null`) `getMap` resolves only the base map, but
-   * rows of the same entity may carry fields declared solely by an organization-scoped map. Reading
-   * or writing such a row with the base map alone stores those fields as plaintext and hands
-   * callers back undecrypted ciphertext, so every scope-aware path unions the organization maps in
-   * (#5949) — the same set `getEncryptedFieldNames` has reported since #2282.
+   * Drops the policy reads memoized by every EntityManager of this process. Map writers call it
+   * after their write commits; readers in other processes never depended on it, because policy is
+   * not cached across units of work.
    */
-  async resolveFieldRulesForScope(entityId, tenantId, organizationId, map) {
-    const mapRules = normalizeEncryptedFieldRules(map?.fields);
-    if (organizationId != null) return mapRules;
-    return mergeEncryptedFieldRules([mapRules, await this.getAllOrganizationFieldRules(entityId, tenantId)]);
-  }
   async invalidateMap(entityId, tenantId, organizationId) {
-    const tags = [cacheKey({ entityId, tenantId, organizationId }), allOrganizationsCacheKey(entityId, tenantId)];
-    for (const tag of tags) {
-      this.memoryCache.delete(tag);
-      this.aggregateMemoryCache.delete(tag);
-      this.inflightMaps.delete(tag);
-      this.missCache.delete(tag);
-      if (this.cache && typeof this.cache.delete === "function") {
-        await this.cache.delete(tag);
-      }
-    }
+    debug("\u267B\uFE0F encmap.invalidate", { entityId, tenantId, organizationId });
+    invalidateEncryptionPolicyMemos();
   }
   // Force a flush of a tenant's cached DEK across the service-level cache and the
   // underlying KMS cache so an operator can pick up a rotated/revoked key without
@@ -415,12 +336,9 @@ class TenantDataEncryptionService {
     } else if (!this.isEnabled()) {
       return [];
     }
-    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null });
-    const fields = await this.resolveFieldRulesForScope(
-      entityId,
-      tenantId ?? null,
-      organizationId ?? null,
-      map
+    const { fields } = await this.resolvePolicy(
+      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },
+      options?.em
     );
     return fields.map((rule) => rule.field);
   }
@@ -481,12 +399,9 @@ class TenantDataEncryptionService {
       debug("\u26AA\uFE0F encrypt.skip.disabled", { entityId, tenantId });
       return payload;
     }
-    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null });
-    const fields = await this.resolveFieldRulesForScope(
-      entityId,
-      tenantId ?? null,
-      organizationId ?? null,
-      map
+    const { map, fields } = await this.resolvePolicy(
+      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },
+      options?.em
     );
     if (!fields.length) {
       debug("\u26AA\uFE0F encrypt.skip.no-map", { entityId, tenantId });
@@ -501,17 +416,14 @@ class TenantDataEncryptionService {
     debug("\u{1F512} encrypt_entity", { entityId, tenantId, organizationId, fields: fields.length });
     return this.encryptFields(payload, fields, dek);
   }
-  async decryptEntityPayload(entityId, payload, tenantId, organizationId) {
+  async decryptEntityPayload(entityId, payload, tenantId, organizationId, options) {
     if (!isTenantDataEncryptionEnabled()) {
       debug("\u26AA\uFE0F decrypt.skip.disabled", { entityId, tenantId });
       return payload;
     }
-    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null });
-    const fields = await this.resolveFieldRulesForScope(
-      entityId,
-      tenantId ?? null,
-      organizationId ?? null,
-      map
+    const { map, fields } = await this.resolvePolicy(
+      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },
+      options?.em
     );
     if (!fields.length) {
       debug("\u26AA\uFE0F decrypt.skip.no-map", { entityId, tenantId });
@@ -529,6 +441,7 @@ class TenantDataEncryptionService {
 }
 export {
   TenantDataEncryptionService,
+  encryptionMapPolicyVersionCacheKey,
   parseDecryptedFieldValue,
   resolveEncryptionKeyId
 };

package/dist/lib/encryption/tenantDataEncryptionService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/tenantDataEncryptionService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport {\n  TenantDataEncryptionError,\n  TenantDataEncryptionErrorCode,\n  decryptWithAesGcm,\n  encryptWithAesGcm,\n  hashForLookup,\n  isEncryptedPayloadShape,\n} from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { createLogger } from '../logger'\nimport type { EncryptionKeyScope, ModuleEncryptionMap } from '../../modules/encryption'\n\nconst logger = createLogger('shared').child({ component: 'tenant-encryption' })\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  keyScope?: EncryptionKeyScope\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype SqlConnection = {\n  execute(sql: string, params?: readonly unknown[]): Promise<unknown>\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n// Mirror the Vault KMS default DEK TTL so a rotated/revoked tenant key is picked\n// up by long-lived processes without a restart (#2746). The service-level cache\n// previously had no TTL and shadowed the KMS's own 15-minute expiry.\nconst DEK_CACHE_TTL_MS = 15 * 60 * 1000\n// Matches the `{ ttl: 300 }` passed to the `CacheStrategy` layer for the all-organizations\n// aggregate, so a process that only ever hits its own memory entry (no shared cache configured,\n// or already warm) still picks up a runtime map edit within the same bound (#6066).\nconst AGGREGATE_CACHE_TTL_MS = 300 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\n// Tag for the aggregate of every organization-scoped map of an entity/tenant. The prefix differs\n// from `cacheKey`'s in its first segment rather than by an extra one, so no entity id can spell a\n// tag that collides with an aggregate (`encmap:all-orgs:x:y` would be reachable both ways).\nfunction allOrganizationsCacheKey(entityId: string, tenantId: string | null): string {\n  return ['encmap-all-orgs', entityId.toLowerCase(), tenantId ?? 'null'].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    logger.debug(event, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n *\n * NOTE (issue #1810 follow-up): `decryptFields` no longer calls this helper for\n * entity-field decryption \u2014 typed string columns whose contents happen to look\n * like JSON (e.g. a display name `{\"a\":1}`) must remain raw strings to avoid\n * downstream React-render crashes. Callers that legitimately need the parse\n * (audit-log jsonb columns, custom-field rotation, encryption CLI) MUST invoke\n * `parseDecryptedFieldValue` themselves on the decrypted payload.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\n/**\n * A value is only treated as \"already encrypted\" when it actually decrypts\n * under the tenant DEK \u2014 i.e. the AES-GCM authentication tag verifies. A purely\n * structural `<iv>:<ct>:<tag>:v1` shape check is forgeable: attacker-controlled\n * field values (e.g. their own profile email/phone) could impersonate ciphertext\n * to skip encryption-at-rest and the lookup hash entirely (issue #2720). Binding\n * the check to a successful authenticated decrypt makes forgery infeasible, so a\n * fake payload simply gets encrypted like any other plaintext.\n */\nfunction isEncryptedWithDek(value: unknown, dek: TenantDek): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  if (parts.length !== 4 || parts[3] !== 'v1') return false\n  return decryptWithAesGcm(value, dek.key) !== null\n}\n\n/**\n * Guard the encrypt path against re-wrapping ciphertext this process cannot open.\n *\n * Called only after {@link isEncryptedWithDek} has already said \"not sealed under the\n * current DEK\". At that point a structurally well-formed envelope means one of two things:\n * genuine ciphertext under some other key, or a length-valid forgery \u2014 the shape check is\n * length-based, not content-based, so any length-correct string qualifies, not just a\n * byte-exact match against something real. Both must stop the write \u2014 the first because\n * nesting envelopes silently destroys recoverable data, the second because rejecting it is\n * strictly safer than persisting attacker-chosen bytes.\n *\n * The field name is safe to report (it comes from the encryption map, not user input); the\n * value never is, so it stays out of both the error message and the log.\n */\nfunction assertNotSealedUnderAnotherKey(value: unknown, field: string): void {\n  if (!isEncryptedPayloadShape(value)) return\n  logger.error('Refusing to re-encrypt a value sealed under a different key', { field })\n  throw new TenantDataEncryptionError(\n    TenantDataEncryptionErrorCode.WRONG_KEY,\n    `[internal] Field \"${field}\" already holds an encrypted payload that does not decrypt under the current tenant DEK. `\n      + 'Encrypting it again would produce an unreadable nested envelope. '\n      + 'Complete the key rotation for this tenant (mercato entities rotate-encryption-key --old-key \u2026) '\n      + 'or restore the DEK that sealed it before writing this record again.',\n  )\n}\n\nfunction normalizeEncryptedFieldRules(\n  fields: readonly { field?: unknown; hashField?: unknown }[] | null | undefined,\n): EncryptedFieldRule[] {\n  if (!Array.isArray(fields)) return []\n  const rules: EncryptedFieldRule[] = []\n  for (const rule of fields) {\n    if (!rule || typeof rule !== 'object') continue\n    const field = rule.field\n    if (typeof field !== 'string' || field.trim().length === 0) continue\n    rules.push({ field, hashField: typeof rule.hashField === 'string' ? rule.hashField : null })\n  }\n  return rules\n}\n\nfunction normalizeEncryptedFieldNames(fields: readonly { field?: unknown }[] | null | undefined): string[] {\n  return normalizeEncryptedFieldRules(fields).map((rule) => rule.field)\n}\n\n/**\n * Union of field rules, first declaration wins on the field name. A later duplicate only\n * contributes its `hashField` when the winning rule declares none, so merging an organization-scoped\n * map into a tenant-wide one never silently retargets an existing lookup-hash column.\n */\nfunction mergeEncryptedFieldRules(groups: readonly EncryptedFieldRule[][]): EncryptedFieldRule[] {\n  const merged: EncryptedFieldRule[] = []\n  const byField = new Map<string, EncryptedFieldRule>()\n  for (const group of groups) {\n    for (const rule of group) {\n      const existing = byField.get(rule.field)\n      if (!existing) {\n        const copy: EncryptedFieldRule = { field: rule.field, hashField: rule.hashField ?? null }\n        byField.set(rule.field, copy)\n        merged.push(copy)\n        continue\n      }\n      if (!existing.hashField && rule.hashField) existing.hashField = rule.hashField\n    }\n  }\n  return merged\n}\n\nfunction readEncryptedFieldsJson(row: Record<string, unknown>): EncryptedFieldRule[] {\n  const raw = row.fields_json ?? row.fieldsJson\n  if (Array.isArray(raw)) return raw as EncryptedFieldRule[]\n  if (typeof raw === 'string') {\n    try {\n      const parsed = JSON.parse(raw)\n      return Array.isArray(parsed) ? parsed as EncryptedFieldRule[] : []\n    } catch {\n      return []\n    }\n  }\n  return []\n}\n\n/**\n * The KMS key id an encryption map's payloads are sealed under: a system-scoped map\n * uses a per-entity key that exists before any tenant does, everything else uses the\n * tenant's own key. Exported so callers that need to probe key availability without\n * encrypting (the encryption CLIs) derive the same id instead of re-spelling the\n * `system:` convention (#5950).\n */\nexport function resolveEncryptionKeyId(\n  entityId: string,\n  keyScope: EncryptionKeyScope | undefined,\n  tenantId: string | null | undefined\n): string | null {\n  return keyScope === 'system' ? `system:${entityId}` : tenantId ?? null\n}\n\nfunction getSqlConnection(em: EntityManager): SqlConnection | null {\n  const source = em as { getConnection?: () => unknown }\n  const conn = source.getConnection?.()\n  if (!conn || typeof conn !== 'object') return null\n  const candidate = conn as { execute?: unknown }\n  if (typeof candidate.execute !== 'function') return null\n  return candidate as SqlConnection\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalAggregateMemoryCache = new Map<string, { at: number; record: EncryptionMapRecord }>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalInflightDeks = new Map<string, Promise<TenantDek | null>>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly aggregateMemoryCache = TenantDataEncryptionService.globalAggregateMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightDeks = TenantDataEncryptionService.globalInflightDeks\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n  private readonly systemDefaultMaps: Map<string, ModuleEncryptionMap>\n\n  constructor(\n    private em: EntityManager,\n    opts?: {\n      cache?: CacheStrategy\n      kms?: KmsService\n      defaultEncryptionMaps?: readonly ModuleEncryptionMap[]\n    }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n    this.systemDefaultMaps = new Map(\n      (opts?.defaultEncryptionMaps ?? [])\n        .filter((map) => map.keyScope === 'system')\n        .map((map) => [map.entityId, map]),\n    )\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  private isDekExpired(dek: TenantDek): boolean {\n    return Date.now() - dek.fetchedAt > DEK_CACHE_TTL_MS\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached && !this.isDekExpired(cached)) return cached\n    if (cached) this.dekCache.delete(tenantId)\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  /**\n   * Resolves the DEK an encrypt call should seal under, provisioning one when the\n   * tenant has none yet.\n   *\n   * Provisioning writes real key material to the KMS/Vault backend, so it is a\n   * state change \u2014 not a cache fill. Callers whose intent is only to preview or\n   * check (\"would this row be encrypted?\") pass `createIfMissing: false` to get a\n   * `null` instead, leaving KMS untouched (issue #5950). The default stays `true`\n   * so every existing write path keeps provisioning on first use.\n   */\n  private async resolveDekForEncrypt(\n    tenantId: string | null,\n    options?: { createIfMissing?: boolean }\n  ): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (options?.createIfMissing === false) return null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    // Dedupe concurrent first-time creation within this process so two callers\n    // can't each generate a distinct DEK and overwrite one another (#2746).\n    // Mirrors the encryption-map inflight dedupe (`globalInflightMaps`).\n    const pending = this.inflightDeks.get(tenantId)\n    if (pending) return pending\n    const creation = (async () => {\n      const created = await this.kms.createTenantDek(tenantId)\n      if (created) this.dekCache.set(tenantId, created)\n      return created ?? null\n    })()\n    this.inflightDeks.set(tenantId, creation)\n    try {\n      return await creation\n    } finally {\n      this.inflightDeks.delete(tenantId)\n    }\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn = getSqlConnection(this.em)\n    if (!conn) return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length && rows[0] && typeof rows[0] === 'object'\n      ? rows[0] as Record<string, unknown>\n      : null\n    if (!row) return null\n    return {\n      entityId: String(row.entity_id ?? row.entityId ?? key.entityId),\n      fields: readEncryptedFieldsJson(row),\n    }\n  }\n\n  private applySystemDefault(record: EncryptionMapRecord | null, entityId: string): EncryptionMapRecord | null {\n    const declared = this.systemDefaultMaps.get(entityId)\n    if (!declared) return record\n    const fields: EncryptedFieldRule[] = declared.fields.map((field) => ({\n      field: field.field,\n      hashField: field.hashField ?? null,\n    }))\n    const declaredFields = new Set(fields.map((field) => field.field))\n    for (const field of record?.fields ?? []) {\n      if (!declaredFields.has(field.field)) fields.push(field)\n    }\n    return {\n      entityId,\n      keyScope: 'system',\n      fields,\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return this.applySystemDefault(resolved, key.entityId)\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return this.applySystemDefault(mem, key.entityId)\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return this.applySystemDefault(cached as EncryptionMapRecord, key.entityId)\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return this.applySystemDefault(loaded, key.entityId)\n    }\n    return this.applySystemDefault(null, key.entityId)\n  }\n\n  private async fetchAllOrganizationFieldRules(\n    entityId: string,\n    tenantId: string | null,\n  ): Promise<EncryptedFieldRule[]> {\n    const conn = getSqlConnection(this.em)\n    if (!conn) return []\n    const sql = `\n      select fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not null\n        and is_active = true\n        and deleted_at is null\n    `\n    const rows = await conn.execute(sql, [entityId, tenantId])\n    if (!Array.isArray(rows) || rows.length === 0) return []\n    const groups: EncryptedFieldRule[][] = []\n    for (const row of rows) {\n      if (!row || typeof row !== 'object') continue\n      groups.push(normalizeEncryptedFieldRules(readEncryptedFieldsJson(row as Record<string, unknown>)))\n    }\n    return mergeEncryptedFieldRules(groups)\n  }\n\n  /**\n   * Cached aggregate of every organization-scoped map for an entity/tenant. `encryptEntityPayload`\n   * and `decryptEntityPayload` consult it on every row at the tenant-wide scope, so the uncached\n   * read this used to be would add a round-trip per flush and per load (#5949).\n   */\n  private async getAllOrganizationFieldRules(\n    entityId: string,\n    tenantId: string | null,\n  ): Promise<EncryptedFieldRule[]> {\n    const tag = allOrganizationsCacheKey(entityId, tenantId)\n    const missExpiresAt = this.missCache.get(tag)\n    if (missExpiresAt) {\n      if (missExpiresAt > Date.now()) return []\n      this.missCache.delete(tag)\n    }\n    const mem = this.aggregateMemoryCache.get(tag)\n    if (mem) {\n      if (mem.at + AGGREGATE_CACHE_TTL_MS > Date.now()) return mem.record.fields\n      this.aggregateMemoryCache.delete(tag)\n    }\n    if (this.cache && typeof this.cache.get === 'function') {\n      const cached = await this.cache.get(tag)\n      if (cached) {\n        const record = cached as EncryptionMapRecord\n        this.aggregateMemoryCache.set(tag, { at: Date.now(), record })\n        return record.fields\n      }\n    }\n    const inflight = this.inflightMaps.get(tag)\n    if (inflight) return (await inflight)?.fields ?? []\n    const pending = (async (): Promise<EncryptionMapRecord | null> => {\n      const fields = await this.fetchAllOrganizationFieldRules(entityId, tenantId)\n      return fields.length ? { entityId, fields } : null\n    })()\n    this.inflightMaps.set(tag, pending)\n    let loaded: EncryptionMapRecord | null\n    try {\n      loaded = await pending\n    } finally {\n      this.inflightMaps.delete(tag)\n    }\n    if (!loaded) {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n      return []\n    }\n    this.missCache.delete(tag)\n    this.aggregateMemoryCache.set(tag, { at: Date.now(), record: loaded })\n    if (this.cache && typeof this.cache.set === 'function') {\n      await this.cache.set(tag, loaded, { ttl: 300 })\n    }\n    return loaded.fields\n  }\n\n  /**\n   * The field rules that are actually encrypted at rest for a scope.\n   *\n   * At the tenant-wide scope (`organizationId == null`) `getMap` resolves only the base map, but\n   * rows of the same entity may carry fields declared solely by an organization-scoped map. Reading\n   * or writing such a row with the base map alone stores those fields as plaintext and hands\n   * callers back undecrypted ciphertext, so every scope-aware path unions the organization maps in\n   * (#5949) \u2014 the same set `getEncryptedFieldNames` has reported since #2282.\n   */\n  private async resolveFieldRulesForScope(\n    entityId: string,\n    tenantId: string | null,\n    organizationId: string | null,\n    map: EncryptionMapRecord | null,\n  ): Promise<EncryptedFieldRule[]> {\n    const mapRules = normalizeEncryptedFieldRules(map?.fields)\n    if (organizationId != null) return mapRules\n    return mergeEncryptedFieldRules([mapRules, await this.getAllOrganizationFieldRules(entityId, tenantId)])\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tags = [cacheKey({ entityId, tenantId, organizationId }), allOrganizationsCacheKey(entityId, tenantId)]\n    for (const tag of tags) {\n      this.memoryCache.delete(tag)\n      this.aggregateMemoryCache.delete(tag)\n      this.inflightMaps.delete(tag)\n      this.missCache.delete(tag)\n      if (this.cache && typeof (this.cache as any).delete === 'function') {\n        await (this.cache as any).delete(tag)\n      }\n    }\n  }\n\n  // Force a flush of a tenant's cached DEK across the service-level cache and the\n  // underlying KMS cache so an operator can pick up a rotated/revoked key without\n  // a process restart (#2746).\n  invalidateDek(tenantId: string): void {\n    this.dekCache.delete(tenantId)\n    this.inflightDeks.delete(tenantId)\n    this.kms.invalidateDek?.(tenantId)\n  }\n\n  /**\n   * Lists the fields an encryption map marks as encrypted at rest.\n   *\n   * `isEnabled()` folds the environment toggle together with KMS health, so by default an\n   * unhealthy KMS reports \"nothing is encrypted\" \u2014 which is safe for write paths but wrong for\n   * readers that must decide whether a stored column holds ciphertext. `ignoreRuntimeHealth`\n   * answers the on-disk question instead: it consults the map even when the KMS cannot currently\n   * resolve a DEK, so callers can fail closed rather than treat ciphertext as plaintext (#4622).\n   */\n  async getEncryptedFieldNames(\n    entityId: string,\n    tenantId: string | null | undefined,\n    organizationId?: string | null,\n    options?: { ignoreRuntimeHealth?: boolean }\n  ): Promise<string[]> {\n    if (options?.ignoreRuntimeHealth) {\n      if (!isTenantDataEncryptionEnabled()) return []\n    } else if (!this.isEnabled()) {\n      return []\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    const fields = await this.resolveFieldRulesForScope(\n      entityId,\n      tenantId ?? null,\n      organizationId ?? null,\n      map,\n    )\n    return fields.map((rule) => rule.field)\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n      // Avoid double-encrypting payloads that genuinely decrypt under this DEK.\n      // A forged ciphertext-shaped string fails this check and is encrypted as\n      // plaintext, closing the encryption-at-rest bypass (issue #2720).\n      if (isEncryptedWithDek(value, dek)) continue\n      // Failing that check does not prove the value is plaintext. A well-formed\n      // envelope sealed under a *different* key \u2014 the previous DEK mid-rotation, or\n      // the derived key the KMS falls back to during a Vault outage \u2014 lands here too,\n      // and encrypting it again would nest one envelope inside another: unreadable by\n      // any normal decrypt, indistinguishable from correct ciphertext by inspection,\n      // and it would overwrite the lookup hash with a hash of ciphertext (issue #5951).\n      // Fail the write closed instead. Nothing is ever stored verbatim, so #2720 stays\n      // shut: a forgery whose shape is not length-valid still gets encrypted as plaintext\n      // above, and a length-valid one is rejected rather than persisted.\n      assertNotSealedUnderAnotherKey(value, rule.field)\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      // Entity fields are typed columns (string/text). Never auto-parse to an object \u2014\n      // it triggers React-render crashes when a string value happens to be valid JSON\n      // (issue #1810 follow-up). Custom field values use a separate helper that\n      // preserves their typed-JSON contract.\n      clone[key] = decrypted\n    }\n    return clone\n  }\n\n  /**\n   * Encrypts the fields an entity's encryption map covers.\n   *\n   * `options.createMissingDek` (default `true`) controls whether a tenant without\n   * a DEK gets one provisioned as a side effect. Preview/check callers \u2014 most\n   * notably `mercato entities rotate-encryption-key --dry-run` \u2014 pass `false` so a\n   * read-only invocation cannot write key material to KMS (issue #5950). With\n   * `false` and no existing DEK the payload is returned unchanged, exactly as it\n   * is when the KMS declines to issue a key.\n   */\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null,\n    options?: { createMissingDek?: boolean }\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    const fields = await this.resolveFieldRulesForScope(\n      entityId,\n      tenantId ?? null,\n      organizationId ?? null,\n      map,\n    )\n    if (!fields.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    const keyId = resolveEncryptionKeyId(entityId, map?.keyScope, tenantId)\n    const dek = await this.resolveDekForEncrypt(keyId, { createIfMissing: options?.createMissingDek !== false })\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId, keyScope: map?.keyScope ?? 'tenant' })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: fields.length })\n    return this.encryptFields(payload, fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    const fields = await this.resolveFieldRulesForScope(\n      entityId,\n      tenantId ?? null,\n      organizationId ?? null,\n      map,\n    )\n    if (!fields.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    const keyId = resolveEncryptionKeyId(entityId, map?.keyScope, tenantId)\n    const dek = await this.getDek(keyId)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId, keyScope: map?.keyScope ?? 'tenant' })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: fields.length })\n    return this.decryptFields(payload, fields, dek)\n  }\n}\n"],
-  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AACxE,SAAS,oBAAoB;AAG7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,oBAAoB,CAAC;AAuB9E,MAAM,kBAAkB,IAAI,KAAK;AAIjC,MAAM,mBAAmB,KAAK,KAAK;AAInC,MAAM,yBAAyB,MAAM;AAErC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAKA,SAAS,yBAAyB,UAAkB,UAAiC;AACnF,SAAO,CAAC,mBAAmB,SAAS,YAAY,GAAG,YAAY,MAAM,EAAE,KAAK,GAAG;AACjF;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AACF,WAAO,MAAM,OAAO,OAAO;AAAA,EAC7B,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAqBO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,SAAS,mBAAmB,OAAgB,KAAyB;AACnE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,KAAM,QAAO;AACpD,SAAO,kBAAkB,OAAO,IAAI,GAAG,MAAM;AAC/C;AAgBA,SAAS,+BAA+B,OAAgB,OAAqB;AAC3E,MAAI,CAAC,wBAAwB,KAAK,EAAG;AACrC,SAAO,MAAM,+DAA+D,EAAE,MAAM,CAAC;AACrF,QAAM,IAAI;AAAA,IACR,8BAA8B;AAAA,IAC9B,qBAAqB,KAAK;AAAA,EAI5B;AACF;AAEA,SAAS,6BACP,QACsB;AACtB,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAA8B,CAAC;AACrC,aAAW,QAAQ,QAAQ;AACzB,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG;AAC5D,UAAM,KAAK,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,CAAC;AAAA,EAC7F;AACA,SAAO;AACT;AAEA,SAAS,6BAA6B,QAAqE;AACzG,SAAO,6BAA6B,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;AACtE;AAOA,SAAS,yBAAyB,QAA+D;AAC/F,QAAM,SAA+B,CAAC;AACtC,QAAM,UAAU,oBAAI,IAAgC;AACpD,aAAW,SAAS,QAAQ;AAC1B,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,QAAQ,IAAI,KAAK,KAAK;AACvC,UAAI,CAAC,UAAU;AACb,cAAM,OAA2B,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,aAAa,KAAK;AACxF,gBAAQ,IAAI,KAAK,OAAO,IAAI;AAC5B,eAAO,KAAK,IAAI;AAChB;AAAA,MACF;AACA,UAAI,CAAC,SAAS,aAAa,KAAK,UAAW,UAAS,YAAY,KAAK;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAAoD;AACnF,QAAM,MAAM,IAAI,eAAe,IAAI;AACnC,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC/B,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,aAAO,MAAM,QAAQ,MAAM,IAAI,SAAiC,CAAC;AAAA,IACnE,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,SAAO,CAAC;AACV;AASO,SAAS,uBACd,UACA,UACA,UACe;AACf,SAAO,aAAa,WAAW,UAAU,QAAQ,KAAK,YAAY;AACpE;AAEA,SAAS,iBAAiB,IAAyC;AACjE,QAAM,SAAS;AACf,QAAM,OAAO,OAAO,gBAAgB;AACpC,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,YAAY,WAAY,QAAO;AACpD,SAAO;AACT;AAEO,MAAM,4BAA4B;AAAA,EAiBvC,YACU,IACR,MAKA;AANQ;AATV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,uBAAuB,4BAA4B;AACpE,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAWvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AACzC,SAAK,oBAAoB,IAAI;AAAA,OAC1B,MAAM,yBAAyB,CAAC,GAC9B,OAAO,CAAC,QAAQ,IAAI,aAAa,QAAQ,EACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC;AAAA,IACrC;AAAA,EACF;AAAA,EA/BA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,6BAA6B,oBAAI,IAAyD;AAAA;AAAA,EACzG;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,qBAAqB,oBAAI,IAAuC;AAAA;AAAA,EAC/E;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EA4BzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEQ,aAAa,KAAyB;AAC5C,WAAO,KAAK,IAAI,IAAI,IAAI,YAAY;AAAA,EACtC;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,UAAU,CAAC,KAAK,aAAa,MAAM,EAAG,QAAO;AACjD,QAAI,OAAQ,MAAK,SAAS,OAAO,QAAQ;AACzC,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACZ,UACA,SAC2B;AAC3B,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,SAAS,oBAAoB,MAAO,QAAO;AAC/C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AAIvE,UAAM,UAAU,KAAK,aAAa,IAAI,QAAQ;AAC9C,QAAI,QAAS,QAAO;AACpB,UAAM,YAAY,YAAY;AAC5B,YAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,UAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,aAAO,WAAW;AAAA,IACpB,GAAG;AACH,SAAK,aAAa,IAAI,UAAU,QAAQ;AACxC,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AACA,WAAK,aAAa,OAAO,QAAQ;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAO,iBAAiB,KAAK,EAAE;AACrC,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,UAAU,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,MAAM,WAC5E,KAAK,CAAC,IACN;AACJ,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,OAAO,IAAI,aAAa,IAAI,YAAY,IAAI,QAAQ;AAAA,MAC9D,QAAQ,wBAAwB,GAAG;AAAA,IACrC;AAAA,EACF;AAAA,EAEQ,mBAAmB,QAAoC,UAA8C;AAC3G,UAAM,WAAW,KAAK,kBAAkB,IAAI,QAAQ;AACpD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAA+B,SAAS,OAAO,IAAI,CAAC,WAAW;AAAA,MACnE,OAAO,MAAM;AAAA,MACb,WAAW,MAAM,aAAa;AAAA,IAChC,EAAE;AACF,UAAM,iBAAiB,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AACjE,eAAW,SAAS,QAAQ,UAAU,CAAC,GAAG;AACxC,UAAI,CAAC,eAAe,IAAI,MAAM,KAAK,EAAG,QAAO,KAAK,KAAK;AAAA,IACzD;AACA,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO,KAAK,mBAAmB,UAAU,IAAI,QAAQ;AAAA,MACrE;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO,KAAK,mBAAmB,KAAK,IAAI,QAAQ;AACzD,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO,KAAK,mBAAmB,QAA+B,IAAI,QAAQ;AAAA,MACxF;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO,KAAK,mBAAmB,QAAQ,IAAI,QAAQ;AAAA,IACrD;AACA,WAAO,KAAK,mBAAmB,MAAM,IAAI,QAAQ;AAAA,EACnD;AAAA,EAEA,MAAc,+BACZ,UACA,UAC+B;AAC/B,UAAM,OAAO,iBAAiB,KAAK,EAAE;AACrC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,UAAU,QAAQ,CAAC;AACzD,QAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,EAAG,QAAO,CAAC;AACvD,UAAM,SAAiC,CAAC;AACxC,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,aAAO,KAAK,6BAA6B,wBAAwB,GAA8B,CAAC,CAAC;AAAA,IACnG;AACA,WAAO,yBAAyB,MAAM;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,6BACZ,UACA,UAC+B;AAC/B,UAAM,MAAM,yBAAyB,UAAU,QAAQ;AACvD,UAAM,gBAAgB,KAAK,UAAU,IAAI,GAAG;AAC5C,QAAI,eAAe;AACjB,UAAI,gBAAgB,KAAK,IAAI,EAAG,QAAO,CAAC;AACxC,WAAK,UAAU,OAAO,GAAG;AAAA,IAC3B;AACA,UAAM,MAAM,KAAK,qBAAqB,IAAI,GAAG;AAC7C,QAAI,KAAK;AACP,UAAI,IAAI,KAAK,yBAAyB,KAAK,IAAI,EAAG,QAAO,IAAI,OAAO;AACpE,WAAK,qBAAqB,OAAO,GAAG;AAAA,IACtC;AACA,QAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,YAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,UAAI,QAAQ;AACV,cAAM,SAAS;AACf,aAAK,qBAAqB,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;AAC7D,eAAO,OAAO;AAAA,MAChB;AAAA,IACF;AACA,UAAM,WAAW,KAAK,aAAa,IAAI,GAAG;AAC1C,QAAI,SAAU,SAAQ,MAAM,WAAW,UAAU,CAAC;AAClD,UAAM,WAAW,YAAiD;AAChE,YAAM,SAAS,MAAM,KAAK,+BAA+B,UAAU,QAAQ;AAC3E,aAAO,OAAO,SAAS,EAAE,UAAU,OAAO,IAAI;AAAA,IAChD,GAAG;AACH,SAAK,aAAa,IAAI,KAAK,OAAO;AAClC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM;AAAA,IACjB,UAAE;AACA,WAAK,aAAa,OAAO,GAAG;AAAA,IAC9B;AACA,QAAI,CAAC,QAAQ;AACX,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AACpD,aAAO,CAAC;AAAA,IACV;AACA,SAAK,UAAU,OAAO,GAAG;AACzB,SAAK,qBAAqB,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,GAAG,QAAQ,OAAO,CAAC;AACrE,QAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,YAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,IAChD;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,0BACZ,UACA,UACA,gBACA,KAC+B;AAC/B,UAAM,WAAW,6BAA6B,KAAK,MAAM;AACzD,QAAI,kBAAkB,KAAM,QAAO;AACnC,WAAO,yBAAyB,CAAC,UAAU,MAAM,KAAK,6BAA6B,UAAU,QAAQ,CAAC,CAAC;AAAA,EACzG;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,OAAO,CAAC,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC,GAAG,yBAAyB,UAAU,QAAQ,CAAC;AAC5G,eAAW,OAAO,MAAM;AACtB,WAAK,YAAY,OAAO,GAAG;AAC3B,WAAK,qBAAqB,OAAO,GAAG;AACpC,WAAK,aAAa,OAAO,GAAG;AAC5B,WAAK,UAAU,OAAO,GAAG;AACzB,UAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,cAAO,KAAK,MAAc,OAAO,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc,UAAwB;AACpC,SAAK,SAAS,OAAO,QAAQ;AAC7B,SAAK,aAAa,OAAO,QAAQ;AACjC,SAAK,IAAI,gBAAgB,QAAQ;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,uBACJ,UACA,UACA,gBACA,SACmB;AACnB,QAAI,SAAS,qBAAqB;AAChC,UAAI,CAAC,8BAA8B,EAAG,QAAO,CAAC;AAAA,IAChD,WAAW,CAAC,KAAK,UAAU,GAAG;AAC5B,aAAO,CAAC;AAAA,IACV;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB;AAAA,IACF;AACA,WAAO,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK;AAAA,EACxC;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAI3C,UAAI,mBAAmB,OAAO,GAAG,EAAG;AAUpC,qCAA+B,OAAO,KAAK,KAAK;AAChD,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AAKxB,YAAM,GAAG,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,qBACJ,UACA,SACA,UACA,gBACA,SACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,QAAQ;AAClB,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,uBAAuB,UAAU,KAAK,UAAU,QAAQ;AACtE,UAAM,MAAM,MAAM,KAAK,qBAAqB,OAAO,EAAE,iBAAiB,SAAS,qBAAqB,MAAM,CAAC;AAC3G,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,UAAU,UAAU,KAAK,YAAY,SAAS,CAAC;AAC3F,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,OAAO,OAAO,CAAC;AACxF,WAAO,KAAK,cAAc,SAAS,QAAQ,GAAG;AAAA,EAChD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB;AAAA,IACF;AACA,QAAI,CAAC,OAAO,QAAQ;AAClB,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,uBAAuB,UAAU,KAAK,UAAU,QAAQ;AACtE,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK;AACnC,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,UAAU,UAAU,KAAK,YAAY,SAAS,CAAC;AAC3F,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,OAAO,OAAO,CAAC;AACxF,WAAO,KAAK,cAAc,SAAS,QAAQ,GAAG;AAAA,EAChD;AACF;",
-  "names": ["pending"]
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport {\n  TenantDataEncryptionError,\n  TenantDataEncryptionErrorCode,\n  decryptWithAesGcm,\n  encryptWithAesGcm,\n  hashForLookup,\n  isEncryptedPayloadShape,\n} from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { createLogger } from '../logger'\nimport {\n  getEncryptionPolicyMemo,\n  invalidateEncryptionPolicyMemos,\n  type ResolvedEncryptionPolicy,\n} from './policyMemo'\nimport type { EncryptionKeyScope, ModuleEncryptionMap } from '../../modules/encryption'\n\nconst logger = createLogger('shared').child({ component: 'tenant-encryption' })\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  keyScope?: EncryptionKeyScope\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype SqlConnection = {\n  execute(sql: string, params?: readonly unknown[]): Promise<unknown>\n}\n\n// Mirror the Vault KMS default DEK TTL so a rotated/revoked tenant key is picked\n// up by long-lived processes without a restart (#2746). The service-level cache\n// previously had no TTL and shadowed the KMS's own 15-minute expiry.\nconst DEK_CACHE_TTL_MS = 15 * 60 * 1000\n\nfunction readScopeId(row: Record<string, unknown>, column: string, property: string): string | null {\n  const value = row[column] ?? row[property]\n  return value == null ? null : String(value).toLowerCase()\n}\n\nfunction sameScopeId(value: string | null, expected: string | null): boolean {\n  return value === (expected == null ? null : expected.toLowerCase())\n}\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\n/**\n * @deprecated Nothing reads this key: encryption policy is resolved from the canonical table and\n * `invalidateMap` no longer publishes a version token. Kept for import compatibility.\n */\nexport function encryptionMapPolicyVersionCacheKey(entityId: string): string {\n  return ['encmap-policy-version', entityId.toLowerCase()].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    logger.debug(event, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n *\n * NOTE (issue #1810 follow-up): `decryptFields` no longer calls this helper for\n * entity-field decryption \u2014 typed string columns whose contents happen to look\n * like JSON (e.g. a display name `{\"a\":1}`) must remain raw strings to avoid\n * downstream React-render crashes. Callers that legitimately need the parse\n * (audit-log jsonb columns, custom-field rotation, encryption CLI) MUST invoke\n * `parseDecryptedFieldValue` themselves on the decrypted payload.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\n/**\n * A value is only treated as \"already encrypted\" when it actually decrypts\n * under the tenant DEK \u2014 i.e. the AES-GCM authentication tag verifies. A purely\n * structural `<iv>:<ct>:<tag>:v1` shape check is forgeable: attacker-controlled\n * field values (e.g. their own profile email/phone) could impersonate ciphertext\n * to skip encryption-at-rest and the lookup hash entirely (issue #2720). Binding\n * the check to a successful authenticated decrypt makes forgery infeasible, so a\n * fake payload simply gets encrypted like any other plaintext.\n */\nfunction isEncryptedWithDek(value: unknown, dek: TenantDek): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  if (parts.length !== 4 || parts[3] !== 'v1') return false\n  return decryptWithAesGcm(value, dek.key) !== null\n}\n\n/**\n * Guard the encrypt path against re-wrapping ciphertext this process cannot open.\n *\n * Called only after {@link isEncryptedWithDek} has already said \"not sealed under the\n * current DEK\". At that point a structurally well-formed envelope means one of two things:\n * genuine ciphertext under some other key, or a length-valid forgery \u2014 the shape check is\n * length-based, not content-based, so any length-correct string qualifies, not just a\n * byte-exact match against something real. Both must stop the write \u2014 the first because\n * nesting envelopes silently destroys recoverable data, the second because rejecting it is\n * strictly safer than persisting attacker-chosen bytes.\n *\n * The field name is safe to report (it comes from the encryption map, not user input); the\n * value never is, so it stays out of both the error message and the log.\n */\nfunction assertNotSealedUnderAnotherKey(value: unknown, field: string): void {\n  if (!isEncryptedPayloadShape(value)) return\n  logger.error('Refusing to re-encrypt a value sealed under a different key', { field })\n  throw new TenantDataEncryptionError(\n    TenantDataEncryptionErrorCode.WRONG_KEY,\n    `[internal] Field \"${field}\" already holds an encrypted payload that does not decrypt under the current tenant DEK. `\n      + 'Encrypting it again would produce an unreadable nested envelope. '\n      + 'Complete the key rotation for this tenant (mercato entities rotate-encryption-key --old-key \u2026) '\n      + 'or restore the DEK that sealed it before writing this record again.',\n  )\n}\n\nfunction normalizeEncryptedFieldRules(\n  fields: readonly { field?: unknown; hashField?: unknown }[] | null | undefined,\n): EncryptedFieldRule[] {\n  if (!Array.isArray(fields)) return []\n  const rules: EncryptedFieldRule[] = []\n  for (const rule of fields) {\n    if (!rule || typeof rule !== 'object') continue\n    const field = rule.field\n    if (typeof field !== 'string' || field.trim().length === 0) continue\n    rules.push({ field, hashField: typeof rule.hashField === 'string' ? rule.hashField : null })\n  }\n  return rules\n}\n\nfunction normalizeEncryptedFieldNames(fields: readonly { field?: unknown }[] | null | undefined): string[] {\n  return normalizeEncryptedFieldRules(fields).map((rule) => rule.field)\n}\n\n/**\n * Union of field rules, first declaration wins on the field name. A later duplicate only\n * contributes its `hashField` when the winning rule declares none, so merging an organization-scoped\n * map into a tenant-wide one never silently retargets an existing lookup-hash column.\n */\nfunction mergeEncryptedFieldRules(groups: readonly EncryptedFieldRule[][]): EncryptedFieldRule[] {\n  const merged: EncryptedFieldRule[] = []\n  const byField = new Map<string, EncryptedFieldRule>()\n  for (const group of groups) {\n    for (const rule of group) {\n      const existing = byField.get(rule.field)\n      if (!existing) {\n        const copy: EncryptedFieldRule = { field: rule.field, hashField: rule.hashField ?? null }\n        byField.set(rule.field, copy)\n        merged.push(copy)\n        continue\n      }\n      if (!existing.hashField && rule.hashField) existing.hashField = rule.hashField\n    }\n  }\n  return merged\n}\n\nfunction readEncryptedFieldsJson(row: Record<string, unknown>): EncryptedFieldRule[] {\n  const raw = row.fields_json ?? row.fieldsJson\n  if (Array.isArray(raw)) return raw as EncryptedFieldRule[]\n  if (typeof raw === 'string') {\n    try {\n      const parsed = JSON.parse(raw)\n      return Array.isArray(parsed) ? parsed as EncryptedFieldRule[] : []\n    } catch {\n      return []\n    }\n  }\n  return []\n}\n\n/**\n * The KMS key id an encryption map's payloads are sealed under: a system-scoped map\n * uses a per-entity key that exists before any tenant does, everything else uses the\n * tenant's own key. Exported so callers that need to probe key availability without\n * encrypting (the encryption CLIs) derive the same id instead of re-spelling the\n * `system:` convention (#5950).\n */\nexport function resolveEncryptionKeyId(\n  entityId: string,\n  keyScope: EncryptionKeyScope | undefined,\n  tenantId: string | null | undefined\n): string | null {\n  return keyScope === 'system' ? `system:${entityId}` : tenantId ?? null\n}\n\n/**\n * Runs a map lookup on an EntityManager rather than on `em.getConnection()`.\n *\n * `AbstractSqlConnection.execute` falls back to the pool whenever it is handed no\n * transaction context, so the connection-level call takes a SECOND pooled\n * connection while the caller already holds one for its open write transaction.\n * Policy resolution is not cached across units of work and runs for every\n * encrypt/decrypt decision that misses the per-unit-of-work memo, so under\n * concurrency every in-flight write waits on a connection that only another\n * waiting write could release \u2014 the pool deadlocks at `DB_POOL_MAX` and never\n * recovers. `SqlEntityManager.execute` forwards `getTransactionContext()`, so the\n * lookup reuses the caller's own connection, provided callers hand in the\n * EntityManager that owns the transaction (the flush subscriber passes\n * `args.em`). Reading the policy inside that transaction is also what an atomic,\n * transaction-aware map write needs.\n */\nfunction getSqlExecutor(em: EntityManager): SqlConnection | null {\n  const candidate = em as unknown as { execute?: unknown }\n  if (typeof candidate.execute !== 'function') return null\n  return candidate as unknown as SqlConnection\n}\n\nexport class TenantDataEncryptionService {\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalInflightDeks = new Map<string, Promise<TenantDek | null>>()\n  private readonly kms: KmsService\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightDeks = TenantDataEncryptionService.globalInflightDeks\n  private readonly systemDefaultMaps: Map<string, ModuleEncryptionMap>\n\n  constructor(\n    private em: EntityManager,\n    opts?: {\n      /** Accepted for compatibility; encryption policy is never cached across units of work. */\n      cache?: CacheStrategy\n      kms?: KmsService\n      defaultEncryptionMaps?: readonly ModuleEncryptionMap[]\n    }\n  ) {\n    this.kms = opts?.kms ?? createKmsService()\n    this.systemDefaultMaps = new Map(\n      (opts?.defaultEncryptionMaps ?? [])\n        .filter((map) => map.keyScope === 'system')\n        .map((map) => [map.entityId, map]),\n    )\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  private isDekExpired(dek: TenantDek): boolean {\n    return Date.now() - dek.fetchedAt > DEK_CACHE_TTL_MS\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached && !this.isDekExpired(cached)) return cached\n    if (cached) this.dekCache.delete(tenantId)\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  /**\n   * Resolves the DEK an encrypt call should seal under, provisioning one when the\n   * tenant has none yet.\n   *\n   * Provisioning writes real key material to the KMS/Vault backend, so it is a\n   * state change \u2014 not a cache fill. Callers whose intent is only to preview or\n   * check (\"would this row be encrypted?\") pass `createIfMissing: false` to get a\n   * `null` instead, leaving KMS untouched (issue #5950). The default stays `true`\n   * so every existing write path keeps provisioning on first use.\n   */\n  private async resolveDekForEncrypt(\n    tenantId: string | null,\n    options?: { createIfMissing?: boolean }\n  ): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (options?.createIfMissing === false) return null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    // Dedupe concurrent first-time creation within this process so two callers\n    // can't each generate a distinct DEK and overwrite one another (#2746).\n    const pending = this.inflightDeks.get(tenantId)\n    if (pending) return pending\n    const creation = (async () => {\n      const created = await this.kms.createTenantDek(tenantId)\n      if (created) this.dekCache.set(tenantId, created)\n      return created ?? null\n    })()\n    this.inflightDeks.set(tenantId, creation)\n    try {\n      return await creation\n    } finally {\n      this.inflightDeks.delete(tenantId)\n    }\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  /**\n   * Reads every row that can decide the policy for `key` in ONE statement: the exact scope, the\n   * tenant-wide scope, and the global scope \u2014 plus, at the tenant-wide scope, every\n   * organization-scoped map of the tenant for the all-organizations aggregate (#5949). Precedence\n   * and duplicate merging happen in JS so the result is identical to resolving the fallback chain\n   * one scope at a time.\n   */\n  private async loadPolicy(key: MapCacheKey, em?: EntityManager): Promise<ResolvedEncryptionPolicy> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn = getSqlExecutor(em ?? this.em)\n    if (!conn) {\n      throw new Error('[internal] Encryption policy lookup requires an EntityManager that can execute SQL')\n    }\n    const includeAllOrganizations = key.organizationId == null\n    const scopeClause = includeAllOrganizations\n      ? 'tenant_id is not distinct from ?'\n      : '(tenant_id is not distinct from ? and (organization_id = ? or organization_id is null))'\n    const sql = `\n      select entity_id, tenant_id, organization_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and is_active = true\n        and deleted_at is null\n        and (${scopeClause} or (tenant_id is null and organization_id is null))\n      order by organization_id asc, created_at asc, id asc\n    `\n    const params = includeAllOrganizations\n      ? [key.entityId, key.tenantId]\n      : [key.entityId, key.tenantId, key.organizationId]\n    const rows = await conn.execute(sql, params)\n    const records = Array.isArray(rows)\n      ? rows.filter((row): row is Record<string, unknown> => Boolean(row) && typeof row === 'object')\n      : []\n\n    const map = this.applySystemDefault(this.pickMostSpecificMap(key, records), key.entityId)\n    const mapRules = normalizeEncryptedFieldRules(map?.fields)\n    if (!includeAllOrganizations) return { map, fields: mapRules }\n    const organizationRows = records.filter((record) => (\n      sameScopeId(readScopeId(record, 'tenant_id', 'tenantId'), key.tenantId)\n      && readScopeId(record, 'organization_id', 'organizationId') !== null\n    ))\n    const organizationRules = mergeEncryptedFieldRules(\n      organizationRows.map((record) => normalizeEncryptedFieldRules(readEncryptedFieldsJson(record))),\n    )\n    return { map, fields: mergeEncryptedFieldRules([mapRules, organizationRules]) }\n  }\n\n  private pickMostSpecificMap(key: MapCacheKey, records: Record<string, unknown>[]): EncryptionMapRecord | null {\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const matches = records.filter((record) => (\n        sameScopeId(readScopeId(record, 'tenant_id', 'tenantId'), candidate.tenantId)\n        && sameScopeId(readScopeId(record, 'organization_id', 'organizationId'), candidate.organizationId)\n      ))\n      if (!matches.length) {\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      if (matches.length > 1) {\n        logger.warn('Duplicate live encryption maps detected; merging field rules fail-safe', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n          count: matches.length,\n        })\n      }\n      return {\n        entityId: String(matches[0].entity_id ?? matches[0].entityId ?? key.entityId),\n        fields: mergeEncryptedFieldRules(matches.map((record) => normalizeEncryptedFieldRules(readEncryptedFieldsJson(record)))),\n      }\n    }\n    return null\n  }\n\n  private applySystemDefault(record: EncryptionMapRecord | null, entityId: string): EncryptionMapRecord | null {\n    const declared = this.systemDefaultMaps.get(entityId)\n    if (!declared) return record\n    const fields: EncryptedFieldRule[] = declared.fields.map((field) => ({\n      field: field.field,\n      hashField: field.hashField ?? null,\n    }))\n    const declaredFields = new Set(fields.map((field) => field.field))\n    for (const field of record?.fields ?? []) {\n      if (!declaredFields.has(field.field)) fields.push(field)\n    }\n    return {\n      entityId,\n      keyScope: 'system',\n      fields,\n    }\n  }\n\n  /**\n   * Resolve policy from the canonical table. Nothing is retained across units of work: no\n   * invalidation protocol can make process-local state authoritative after an independent worker\n   * commits a map mutation.\n   *\n   * Within one unit of work \u2014 the caller's EntityManager, or its open transaction \u2014 repeated\n   * decisions for the same scope share a single read, so loading N rows or running the before/after\n   * hooks of one flush costs one query instead of one per row and hook. That memo dies with the\n   * EntityManager/transaction, is dropped for the EntityManager that writes a map\n   * (`forgetEncryptionPolicyMemo`) and after its flush, and for every EntityManager when this\n   * process invalidates a map. Calls that do not hand in an EntityManager fall back to the\n   * long-lived service EntityManager and are never memoized.\n   */\n  private resolvePolicy(key: MapCacheKey, em?: EntityManager): Promise<ResolvedEncryptionPolicy> {\n    if (!em) return this.loadPolicy(key)\n    const memo = getEncryptionPolicyMemo(em)\n    const tag = cacheKey(key)\n    const pending = memo.get(tag)\n    if (pending) return pending\n    const loading = this.loadPolicy(key, em)\n    memo.set(tag, loading)\n    loading.catch(() => {\n      if (memo.get(tag) === loading) memo.delete(tag)\n    })\n    return loading\n  }\n\n  /**\n   * Drops the policy reads memoized by every EntityManager of this process. Map writers call it\n   * after their write commits; readers in other processes never depended on it, because policy is\n   * not cached across units of work.\n   */\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    debug('\u267B\uFE0F encmap.invalidate', { entityId, tenantId, organizationId })\n    invalidateEncryptionPolicyMemos()\n  }\n\n  // Force a flush of a tenant's cached DEK across the service-level cache and the\n  // underlying KMS cache so an operator can pick up a rotated/revoked key without\n  // a process restart (#2746).\n  invalidateDek(tenantId: string): void {\n    this.dekCache.delete(tenantId)\n    this.inflightDeks.delete(tenantId)\n    this.kms.invalidateDek?.(tenantId)\n  }\n\n  /**\n   * Lists the fields an encryption map marks as encrypted at rest.\n   *\n   * `isEnabled()` folds the environment toggle together with KMS health, so by default an\n   * unhealthy KMS reports \"nothing is encrypted\" \u2014 which is safe for write paths but wrong for\n   * readers that must decide whether a stored column holds ciphertext. `ignoreRuntimeHealth`\n   * answers the on-disk question instead: it consults the map even when the KMS cannot currently\n   * resolve a DEK, so callers can fail closed rather than treat ciphertext as plaintext (#4622).\n   */\n  async getEncryptedFieldNames(\n    entityId: string,\n    tenantId: string | null | undefined,\n    organizationId?: string | null,\n    options?: { ignoreRuntimeHealth?: boolean; em?: EntityManager }\n  ): Promise<string[]> {\n    if (options?.ignoreRuntimeHealth) {\n      if (!isTenantDataEncryptionEnabled()) return []\n    } else if (!this.isEnabled()) {\n      return []\n    }\n    const { fields } = await this.resolvePolicy(\n      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },\n      options?.em,\n    )\n    return fields.map((rule) => rule.field)\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n      // Avoid double-encrypting payloads that genuinely decrypt under this DEK.\n      // A forged ciphertext-shaped string fails this check and is encrypted as\n      // plaintext, closing the encryption-at-rest bypass (issue #2720).\n      if (isEncryptedWithDek(value, dek)) continue\n      // Failing that check does not prove the value is plaintext. A well-formed\n      // envelope sealed under a *different* key \u2014 the previous DEK mid-rotation, or\n      // the derived key the KMS falls back to during a Vault outage \u2014 lands here too,\n      // and encrypting it again would nest one envelope inside another: unreadable by\n      // any normal decrypt, indistinguishable from correct ciphertext by inspection,\n      // and it would overwrite the lookup hash with a hash of ciphertext (issue #5951).\n      // Fail the write closed instead. Nothing is ever stored verbatim, so #2720 stays\n      // shut: a forgery whose shape is not length-valid still gets encrypted as plaintext\n      // above, and a length-valid one is rejected rather than persisted.\n      assertNotSealedUnderAnotherKey(value, rule.field)\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      // Entity fields are typed columns (string/text). Never auto-parse to an object \u2014\n      // it triggers React-render crashes when a string value happens to be valid JSON\n      // (issue #1810 follow-up). Custom field values use a separate helper that\n      // preserves their typed-JSON contract.\n      clone[key] = decrypted\n    }\n    return clone\n  }\n\n  /**\n   * Encrypts the fields an entity's encryption map covers.\n   *\n   * `options.createMissingDek` (default `true`) controls whether a tenant without\n   * a DEK gets one provisioned as a side effect. Preview/check callers \u2014 most\n   * notably `mercato entities rotate-encryption-key --dry-run` \u2014 pass `false` so a\n   * read-only invocation cannot write key material to KMS (issue #5950). With\n   * `false` and no existing DEK the payload is returned unchanged, exactly as it\n   * is when the KMS declines to issue a key.\n   */\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null,\n    options?: { createMissingDek?: boolean; em?: EntityManager }\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const { map, fields } = await this.resolvePolicy(\n      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },\n      options?.em,\n    )\n    if (!fields.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    const keyId = resolveEncryptionKeyId(entityId, map?.keyScope, tenantId)\n    const dek = await this.resolveDekForEncrypt(keyId, { createIfMissing: options?.createMissingDek !== false })\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId, keyScope: map?.keyScope ?? 'tenant' })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: fields.length })\n    return this.encryptFields(payload, fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null,\n    options?: { em?: EntityManager }\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const { map, fields } = await this.resolvePolicy(\n      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },\n      options?.em,\n    )\n    if (!fields.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    const keyId = resolveEncryptionKeyId(entityId, map?.keyScope, tenantId)\n    const dek = await this.getDek(keyId)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId, keyScope: map?.keyScope ?? 'tenant' })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: fields.length })\n    return this.decryptFields(payload, fields, dek)\n  }\n}\n"],
+  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AACxE,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAGP,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,oBAAoB,CAAC;AA0B9E,MAAM,mBAAmB,KAAK,KAAK;AAEnC,SAAS,YAAY,KAA8B,QAAgB,UAAiC;AAClG,QAAM,QAAQ,IAAI,MAAM,KAAK,IAAI,QAAQ;AACzC,SAAO,SAAS,OAAO,OAAO,OAAO,KAAK,EAAE,YAAY;AAC1D;AAEA,SAAS,YAAY,OAAsB,UAAkC;AAC3E,SAAO,WAAW,YAAY,OAAO,OAAO,SAAS,YAAY;AACnE;AAEA,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAMO,SAAS,mCAAmC,UAA0B;AAC3E,SAAO,CAAC,yBAAyB,SAAS,YAAY,CAAC,EAAE,KAAK,GAAG;AACnE;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AACF,WAAO,MAAM,OAAO,OAAO;AAAA,EAC7B,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAqBO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,SAAS,mBAAmB,OAAgB,KAAyB;AACnE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,KAAM,QAAO;AACpD,SAAO,kBAAkB,OAAO,IAAI,GAAG,MAAM;AAC/C;AAgBA,SAAS,+BAA+B,OAAgB,OAAqB;AAC3E,MAAI,CAAC,wBAAwB,KAAK,EAAG;AACrC,SAAO,MAAM,+DAA+D,EAAE,MAAM,CAAC;AACrF,QAAM,IAAI;AAAA,IACR,8BAA8B;AAAA,IAC9B,qBAAqB,KAAK;AAAA,EAI5B;AACF;AAEA,SAAS,6BACP,QACsB;AACtB,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAA8B,CAAC;AACrC,aAAW,QAAQ,QAAQ;AACzB,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG;AAC5D,UAAM,KAAK,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,CAAC;AAAA,EAC7F;AACA,SAAO;AACT;AAEA,SAAS,6BAA6B,QAAqE;AACzG,SAAO,6BAA6B,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;AACtE;AAOA,SAAS,yBAAyB,QAA+D;AAC/F,QAAM,SAA+B,CAAC;AACtC,QAAM,UAAU,oBAAI,IAAgC;AACpD,aAAW,SAAS,QAAQ;AAC1B,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,QAAQ,IAAI,KAAK,KAAK;AACvC,UAAI,CAAC,UAAU;AACb,cAAM,OAA2B,EAAE,OAAO,KAAK,OAAO,WAAW,KAAK,aAAa,KAAK;AACxF,gBAAQ,IAAI,KAAK,OAAO,IAAI;AAC5B,eAAO,KAAK,IAAI;AAChB;AAAA,MACF;AACA,UAAI,CAAC,SAAS,aAAa,KAAK,UAAW,UAAS,YAAY,KAAK;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAAoD;AACnF,QAAM,MAAM,IAAI,eAAe,IAAI;AACnC,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC/B,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,aAAO,MAAM,QAAQ,MAAM,IAAI,SAAiC,CAAC;AAAA,IACnE,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,SAAO,CAAC;AACV;AASO,SAAS,uBACd,UACA,UACA,UACe;AACf,SAAO,aAAa,WAAW,UAAU,QAAQ,KAAK,YAAY;AACpE;AAkBA,SAAS,eAAe,IAAyC;AAC/D,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,YAAY,WAAY,QAAO;AACpD,SAAO;AACT;AAEO,MAAM,4BAA4B;AAAA,EAQvC,YACU,IACR,MAMA;AAPQ;AALV,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAY1D,SAAK,MAAM,MAAM,OAAO,iBAAiB;AACzC,SAAK,oBAAoB,IAAI;AAAA,OAC1B,MAAM,yBAAyB,CAAC,GAC9B,OAAO,CAAC,QAAQ,IAAI,aAAa,QAAQ,EACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC;AAAA,IACrC;AAAA,EACF;AAAA,EAtBA;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,qBAAqB,oBAAI,IAAuC;AAAA;AAAA,EAuB/E,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEQ,aAAa,KAAyB;AAC5C,WAAO,KAAK,IAAI,IAAI,IAAI,YAAY;AAAA,EACtC;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,UAAU,CAAC,KAAK,aAAa,MAAM,EAAG,QAAO;AACjD,QAAI,OAAQ,MAAK,SAAS,OAAO,QAAQ;AACzC,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACZ,UACA,SAC2B;AAC3B,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,SAAS,oBAAoB,MAAO,QAAO;AAC/C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AAGvE,UAAM,UAAU,KAAK,aAAa,IAAI,QAAQ;AAC9C,QAAI,QAAS,QAAO;AACpB,UAAM,YAAY,YAAY;AAC5B,YAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,UAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,aAAO,WAAW;AAAA,IACpB,GAAG;AACH,SAAK,aAAa,IAAI,UAAU,QAAQ;AACxC,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AACA,WAAK,aAAa,OAAO,QAAQ;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,WAAW,KAAkB,IAAuD;AAEhG,UAAM,OAAO,eAAe,MAAM,KAAK,EAAE;AACzC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,oFAAoF;AAAA,IACtG;AACA,UAAM,0BAA0B,IAAI,kBAAkB;AACtD,UAAM,cAAc,0BAChB,qCACA;AACJ,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAMD,WAAW;AAAA;AAAA;AAGtB,UAAM,SAAS,0BACX,CAAC,IAAI,UAAU,IAAI,QAAQ,IAC3B,CAAC,IAAI,UAAU,IAAI,UAAU,IAAI,cAAc;AACnD,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,MAAM;AAC3C,UAAM,UAAU,MAAM,QAAQ,IAAI,IAC9B,KAAK,OAAO,CAAC,QAAwC,QAAQ,GAAG,KAAK,OAAO,QAAQ,QAAQ,IAC5F,CAAC;AAEL,UAAM,MAAM,KAAK,mBAAmB,KAAK,oBAAoB,KAAK,OAAO,GAAG,IAAI,QAAQ;AACxF,UAAM,WAAW,6BAA6B,KAAK,MAAM;AACzD,QAAI,CAAC,wBAAyB,QAAO,EAAE,KAAK,QAAQ,SAAS;AAC7D,UAAM,mBAAmB,QAAQ,OAAO,CAAC,WACvC,YAAY,YAAY,QAAQ,aAAa,UAAU,GAAG,IAAI,QAAQ,KACnE,YAAY,QAAQ,mBAAmB,gBAAgB,MAAM,IACjE;AACD,UAAM,oBAAoB;AAAA,MACxB,iBAAiB,IAAI,CAAC,WAAW,6BAA6B,wBAAwB,MAAM,CAAC,CAAC;AAAA,IAChG;AACA,WAAO,EAAE,KAAK,QAAQ,yBAAyB,CAAC,UAAU,iBAAiB,CAAC,EAAE;AAAA,EAChF;AAAA,EAEQ,oBAAoB,KAAkB,SAAgE;AAC5G,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,UAAU,gBAAgB,KAAK;AAAA,MACvE,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,UAAU,QAAQ,OAAO,CAAC,WAC9B,YAAY,YAAY,QAAQ,aAAa,UAAU,GAAG,UAAU,QAAQ,KACzE,YAAY,YAAY,QAAQ,mBAAmB,gBAAgB,GAAG,UAAU,cAAc,CAClG;AACD,UAAI,CAAC,QAAQ,QAAQ;AACnB,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,UAAI,QAAQ,SAAS,GAAG;AACtB,eAAO,KAAK,0EAA0E;AAAA,UACpF,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,UAC1B,OAAO,QAAQ;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,UAAU,OAAO,QAAQ,CAAC,EAAE,aAAa,QAAQ,CAAC,EAAE,YAAY,IAAI,QAAQ;AAAA,QAC5E,QAAQ,yBAAyB,QAAQ,IAAI,CAAC,WAAW,6BAA6B,wBAAwB,MAAM,CAAC,CAAC,CAAC;AAAA,MACzH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,mBAAmB,QAAoC,UAA8C;AAC3G,UAAM,WAAW,KAAK,kBAAkB,IAAI,QAAQ;AACpD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAA+B,SAAS,OAAO,IAAI,CAAC,WAAW;AAAA,MACnE,OAAO,MAAM;AAAA,MACb,WAAW,MAAM,aAAa;AAAA,IAChC,EAAE;AACF,UAAM,iBAAiB,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AACjE,eAAW,SAAS,QAAQ,UAAU,CAAC,GAAG;AACxC,UAAI,CAAC,eAAe,IAAI,MAAM,KAAK,EAAG,QAAO,KAAK,KAAK;AAAA,IACzD;AACA,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeQ,cAAc,KAAkB,IAAuD;AAC7F,QAAI,CAAC,GAAI,QAAO,KAAK,WAAW,GAAG;AACnC,UAAM,OAAO,wBAAwB,EAAE;AACvC,UAAM,MAAM,SAAS,GAAG;AACxB,UAAM,UAAU,KAAK,IAAI,GAAG;AAC5B,QAAI,QAAS,QAAO;AACpB,UAAM,UAAU,KAAK,WAAW,KAAK,EAAE;AACvC,SAAK,IAAI,KAAK,OAAO;AACrB,YAAQ,MAAM,MAAM;AAClB,UAAI,KAAK,IAAI,GAAG,MAAM,QAAS,MAAK,OAAO,GAAG;AAAA,IAChD,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,kCAAwB,EAAE,UAAU,UAAU,eAAe,CAAC;AACpE,oCAAgC;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc,UAAwB;AACpC,SAAK,SAAS,OAAO,QAAQ;AAC7B,SAAK,aAAa,OAAO,QAAQ;AACjC,SAAK,IAAI,gBAAgB,QAAQ;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,uBACJ,UACA,UACA,gBACA,SACmB;AACnB,QAAI,SAAS,qBAAqB;AAChC,UAAI,CAAC,8BAA8B,EAAG,QAAO,CAAC;AAAA,IAChD,WAAW,CAAC,KAAK,UAAU,GAAG;AAC5B,aAAO,CAAC;AAAA,IACV;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,KAAK;AAAA,MAC5B,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK;AAAA,MAC/E,SAAS;AAAA,IACX;AACA,WAAO,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK;AAAA,EACxC;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAI3C,UAAI,mBAAmB,OAAO,GAAG,EAAG;AAUpC,qCAA+B,OAAO,KAAK,KAAK;AAChD,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AAKxB,YAAM,GAAG,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,qBACJ,UACA,SACA,UACA,gBACA,SACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,EAAE,KAAK,OAAO,IAAI,MAAM,KAAK;AAAA,MACjC,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK;AAAA,MAC/E,SAAS;AAAA,IACX;AACA,QAAI,CAAC,OAAO,QAAQ;AAClB,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,uBAAuB,UAAU,KAAK,UAAU,QAAQ;AACtE,UAAM,MAAM,MAAM,KAAK,qBAAqB,OAAO,EAAE,iBAAiB,SAAS,qBAAqB,MAAM,CAAC;AAC3G,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,UAAU,UAAU,KAAK,YAAY,SAAS,CAAC;AAC3F,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,OAAO,OAAO,CAAC;AACxF,WAAO,KAAK,cAAc,SAAS,QAAQ,GAAG;AAAA,EAChD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACA,SACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,EAAE,KAAK,OAAO,IAAI,MAAM,KAAK;AAAA,MACjC,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK;AAAA,MAC/E,SAAS;AAAA,IACX;AACA,QAAI,CAAC,OAAO,QAAQ;AAClB,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,uBAAuB,UAAU,KAAK,UAAU,QAAQ;AACtE,UAAM,MAAM,MAAM,KAAK,OAAO,KAAK;AACnC,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,UAAU,UAAU,KAAK,YAAY,SAAS,CAAC;AAC3F,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,OAAO,OAAO,CAAC;AACxF,WAAO,KAAK,cAAc,SAAS,QAAQ,GAAG;AAAA,EAChD;AACF;",
+  "names": []
 }