@proteinjs/db 1.35.1 → 1.36.0

package/dist/src/encryption/EncryptionLifecycleWalker.js

@@ -0,0 +1,343 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionLifecycleWalker = void 0;
+var db_query_1 = require("@proteinjs/db-query");
+var logger_1 = require("@proteinjs/logger");
+var EncryptedColumns_1 = require("./EncryptedColumns");
+var EncryptionEnvelope_1 = require("./EncryptionEnvelope");
+var DataKeyStore_1 = require("./DataKeyStore");
+/**
+ * The reusable ONLINE backfill behind every encrypted-column config transition (and key
+ * rotation) — the migration-runner pattern: a server-side, id-ordered, windowed table walk
+ * that rewrites pending rows THROUGH the normal write seam (so encryption, companions, and
+ * search tokens all derive exactly as a live write would).
+ *
+ * Idempotent and resumable by construction: pending-ness is detected from the stored value
+ * itself (envelope or not, version current or not), so a re-run — after a crash, or just to
+ * be sure — skips completed rows and continues. Rows written by live traffic mid-walk are
+ * already in the new shape and skip too. Run it from a `Migration.run()` for deploy-coupled
+ * transitions.
+ */
+var EncryptionLifecycleWalker = /** @class */ (function () {
+    function EncryptionLifecycleWalker() {
+        this.logger = new logger_1.Logger({ name: this.constructor.name });
+        this.encryptedColumns = new EncryptedColumns_1.EncryptedColumns();
+        this.envelope = new EncryptionEnvelope_1.EncryptionEnvelope();
+    }
+    EncryptionLifecycleWalker.prototype.walkTable = function (table, mode, options) {
+        var _a, _b, _c;
+        if (options === void 0) { options = {}; }
+        return __awaiter(this, void 0, void 0, function () {
+            var props, _d, Db, getDbAsSystem, dbDriver, db, windowSize, columnNames, activeVersionByOwner, summary, cursor, rawRows, _i, rawRows_1, rawRow, pendingProps, _e, columnNames_1, _f, prop, columnName;
+            return __generator(this, function (_g) {
+                switch (_g.label) {
+                    case 0:
+                        this.encryptedColumns.ensureSchema(table);
+                        props = this.resolveProps(table, mode, options);
+                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require('../Db')); })];
+                    case 1:
+                        _d = _g.sent(), Db = _d.Db, getDbAsSystem = _d.getDbAsSystem;
+                        dbDriver = (_a = options.dbDriver) !== null && _a !== void 0 ? _a : Db.getDefaultDbDriver();
+                        db = (_b = options.db) !== null && _b !== void 0 ? _b : getDbAsSystem();
+                        windowSize = (_c = options.windowSize) !== null && _c !== void 0 ? _c : EncryptionLifecycleWalker.DEFAULT_WINDOW_SIZE;
+                        columnNames = props.map(function (prop) { return ({
+                            prop: prop,
+                            columnName: table.columns[prop].name,
+                        }); });
+                        activeVersionByOwner = new Map();
+                        summary = { scanned: 0, rewritten: 0 };
+                        cursor = options.startAfterId;
+                        _g.label = 2;
+                    case 2:
+                        if (!true) return [3 /*break*/, 12];
+                        return [4 /*yield*/, this.rawWindow(table, dbDriver, columnNames, cursor, windowSize)];
+                    case 3:
+                        rawRows = _g.sent();
+                        if (rawRows.length === 0) {
+                            return [3 /*break*/, 12];
+                        }
+                        _i = 0, rawRows_1 = rawRows;
+                        _g.label = 4;
+                    case 4:
+                        if (!(_i < rawRows_1.length)) return [3 /*break*/, 11];
+                        rawRow = rawRows_1[_i];
+                        summary.scanned++;
+                        pendingProps = [];
+                        _e = 0, columnNames_1 = columnNames;
+                        _g.label = 5;
+                    case 5:
+                        if (!(_e < columnNames_1.length)) return [3 /*break*/, 8];
+                        _f = columnNames_1[_e], prop = _f.prop, columnName = _f.columnName;
+                        return [4 /*yield*/, this.isPending(mode, rawRow[columnName], activeVersionByOwner)];
+                    case 6:
+                        if (_g.sent()) {
+                            pendingProps.push(prop);
+                        }
+                        _g.label = 7;
+                    case 7:
+                        _e++;
+                        return [3 /*break*/, 5];
+                    case 8:
+                        if (pendingProps.length === 0) {
+                            return [3 /*break*/, 10];
+                        }
+                        return [4 /*yield*/, this.rewriteRow(table, db, rawRow['id'], pendingProps)];
+                    case 9:
+                        _g.sent();
+                        summary.rewritten++;
+                        _g.label = 10;
+                    case 10:
+                        _i++;
+                        return [3 /*break*/, 4];
+                    case 11:
+                        cursor = rawRows[rawRows.length - 1]['id'];
+                        if (rawRows.length < windowSize) {
+                            return [3 /*break*/, 12];
+                        }
+                        return [3 /*break*/, 2];
+                    case 12:
+                        if (!(mode === 'decrypt')) return [3 /*break*/, 14];
+                        return [4 /*yield*/, this.sweepTokenRows(table, db, columnNames.map(function (_a) {
+                                var columnName = _a.columnName;
+                                return columnName;
+                            }))];
+                    case 13:
+                        _g.sent();
+                        _g.label = 14;
+                    case 14:
+                        this.logger.info({
+                            message: "Encryption lifecycle walk finished",
+                            obj: __assign({ table: table.name, mode: mode }, summary),
+                        });
+                        return [2 /*return*/, summary];
+                }
+            });
+        });
+    };
+    EncryptionLifecycleWalker.prototype.isPending = function (mode, rawValue, activeVersionByOwner) {
+        return __awaiter(this, void 0, void 0, function () {
+            var parsed, _a, activeVersion;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        if (rawValue === null || typeof rawValue === 'undefined') {
+                            return [2 /*return*/, false];
+                        }
+                        parsed = this.envelope.parse(rawValue);
+                        _a = mode;
+                        switch (_a) {
+                            case 'encrypt': return [3 /*break*/, 1];
+                            case 'retokenize': return [3 /*break*/, 2];
+                            case 'decrypt': return [3 /*break*/, 3];
+                            case 'rotate-keys': return [3 /*break*/, 4];
+                        }
+                        return [3 /*break*/, 7];
+                    case 1: return [2 /*return*/, !parsed];
+                    case 2: return [2 /*return*/, true];
+                    case 3: return [2 /*return*/, !!parsed];
+                    case 4:
+                        if (!parsed) {
+                            return [2 /*return*/, true]; // plaintext straggler — encrypt under the current key
+                        }
+                        activeVersion = activeVersionByOwner.get(parsed.owner);
+                        if (!(typeof activeVersion === 'undefined')) return [3 /*break*/, 6];
+                        return [4 /*yield*/, new DataKeyStore_1.DataKeyStore().getWriteKey(parsed.owner)];
+                    case 5:
+                        activeVersion = (_b.sent()).version;
+                        activeVersionByOwner.set(parsed.owner, activeVersion);
+                        _b.label = 6;
+                    case 6: return [2 /*return*/, parsed.version < activeVersion];
+                    case 7: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Rewrite one row through the normal seam: read it (the deserialize hook decrypts — or
+     * passes plaintext through, the adoption path), write the pending columns back (the
+     * serialize hook re-derives ciphertext, companions, and tokens under the current config).
+     */
+    EncryptionLifecycleWalker.prototype.rewriteRow = function (table, db, id, pendingProps) {
+        return __awaiter(this, void 0, void 0, function () {
+            var row, payload, _i, pendingProps_1, prop;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, db.get(table, { id: id })];
+                    case 1:
+                        row = _a.sent();
+                        if (!row) {
+                            return [2 /*return*/]; // deleted mid-walk
+                        }
+                        payload = { id: id };
+                        for (_i = 0, pendingProps_1 = pendingProps; _i < pendingProps_1.length; _i++) {
+                            prop = pendingProps_1[_i];
+                            if (typeof row[prop] !== 'undefined') {
+                                payload[prop] = row[prop];
+                            }
+                        }
+                        if (Object.keys(payload).length === 1) {
+                            return [2 /*return*/];
+                        }
+                        return [4 /*yield*/, db.update(table, payload)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** Raw (un-deserialized) id-ordered window — pending-ness must see stored bytes, not decrypted values. */
+    EncryptionLifecycleWalker.prototype.rawWindow = function (table, dbDriver, columnNames, cursor, windowSize) {
+        return __awaiter(this, void 0, void 0, function () {
+            var StatementConfigFactory, statementConfigFactory, qb;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require('../StatementConfigFactory')); })];
+                    case 1:
+                        StatementConfigFactory = (_a.sent()).StatementConfigFactory;
+                        statementConfigFactory = new StatementConfigFactory(dbDriver.getDbName());
+                        qb = new db_query_1.QueryBuilder(table.name).select({ fields: __spreadArray(['id'], columnNames.map(function (_a) {
+                                var prop = _a.prop;
+                                return prop;
+                            }), true) });
+                        if (cursor) {
+                            qb.condition({ field: 'id', operator: '>', value: cursor });
+                        }
+                        qb.sort([{ field: 'id' }]).paginate({ start: 0, end: windowSize });
+                        return [4 /*yield*/, dbDriver.runQuery(function (config) { return qb.toSql(statementConfigFactory.getStatementConfig(config)); })];
+                    case 2: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    /** After decrypt-out, the decrypted columns' token rows are stale — sweep them. */
+    EncryptionLifecycleWalker.prototype.sweepTokenRows = function (table, db, columnNames) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var tokenTable, deleteQb;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        tokenTable = (_a = this.encryptedColumns.tokenTableFor(table)) !== null && _a !== void 0 ? _a : this.encryptedColumns.tokenTableShape(table);
+                        return [4 /*yield*/, db.tableExists(tokenTable)];
+                    case 1:
+                        if (!(_b.sent())) {
+                            return [2 /*return*/];
+                        }
+                        deleteQb = new db_query_1.QueryBuilder(tokenTable.name).condition({
+                            field: 'columnName',
+                            operator: 'IN',
+                            value: columnNames,
+                        });
+                        return [4 /*yield*/, db.delete(tokenTable, deleteQb)];
+                    case 2:
+                        _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    EncryptionLifecycleWalker.prototype.resolveProps = function (table, mode, options) {
+        if (options.columns && options.columns.length > 0) {
+            for (var _i = 0, _a = options.columns; _i < _a.length; _i++) {
+                var prop = _a[_i];
+                if (!table.columns[prop]) {
+                    throw new Error("(".concat(table.name, ") Unknown column property to walk: ").concat(prop));
+                }
+            }
+            return options.columns;
+        }
+        if (mode === 'decrypt') {
+            throw new Error("Mode 'decrypt' requires options.columns: after the config flips to encrypted: false, the " +
+                "declaration no longer names the columns to decrypt.");
+        }
+        var props = this.encryptedColumns.encryptedProps(table);
+        if (props.length === 0) {
+            throw new Error("(".concat(table.name, ") No encrypted columns declared \u2014 nothing to walk."));
+        }
+        return props;
+    };
+    EncryptionLifecycleWalker.DEFAULT_WINDOW_SIZE = 200;
+    return EncryptionLifecycleWalker;
+}());
+exports.EncryptionLifecycleWalker = EncryptionLifecycleWalker;
+//# sourceMappingURL=EncryptionLifecycleWalker.js.map

package/dist/src/encryption/EncryptionLifecycleWalker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionLifecycleWalker.js","sourceRoot":"","sources":["../../../src/encryption/EncryptionLifecycleWalker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAAmD;AACnD,4CAA2C;AAE3C,uDAAsD;AACtD,2DAA0D;AAC1D,+CAA8C;AAqC9C;;;;;;;;;;;GAWG;AACH;IAAA;QAEU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,qBAAgB,GAAG,IAAI,mCAAgB,EAAE,CAAC;QAC1C,aAAQ,GAAG,IAAI,uCAAkB,EAAE,CAAC;IAwL9C,CAAC;IAtLO,6CAAS,GAAf,UACE,KAAiB,EACjB,IAAwB,EACxB,OAAmC;;QAAnC,wBAAA,EAAA,YAAmC;;;;;;wBAEnC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;wBACxB,sFAAa,OAAO,QAAC;;wBAA7C,KAAwB,SAAqB,EAA3C,EAAE,QAAA,EAAE,aAAa,mBAAA;wBACnB,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,CAAC,kBAAkB,EAAE,CAAC;wBACvD,EAAE,GAAG,MAAA,OAAO,CAAC,EAAE,mCAAI,aAAa,EAAE,CAAC;wBACnC,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,yBAAyB,CAAC,mBAAmB,CAAC;wBACjF,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,UAAC,IAAI,IAAK,OAAA,CAAC;4BACvC,IAAI,MAAA;4BACJ,UAAU,EAAI,KAAK,CAAC,OAAe,CAAC,IAAI,CAAsB,CAAC,IAAI;yBACpE,CAAC,EAHsC,CAGtC,CAAC,CAAC;wBACE,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAC;wBAEjD,OAAO,GAA0B,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;wBAChE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;;;6BAE3B,IAAI;wBACO,qBAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAA;;wBAAhF,OAAO,GAAG,SAAsE;wBACtF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;4BACxB,yBAAM;yBACP;8BAE2B,EAAP,mBAAO;;;6BAAP,CAAA,qBAAO,CAAA;wBAAjB,MAAM;wBACf,OAAO,CAAC,OAAO,EAAE,CAAC;wBACZ,YAAY,GAAa,EAAE,CAAC;8BACY,EAAX,2BAAW;;;6BAAX,CAAA,yBAAW,CAAA;wBAAnC,sBAAoB,EAAlB,IAAI,UAAA,EAAE,UAAU,gBAAA;wBACvB,qBAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,EAAA;;wBAAxE,IAAI,SAAoE,EAAE;4BACxE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;yBACzB;;;wBAHgC,IAAW,CAAA;;;wBAM9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;4BAC7B,yBAAS;yBACV;wBAED,qBAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,EAAA;;wBAA5D,SAA4D,CAAC;wBAC7D,OAAO,CAAC,SAAS,EAAE,CAAC;;;wBAdD,IAAO,CAAA;;;wBAiB5B,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE;4BAC/B,yBAAM;yBACP;;;6BAGC,CAAA,IAAI,KAAK,SAAS,CAAA,EAAlB,yBAAkB;wBACpB,qBAAM,IAAI,CAAC,cAAc,CACvB,KAAK,EACL,EAAE,EACF,WAAW,CAAC,GAAG,CAAC,UAAC,EAAc;oCAAZ,UAAU,gBAAA;gCAAO,OAAA,UAAU;4BAAV,CAAU,CAAC,CAChD,EAAA;;wBAJD,SAIC,CAAC;;;wBAGJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;4BACf,OAAO,EAAE,oCAAoC;4BAC7C,GAAG,aAAI,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,MAAA,IAAK,OAAO,CAAE;yBAC7C,CAAC,CAAC;wBACH,sBAAO,OAAO,EAAC;;;;KAChB;IAEa,6CAAS,GAAvB,UACE,IAAwB,EACxB,QAAa,EACb,oBAAyC;;;;;;wBAEzC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;4BACxD,sBAAO,KAAK,EAAC;yBACd;wBAEK,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACrC,KAAA,IAAI,CAAA;;iCACL,SAAS,CAAC,CAAV,wBAAS;iCAET,YAAY,CAAC,CAAb,wBAAY;iCAEZ,SAAS,CAAC,CAAV,wBAAS;iCAET,aAAa,CAAC,CAAd,wBAAa;;;4BALhB,sBAAO,CAAC,MAAM,EAAC;4BAEf,sBAAO,IAAI,EAAC;4BAEZ,sBAAO,CAAC,CAAC,MAAM,EAAC;;wBAEhB,IAAI,CAAC,MAAM,EAAE;4BACX,sBAAO,IAAI,EAAC,CAAC,sDAAsD;yBACpE;wBACG,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;6BACvD,CAAA,OAAO,aAAa,KAAK,WAAW,CAAA,EAApC,wBAAoC;wBACrB,qBAAM,IAAI,2BAAY,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAA;;wBAAnE,aAAa,GAAG,CAAC,SAAkD,CAAC,CAAC,OAAO,CAAC;wBAC7E,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;;4BAExD,sBAAO,MAAM,CAAC,OAAO,GAAG,aAAa,EAAC;;;;;KAG3C;IAED;;;;OAIG;IACW,8CAAU,GAAxB,UACE,KAAiB,EACjB,EAA2B,EAC3B,EAAU,EACV,YAAsB;;;;;4BAEV,qBAAM,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,IAAA,EAAE,CAAC,EAAA;;wBAAjC,GAAG,GAAG,SAA2B;wBACvC,IAAI,CAAC,GAAG,EAAE;4BACR,sBAAO,CAAC,mBAAmB;yBAC5B;wBAEK,OAAO,GAAQ,EAAE,EAAE,IAAA,EAAE,CAAC;wBAC5B,WAA+B,EAAZ,6BAAY,EAAZ,0BAAY,EAAZ,IAAY,EAAE;4BAAtB,IAAI;4BACb,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE;gCACpC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;6BAC3B;yBACF;wBAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;4BACrC,sBAAO;yBACR;wBAED,qBAAM,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAA;;wBAA/B,SAA+B,CAAC;;;;;KACjC;IAED,0GAA0G;IAC5F,6CAAS,GAAvB,UACE,KAAiB,EACjB,QAAkC,EAClC,WAAmD,EACnD,MAA0B,EAC1B,UAAkB;;;;;4BAEiB,sFAAa,2BAA2B,QAAC;;wBAApE,sBAAsB,GAAK,CAAA,SAAyC,CAAA,uBAA9C;wBACxB,sBAAsB,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;wBAC1E,EAAE,GAAG,IAAI,uBAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,iBAAG,IAAI,GAAK,WAAW,CAAC,GAAG,CAAC,UAAC,EAAQ;oCAAN,IAAI,UAAA;gCAAO,OAAA,IAAI;4BAAJ,CAAI,CAAC,OAAC,EAAE,CAAC,CAAC;wBAC3G,IAAI,MAAM,EAAE;4BACV,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;yBAC7D;wBACD,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;wBAC5D,qBAAM,QAAQ,CAAC,QAAQ,CAAC,UAAC,MAAM,IAAK,OAAA,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAA3D,CAA2D,CAAC,EAAA;4BAAvG,sBAAO,SAAgG,EAAC;;;;KACzG;IAED,mFAAmF;IACrE,kDAAc,GAA5B,UAA6B,KAAiB,EAAE,EAA2B,EAAE,WAAqB;;;;;;;wBAC1F,UAAU,GAAG,MAAA,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,mCAAI,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;wBACxG,qBAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAA;;wBAAtC,IAAI,CAAC,CAAC,SAAgC,CAAC,EAAE;4BACvC,sBAAO;yBACR;wBAEK,QAAQ,GAAG,IAAI,uBAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;4BAC3D,KAAK,EAAE,YAAY;4BACnB,QAAQ,EAAE,IAAI;4BACd,KAAK,EAAE,WAAW;yBACnB,CAAC,CAAC;wBACH,qBAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAA;;wBAArC,SAAqC,CAAC;;;;;KACvC;IAEO,gDAAY,GAApB,UAAqB,KAAiB,EAAE,IAAwB,EAAE,OAA8B;QAC9F,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;YACjD,KAAmB,UAAe,EAAf,KAAA,OAAO,CAAC,OAAO,EAAf,cAAe,EAAf,IAAe,EAAE;gBAA/B,IAAM,IAAI,SAAA;gBACb,IAAI,CAAE,KAAK,CAAC,OAAe,CAAC,IAAI,CAAC,EAAE;oBACjC,MAAM,IAAI,KAAK,CAAC,WAAI,KAAK,CAAC,IAAI,gDAAsC,IAAI,CAAE,CAAC,CAAC;iBAC7E;aACF;YACD,OAAO,OAAO,CAAC,OAAO,CAAC;SACxB;QAED,IAAI,IAAI,KAAK,SAAS,EAAE;YACtB,MAAM,IAAI,KAAK,CACb,2FAA2F;gBACzF,qDAAqD,CACxD,CAAC;SACH;QAED,IAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,MAAM,IAAI,KAAK,CAAC,WAAI,KAAK,CAAC,IAAI,4DAAoD,CAAC,CAAC;SACrF;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IA1LuB,6CAAmB,GAAG,GAAG,AAAN,CAAO;IA2LpD,gCAAC;CAAA,AA5LD,IA4LC;AA5LY,8DAAyB"}

package/dist/src/encryption/EncryptionRecordHooks.d.ts

@@ -0,0 +1,47 @@
+import type { Table } from '../Table';
+import type { SerializedRecord } from '../Record';
+/** Who a row being written belongs to — the data key its values encrypt under. */
+export type EncryptionWriteContext = {
+    keyOwner: string;
+};
+/**
+ * The transparent encrypt/decrypt seam, invoked by `RecordSerializer` on every write's
+ * serialize and every read's deserialize — the same per-column hook layer every caller
+ * already passes through, so services, watchers, migrations, and queued client
+ * transactions get encryption without knowing it exists.
+ *
+ * - Serialize: after the columns' own `serialize` steps, values of encrypted columns are
+ *   replaced with self-describing envelopes (`EncryptionEnvelope`), and the searchable /
+ *   sort companions are written beside them in the same statement.
+ * - Deserialize: before the columns' own `deserialize` steps, envelope values are decrypted
+ *   (the envelope names its key — owner + version — so no context is needed) and
+ *   framework-derived companion columns are dropped. A non-envelope value in an encrypted
+ *   column passes through unchanged — the online-adoption transition: rows written before
+ *   the encrypt backfill stay readable while the walker converges them.
+ *
+ * Server-only: this seam executes where the database driver runs. Browser code proxies
+ * through `DbService` and receives decrypted values over the authenticated service.
+ */
+export declare class EncryptionRecordHooks {
+    private encryptedColumns;
+    private envelope;
+    private tokenizer;
+    /** Encrypt encrypted-column values in `serialized` (column-name-keyed) and add companions. */
+    onSerialize(table: Table<any>, serialized: SerializedRecord, context?: EncryptionWriteContext): Promise<void>;
+    /**
+     * A copy of `serializedRecord` with framework companion columns dropped and every
+     * envelope value decrypted (any column — self-describing ciphertext also covers the
+     * decrypt-out transition, where the config no longer marks the column).
+     */
+    onDeserialize(table: Table<any>, serializedRecord: SerializedRecord): Promise<SerializedRecord>;
+    /**
+     * The key owner for a row being written — its permission-source scope owner:
+     * `DbEncryptionConfig.resolveKeyOwner` when the deployment supplies one (richer sharing
+     * models map scope→owner there), else the row's `scope` column value (the framework's
+     * scope columns hold the owning user's id).
+     */
+    resolveKeyOwnerForWrite(table: Table<any>, record: any): Promise<string>;
+    private internalColumnNames;
+    private assertServerSide;
+}
+//# sourceMappingURL=EncryptionRecordHooks.d.ts.map

package/dist/src/encryption/EncryptionRecordHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionRecordHooks.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptionRecordHooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAOlD,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,SAAS,CAAyB;IAE1C,8FAA8F;IACxF,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDnH;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0BrG;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB9E,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,gBAAgB;CAQzB"}

package/dist/src/encryption/EncryptionRecordHooks.js

@@ -0,0 +1,229 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionRecordHooks = void 0;
+var DbEncryptionConfig_1 = require("./DbEncryptionConfig");
+var EncryptedColumns_1 = require("./EncryptedColumns");
+var EncryptionEnvelope_1 = require("./EncryptionEnvelope");
+var DataKeyStore_1 = require("./DataKeyStore");
+var SearchTokenizer_1 = require("./SearchTokenizer");
+/**
+ * The transparent encrypt/decrypt seam, invoked by `RecordSerializer` on every write's
+ * serialize and every read's deserialize — the same per-column hook layer every caller
+ * already passes through, so services, watchers, migrations, and queued client
+ * transactions get encryption without knowing it exists.
+ *
+ * - Serialize: after the columns' own `serialize` steps, values of encrypted columns are
+ *   replaced with self-describing envelopes (`EncryptionEnvelope`), and the searchable /
+ *   sort companions are written beside them in the same statement.
+ * - Deserialize: before the columns' own `deserialize` steps, envelope values are decrypted
+ *   (the envelope names its key — owner + version — so no context is needed) and
+ *   framework-derived companion columns are dropped. A non-envelope value in an encrypted
+ *   column passes through unchanged — the online-adoption transition: rows written before
+ *   the encrypt backfill stay readable while the walker converges them.
+ *
+ * Server-only: this seam executes where the database driver runs. Browser code proxies
+ * through `DbService` and receives decrypted values over the authenticated service.
+ */
+var EncryptionRecordHooks = /** @class */ (function () {
+    function EncryptionRecordHooks() {
+        this.encryptedColumns = new EncryptedColumns_1.EncryptedColumns();
+        this.envelope = new EncryptionEnvelope_1.EncryptionEnvelope();
+        this.tokenizer = new SearchTokenizer_1.SearchTokenizer();
+    }
+    /** Encrypt encrypted-column values in `serialized` (column-name-keyed) and add companions. */
+    EncryptionRecordHooks.prototype.onSerialize = function (table, serialized, context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var touchedProps, writeKey, _i, touchedProps_1, prop, column, config, value;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.encryptedColumns.ensureSchema(table);
+                        touchedProps = this.encryptedColumns
+                            .encryptedProps(table)
+                            .filter(function (prop) { return table.columns[prop].name in serialized; });
+                        if (touchedProps.length === 0) {
+                            return [2 /*return*/];
+                        }
+                        this.assertServerSide();
+                        _i = 0, touchedProps_1 = touchedProps;
+                        _a.label = 1;
+                    case 1:
+                        if (!(_i < touchedProps_1.length)) return [3 /*break*/, 5];
+                        prop = touchedProps_1[_i];
+                        column = table.columns[prop];
+                        config = this.encryptedColumns.configFor(table, prop);
+                        value = serialized[column.name];
+                        if (value === null) {
+                            // Null stays null (IS NULL queries keep working); companions null out with it.
+                            if (config.searchable === 'equality') {
+                                serialized["".concat(column.name, "_enc_eq")] = null;
+                            }
+                            if (config.sortKey) {
+                                serialized["".concat(column.name, "_enc_srt")] = null;
+                            }
+                            return [3 /*break*/, 4];
+                        }
+                        if (typeof value !== 'string') {
+                            throw new DbEncryptionConfig_1.EncryptedColumnConfigError("(".concat(table.name, ".").concat(prop, ") encrypted columns must serialize to a string; ") +
+                                "got ".concat(typeof value, ". Declare 'encrypted' on a StringColumn-family column."));
+                        }
+                        if (!!writeKey) return [3 /*break*/, 3];
+                        if (!(context === null || context === void 0 ? void 0 : context.keyOwner)) {
+                            throw new DbEncryptionConfig_1.EncryptedColumnConfigError("(".concat(table.name, ") A write touches encrypted column '").concat(prop, "' but no key owner was ") +
+                                "resolved. Writes to encrypted columns must resolve the row's scope owner " +
+                                "(the row's 'scope' value, or DbEncryptionConfig.resolveKeyOwner).");
+                        }
+                        return [4 /*yield*/, new DataKeyStore_1.DataKeyStore().getWriteKey(context.keyOwner)];
+                    case 2:
+                        writeKey = _a.sent();
+                        _a.label = 3;
+                    case 3:
+                        serialized[column.name] = this.envelope.encrypt(value, writeKey);
+                        if (config.searchable === 'equality') {
+                            serialized["".concat(column.name, "_enc_eq")] = this.tokenizer.equalityFingerprint(value, writeKey.indexKey);
+                        }
+                        if (config.sortKey) {
+                            serialized["".concat(column.name, "_enc_srt")] = this.tokenizer.sortPrefix(value, config.sortKey.revealPrefix);
+                        }
+                        _a.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * A copy of `serializedRecord` with framework companion columns dropped and every
+     * envelope value decrypted (any column — self-describing ciphertext also covers the
+     * decrypt-out transition, where the config no longer marks the column).
+     */
+    EncryptionRecordHooks.prototype.onDeserialize = function (table, serializedRecord) {
+        return __awaiter(this, void 0, void 0, function () {
+            var prepared, internalColumnNames, decrypted, _i, _a, columnName, value, parsed, key;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.encryptedColumns.ensureSchema(table);
+                        prepared = {};
+                        internalColumnNames = this.internalColumnNames(table);
+                        decrypted = false;
+                        _i = 0, _a = Object.keys(serializedRecord);
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        columnName = _a[_i];
+                        if (internalColumnNames.has(columnName)) {
+                            return [3 /*break*/, 3];
+                        }
+                        value = serializedRecord[columnName];
+                        parsed = this.envelope.parse(value);
+                        if (!parsed) {
+                            prepared[columnName] = value;
+                            return [3 /*break*/, 3];
+                        }
+                        this.assertServerSide();
+                        return [4 /*yield*/, new DataKeyStore_1.DataKeyStore().getKeyByVersion(parsed.owner, parsed.version)];
+                    case 2:
+                        key = _b.sent();
+                        prepared[columnName] = this.envelope.decrypt(value, key);
+                        decrypted = true;
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/, decrypted || internalColumnNames.size > 0 ? prepared : serializedRecord];
+                }
+            });
+        });
+    };
+    /**
+     * The key owner for a row being written — its permission-source scope owner:
+     * `DbEncryptionConfig.resolveKeyOwner` when the deployment supplies one (richer sharing
+     * models map scope→owner there), else the row's `scope` column value (the framework's
+     * scope columns hold the owning user's id).
+     */
+    EncryptionRecordHooks.prototype.resolveKeyOwnerForWrite = function (table, record) {
+        return __awaiter(this, void 0, void 0, function () {
+            var config, owner;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        config = (0, DbEncryptionConfig_1.getDbEncryptionConfig)();
+                        if (!config.resolveKeyOwner) return [3 /*break*/, 2];
+                        return [4 /*yield*/, config.resolveKeyOwner({ table: table, record: record })];
+                    case 1:
+                        owner = _a.sent();
+                        if (owner) {
+                            return [2 /*return*/, owner];
+                        }
+                        _a.label = 2;
+                    case 2:
+                        if (typeof record.scope === 'string' && record.scope.length > 0) {
+                            return [2 /*return*/, record.scope];
+                        }
+                        throw new DbEncryptionConfig_1.EncryptedColumnConfigError("(".concat(table.name, ") Cannot resolve the key owner for a write to an encrypted column: the row ") +
+                            "carries no 'scope' value and DbEncryptionConfig.resolveKeyOwner resolved nothing. " +
+                            "Scoped tables get this automatically; other tables must supply resolveKeyOwner.");
+                }
+            });
+        });
+    };
+    EncryptionRecordHooks.prototype.internalColumnNames = function (table) {
+        var names = new Set();
+        for (var _i = 0, _a = Object.keys(table.columns); _i < _a.length; _i++) {
+            var prop = _a[_i];
+            var column = table.columns[prop];
+            if (this.encryptedColumns.isInternalColumn(column)) {
+                names.add(column.name);
+            }
+        }
+        return names;
+    };
+    EncryptionRecordHooks.prototype.assertServerSide = function () {
+        if (typeof self !== 'undefined') {
+            throw new Error("Column encryption executes where the database driver runs (the server); the browser " +
+                "must reach encrypted tables through DbService.");
+        }
+    };
+    return EncryptionRecordHooks;
+}());
+exports.EncryptionRecordHooks = EncryptionRecordHooks;
+//# sourceMappingURL=EncryptionRecordHooks.js.map

package/dist/src/encryption/EncryptionRecordHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionRecordHooks.js","sourceRoot":"","sources":["../../../src/encryption/EncryptionRecordHooks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,2DAAyF;AACzF,uDAAsD;AACtD,2DAA0D;AAC1D,+CAA+D;AAC/D,qDAAoD;AAKpD;;;;;;;;;;;;;;;;;GAiBG;AACH;IAAA;QACU,qBAAgB,GAAG,IAAI,mCAAgB,EAAE,CAAC;QAC1C,aAAQ,GAAG,IAAI,uCAAkB,EAAE,CAAC;QACpC,cAAS,GAAG,IAAI,iCAAe,EAAE,CAAC;IAsI5C,CAAC;IApIC,8FAA8F;IACxF,2CAAW,GAAjB,UAAkB,KAAiB,EAAE,UAA4B,EAAE,OAAgC;;;;;;wBACjG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpC,YAAY,GAAG,IAAI,CAAC,gBAAgB;6BACvC,cAAc,CAAC,KAAK,CAAC;6BACrB,MAAM,CAAC,UAAC,IAAI,IAAK,OAAE,KAAK,CAAC,OAAe,CAAC,IAAI,CAAsB,CAAC,IAAI,IAAI,UAAU,EAArE,CAAqE,CAAC,CAAC;wBAC3F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;4BAC7B,sBAAO;yBACR;wBAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;8BAEO,EAAZ,6BAAY;;;6BAAZ,CAAA,0BAAY,CAAA;wBAApB,IAAI;wBACP,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,IAAI,CAAC,CAAC;wBACtC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAE,CAAC;wBACvD,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACtC,IAAI,KAAK,KAAK,IAAI,EAAE;4BAClB,+EAA+E;4BAC/E,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE;gCACpC,UAAU,CAAC,UAAG,MAAM,CAAC,IAAI,YAAS,CAAC,GAAG,IAAI,CAAC;6BAC5C;4BACD,IAAI,MAAM,CAAC,OAAO,EAAE;gCAClB,UAAU,CAAC,UAAG,MAAM,CAAC,IAAI,aAAU,CAAC,GAAG,IAAI,CAAC;6BAC7C;4BACD,wBAAS;yBACV;wBAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;4BAC7B,MAAM,IAAI,+CAA0B,CAClC,WAAI,KAAK,CAAC,IAAI,cAAI,IAAI,qDAAkD;gCACtE,cAAO,OAAO,KAAK,2DAAwD,CAC9E,CAAC;yBACH;6BAEG,CAAC,QAAQ,EAAT,wBAAS;wBACX,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,EAAE;4BACtB,MAAM,IAAI,+CAA0B,CAClC,WAAI,KAAK,CAAC,IAAI,iDAAuC,IAAI,4BAAyB;gCAChF,2EAA2E;gCAC3E,mEAAmE,CACtE,CAAC;yBACH;wBACU,qBAAM,IAAI,2BAAY,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAA;;wBAAjE,QAAQ,GAAG,SAAsD,CAAC;;;wBAGpE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;wBACjE,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE;4BACpC,UAAU,CAAC,UAAG,MAAM,CAAC,IAAI,YAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;yBACpG;wBACD,IAAI,MAAM,CAAC,OAAO,EAAE;4BAClB,UAAU,CAAC,UAAG,MAAM,CAAC,IAAI,aAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;yBACtG;;;wBAvCgB,IAAY,CAAA;;;;;;KAyChC;IAED;;;;OAIG;IACG,6CAAa,GAAnB,UAAoB,KAAiB,EAAE,gBAAkC;;;;;;wBACvE,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpC,QAAQ,GAAqB,EAAE,CAAC;wBAChC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBACxD,SAAS,GAAG,KAAK,CAAC;8BACgC,EAA7B,KAAA,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;6BAA7B,CAAA,cAA6B,CAAA;wBAA3C,UAAU;wBACnB,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;4BACvC,wBAAS;yBACV;wBAEK,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBACrC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBAC1C,IAAI,CAAC,MAAM,EAAE;4BACX,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;4BAC7B,wBAAS;yBACV;wBAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACZ,qBAAM,IAAI,2BAAY,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAA;;wBAA5E,GAAG,GAAG,SAAsE;wBAClF,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAe,EAAE,GAAG,CAAC,CAAC;wBACnE,SAAS,GAAG,IAAI,CAAC;;;wBAfM,IAA6B,CAAA;;4BAkBtD,sBAAO,SAAS,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,EAAC;;;;KAChF;IAED;;;;;OAKG;IACG,uDAAuB,GAA7B,UAA8B,KAAiB,EAAE,MAAW;;;;;;wBACpD,MAAM,GAAG,IAAA,0CAAqB,GAAE,CAAC;6BACnC,MAAM,CAAC,eAAe,EAAtB,wBAAsB;wBACV,qBAAM,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,OAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAAA;;wBAAvD,KAAK,GAAG,SAA+C;wBAC7D,IAAI,KAAK,EAAE;4BACT,sBAAO,KAAK,EAAC;yBACd;;;wBAGH,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC/D,sBAAO,MAAM,CAAC,KAAK,EAAC;yBACrB;wBAED,MAAM,IAAI,+CAA0B,CAClC,WAAI,KAAK,CAAC,IAAI,gFAA6E;4BACzF,oFAAoF;4BACpF,iFAAiF,CACpF,CAAC;;;;KACH;IAEO,mDAAmB,GAA3B,UAA4B,KAAiB;QAC3C,IAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAmB,UAA0B,EAA1B,KAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAA1B,cAA0B,EAA1B,IAA0B,EAAE;YAA1C,IAAM,IAAI,SAAA;YACb,IAAM,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE;gBAClD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aACxB;SACF;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gDAAgB,GAAxB;QACE,IAAI,OAAO,IAAI,KAAK,WAAW,EAAE;YAC/B,MAAM,IAAI,KAAK,CACb,sFAAsF;gBACpF,gDAAgD,CACnD,CAAC;SACH;IACH,CAAC;IACH,4BAAC;AAAD,CAAC,AAzID,IAyIC;AAzIY,sDAAqB"}