@proteinjs/db 1.35.1 → 1.37.0

package/dist/src/encryption/EncryptedColumnQueryTransform.js

@@ -0,0 +1,423 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptedColumnQueryTransform = void 0;
+var util_1 = require("@proteinjs/util");
+var db_query_1 = require("@proteinjs/db-query");
+var EncryptedColumns_1 = require("./EncryptedColumns");
+var EncryptedColumnQueryError_1 = require("./EncryptedColumnQueryError");
+var DbEncryptionConfig_1 = require("./DbEncryptionConfig");
+var DataKeyStore_1 = require("./DataKeyStore");
+var SearchTokenizer_1 = require("./SearchTokenizer");
+/**
+ * An encrypted column's `ColumnQueryTransform` — the query-side half of the column's
+ * encryption contract (`EncryptionRecordHooks` is the storage-side half). Attached to the
+ * column by `EncryptedColumns.ensureSchema` (derived from `ColumnOptions.encrypted`, never
+ * caller-declared) and applied by `QueryBuilder.applyColumnTransforms` on every query, so
+ * callers keep writing exactly what they write today:
+ *
+ * - **Equality** (`=`, `IN`) on a column declared `searchable: 'equality'` rewrites onto the
+ *   whole-value fingerprint companion — one indexed lookup, exact (fingerprints cover the
+ *   exact value), fingerprinted once per accessible key owner (shared-scope reads OR the
+ *   owners' fingerprints).
+ * - **Contains / prefix LIKE** on a column declared `searchable: 'contains'` resolves in two
+ *   index-bounded steps: (1) the token table answers a candidate id set — rows holding ALL
+ *   of the query's fragment fingerprints under some accessible owner key; (2) candidates
+ *   are verified against the decrypted value (the pg_trgm recheck semantics — no false
+ *   positive survives, no true match ≥3-chars-per-word is missed). The condition then
+ *   rewrites to the VERIFIED id set, so it composes exactly under any boolean structure,
+ *   ORDER BY, pagination, and COUNT.
+ * - **Out-of-contract shapes are REJECTED loudly at query-build time** — undeclared ORDER BY,
+ *   ranges, arbitrary LIKE patterns, aggregation over the value — each error naming the
+ *   sanctioned paths. A limitation a developer cannot hit silently is a contract; one they
+ *   discover in production is a bug.
+ */
+var EncryptedColumnQueryTransform = /** @class */ (function () {
+    function EncryptedColumnQueryTransform(table, prop, column, config, runtime) {
+        this.table = table;
+        this.prop = prop;
+        this.column = column;
+        this.config = config;
+        this.runtime = runtime;
+        this.encryptedColumns = new EncryptedColumns_1.EncryptedColumns();
+        this.tokenizer = new SearchTokenizer_1.SearchTokenizer();
+    }
+    EncryptedColumnQueryTransform.prototype.transformCondition = function (condition, context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var operator, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        operator = condition.operator;
+                        if (operator === 'IS NULL' || operator === 'IS NOT NULL') {
+                            return [2 /*return*/, undefined]; // encryption preserves null-ness — native
+                        }
+                        if (condition.value === null) {
+                            return [2 /*return*/, undefined]; // `= null` renders IS NULL; a normalized empty-IN renders 1=0
+                        }
+                        if ((0, util_1.isInstanceOf)(condition.value, db_query_1.QueryBuilder)) {
+                            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot compare encrypted column `".concat(this.table.name, ".").concat(this.prop, "` against a subquery. ") +
+                                "Compare on a metadata column, or resolve the subquery app-side and pass literal values.");
+                        }
+                        _a = operator;
+                        switch (_a) {
+                            case '=': return [3 /*break*/, 1];
+                            case 'IN': return [3 /*break*/, 1];
+                            case 'LIKE': return [3 /*break*/, 3];
+                            case '<': return [3 /*break*/, 5];
+                            case '>': return [3 /*break*/, 5];
+                            case '<=': return [3 /*break*/, 5];
+                            case '>=': return [3 /*break*/, 5];
+                            case 'BETWEEN': return [3 /*break*/, 5];
+                        }
+                        return [3 /*break*/, 6];
+                    case 1: return [4 /*yield*/, this.equalityCondition(condition, context)];
+                    case 2: return [2 /*return*/, _b.sent()];
+                    case 3: return [4 /*yield*/, this.likeCondition(condition, context)];
+                    case 4: return [2 /*return*/, _b.sent()];
+                    case 5: throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot apply range condition (".concat(operator, ") to encrypted column `").concat(this.table.name, ".").concat(this.prop, "`. ") +
+                        "Ranges over an encrypted value are not supported. Options: filter by a metadata column; " +
+                        "filter the fetched, decrypted rows app-side (bounded sets); or use " +
+                        "encrypted: { sortKey: { revealPrefix: N } } ordering with app-side refinement.");
+                    case 6: 
+                    // <>, !=, NOT IN, NOT, NOT LIKE — negations over lossy/keyed representations cannot
+                    // be answered exactly DB-side.
+                    throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot apply ".concat(operator, " to encrypted column `").concat(this.table.name, ".").concat(this.prop, "`. Options: use ") +
+                        "equality/contains conditions (searchable declarations) and exclude app-side; or filter " +
+                        "by a metadata column.");
+                }
+            });
+        });
+    };
+    EncryptedColumnQueryTransform.prototype.transformSort = function (criteria) {
+        if (criteria.byValues && criteria.byValues.length > 0) {
+            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot ORDER BY specific values of encrypted column `".concat(this.table.name, ".").concat(this.prop, "`: value-CASE ") +
+                "ordering compares the stored value. Options: order by a metadata column; or order the " +
+                "fetched rows for display (bounded sets).");
+        }
+        if (!this.config.sortKey) {
+            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot ORDER BY encrypted column `".concat(this.table.name, ".").concat(this.prop, "` (no sortKey declared). Options: ") +
+                "sort by a metadata column; sort the fetched rows for display (bounded sets); or declare " +
+                "encrypted: { sortKey: { revealPrefix: N } } \u2014 a documented, bounded reveal of the first " +
+                "N characters' order.");
+        }
+        return __assign(__assign({}, criteria), { field: this.encryptedColumns.sortCompanionProp(this.table, this.prop) });
+    };
+    EncryptedColumnQueryTransform.prototype.transformAggregate = function (aggregate) {
+        if (aggregate.function === 'COUNT') {
+            return undefined; // counting rows never reads the value — native
+        }
+        throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot ".concat(aggregate.function, " encrypted column `").concat(this.table.name, ".").concat(this.prop, "`. Aggregation over ") +
+            "an encrypted value is not supported. Options: aggregate a metadata column; or fetch the " +
+            "rows and aggregate the decrypted values app-side (bounded sets).");
+    };
+    EncryptedColumnQueryTransform.prototype.transformGroupByField = function () {
+        throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot GROUP BY encrypted column `".concat(this.table.name, ".").concat(this.prop, "`. Grouping over an encrypted ") +
+            "value is not supported. Options: group by a metadata column; or group the fetched, " +
+            "decrypted rows app-side (bounded sets).");
+    };
+    EncryptedColumnQueryTransform.prototype.equalityCondition = function (condition, context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var values, _i, values_1, value, keys, fingerprints, _a, keys_1, key, _b, values_2, value, companionProp;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (this.config.searchable !== 'equality') {
+                            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot compare encrypted column `".concat(this.table.name, ".").concat(this.prop, "` by value (").concat(condition.operator, "): ") +
+                                "the column does not declare encrypted: { searchable: 'equality' }. Options: declare it (plus the " +
+                                "lifecycle backfill) for indexed exact lookups; declare searchable: 'contains' and use LIKE; " +
+                                "or look the row up by a metadata column.");
+                        }
+                        if (!context.caseSensitive) {
+                            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot case-insensitively compare encrypted column `".concat(this.table.name, ".").concat(this.prop, "`: equality ") +
+                                "fingerprints cover the exact value. Options: compare the exact value; or declare " +
+                                "searchable: 'contains' and use LIKE for token-normalized matching.");
+                        }
+                        values = Array.isArray(condition.value) ? condition.value : [condition.value];
+                        for (_i = 0, values_1 = values; _i < values_1.length; _i++) {
+                            value = values_1[_i];
+                            if (typeof value !== 'string') {
+                                throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Encrypted column `".concat(this.table.name, ".").concat(this.prop, "` equality values must be strings; ") +
+                                    "got ".concat(typeof value, "."));
+                            }
+                        }
+                        return [4 /*yield*/, this.accessibleIndexKeys()];
+                    case 1:
+                        keys = _c.sent();
+                        fingerprints = [];
+                        for (_a = 0, keys_1 = keys; _a < keys_1.length; _a++) {
+                            key = keys_1[_a];
+                            for (_b = 0, values_2 = values; _b < values_2.length; _b++) {
+                                value = values_2[_b];
+                                fingerprints.push(this.tokenizer.equalityFingerprint(value, key.indexKey));
+                            }
+                        }
+                        companionProp = this.encryptedColumns.eqCompanionProp(this.table, this.prop);
+                        if (fingerprints.length === 1) {
+                            return [2 /*return*/, { field: companionProp, operator: '=', value: fingerprints[0] }];
+                        }
+                        return [2 /*return*/, { field: companionProp, operator: 'IN', value: fingerprints }];
+                }
+            });
+        });
+    };
+    EncryptedColumnQueryTransform.prototype.likeCondition = function (condition, context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var shape, verifiedIds;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (this.config.searchable !== 'contains') {
+                            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot LIKE-search encrypted column `".concat(this.table.name, ".").concat(this.prop, "`: the column does not declare ") +
+                                "encrypted: { searchable: 'contains' }. Options: declare it (plus the lifecycle backfill) " +
+                                "for indexed contains/prefix search; or search a metadata column.");
+                        }
+                        shape = this.parseLikePattern(condition.value);
+                        if (shape.kind === 'match-any') {
+                            // LIKE '%' / '%%' — matches every non-null value.
+                            return [2 /*return*/, { field: this.prop, operator: 'IS NOT NULL' }];
+                        }
+                        return [4 /*yield*/, this.verifiedCandidateIds(shape, context.caseSensitive)];
+                    case 1:
+                        verifiedIds = _a.sent();
+                        return [2 /*return*/, { field: 'id', operator: 'IN', value: verifiedIds }];
+                }
+            });
+        });
+    };
+    /**
+     * The two index-bounded steps of contains search (class doc): token-cover candidates,
+     * then decrypt-and-verify. Returns the ids whose values TRULY match the pattern.
+     */
+    EncryptedColumnQueryTransform.prototype.verifiedCandidateIds = function (shape, caseSensitive) {
+        return __awaiter(this, void 0, void 0, function () {
+            var keys, fragments, candidateIds, verifyQb, rows, verified, _i, rows_1, row, value;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.accessibleIndexKeys()];
+                    case 1:
+                        keys = _a.sent();
+                        if (keys.length === 0) {
+                            return [2 /*return*/, []];
+                        }
+                        fragments = this.tokenizer.fragmentsForQuery(shape.needle);
+                        if (fragments.length === 0) {
+                            // A needle with no indexable words (punctuation-only). Verification alone cannot be
+                            // index-bounded; reject rather than silently scan.
+                            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot search encrypted column `".concat(this.table.name, ".").concat(this.prop, "` for a pattern with no letters or ") +
+                                "digits (".concat(JSON.stringify(shape.needle), "). Search patterns must contain at least one word character."));
+                        }
+                        return [4 /*yield*/, this.tokenCoverCandidates(fragments, keys)];
+                    case 2:
+                        candidateIds = _a.sent();
+                        if (candidateIds.length === 0) {
+                            return [2 /*return*/, []];
+                        }
+                        verifyQb = new db_query_1.QueryBuilder(this.table.name)
+                            .select({ fields: ['id', this.prop] })
+                            .condition({ field: 'id', operator: 'IN', value: candidateIds });
+                        return [4 /*yield*/, this.runtime.query(this.table, verifyQb)];
+                    case 3:
+                        rows = _a.sent();
+                        verified = [];
+                        for (_i = 0, rows_1 = rows; _i < rows_1.length; _i++) {
+                            row = rows_1[_i];
+                            value = row[this.prop];
+                            if (typeof value === 'string' && this.matches(value, shape, caseSensitive)) {
+                                verified.push(row.id);
+                            }
+                        }
+                        return [2 /*return*/, verified];
+                }
+            });
+        });
+    };
+    /** Candidate ids: rows whose token rows cover ALL query fragments under SOME accessible key. */
+    EncryptedColumnQueryTransform.prototype.tokenCoverCandidates = function (fragments, keys) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var tokenTable, fingerprintSources, keyIndex, _i, fragments_1, fragment, fingerprint, sources, tokenQb, tokenRows, coverage, _b, tokenRows_1, tokenRow, sources, byKey, _c, sources_1, source, matched, candidates, _d, _e, _f, recordId, byKey, _g, _h, matched;
+            return __generator(this, function (_j) {
+                switch (_j.label) {
+                    case 0:
+                        tokenTable = this.encryptedColumns.tokenTableFor(this.table);
+                        if (!tokenTable) {
+                            return [2 /*return*/, []];
+                        }
+                        fingerprintSources = new Map();
+                        for (keyIndex = 0; keyIndex < keys.length; keyIndex++) {
+                            for (_i = 0, fragments_1 = fragments; _i < fragments_1.length; _i++) {
+                                fragment = fragments_1[_i];
+                                fingerprint = this.tokenizer.fingerprint(fragment, keys[keyIndex].indexKey);
+                                sources = (_a = fingerprintSources.get(fingerprint)) !== null && _a !== void 0 ? _a : [];
+                                sources.push({ keyIndex: keyIndex, fragment: fragment });
+                                fingerprintSources.set(fingerprint, sources);
+                            }
+                        }
+                        tokenQb = new db_query_1.QueryBuilder(tokenTable.name)
+                            .select({ fields: ['recordId', 'token'] })
+                            .condition({ field: 'columnName', operator: '=', value: this.column.name })
+                            .condition({ field: 'token', operator: 'IN', value: Array.from(fingerprintSources.keys()) });
+                        return [4 /*yield*/, this.runtime.systemQuery(tokenTable, tokenQb)];
+                    case 1:
+                        tokenRows = (_j.sent());
+                        coverage = new Map();
+                        for (_b = 0, tokenRows_1 = tokenRows; _b < tokenRows_1.length; _b++) {
+                            tokenRow = tokenRows_1[_b];
+                            sources = fingerprintSources.get(tokenRow.token);
+                            if (!sources) {
+                                continue;
+                            }
+                            byKey = coverage.get(tokenRow.recordId);
+                            if (!byKey) {
+                                byKey = new Map();
+                                coverage.set(tokenRow.recordId, byKey);
+                            }
+                            for (_c = 0, sources_1 = sources; _c < sources_1.length; _c++) {
+                                source = sources_1[_c];
+                                matched = byKey.get(source.keyIndex);
+                                if (!matched) {
+                                    matched = new Set();
+                                    byKey.set(source.keyIndex, matched);
+                                }
+                                matched.add(source.fragment);
+                            }
+                        }
+                        candidates = [];
+                        for (_d = 0, _e = Array.from(coverage.entries()); _d < _e.length; _d++) {
+                            _f = _e[_d], recordId = _f[0], byKey = _f[1];
+                            for (_g = 0, _h = Array.from(byKey.values()); _g < _h.length; _g++) {
+                                matched = _h[_g];
+                                if (matched.size === fragments.length) {
+                                    candidates.push(recordId);
+                                    break;
+                                }
+                            }
+                        }
+                        return [2 /*return*/, candidates];
+                }
+            });
+        });
+    };
+    EncryptedColumnQueryTransform.prototype.matches = function (value, shape, caseSensitive) {
+        var haystack = caseSensitive ? value : value.toLowerCase();
+        var needle = caseSensitive ? shape.needle : shape.needle.toLowerCase();
+        switch (shape.kind) {
+            case 'contains':
+                return haystack.includes(needle);
+            case 'prefix':
+                return haystack.startsWith(needle);
+            case 'suffix':
+                return haystack.endsWith(needle);
+            case 'exact':
+                return haystack === needle;
+            default:
+                return false;
+        }
+    };
+    EncryptedColumnQueryTransform.prototype.parseLikePattern = function (pattern) {
+        var _this = this;
+        if (typeof pattern !== 'string') {
+            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Encrypted column `".concat(this.table.name, ".").concat(this.prop, "` LIKE patterns must be strings; ") +
+                "got ".concat(typeof pattern, "."));
+        }
+        var rejectPattern = function () {
+            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("Cannot apply LIKE pattern ".concat(JSON.stringify(pattern), " to encrypted column ") +
+                "`".concat(_this.table.name, ".").concat(_this.prop, "`. Supported: contains ('%q%'), prefix ('q%'), suffix ('%q'), ") +
+                "and exact ('q'). Mid-pattern wildcards, '_' wildcards, and escapes are not supported on " +
+                "encrypted columns; search a metadata column for those shapes.");
+        };
+        var leading = pattern.startsWith('%');
+        var trailing = pattern.endsWith('%') && pattern.length > (leading ? 1 : 0);
+        var needle = pattern.slice(leading ? 1 : 0, trailing ? -1 : undefined);
+        if (needle.length === 0) {
+            if (leading || trailing) {
+                return { kind: 'match-any', needle: '' };
+            }
+            return { kind: 'exact', needle: '' };
+        }
+        if (needle.includes('%') || needle.includes('_') || needle.includes('\\')) {
+            rejectPattern();
+        }
+        if (leading && trailing) {
+            return { kind: 'contains', needle: needle };
+        }
+        if (trailing) {
+            return { kind: 'prefix', needle: needle };
+        }
+        if (leading) {
+            return { kind: 'suffix', needle: needle };
+        }
+        return { kind: 'exact', needle: needle };
+    };
+    EncryptedColumnQueryTransform.prototype.accessibleIndexKeys = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var config, owners;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        config = (0, DbEncryptionConfig_1.getDbEncryptionConfig)();
+                        if (!config.getAccessibleKeyOwners) {
+                            throw new EncryptedColumnQueryError_1.EncryptedColumnQueryError("A query searches an encrypted column but DbEncryptionConfig.getAccessibleKeyOwners is not " +
+                                "configured. Search fingerprints are keyed per owner; the config must supply the caller's " +
+                                "accessible key owners (their own id plus owners sharing with them).");
+                        }
+                        return [4 /*yield*/, config.getAccessibleKeyOwners({ runAsSystem: this.runtime.runAsSystem })];
+                    case 1:
+                        owners = _a.sent();
+                        return [4 /*yield*/, new DataKeyStore_1.DataKeyStore().getQueryIndexKeys(owners)];
+                    case 2: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    return EncryptedColumnQueryTransform;
+}());
+exports.EncryptedColumnQueryTransform = EncryptedColumnQueryTransform;
+//# sourceMappingURL=EncryptedColumnQueryTransform.js.map

package/dist/src/encryption/EncryptedColumnQueryTransform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptedColumnQueryTransform.js","sourceRoot":"","sources":["../../../src/encryption/EncryptedColumnQueryTransform.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAA+C;AAC/C,gDAO6B;AAE7B,uDAA6E;AAC7E,yEAAwE;AACxE,2DAA6D;AAC7D,+CAA+D;AAC/D,qDAAoD;AAOpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;IAIE,uCACU,KAAiB,EACjB,IAAY,EACZ,MAAwB,EACxB,MAA6B,EAC7B,OAA2B;QAJ3B,UAAK,GAAL,KAAK,CAAY;QACjB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAkB;QACxB,WAAM,GAAN,MAAM,CAAuB;QAC7B,YAAO,GAAP,OAAO,CAAoB;QAR7B,qBAAgB,GAAG,IAAI,mCAAgB,EAAE,CAAC;QAC1C,cAAS,GAAG,IAAI,iCAAe,EAAE,CAAC;IAQvC,CAAC;IAEE,0DAAkB,GAAxB,UACE,SAAyB,EACzB,OAAoC;;;;;;wBAE9B,QAAQ,GAAG,SAAS,CAAC,QAAkB,CAAC;wBAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,EAAE;4BACxD,sBAAO,SAAS,EAAC,CAAC,0CAA0C;yBAC7D;wBACD,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE;4BAC5B,sBAAO,SAAS,EAAC,CAAC,8DAA8D;yBACjF;wBACD,IAAI,IAAA,mBAAY,EAAC,SAAS,CAAC,KAAK,EAAE,uBAAY,CAAC,EAAE;4BAC/C,MAAM,IAAI,qDAAyB,CACjC,2CAAqC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,2BAAyB;gCACxF,yFAAyF,CAC5F,CAAC;yBACH;wBAEO,KAAA,QAAQ,CAAA;;iCACT,GAAG,CAAC,CAAJ,wBAAG;iCACH,IAAI,CAAC,CAAL,wBAAI;iCAEJ,MAAM,CAAC,CAAP,wBAAM;iCAEN,GAAG,CAAC,CAAJ,wBAAG;iCACH,GAAG,CAAC,CAAJ,wBAAG;iCACH,IAAI,CAAC,CAAL,wBAAI;iCACJ,IAAI,CAAC,CAAL,wBAAI;iCACJ,SAAS,CAAC,CAAV,wBAAS;;;4BAPL,qBAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAA;4BAAvD,sBAAO,SAAgD,EAAC;4BAEjD,qBAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,EAAA;4BAAnD,sBAAO,SAA4C,EAAC;4BAMpD,MAAM,IAAI,qDAAyB,CACjC,wCAAiC,QAAQ,oCAA2B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,QAAM;wBACpG,0FAA0F;wBAC1F,qEAAqE;wBACrE,gFAAgF,CACnF,CAAC;;oBAEF,oFAAoF;oBACpF,+BAA+B;oBAC/B,MAAM,IAAI,qDAAyB,CACjC,uBAAgB,QAAQ,mCAA0B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,qBAAmB;wBAC/F,yFAAyF;wBACzF,uBAAuB,CAC1B,CAAC;;;;KAEP;IAED,qDAAa,GAAb,UAAc,QAA2B;QACvC,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACrD,MAAM,IAAI,qDAAyB,CACjC,+DAAyD,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,mBAAiB;gBACpG,wFAAwF;gBACxF,0CAA0C,CAC7C,CAAC;SACH;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YACxB,MAAM,IAAI,qDAAyB,CACjC,4CAAsC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,uCAAqC;gBACrG,0FAA0F;gBAC1F,+FAA0F;gBAC1F,sBAAsB,CACzB,CAAC;SACH;QAED,6BAAY,QAAQ,KAAE,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAG;IAChG,CAAC;IAED,0DAAkB,GAAlB,UAAmB,SAAyB;QAC1C,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,EAAE;YAClC,OAAO,SAAS,CAAC,CAAC,+CAA+C;SAClE;QAED,MAAM,IAAI,qDAAyB,CACjC,iBAAU,SAAS,CAAC,QAAQ,gCAAuB,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,yBAAuB;YACpG,0FAA0F;YAC1F,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,6DAAqB,GAArB;QACE,MAAM,IAAI,qDAAyB,CACjC,4CAAsC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,mCAAiC;YACjG,qFAAqF;YACrF,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAEa,yDAAiB,GAA/B,UACE,SAAyB,EACzB,OAAoC;;;;;;wBAEpC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE;4BACzC,MAAM,IAAI,qDAAyB,CACjC,2CAAqC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,yBAAgB,SAAS,CAAC,QAAQ,QAAK;gCACtG,mGAAmG;gCACnG,8FAA8F;gCAC9F,0CAA0C,CAC7C,CAAC;yBACH;wBACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;4BAC1B,MAAM,IAAI,qDAAyB,CACjC,8DAAwD,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,iBAAe;gCACjG,mFAAmF;gCACnF,oEAAoE,CACvE,CAAC;yBACH;wBAEK,MAAM,GAAU,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;wBAC3F,WAA0B,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;4BAAjB,KAAK;4BACd,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;gCAC7B,MAAM,IAAI,qDAAyB,CACjC,4BAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,wCAAsC;oCACtF,cAAO,OAAO,KAAK,MAAG,CACzB,CAAC;6BACH;yBACF;wBAEY,qBAAM,IAAI,CAAC,mBAAmB,EAAE,EAAA;;wBAAvC,IAAI,GAAG,SAAgC;wBACvC,YAAY,GAAa,EAAE,CAAC;wBAClC,WAAsB,EAAJ,aAAI,EAAJ,kBAAI,EAAJ,IAAI,EAAE;4BAAb,GAAG;4BACZ,WAA0B,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;gCAAjB,KAAK;gCACd,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;6BAC5E;yBACF;wBAEK,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;wBACnF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;4BAC7B,sBAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,EAAC;yBACxE;wBAED,sBAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAC;;;;KACtE;IAEa,qDAAa,GAA3B,UACE,SAAyB,EACzB,OAAoC;;;;;;wBAEpC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE;4BACzC,MAAM,IAAI,qDAAyB,CACjC,+CAAyC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,oCAAkC;gCACrG,2FAA2F;gCAC3F,kEAAkE,CACrE,CAAC;yBACH;wBAEK,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE;4BAC9B,kDAAkD;4BAClD,sBAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAC;yBACtD;wBAEmB,qBAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,EAAA;;wBAA3E,WAAW,GAAG,SAA6D;wBACjF,sBAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAC;;;;KAC5D;IAED;;;OAGG;IACW,4DAAoB,GAAlC,UAAmC,KAAgB,EAAE,aAAsB;;;;;4BAC5D,qBAAM,IAAI,CAAC,mBAAmB,EAAE,EAAA;;wBAAvC,IAAI,GAAG,SAAgC;wBAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;4BACrB,sBAAO,EAAE,EAAC;yBACX;wBAEK,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;4BAC1B,oFAAoF;4BACpF,mDAAmD;4BACnD,MAAM,IAAI,qDAAyB,CACjC,0CAAoC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,wCAAsC;gCACpG,kBAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,iEAA8D,CACxG,CAAC;yBACH;wBAEoB,qBAAM,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;wBAA/D,YAAY,GAAG,SAAgD;wBACrE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;4BAC7B,sBAAO,EAAE,EAAC;yBACX;wBAEK,QAAQ,GAAG,IAAI,uBAAY,CAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;6BACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;6BACrC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBACtD,qBAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAA;;wBAArD,IAAI,GAAG,SAA8C;wBACrD,QAAQ,GAAa,EAAE,CAAC;wBAC9B,WAAsB,EAAJ,aAAI,EAAJ,kBAAI,EAAJ,IAAI,EAAE;4BAAb,GAAG;4BACN,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE;gCAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;6BACvB;yBACF;wBAED,sBAAO,QAAQ,EAAC;;;;KACjB;IAED,gGAAgG;IAClF,4DAAoB,GAAlC,UAAmC,SAAmB,EAAE,IAAuB;;;;;;;wBACvE,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACnE,IAAI,CAAC,UAAU,EAAE;4BACf,sBAAO,EAAE,EAAC;yBACX;wBAGK,kBAAkB,GAAG,IAAI,GAAG,EAAoD,CAAC;wBACvF,KAAS,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;4BACzD,WAAgC,EAAT,uBAAS,EAAT,uBAAS,EAAT,IAAS,EAAE;gCAAvB,QAAQ;gCACX,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;gCAC5E,OAAO,GAAG,MAAA,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC;gCAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,UAAA,EAAE,QAAQ,UAAA,EAAE,CAAC,CAAC;gCACrC,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;6BAC9C;yBACF;wBAEK,OAAO,GAAG,IAAI,uBAAY,CAAwB,UAAU,CAAC,IAAI,CAAC;6BACrE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;6BACzC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;6BAC1E,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;wBAC5E,qBAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,EAAA;;wBAAhE,SAAS,GAAG,CAAC,SAAmD,CAA4B;wBAG5F,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;wBAC7D,WAAgC,EAAT,uBAAS,EAAT,uBAAS,EAAT,IAAS,EAAE;4BAAvB,QAAQ;4BACX,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;4BACvD,IAAI,CAAC,OAAO,EAAE;gCACZ,SAAS;6BACV;4BACG,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;4BAC5C,IAAI,CAAC,KAAK,EAAE;gCACV,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;gCAClB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;6BACxC;4BACD,WAA4B,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;gCAAnB,MAAM;gCACX,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gCACzC,IAAI,CAAC,OAAO,EAAE;oCACZ,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;oCACpB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;iCACrC;gCACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;6BAC9B;yBACF;wBAEK,UAAU,GAAa,EAAE,CAAC;wBAChC,WAA8D,EAA9B,KAAA,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAA9B,cAA8B,EAA9B,IAA8B,EAAE;4BAArD,WAAiB,EAAhB,QAAQ,QAAA,EAAE,KAAK,QAAA;4BACzB,WAAgD,EAA1B,KAAA,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAA1B,cAA0B,EAA1B,IAA0B,EAAE;gCAAvC,OAAO;gCAChB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE;oCACrC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oCAC1B,MAAM;iCACP;6BACF;yBACF;wBAED,sBAAO,UAAU,EAAC;;;;KACnB;IAEO,+CAAO,GAAf,UAAgB,KAAa,EAAE,KAAgB,EAAE,aAAsB;QACrE,IAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACzE,QAAQ,KAAK,CAAC,IAAI,EAAE;YAClB,KAAK,UAAU;gBACb,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,KAAK,QAAQ;gBACX,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACrC,KAAK,QAAQ;gBACX,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,KAAK,OAAO;gBACV,OAAO,QAAQ,KAAK,MAAM,CAAC;YAC7B;gBACE,OAAO,KAAK,CAAC;SAChB;IACH,CAAC;IAEO,wDAAgB,GAAxB,UAAyB,OAAgB;QAAzC,iBAwCC;QAvCC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;YAC/B,MAAM,IAAI,qDAAyB,CACjC,4BAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,IAAI,CAAC,IAAI,sCAAoC;gBACpF,cAAO,OAAO,OAAO,MAAG,CAC3B,CAAC;SACH;QAED,IAAM,aAAa,GAAG;YACpB,MAAM,IAAI,qDAAyB,CACjC,oCAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0BAAuB;gBACzE,WAAK,KAAI,CAAC,KAAK,CAAC,IAAI,cAAI,KAAI,CAAC,IAAI,mEAAiE;gBAClG,0FAA0F;gBAC1F,+DAA+D,CAClE,CAAC;QACJ,CAAC,CAAC;QAEF,IAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,IAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;YACvB,IAAI,OAAO,IAAI,QAAQ,EAAE;gBACvB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;aAC1C;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SACtC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACzE,aAAa,EAAE,CAAC;SACjB;QAED,IAAI,OAAO,IAAI,QAAQ,EAAE;YACvB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,QAAA,EAAE,CAAC;SACrC;QACD,IAAI,QAAQ,EAAE;YACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,QAAA,EAAE,CAAC;SACnC;QACD,IAAI,OAAO,EAAE;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,QAAA,EAAE,CAAC;SACnC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,QAAA,EAAE,CAAC;IACnC,CAAC;IAEa,2DAAmB,GAAjC;;;;;;wBACQ,MAAM,GAAG,IAAA,0CAAqB,GAAE,CAAC;wBACvC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;4BAClC,MAAM,IAAI,qDAAyB,CACjC,4FAA4F;gCAC1F,2FAA2F;gCAC3F,qEAAqE,CACxE,CAAC;yBACH;wBAEc,qBAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAA;;wBAAvF,MAAM,GAAG,SAA8E;wBACtF,qBAAM,IAAI,2BAAY,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAA;4BAAzD,sBAAO,SAAkD,EAAC;;;;KAC3D;IACH,oCAAC;AAAD,CAAC,AAlVD,IAkVC;AAlVY,sEAA6B"}

package/dist/src/encryption/EncryptedColumns.d.ts

@@ -0,0 +1,69 @@
+import { Column, EncryptedColumnConfig, Table } from '../Table';
+import { Record } from '../Record';
+/** One search-token row: a keyed fingerprint of one token of one encrypted column value. */
+export interface EncryptionSearchToken extends Record {
+    recordId: string;
+    columnName: string;
+    token: string;
+}
+/**
+ * The schema side of column encryption (`ColumnOptions.encrypted`): validation of the
+ * declaration, and derivation of the physical schema an encrypted column needs —
+ * automatically, at the framework seam, never by callers:
+ *
+ * - the ciphertext column itself widens to STRING(MAX) (envelopes outgrow declared widths);
+ * - `searchable: 'equality'` derives an indexed whole-value fingerprint companion column
+ *   (`<column>_enc_eq`); a `unique` declaration on the base column moves onto it (per-owner
+ *   value uniqueness — fingerprints are keyed per owner);
+ * - `searchable: 'contains'` derives a companion search-token TABLE (`<table>_enc_tok`) —
+ *   a plain indexed inverted index, portable across drivers (Spanner's native search
+ *   indexes are a named later optimization at the driver layer);
+ * - `sortKey: { revealPrefix: N }` derives an ordered-prefix companion column
+ *   (`<column>_enc_srt`) for native ORDER BY — the declared bounded reveal.
+ *
+ * `ensureSchema` is idempotent and runs wherever the physical schema is consulted
+ * (TableManager, the record serializer, the query translator).
+ */
+export declare class EncryptedColumns {
+    private static readonly SCHEMA_APPLIED_MARKER;
+    private static readonly INTERNAL_COLUMN_MARKER;
+    /** Validate declarations and inject the derived physical schema (idempotent). */
+    ensureSchema(table: Table<any>): void;
+    /**
+     * The mandatory-declaration gate (`DbEncryptionConfig.requireEncryptedDeclarations`):
+     * every text-holding column must declare `encrypted` (`false` or a config object), so no
+     * column can be added without deciding, and the encrypted set can never silently drift.
+     * Identifier-bearing column classes (uuids, references) are metadata by construction and
+     * are exempt.
+     */
+    validateDeclarations(table: Table<any>): void;
+    /** The `encrypted` config object for a column property, or undefined when not encrypted. */
+    configFor(table: Table<any>, prop: string): EncryptedColumnConfig | undefined;
+    /** Property names of this table's encrypted columns. */
+    encryptedProps(table: Table<any>): string[];
+    /** Property names declared `searchable: 'contains'`. */
+    containsProps(table: Table<any>): string[];
+    /** Does this write payload touch any encrypted column? */
+    recordTouchesEncryptedColumns(table: Table<any>, record: any): boolean;
+    hasEncryptedColumns(table: Table<any>): boolean;
+    /** The derived search-token table for `table`, or undefined when nothing is `contains`-searchable. */
+    tokenTableFor(table: Table<any>): Table<EncryptionSearchToken> | undefined;
+    tokenTableName(table: Table<any>): string;
+    /** Companion property names EQUAL their column names (several seams assume prop == name). */
+    eqCompanionProp(table: Table<any>, prop: string): string;
+    sortCompanionProp(table: Table<any>, prop: string): string;
+    /** Framework-derived companion columns are dropped from deserialized records and exempt from declaration checks. */
+    isInternalColumn(column: Column<any, any>): boolean;
+    private validateDeclaration;
+    private injectEqualityCompanion;
+    private injectSortCompanion;
+    private injectCompanionColumn;
+    /**
+     * The token table's SHAPE for `table`, independent of registration — the lifecycle
+     * walker's decrypt-out sweep needs it after the config stopped declaring any
+     * `searchable: 'contains'` column (when `tokenTableFor` no longer resolves).
+     */
+    tokenTableShape(table: Table<any>): Table<EncryptionSearchToken>;
+    private isTextColumn;
+}
+//# sourceMappingURL=EncryptedColumns.d.ts.map

package/dist/src/encryption/EncryptedColumns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptedColumns.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptedColumns.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,MAAM,EAAqB,MAAM,WAAW,CAAC;AAatD,4FAA4F;AAC5F,MAAM,WAAW,qBAAsB,SAAQ,MAAM;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAwB;IACrE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAyB;IAEvE,iFAAiF;IACjF,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI;IAkDrC;;;;;;OAMG;IACH,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI;IAqB7C,4FAA4F;IAC5F,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAM7E,wDAAwD;IACxD,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;IAI3C,wDAAwD;IACxD,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;IAI1C,0DAA0D;IAC1D,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO;IAItE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO;IAI/C,sGAAsG;IACtG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC,GAAG,SAAS;IAK1E,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM;IAIzC,6FAA6F;IAC7F,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAIxD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAI1D,oHAAoH;IACpH,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO;IAInD,OAAO,CAAC,mBAAmB;IA8D3B,OAAO,CAAC,uBAAuB;IAwB/B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,qBAAqB;IAY7B;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAmBhE,OAAO,CAAC,YAAY;CAarB"}