@vorionsys/platform-core 0.1.0

package/dist/common/encryption.js

@@ -0,0 +1,527 @@
+/**
+ * Encryption utilities for sensitive data at rest
+ *
+ * Uses AES-256-GCM for authenticated encryption with PBKDF2 key derivation.
+ *
+ * Security notes:
+ * - Key derivation uses PBKDF2-SHA512 with 100,000+ iterations (OWASP recommended)
+ * - NEVER falls back to JWT secret (would cause data loss on rotation)
+ * - Supports versioned key derivation for future algorithm changes
+ * - KDF v1 (SHA-256) is DEPRECATED - migrate all data to v2 before deprecation date
+ *
+ * KDF v1 DEPRECATION TIMELINE:
+ * - Warning phase: Now until 2025-06-01
+ * - Error phase: After 2025-06-01, v1 decryption throws an error
+ * - Run `vorion migrate encryption` to migrate all v1 data to v2
+ */
+import { createCipheriv, createDecipheriv, randomBytes, createHash, pbkdf2Sync } from 'node:crypto';
+import { z } from 'zod';
+import { getConfig } from './config.js';
+import { EncryptionError, ConfigurationError } from './errors.js';
+import { createLogger } from './logger.js';
+import { getSecurityMode } from './security-mode.js';
+import { validateEntropy } from './crypto-utils.js';
+import { createSafeParser } from './safe-json.js';
+const logger = createLogger({ component: 'encryption' });
+/**
+ * Track whether we've already logged the SHA-256 deprecation warning
+ * to avoid spamming logs on every decrypt operation
+ */
+let sha256DeprecationWarningLogged = false;
+/**
+ * Count of v1 decryption attempts for monitoring
+ */
+let v1DecryptionCount = 0;
+/**
+ * KDF v1 deprecation date - after this date, v1 decryption will throw an error
+ * Format: YYYY-MM-DD
+ */
+const KDF_V1_DEPRECATION_DATE = '2025-06-01';
+/**
+ * Check if v1 KDF is past deprecation date
+ */
+function isV1Deprecated() {
+    const deprecationDate = new Date(KDF_V1_DEPRECATION_DATE);
+    return new Date() > deprecationDate;
+}
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const AUTH_TAG_LENGTH = 16;
+const KEY_LENGTH = 32; // 256 bits for AES-256
+/**
+ * Error message template for missing encryption configuration
+ */
+function getEncryptionConfigError(missingKey) {
+    const securityMode = getSecurityMode();
+    return `CRITICAL: ${missingKey} is not configured.
+
+Encryption keys are REQUIRED in ALL environments (including ${securityMode}).
+
+To configure encryption:
+
+1. Generate secure keys:
+   $ vorion secrets generate --type encryption
+
+2. Set environment variables:
+   export VORION_ENCRYPTION_KEY="<generated-key>"
+   export VORION_ENCRYPTION_SALT="<generated-salt>"
+
+3. Or add to your .env file:
+   VORION_ENCRYPTION_KEY=<generated-key>
+   VORION_ENCRYPTION_SALT=<generated-salt>
+
+For development setup, see: docs/security/ENCRYPTION_SETUP.md
+For key rotation procedures, see: docs/security/KEY_ROTATION.md`;
+}
+/**
+ * Validate encryption key strength using advanced entropy validation
+ *
+ * Performs comprehensive validation including:
+ * - Minimum length check
+ * - Shannon entropy calculation
+ * - Pattern detection (repeated sequences, keyboard patterns)
+ * - Unique character ratio analysis
+ *
+ * @param key - The encryption key to validate
+ * @param keyName - Name of the key for error messages
+ * @throws ConfigurationError if key is too weak
+ */
+function validateKeyStrength(key, keyName) {
+    const MIN_KEY_LENGTH = 32;
+    const MIN_ENTROPY_BITS = 128;
+    if (key.length < MIN_KEY_LENGTH) {
+        throw new ConfigurationError(`${keyName} is too short (${key.length} chars). ` +
+            `Minimum length is ${MIN_KEY_LENGTH} characters. ` +
+            `Generate a secure key with: vorion secrets generate --type encryption`, { keyName, actualLength: key.length, requiredLength: MIN_KEY_LENGTH });
+    }
+    // Use advanced entropy validation from crypto-utils
+    const entropyResult = validateEntropy(key, MIN_ENTROPY_BITS);
+    if (!entropyResult.valid) {
+        throw new ConfigurationError(`${keyName} failed entropy validation: ${entropyResult.reason}. ` +
+            `Use a cryptographically random key: vorion secrets generate --type encryption`, {
+            keyName,
+            entropyBits: Math.floor(entropyResult.entropyBits),
+            requiredEntropy: MIN_ENTROPY_BITS,
+            reason: entropyResult.reason,
+        });
+    }
+    // Log warnings about detected patterns
+    if (entropyResult.warnings.length > 0) {
+        logger.warn({
+            keyName,
+            warnings: entropyResult.warnings,
+            entropyBits: Math.floor(entropyResult.entropyBits),
+        }, `${keyName} passed validation but has potential weaknesses`);
+    }
+}
+/**
+ * Derive a 256-bit key using the specified KDF version
+ *
+ * @param kdfVersion - Which key derivation function to use (1=SHA-256 legacy, 2=PBKDF2)
+ * @returns Derived 32-byte key suitable for AES-256
+ * @throws ConfigurationError if encryption key is not configured
+ */
+function deriveKey(kdfVersion = 2) {
+    const config = getConfig();
+    // Get encryption key - REQUIRED, no fallbacks
+    const encryptionKey = config.encryption?.key;
+    if (!encryptionKey) {
+        throw new ConfigurationError(getEncryptionConfigError('VORION_ENCRYPTION_KEY'), { missingKey: 'VORION_ENCRYPTION_KEY', securityMode: getSecurityMode() });
+    }
+    // Validate key strength
+    validateKeyStrength(encryptionKey, 'VORION_ENCRYPTION_KEY');
+    if (kdfVersion === 1) {
+        // Check if v1 is past deprecation date
+        if (isV1Deprecated()) {
+            throw new EncryptionError(`KDF v1 (SHA-256) is no longer supported after ${KDF_V1_DEPRECATION_DATE}. ` +
+                `All encrypted data must be migrated to KDF v2 using 'vorion migrate encryption'.`, {
+                kdfVersion: 1,
+                deprecationDate: KDF_V1_DEPRECATION_DATE,
+                migrationCommand: 'vorion migrate encryption',
+            });
+        }
+        // Increment v1 decryption counter for monitoring
+        v1DecryptionCount++;
+        // Log security warning for every v1 decryption attempt
+        logger.warn({
+            kdfVersion: 1,
+            v1DecryptionCount,
+            deprecationDate: KDF_V1_DEPRECATION_DATE,
+            recommendation: 'Run: vorion migrate encryption',
+        }, 'SECURITY WARNING: Decrypting data with legacy KDF v1 (SHA-256). ' +
+            `This KDF will be disabled after ${KDF_V1_DEPRECATION_DATE}. ` +
+            'Please migrate all encrypted data to KDF v2 (PBKDF2-SHA512).');
+        // Also log the deprecation warning once
+        if (!sha256DeprecationWarningLogged) {
+            sha256DeprecationWarningLogged = true;
+            logger.warn({
+                kdfVersion: 1,
+                migrationGuide: 'Use migrateEnvelope() or migrateEncryptedField() to upgrade encrypted data',
+                cliCommand: 'vorion migrate encryption',
+            }, 'SECURITY DEPRECATION: Legacy SHA-256 key derivation (KDF v1) is deprecated. ' +
+                'This method is cryptographically weak and should only be used for decrypting legacy data. ' +
+                'Run "vorion migrate encryption" to migrate all data to KDF v2.');
+        }
+        return createHash('sha256').update(encryptionKey).digest();
+    }
+    // Version 2: PBKDF2-SHA512 (secure, current)
+    const salt = config.encryption?.salt;
+    if (!salt) {
+        throw new ConfigurationError(getEncryptionConfigError('VORION_ENCRYPTION_SALT'), { missingKey: 'VORION_ENCRYPTION_SALT', securityMode: getSecurityMode() });
+    }
+    // Validate salt (less stringent than key, but still required)
+    if (salt.length < 16) {
+        throw new ConfigurationError(`VORION_ENCRYPTION_SALT is too short (${salt.length} chars). ` +
+            `Minimum length is 16 characters. ` +
+            `Generate a secure salt with: vorion secrets generate --type encryption`, { actualLength: salt.length, requiredLength: 16 });
+    }
+    const iterations = config.encryption?.pbkdf2Iterations ?? 100000;
+    return pbkdf2Sync(encryptionKey, salt, iterations, KEY_LENGTH, 'sha512');
+}
+/**
+ * Get the current KDF version from config
+ */
+function getCurrentKdfVersion() {
+    const config = getConfig();
+    return (config.encryption?.kdfVersion ?? 2);
+}
+/**
+ * Encrypt a value using AES-256-GCM with PBKDF2-derived key
+ */
+export function encrypt(plaintext) {
+    const kdfVersion = getCurrentKdfVersion();
+    const key = deriveKey(kdfVersion);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    return {
+        ciphertext: encrypted.toString('base64'),
+        iv: iv.toString('base64'),
+        authTag: cipher.getAuthTag().toString('base64'),
+        version: 1,
+        kdfVersion,
+    };
+}
+/**
+ * Decrypt a value using AES-256-GCM
+ *
+ * Automatically detects and uses the correct KDF version from the envelope.
+ * This ensures backward compatibility with data encrypted using the legacy SHA-256 method.
+ */
+export function decrypt(envelope) {
+    if (envelope.version !== 1) {
+        throw new EncryptionError(`Unsupported encryption version: ${envelope.version}`, { version: envelope.version });
+    }
+    // Use the KDF version from the envelope, defaulting to v1 for backward compatibility
+    // with data encrypted before kdfVersion was added to envelopes
+    const kdfVersion = envelope.kdfVersion ?? 1;
+    const key = deriveKey(kdfVersion);
+    const iv = Buffer.from(envelope.iv, 'base64');
+    const authTag = Buffer.from(envelope.authTag, 'base64');
+    const ciphertext = Buffer.from(envelope.ciphertext, 'base64');
+    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+    ]);
+    return decrypted.toString('utf8');
+}
+/**
+ * Encrypt a JSON object, returning an encrypted field marker
+ */
+export function encryptObject(data) {
+    const plaintext = JSON.stringify(data);
+    return {
+        __encrypted: true,
+        envelope: encrypt(plaintext),
+    };
+}
+/**
+ * Zod schema for decrypted object data.
+ * Allows any valid JSON object structure but ensures it's not a primitive.
+ */
+const DecryptedObjectSchema = z.record(z.unknown());
+/**
+ * Safe parser for decrypted JSON objects.
+ * Validates the structure and protects against prototype pollution.
+ */
+const parseDecryptedObject = createSafeParser(DecryptedObjectSchema, {
+    maxDepth: 50,
+    maxSize: 10 * 1024 * 1024, // 10MB max for decrypted data
+    stripPrototype: true,
+});
+/**
+ * Decrypt an encrypted field marker back to a JSON object.
+ *
+ * Uses safe JSON parsing with prototype pollution protection
+ * and schema validation to ensure security.
+ */
+export function decryptObject(field) {
+    if (!field.__encrypted || !field.envelope) {
+        throw new EncryptionError('Invalid encrypted field format', { hasEncryptedFlag: !!field.__encrypted, hasEnvelope: !!field.envelope });
+    }
+    const plaintext = decrypt(field.envelope);
+    try {
+        // Use safe JSON parser with schema validation and prototype pollution protection
+        return parseDecryptedObject(plaintext);
+    }
+    catch (error) {
+        // Re-throw as EncryptionError to maintain consistent error handling
+        throw new EncryptionError(`Failed to parse decrypted JSON: ${error instanceof Error ? error.message : 'Unknown error'}`, {
+            originalError: error instanceof Error ? error.message : String(error),
+            plaintextLength: plaintext.length,
+        });
+    }
+}
+/**
+ * Check if a value is an encrypted field
+ */
+export function isEncryptedField(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        '__encrypted' in value &&
+        value.__encrypted === true &&
+        'envelope' in value);
+}
+/**
+ * Compute SHA-256 hash for tamper detection
+ */
+export function computeHash(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/**
+ * Compute chained hash (includes previous hash for chain integrity)
+ */
+export function computeChainedHash(data, previousHash) {
+    return createHash('sha256')
+        .update(previousHash)
+        .update(data)
+        .digest('hex');
+}
+// ============================================================================
+// Migration Utilities
+// ============================================================================
+/**
+ * Check if an envelope needs migration to the current KDF version
+ *
+ * @param envelope - The encrypted envelope to check
+ * @returns true if the envelope uses an older KDF version than current config
+ */
+export function needsMigration(envelope) {
+    const currentVersion = getCurrentKdfVersion();
+    const envelopeVersion = envelope.kdfVersion ?? 1;
+    return envelopeVersion < currentVersion;
+}
+/**
+ * Migrate an encrypted envelope to the current KDF version
+ *
+ * This decrypts the data using its original KDF and re-encrypts with the current KDF.
+ * Use this during a migration window to upgrade legacy encrypted data.
+ *
+ * @param envelope - The encrypted envelope to migrate
+ * @returns New envelope encrypted with current KDF version
+ * @throws EncryptionError if decryption or re-encryption fails
+ */
+export function migrateEnvelope(envelope) {
+    if (!needsMigration(envelope)) {
+        return envelope; // Already at current version
+    }
+    // Decrypt with original KDF version (handled automatically by decrypt)
+    const plaintext = decrypt(envelope);
+    // Re-encrypt with current KDF version
+    return encrypt(plaintext);
+}
+/**
+ * Migrate an encrypted field to the current KDF version
+ *
+ * @param field - The encrypted field to migrate
+ * @returns New field with envelope encrypted using current KDF version
+ */
+export function migrateEncryptedField(field) {
+    if (!needsMigration(field.envelope)) {
+        return field;
+    }
+    return {
+        __encrypted: true,
+        envelope: migrateEnvelope(field.envelope),
+    };
+}
+/**
+ * Get the KDF version used in an envelope
+ *
+ * @param envelope - The envelope to check
+ * @returns The KDF version (1 for legacy, 2 for PBKDF2)
+ */
+export function getEnvelopeKdfVersion(envelope) {
+    return envelope.kdfVersion ?? 1;
+}
+/**
+ * Migrate encrypted data to the latest KDF version
+ *
+ * This is the main migration function that handles any encrypted data format.
+ * It automatically detects the format (envelope or field) and migrates accordingly.
+ *
+ * @param encryptedData - Encrypted envelope or field to migrate
+ * @returns Migrated data in the same format as input
+ * @throws EncryptionError if migration fails
+ *
+ * @example
+ * ```typescript
+ * // Migrate an envelope
+ * const migratedEnvelope = migrateToLatestKdf(legacyEnvelope);
+ *
+ * // Migrate an encrypted field
+ * const migratedField = migrateToLatestKdf(legacyField);
+ * ```
+ */
+export function migrateToLatestKdf(encryptedData) {
+    // Check if it's an encrypted field
+    if ('__encrypted' in encryptedData && encryptedData.__encrypted === true) {
+        return migrateEncryptedField(encryptedData);
+    }
+    // It's an envelope
+    return migrateEnvelope(encryptedData);
+}
+/**
+ * Get the v1 KDF deprecation status and information
+ *
+ * Use this to check deprecation status and show appropriate warnings to users.
+ *
+ * @returns Deprecation status information
+ */
+export function getKdfDeprecationStatus() {
+    const deprecationDate = new Date(KDF_V1_DEPRECATION_DATE);
+    const now = new Date();
+    const diffMs = deprecationDate.getTime() - now.getTime();
+    const daysUntil = Math.ceil(diffMs / (1000 * 60 * 60 * 24));
+    return {
+        isDeprecated: isV1Deprecated(),
+        deprecationDate: KDF_V1_DEPRECATION_DATE,
+        daysUntilDeprecation: Math.max(0, daysUntil),
+        v1DecryptionCount,
+    };
+}
+/**
+ * Check startup for v1 encrypted data and log warnings
+ *
+ * Call this during application startup to warn about legacy encrypted data
+ * that needs migration.
+ *
+ * @param envelopes - Array of encrypted envelopes to check
+ * @returns Object with counts of v1 and v2 envelopes
+ */
+export function checkStartupEncryption(envelopes) {
+    let v1Count = 0;
+    let v2Count = 0;
+    for (const envelope of envelopes) {
+        const version = getEnvelopeKdfVersion(envelope);
+        if (version === 1) {
+            v1Count++;
+        }
+        else {
+            v2Count++;
+        }
+    }
+    const needsMigration = v1Count > 0;
+    if (needsMigration) {
+        const deprecationStatus = getKdfDeprecationStatus();
+        if (deprecationStatus.isDeprecated) {
+            logger.error({
+                v1Count,
+                v2Count,
+                deprecationDate: deprecationStatus.deprecationDate,
+            }, 'CRITICAL: Found v1 encrypted data after deprecation date. ' +
+                'Decryption of this data will fail. Run "vorion migrate encryption" immediately.');
+        }
+        else {
+            logger.warn({
+                v1Count,
+                v2Count,
+                deprecationDate: deprecationStatus.deprecationDate,
+                daysRemaining: deprecationStatus.daysUntilDeprecation,
+            }, `STARTUP WARNING: Found ${v1Count} envelope(s) using deprecated KDF v1. ` +
+                `These must be migrated before ${deprecationStatus.deprecationDate} ` +
+                `(${deprecationStatus.daysUntilDeprecation} days remaining). ` +
+                'Run "vorion migrate encryption" to migrate.');
+        }
+    }
+    return { v1Count, v2Count, needsMigration };
+}
+/**
+ * Migrate a batch of envelopes with progress tracking
+ *
+ * @param envelopes - Array of envelopes to migrate
+ * @param onProgress - Optional callback for progress updates
+ * @returns Batch migration result with statistics
+ */
+export function migrateEnvelopeBatch(envelopes, onProgress) {
+    const results = [];
+    const stats = {
+        total: envelopes.length,
+        migrated: 0,
+        skipped: 0,
+        failed: 0,
+        errors: [],
+    };
+    for (let i = 0; i < envelopes.length; i++) {
+        const envelope = envelopes[i];
+        try {
+            if (needsMigration(envelope)) {
+                results.push(migrateEnvelope(envelope));
+                stats.migrated++;
+            }
+            else {
+                results.push(envelope);
+                stats.skipped++;
+            }
+        }
+        catch (error) {
+            stats.failed++;
+            stats.errors.push({
+                index: i,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            // Keep the original envelope on failure
+            results.push(envelope);
+        }
+        if (onProgress) {
+            onProgress(i + 1, envelopes.length);
+        }
+    }
+    return { results, stats };
+}
+/**
+ * Create an encryptIfEnabled function with injected configuration.
+ *
+ * This factory function removes the service locator anti-pattern by
+ * accepting configuration via parameter rather than calling getConfig().
+ *
+ * NOTE: This version does not include tracing to avoid circular dependencies.
+ * Use the traceEncryptSync wrapper from intent/tracing.js when tracing is needed.
+ *
+ * @param config - Application configuration (for encryption settings)
+ * @returns Function that encrypts data if encryption is enabled in config
+ *
+ * @example
+ * // With dependency injection
+ * const encryptIfEnabled = createEncryptIfEnabled(config);
+ * const encrypted = encryptIfEnabled(sensitiveData);
+ *
+ * @example
+ * // For testing
+ * const mockConfig = { intent: { encryptContext: false } } as Config;
+ * const encryptIfEnabled = createEncryptIfEnabled(mockConfig);
+ */
+export function createEncryptIfEnabled(config) {
+    return (data) => {
+        if (config.intent.encryptContext) {
+            return encryptObject(data);
+        }
+        return data;
+    };
+}
+//# sourceMappingURL=encryption.js.map

package/dist/common/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/common/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAiB,gBAAgB,EAAwC,MAAM,gBAAgB,CAAC;AAEvG,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AAEzD;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C;;GAEG;AACH,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B;;;GAGG;AACH,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAE7C;;GAEG;AACH,SAAS,cAAc;IACrB,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1D,OAAO,IAAI,IAAI,EAAE,GAAG,eAAe,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,uBAAuB;AAmD9C;;GAEG;AACH,SAAS,wBAAwB,CAAC,UAAkB;IAClD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,OAAO,aAAa,UAAU;;8DAE8B,YAAY;;;;;;;;;;;;;;;;gEAgBV,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,OAAe;IACvD,MAAM,cAAc,GAAG,EAAE,CAAC;IAC1B,MAAM,gBAAgB,GAAG,GAAG,CAAC;IAE7B,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAC1B,GAAG,OAAO,kBAAkB,GAAG,CAAC,MAAM,WAAW;YACjD,qBAAqB,cAAc,eAAe;YAClD,uEAAuE,EACvE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAE7D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC1B,GAAG,OAAO,+BAA+B,aAAa,CAAC,MAAM,IAAI;YACjE,+EAA+E,EAC/E;YACE,OAAO;YACP,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC;YAClD,eAAe,EAAE,gBAAgB;YACjC,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CACT;YACE,OAAO;YACP,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC;SACnD,EACD,GAAG,OAAO,iDAAiD,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,aAAyB,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,8CAA8C;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC;IAC7C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,CAAC,uBAAuB,CAAC,EACjD,EAAE,UAAU,EAAE,uBAAuB,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,mBAAmB,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IAE5D,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,uCAAuC;QACvC,IAAI,cAAc,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,iDAAiD,uBAAuB,IAAI;gBAC5E,kFAAkF,EAClF;gBACE,UAAU,EAAE,CAAC;gBACb,eAAe,EAAE,uBAAuB;gBACxC,gBAAgB,EAAE,2BAA2B;aAC9C,CACF,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,iBAAiB,EAAE,CAAC;QAEpB,uDAAuD;QACvD,MAAM,CAAC,IAAI,CACT;YACE,UAAU,EAAE,CAAC;YACb,iBAAiB;YACjB,eAAe,EAAE,uBAAuB;YACxC,cAAc,EAAE,gCAAgC;SACjD,EACD,kEAAkE;YAClE,mCAAmC,uBAAuB,IAAI;YAC9D,8DAA8D,CAC/D,CAAC;QAEF,wCAAwC;QACxC,IAAI,CAAC,8BAA8B,EAAE,CAAC;YACpC,8BAA8B,GAAG,IAAI,CAAC;YACtC,MAAM,CAAC,IAAI,CACT;gBACE,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,4EAA4E;gBAC5F,UAAU,EAAE,2BAA2B;aACxC,EACD,8EAA8E;gBAC9E,4FAA4F;gBAC5F,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,6CAA6C;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,CAAC,wBAAwB,CAAC,EAClD,EAAE,UAAU,EAAE,wBAAwB,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,kBAAkB,CAC1B,wCAAwC,IAAI,CAAC,MAAM,WAAW;YAC9D,mCAAmC;YACnC,wEAAwE,EACxE,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,IAAI,MAAM,CAAC;IAEjE,OAAO,UAAU,CACf,aAAa,EACb,IAAI,EACJ,UAAU,EACV,UAAU,EACV,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB;IAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,IAAI,CAAC,CAAe,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,OAAO,EAAE,CAAC;QACV,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,QAA2B;IACjD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,mCAAmC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,qFAAqF;IACrF,+DAA+D;IAC/D,MAAM,UAAU,GAAe,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAA6B;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,qBAAqB,EAAE;IACnE,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,8BAA8B;IACzD,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC;QACH,iFAAiF;QACjF,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oEAAoE;QACpE,MAAM,IAAI,eAAe,CACvB,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EAC7F;YACE,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACrE,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,aAAa,IAAI,KAAK;QACrB,KAAwB,CAAC,WAAW,KAAK,IAAI;QAC9C,UAAU,IAAI,KAAK,CACpB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,YAAoB;IACnE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAA2B;IACxD,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;IACjD,OAAO,eAAe,GAAG,cAAc,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,CAAC,6BAA6B;IAChD,CAAC;IAED,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpC,sCAAsC;IACtC,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,OAAO,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;AAClC,CAAC;AAwBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAiD;IAEjD,mCAAmC;IACnC,IAAI,aAAa,IAAI,aAAa,IAAI,aAAa,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACzE,OAAO,qBAAqB,CAAC,aAA+B,CAAC,CAAC;IAChE,CAAC;IAED,mBAAmB;IACnB,OAAO,eAAe,CAAC,aAAkC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IAMrC,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,YAAY,EAAE,cAAc,EAAE;QAC9B,eAAe,EAAE,uBAAuB;QACxC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;QAC5C,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA8B;IAE9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,CAAC;IAEnC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,iBAAiB,GAAG,uBAAuB,EAAE,CAAC;QAEpD,IAAI,iBAAiB,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CACV;gBACE,OAAO;gBACP,OAAO;gBACP,eAAe,EAAE,iBAAiB,CAAC,eAAe;aACnD,EACD,4DAA4D;gBAC5D,iFAAiF,CAClF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT;gBACE,OAAO;gBACP,OAAO;gBACP,eAAe,EAAE,iBAAiB,CAAC,eAAe;gBAClD,aAAa,EAAE,iBAAiB,CAAC,oBAAoB;aACtD,EACD,0BAA0B,OAAO,wCAAwC;gBACzE,iCAAiC,iBAAiB,CAAC,eAAe,GAAG;gBACrE,IAAI,iBAAiB,CAAC,oBAAoB,oBAAoB;gBAC9D,6CAA6C,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA8B,EAC9B,UAAqD;IAErD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAyB;QAClC,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,wCAAwC;YACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc;IAEd,OAAO,CAAC,IAA6B,EAAW,EAAE;QAChD,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACjC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/common/error-sanitizer.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Error Sanitizer
+ *
+ * Removes sensitive information from errors before returning to clients.
+ * Prevents leaking internal details like file paths, stack traces,
+ * database schema, and internal service names.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Sanitized error safe to return to clients
+ */
+export interface SanitizedError {
+    /** Error code for client handling */
+    code: string;
+    /** User-friendly error message (no internal details) */
+    message: string;
+    /** Request ID for correlation with server logs */
+    requestId: string;
+}
+/**
+ * Sanitize an error message by removing sensitive information
+ *
+ * @param message - The error message to sanitize
+ * @returns Sanitized message safe for client consumption
+ */
+export declare function sanitizeErrorMessage(message: string): string;
+/**
+ * Sanitize an error for safe client consumption
+ *
+ * Full error details are logged server-side for debugging.
+ * Only sanitized, generic information is returned for clients.
+ *
+ * @param error - The error to sanitize
+ * @param requestId - Optional request ID for correlation (generated if not provided)
+ * @returns Sanitized error safe to return to clients
+ */
+export declare function sanitizeError(error: Error, requestId?: string): SanitizedError;
+/**
+ * Generate a unique request ID for error correlation
+ */
+export declare function generateRequestId(): string;
+/**
+ * Create an error response object for HTTP responses
+ *
+ * @param error - The error to convert
+ * @param requestId - Request ID for correlation
+ * @param statusCode - HTTP status code (determined from error if not provided)
+ * @returns Error response object
+ */
+export declare function createErrorResponse(error: Error, requestId?: string, statusCode?: number): {
+    statusCode: number;
+    body: SanitizedError;
+};
+/**
+ * Wrap an async function with error sanitization
+ *
+ * @param fn - The async function to wrap
+ * @param requestId - Request ID for error correlation
+ * @returns Wrapped function that sanitizes errors
+ */
+export declare function withErrorSanitization<T extends (...args: unknown[]) => Promise<unknown>>(fn: T, requestId?: string): (...args: Parameters<T>) => Promise<ReturnType<T> | SanitizedError>;
+/**
+ * Check if an object is a SanitizedError
+ */
+export declare function isSanitizedError(obj: unknown): obj is SanitizedError;
+//# sourceMappingURL=error-sanitizer.d.ts.map

package/dist/common/error-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-sanitizer.d.ts","sourceRoot":"","sources":["../../src/common/error-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;CAEnB;AAyGD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyB5D;AA0DD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CAoC9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,KAAK,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB;IACD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;CACtB,CAUA;AAsBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EACtF,EAAE,EAAE,CAAC,EACL,SAAS,CAAC,EAAE,MAAM,GACjB,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAWrE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc,CAYpE"}