@vorionsys/platform-core 0.1.0

package/dist/security/encryption/middleware.js

@@ -0,0 +1,493 @@
+/**
+ * Database Middleware for Field-Level Encryption
+ *
+ * Provides transparent encryption/decryption hooks for database operations.
+ * Supports integration with Drizzle ORM and other database layers.
+ *
+ * Features:
+ * - Automatic encryption on insert/update
+ * - Automatic decryption on select
+ * - Configurable per-table policies
+ * - Transaction support
+ * - Batch operation optimization
+ * - Error handling with fallback options
+ *
+ * @example
+ * ```typescript
+ * import { createEncryptionMiddleware } from './middleware';
+ *
+ * const middleware = createEncryptionMiddleware({
+ *   policies: {
+ *     users: userEncryptionPolicy,
+ *     patients: patientEncryptionPolicy,
+ *   },
+ * });
+ *
+ * // Apply to Drizzle
+ * const db = drizzle(connection, {
+ *   ...middleware.drizzleConfig,
+ * });
+ * ```
+ *
+ * @packageDocumentation
+ * @module security/encryption/middleware
+ */
+import { createLogger } from '../../common/logger.js';
+import { getFieldEncryptionService } from './service.js';
+import { isEncryptedFieldMarker } from './types.js';
+import { generatePolicy } from './decorators.js';
+const logger = createLogger({ component: 'encryption-middleware' });
+// =============================================================================
+// Encryption Middleware
+// =============================================================================
+/**
+ * Database encryption middleware
+ *
+ * Provides hooks for automatic field-level encryption and decryption
+ * during database operations.
+ */
+export class EncryptionMiddleware {
+    config;
+    encryptionService;
+    initialized = false;
+    constructor(config) {
+        this.config = {
+            failOnError: true,
+            debug: false,
+            ...config,
+        };
+        this.encryptionService = config.encryptionService ?? getFieldEncryptionService();
+    }
+    /**
+     * Initialize the middleware
+     */
+    async initialize() {
+        if (this.initialized) {
+            logger.warn('EncryptionMiddleware already initialized');
+            return;
+        }
+        logger.info('Initializing EncryptionMiddleware');
+        await this.encryptionService.initialize();
+        this.initialized = true;
+        logger.info({ tableCount: Object.keys(this.config.policies).length }, 'EncryptionMiddleware initialized');
+    }
+    /**
+     * Ensure middleware is initialized
+     */
+    ensureInitialized() {
+        if (!this.initialized) {
+            throw new Error('EncryptionMiddleware not initialized. Call initialize() first.');
+        }
+    }
+    /**
+     * Get policy for a table
+     */
+    getPolicy(tableName) {
+        return this.config.policies[tableName];
+    }
+    /**
+     * Extract tenant ID from context
+     */
+    extractTenantId(context) {
+        if (context.tenantId)
+            return context.tenantId;
+        if (this.config.getTenantId) {
+            return this.config.getTenantId(context);
+        }
+        return this.config.defaultTenantId;
+    }
+    /**
+     * Pre-insert hook - encrypts fields before insert
+     *
+     * @param data - The data to be inserted
+     * @param context - Operation context
+     * @returns Processed data with encrypted fields
+     */
+    async beforeInsert(data, context) {
+        this.ensureInitialized();
+        const policy = this.getPolicy(context.tableName);
+        if (!policy) {
+            return { data, processedFields: [] };
+        }
+        return this.encryptData(data, policy, context);
+    }
+    /**
+     * Pre-update hook - encrypts fields before update
+     *
+     * @param data - The data to be updated
+     * @param context - Operation context
+     * @returns Processed data with encrypted fields
+     */
+    async beforeUpdate(data, context) {
+        this.ensureInitialized();
+        const policy = this.getPolicy(context.tableName);
+        if (!policy) {
+            return { data, processedFields: [] };
+        }
+        return this.encryptData(data, policy, context);
+    }
+    /**
+     * Post-select hook - decrypts fields after select
+     *
+     * @param data - The data retrieved from database
+     * @param context - Operation context
+     * @returns Processed data with decrypted fields
+     */
+    async afterSelect(data, context) {
+        this.ensureInitialized();
+        const policy = this.getPolicy(context.tableName);
+        if (!policy) {
+            return { data, processedFields: [] };
+        }
+        return this.decryptData(data, policy, context);
+    }
+    /**
+     * Batch pre-insert hook - encrypts fields for multiple records
+     */
+    async beforeInsertMany(records, context) {
+        this.ensureInitialized();
+        const policy = this.getPolicy(context.tableName);
+        if (!policy) {
+            return { data: records, processedFields: [] };
+        }
+        const results = await Promise.all(records.map((record) => this.encryptData(record, policy, context)));
+        const processedFields = new Set();
+        const errors = [];
+        for (const result of results) {
+            result.processedFields.forEach((f) => processedFields.add(f));
+            if (result.errors) {
+                errors.push(...result.errors);
+            }
+        }
+        return {
+            data: results.map((r) => r.data),
+            processedFields: Array.from(processedFields),
+            errors: errors.length > 0 ? errors : undefined,
+        };
+    }
+    /**
+     * Batch post-select hook - decrypts fields for multiple records
+     */
+    async afterSelectMany(records, context) {
+        this.ensureInitialized();
+        const policy = this.getPolicy(context.tableName);
+        if (!policy) {
+            return { data: records, processedFields: [] };
+        }
+        const results = await Promise.all(records.map((record) => this.decryptData(record, policy, context)));
+        const processedFields = new Set();
+        const errors = [];
+        for (const result of results) {
+            result.processedFields.forEach((f) => processedFields.add(f));
+            if (result.errors) {
+                errors.push(...result.errors);
+            }
+        }
+        return {
+            data: results.map((r) => r.data),
+            processedFields: Array.from(processedFields),
+            errors: errors.length > 0 ? errors : undefined,
+        };
+    }
+    /**
+     * Encrypt data according to policy
+     */
+    async encryptData(data, policy, context) {
+        const result = { ...data };
+        const processedFields = [];
+        const errors = [];
+        const tenantId = this.extractTenantId(context);
+        for (const fieldPolicy of policy.fields) {
+            if (!fieldPolicy.encrypted)
+                continue;
+            const value = this.getNestedValue(data, fieldPolicy.fieldName);
+            // Skip if value is null, undefined, or already encrypted
+            if (value === null || value === undefined)
+                continue;
+            if (isEncryptedFieldMarker(value))
+                continue;
+            try {
+                const encrypted = await this.encryptionService.encrypt(String(value), {
+                    fieldName: fieldPolicy.fieldName,
+                    classification: fieldPolicy.classification,
+                    algorithm: fieldPolicy.algorithm,
+                    deterministic: fieldPolicy.deterministic,
+                    tenantId,
+                });
+                this.setNestedValue(result, fieldPolicy.fieldName, encrypted);
+                processedFields.push(fieldPolicy.fieldName);
+                if (this.config.debug) {
+                    logger.debug({ field: fieldPolicy.fieldName, table: context.tableName }, 'Field encrypted');
+                }
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                if (this.config.failOnError) {
+                    throw error;
+                }
+                errors.push({ field: fieldPolicy.fieldName, error: errorMessage });
+                logger.error({ error, field: fieldPolicy.fieldName, table: context.tableName }, 'Failed to encrypt field');
+            }
+        }
+        return {
+            data: result,
+            processedFields,
+            errors: errors.length > 0 ? errors : undefined,
+        };
+    }
+    /**
+     * Decrypt data according to policy
+     */
+    async decryptData(data, policy, context) {
+        const result = { ...data };
+        const processedFields = [];
+        const errors = [];
+        const tenantId = this.extractTenantId(context);
+        for (const fieldPolicy of policy.fields) {
+            if (!fieldPolicy.encrypted)
+                continue;
+            const value = this.getNestedValue(data, fieldPolicy.fieldName);
+            // Skip if not encrypted
+            if (!isEncryptedFieldMarker(value))
+                continue;
+            try {
+                const decrypted = await this.encryptionService.decrypt(value, {
+                    fieldName: fieldPolicy.fieldName,
+                    tenantId,
+                });
+                this.setNestedValue(result, fieldPolicy.fieldName, decrypted);
+                processedFields.push(fieldPolicy.fieldName);
+                if (this.config.debug) {
+                    logger.debug({ field: fieldPolicy.fieldName, table: context.tableName }, 'Field decrypted');
+                }
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                if (this.config.failOnError) {
+                    throw error;
+                }
+                errors.push({ field: fieldPolicy.fieldName, error: errorMessage });
+                logger.error({ error, field: fieldPolicy.fieldName, table: context.tableName }, 'Failed to decrypt field');
+            }
+        }
+        return {
+            data: result,
+            processedFields,
+            errors: errors.length > 0 ? errors : undefined,
+        };
+    }
+    /**
+     * Get nested value from object using dot notation
+     */
+    getNestedValue(obj, path) {
+        const parts = path.split('.');
+        let current = obj;
+        for (const part of parts) {
+            if (current === null || current === undefined)
+                return undefined;
+            if (typeof current !== 'object')
+                return undefined;
+            current = current[part];
+        }
+        return current;
+    }
+    /**
+     * Set nested value in object using dot notation
+     */
+    setNestedValue(obj, path, value) {
+        const parts = path.split('.');
+        let current = obj;
+        for (let i = 0; i < parts.length - 1; i++) {
+            const part = parts[i];
+            if (!(part in current) || typeof current[part] !== 'object') {
+                current[part] = {};
+            }
+            current = current[part];
+        }
+        current[parts[parts.length - 1]] = value;
+    }
+    /**
+     * Create Drizzle ORM compatible configuration
+     *
+     * Returns configuration hooks that can be passed to Drizzle.
+     */
+    getDrizzleConfig() {
+        return {
+            beforeInsert: this.beforeInsert.bind(this),
+            beforeUpdate: this.beforeUpdate.bind(this),
+            afterSelect: this.afterSelect.bind(this),
+            beforeInsertMany: this.beforeInsertMany.bind(this),
+            afterSelectMany: this.afterSelectMany.bind(this),
+        };
+    }
+    /**
+     * Shutdown the middleware
+     */
+    async shutdown() {
+        logger.info('Shutting down EncryptionMiddleware');
+        this.initialized = false;
+        logger.info('EncryptionMiddleware shutdown complete');
+    }
+}
+// =============================================================================
+// Factory Functions
+// =============================================================================
+/**
+ * Create encryption middleware instance
+ */
+export function createEncryptionMiddleware(config) {
+    return new EncryptionMiddleware(config);
+}
+/**
+ * Create middleware from decorated classes
+ *
+ * Automatically generates policies from class decorators.
+ *
+ * @example
+ * ```typescript
+ * const middleware = createMiddlewareFromClasses({
+ *   User: UserEntity,
+ *   Patient: PatientEntity,
+ * });
+ * ```
+ */
+export function createMiddlewareFromClasses(classMap, options) {
+    const policies = {};
+    for (const [tableName, cls] of Object.entries(classMap)) {
+        const policy = generatePolicy(cls, tableName);
+        if (policy.fields.length > 0) {
+            policies[tableName] = policy;
+        }
+    }
+    return createEncryptionMiddleware({
+        ...options,
+        policies,
+    });
+}
+// =============================================================================
+// Singleton Management
+// =============================================================================
+let defaultMiddleware = null;
+/**
+ * Get the default encryption middleware instance
+ */
+export function getEncryptionMiddleware() {
+    return defaultMiddleware;
+}
+/**
+ * Set the default encryption middleware instance
+ */
+export function setEncryptionMiddleware(middleware) {
+    defaultMiddleware = middleware;
+}
+/**
+ * Reset the default encryption middleware (for testing)
+ */
+export async function resetEncryptionMiddleware() {
+    if (defaultMiddleware) {
+        await defaultMiddleware.shutdown();
+        defaultMiddleware = null;
+    }
+}
+// =============================================================================
+// Utility Functions
+// =============================================================================
+/**
+ * Create a policy builder for fluent policy creation
+ *
+ * @example
+ * ```typescript
+ * const policy = policyBuilder('users')
+ *   .addField('ssn', DataClassification.RESTRICTED)
+ *   .addSearchableField('email', DataClassification.CONFIDENTIAL)
+ *   .addField('phone', DataClassification.CONFIDENTIAL, { algorithm: 'chacha20-poly1305' })
+ *   .build();
+ * ```
+ */
+export function policyBuilder(entityName) {
+    return new PolicyBuilder(entityName);
+}
+/**
+ * Fluent policy builder
+ */
+export class PolicyBuilder {
+    entityName;
+    fields = [];
+    description;
+    defaultClassification;
+    strictMode = false;
+    constructor(entityName) {
+        this.entityName = entityName;
+    }
+    /**
+     * Add a field to the policy
+     */
+    addField(fieldName, classification, options) {
+        this.fields.push({
+            fieldName,
+            classification,
+            encrypted: true,
+            algorithm: options?.algorithm,
+            keyDerivationSuffix: options?.keyDerivationSuffix,
+        });
+        return this;
+    }
+    /**
+     * Add a searchable (deterministic) encrypted field
+     */
+    addSearchableField(fieldName, classification, options) {
+        this.fields.push({
+            fieldName,
+            classification,
+            encrypted: true,
+            deterministic: true,
+            keyDerivationSuffix: options?.keyDerivationSuffix,
+        });
+        return this;
+    }
+    /**
+     * Add a non-encrypted field (for documentation)
+     */
+    addUnencryptedField(fieldName, classification) {
+        this.fields.push({
+            fieldName,
+            classification,
+            encrypted: false,
+        });
+        return this;
+    }
+    /**
+     * Set policy description
+     */
+    withDescription(description) {
+        this.description = description;
+        return this;
+    }
+    /**
+     * Set default classification for unlisted fields
+     */
+    withDefaultClassification(classification) {
+        this.defaultClassification = classification;
+        return this;
+    }
+    /**
+     * Enable strict mode (fail on unlisted fields)
+     */
+    withStrictMode(strict = true) {
+        this.strictMode = strict;
+        return this;
+    }
+    /**
+     * Build the policy
+     */
+    build() {
+        return {
+            entityName: this.entityName,
+            description: this.description,
+            fields: this.fields,
+            defaultClassification: this.defaultClassification,
+            strictMode: this.strictMode,
+        };
+    }
+}
+//# sourceMappingURL=middleware.js.map

package/dist/security/encryption/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/security/encryption/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAKzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAsB,cAAc,EAA+B,MAAM,iBAAiB,CAAC;AAElG,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAkEpE,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAA6B;IACnC,iBAAiB,CAAyB;IACnD,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,MAAkC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,KAAK;YACZ,GAAG,MAAM;SACV,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,yBAAyB,EAAE,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,IAAI,CACT,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EACxD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAyB;QAC/C,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,IAAO,EACP,OAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,IAAO,EACP,OAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,IAAO,EACP,OAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAY,EACZ,OAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CACnE,CAAC;QAEF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,MAAM,MAAM,GAA4C,EAAE,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAChC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAY,EACZ,OAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CACnE,CAAC;QAEF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,MAAM,MAAM,GAA4C,EAAE,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAChC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CACvB,IAAO,EACP,MAA6B,EAC7B,OAAyB;QAEzB,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,MAAM,GAA4C,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,SAAS;gBAAE,SAAS;YAErC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YAE/D,yDAAyD;YACzD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpD,IAAI,sBAAsB,CAAC,KAAK,CAAC;gBAAE,SAAS;YAE5C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACpE,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,aAAa,EAAE,WAAW,CAAC,aAAa;oBACxC,QAAQ;iBACT,CAAC,CAAC;gBAEH,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9D,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAE5C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACtB,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAC1D,iBAAiB,CAClB,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAE9E,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC5B,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EACjE,yBAAyB,CAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,eAAe;YACf,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CACvB,IAAO,EACP,MAA6B,EAC7B,OAAyB;QAEzB,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,MAAM,GAA4C,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,SAAS;gBAAE,SAAS;YAErC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YAE/D,wBAAwB;YACxB,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;gBAAE,SAAS;YAE7C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAA6B,EAAE;oBACpF,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,QAAQ;iBACT,CAAC,CAAC;gBAEH,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9D,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBAE5C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACtB,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAC1D,iBAAiB,CAClB,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAE9E,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC5B,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EACjE,yBAAyB,CAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,eAAe;YACf,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAA4B,EAAE,IAAY;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;QAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChE,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAA4B,EAAE,IAAY,EAAE,KAAc;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAA4B,GAAG,CAAC;QAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACd,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1C,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACxC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAClD,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;SACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;CACF;AA4BD,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAkC;IAElC,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA6D,EAC7D,OAAsD;IAEtD,MAAM,QAAQ,GAA0C,EAAE,CAAC;IAE3D,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,GAAG,OAAO;QACV,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,IAAI,iBAAiB,GAAgC,IAAI,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAgC;IACtE,iBAAiB,GAAG,UAAU,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QACnC,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,aAAa;IACP,UAAU,CAAS;IACnB,MAAM,GAAoC,EAAE,CAAC;IACtD,WAAW,CAAU;IACrB,qBAAqB,CAA2C;IAChE,UAAU,GAAG,KAAK,CAAC;IAE3B,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,SAAiB,EACjB,cAAuD,EACvD,OAGC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,SAAS;YACT,cAAc;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,mBAAmB,EAAE,OAAO,EAAE,mBAAmB;SAClD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,SAAiB,EACjB,cAAuD,EACvD,OAEC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,SAAS;YACT,cAAc;YACd,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,OAAO,EAAE,mBAAmB;SAClD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,SAAiB,EACjB,cAAuD;QAEvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,SAAS;YACT,cAAc;YACd,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,WAAmB;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,yBAAyB,CACvB,cAAuD;QAEvD,IAAI,CAAC,qBAAqB,GAAG,cAAc,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAM,GAAG,IAAI;QAC1B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/security/encryption/service.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Field-Level Encryption Service
+ *
+ * Core encryption service providing transparent field-level encryption
+ * for sensitive data stored in the database.
+ *
+ * Features:
+ * - AES-256-GCM authenticated encryption (default)
+ * - ChaCha20-Poly1305 support
+ * - Unique IV per encryption operation
+ * - AAD (Additional Authenticated Data) for field binding
+ * - Key versioning for rotation support
+ * - Deterministic encryption for searchable fields
+ * - Object-level encryption with policy support
+ * - Audit logging for all operations
+ *
+ * Security guarantees:
+ * - Confidentiality: Data is encrypted with strong algorithms
+ * - Integrity: AEAD provides authentication
+ * - Field binding: AAD prevents field swapping attacks
+ * - Key isolation: Field-specific keys via HKDF
+ *
+ * @packageDocumentation
+ * @module security/encryption/service
+ */
+import type { KeyProvider } from './key-provider.js';
+import type { EncryptedFieldMarker, EncryptionConfig, EncryptOptions, DecryptOptions, ReencryptOptions, FieldEncryptionPolicy, AuditCallback } from './types.js';
+/**
+ * Custom error class for encryption operations
+ */
+export declare class FieldEncryptionError extends Error {
+    readonly code: string;
+    readonly details?: Record<string, unknown>;
+    constructor(message: string, code: string, details?: Record<string, unknown>);
+}
+/**
+ * Field-level encryption service
+ *
+ * Provides methods for encrypting and decrypting individual fields
+ * with support for key versioning, AAD binding, and audit logging.
+ *
+ * @example
+ * ```typescript
+ * const service = createFieldEncryptionService();
+ * await service.initialize();
+ *
+ * // Encrypt a sensitive field
+ * const encrypted = await service.encrypt('123-45-6789', {
+ *   fieldName: 'ssn',
+ *   classification: DataClassification.RESTRICTED,
+ * });
+ *
+ * // Decrypt the field
+ * const plaintext = await service.decrypt(encrypted, {
+ *   fieldName: 'ssn',
+ * });
+ * ```
+ */
+export declare class FieldEncryptionService {
+    private readonly config;
+    private readonly keyProvider;
+    private readonly auditCallbacks;
+    private initialized;
+    constructor(config?: Partial<EncryptionConfig>, keyProvider?: KeyProvider);
+    /**
+     * Initialize the encryption service
+     */
+    initialize(): Promise<void>;
+    /**
+     * Ensure the service is initialized
+     */
+    private ensureInitialized;
+    /**
+     * Register an audit callback
+     */
+    onAudit(callback: AuditCallback): void;
+    /**
+     * Emit audit event
+     */
+    private emitAudit;
+    /**
+     * Check if encryption is required for the given classification
+     */
+    private requiresEncryption;
+    /**
+     * Build Additional Authenticated Data (AAD)
+     */
+    private buildAAD;
+    /**
+     * Encrypt a plaintext value
+     *
+     * @param plaintext - The value to encrypt
+     * @param options - Encryption options
+     * @returns Encrypted field marker ready for storage
+     */
+    encrypt(plaintext: string, options?: EncryptOptions): Promise<EncryptedFieldMarker>;
+    /**
+     * Decrypt an encrypted field
+     *
+     * @param encryptedMarker - The encrypted field marker
+     * @param options - Decryption options
+     * @returns Decrypted plaintext
+     */
+    decrypt(encryptedMarker: EncryptedFieldMarker, options?: DecryptOptions): Promise<string>;
+    /**
+     * Encrypt multiple fields in an object according to a policy
+     *
+     * @param obj - The object containing fields to encrypt
+     * @param policy - The encryption policy defining which fields to encrypt
+     * @param tenantId - Optional tenant ID for multi-tenant isolation
+     * @returns Object with encrypted fields
+     */
+    encryptObject<T extends Record<string, unknown>>(obj: T, policy: FieldEncryptionPolicy, tenantId?: string): Promise<T>;
+    /**
+     * Decrypt multiple fields in an object according to a policy
+     *
+     * @param obj - The object containing encrypted fields
+     * @param policy - The encryption policy defining which fields to decrypt
+     * @param tenantId - Optional tenant ID for multi-tenant isolation
+     * @returns Object with decrypted fields
+     */
+    decryptObject<T extends Record<string, unknown>>(obj: T, policy: FieldEncryptionPolicy, tenantId?: string): Promise<T>;
+    /**
+     * Re-encrypt a field with a new key version
+     *
+     * @param encryptedMarker - The currently encrypted field
+     * @param options - Re-encryption options including new key version
+     * @returns Newly encrypted field marker
+     */
+    reencrypt(encryptedMarker: EncryptedFieldMarker, options: ReencryptOptions): Promise<EncryptedFieldMarker>;
+    /**
+     * Get the current key version
+     */
+    getCurrentKeyVersion(): Promise<number>;
+    /**
+     * Get nested value from object using dot notation
+     */
+    private getNestedValue;
+    /**
+     * Set nested value in object using dot notation
+     */
+    private setNestedValue;
+    /**
+     * Shutdown the service
+     */
+    shutdown(): Promise<void>;
+}
+/**
+ * Create a new FieldEncryptionService instance
+ */
+export declare function createFieldEncryptionService(config?: Partial<EncryptionConfig>, keyProvider?: KeyProvider): FieldEncryptionService;
+/**
+ * Get the default field encryption service instance
+ */
+export declare function getFieldEncryptionService(): FieldEncryptionService;
+/**
+ * Set a custom field encryption service as the default
+ */
+export declare function setFieldEncryptionService(service: FieldEncryptionService): void;
+/**
+ * Reset the default field encryption service (for testing)
+ */
+export declare function resetFieldEncryptionService(): Promise<void>;
+//# sourceMappingURL=service.d.ts.map

package/dist/security/encryption/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/security/encryption/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAEV,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EAGrB,aAAa,EAGd,MAAM,YAAY,CAAC;AAiBpB;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjD,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAKpD;AAoDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,WAAW,CAAS;gBAG1B,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM,EACtC,WAAW,CAAC,EAAE,WAAW;IAM3B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IASzB;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAItC;;OAEG;YACW,SAAS;IAYvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACH,OAAO,CAAC,QAAQ;IAchB;;;;;;OAMG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC;IAsKhC;;;;;;OAMG;IACG,OAAO,CACX,eAAe,EAAE,oBAAoB,EACrC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC;IAuIlB;;;;;;;OAOG;IACG,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnD,GAAG,EAAE,CAAC,EACN,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,CAAC,CAAC;IAyBb;;;;;;;OAOG;IACG,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnD,GAAG,EAAE,CAAC,EACN,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,CAAC,CAAC;IAsBb;;;;;;OAMG;IACG,SAAS,CACb,eAAe,EAAE,oBAAoB,EACrC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC;IA6DhC;;OAEG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7C;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;OAEG;IACH,OAAO,CAAC,cAAc;IAetB;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAMhC;AAMD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAClC,WAAW,CAAC,EAAE,WAAW,GACxB,sBAAsB,CAExB;AAQD;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,sBAAsB,CAKlE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAE/E;AAED;;GAEG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAKjE"}