@webda/core 4.0.0-beta.6 → 4.0.0-beta.8

package/lib/services/command.d.ts

@@ -25,8 +25,10 @@ export interface CommandOptions {
      * - `"initialized"` (default): runs after `Core.init()` — full runtime including service.init() (DB, network).
      * - `"resolved"`: runs after `Core.resolve()` only — services are constructed and resolve()d but init() is skipped.
      *   Use for build-time codegen hooks that shouldn't touch the network.
+     * - `"application"`: runs with the loaded application only — no Core, no service, the configuration is not
+     *   decrypted. The method must be static. Use for tooling on the configuration files, like `webda config encrypt`.
      */
-    phase?: "resolved" | "initialized";
+    phase?: "application" | "resolved" | "initialized";
 }
 /**
  * Declare a CLI command on a service method.
@@ -39,6 +41,10 @@ export interface CommandOptions {
  * - JSDoc `@description` on parameter provides help text for the flag
  * - JSDoc `@deprecated` on parameter marks the flag as deprecated
  *
+ * A handler returning a number sets the process exit code (the highest one when
+ * several services run the command); any other result exits with `0`. Log counts
+ * rather than returning them.
+ *
  * Multiple services can declare the same command name — they all run in
  * dependency-graph order. Use `--service=ServiceName` to filter at invocation.
  *

package/lib/services/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/services/command.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,eAAO,MAAM,OAAO;;;CAgBnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAuB,4GAExF"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/services/command.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,aAAa,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,eAAO,MAAM,OAAO;;;CAgBnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAuB,4GAExF"}

package/lib/services/command.js

@@ -10,6 +10,10 @@ import { createMethodDecorator } from "@webda/tsc-esm";
  * - JSDoc `@description` on parameter provides help text for the flag
  * - JSDoc `@deprecated` on parameter marks the flag as deprecated
  *
+ * A handler returning a number sets the process exit code (the highest one when
+ * several services run the command); any other result exits with `0`. Log counts
+ * rather than returning them.
+ *
  * Multiple services can declare the same command name — they all run in
  * dependency-graph order. Use `--service=ServiceName` to filter at invocation.
  *

package/lib/services/command.js.map

@@ -1 +1 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/services/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAiCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAC1C,CACE,KAAU,EACV,OAAoC,EACpC,IAAY,EACZ,OAAO,GAAmB,EAAE,WAAW,EAAE,EAAE,EAAE,EAC7C,EAAE;IACF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW,CAAC,IAAI,CAAC;QACjD,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAO,GAAkC,EAAE,WAAW,EAAE,EAAE,EAAE;IACvF,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/services/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAmCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAC1C,CACE,KAAU,EACV,OAAoC,EACpC,IAAY,EACZ,OAAO,GAAmB,EAAE,WAAW,EAAE,EAAE,EAAE,EAC7C,EAAE;IACF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW,CAAC,IAAI,CAAC;QACjD,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAO,GAAkC,EAAE,WAAW,EAAE,EAAE,EAAE;IACvF,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/lib/services/cryptoservice.service.d.ts

@@ -1,23 +1,58 @@
 import * as util from "util";
 import { CryptoServiceParameters, JWTOptions, KeysDefinition } from "./icryptoservice.js";
+import { AuthenticatedEncryption } from "./authenticatedencryption.js";
+import { PkiKeyring } from "./pki.encrypter.js";
+import type { ConfigurationEncryption } from "../application/iconfiguration.js";
 import { Service } from "./service.js";
 import { OperationContext } from "../contexts/operationcontext.js";
-/** Wraps a secret string value, masking it in logs and inspect output */
+import { type SecretFinding } from "./secretscheck.js";
+/**
+ * A secret value decrypted from a `crypt:<encrypter>:<data>` configuration string
+ *
+ * The plain value is only available through {@link SecretString.getValue}: string
+ * conversion, `JSON.stringify` and `util.inspect` all return a mask, so the secret
+ * does not leak into logs, configuration dumps or serialized services.
+ *
+ * In a service parameters class, type a secret field as `string | SecretString`
+ * and read it with {@link SecretString.from}.
+ *
+ * `@secret` marks every property typed with this class as a secret in the generated
+ * schema (`x-webda-secret`), so `webda config encrypt` encrypts it and `--check` reports it when it is not encrypted.
+ *
+ * @type string
+ * @secret
+ */
 export declare class SecretString {
-    protected str: string;
-    protected encrypter: string;
+    #private;
+    /**
+     * Name of the encrypter that decrypted the value
+     */
+    readonly encrypter: string;
     /** Create a new SecretString
      * @param str - the secret value
-     * @param encrypter - the encrypter service name
+     * @param encrypter - the encrypter name
      */
     constructor(str: string, encrypter: string);
     /**
      * Extract the plain string value, warning if the string is not encrypted
-     * @param value - the value to set
-     * @param path - the path
-     * @returns the result string
+     *
+     * The warning never contains the value itself, only the optional path.
+     *
+     * @param value - the secret, or a plain string
+     * @param path - the configuration path of the value, used in the warning
+     * @returns the plain value
      */
     static from(value: string | SecretString, path?: string): string;
+    /**
+     * Replace every SecretString in a structure by its plain value
+     *
+     * Use it to pass a configuration object holding secrets to a third-party client
+     * that expects plain strings. The structure is copied, not modified.
+     *
+     * @param value - the structure to unwrap
+     * @returns a copy with plain values
+     */
+    static unwrap<T = any>(value: T): T;
     /**
      * Get the underlying secret value
      * @returns the result string
@@ -28,6 +63,11 @@ export declare class SecretString {
      * @returns the result string
      */
     toString(): string;
+    /**
+     * Return a masked representation to prevent secret leakage through JSON
+     * @returns the result string
+     */
+    toJSON(): string;
     /**
      * Custom inspect handler to mask the secret in Node.js util.inspect
      * @param depth - the depth level
@@ -37,6 +77,68 @@ export declare class SecretString {
      */
     [util.inspect.custom](depth: any, options: any, inspect: any): string;
 }
+/**
+ * A parsed encrypted or to-encrypt configuration value
+ */
+export interface EncryptedValue {
+    mode: "encrypt" | "crypt";
+    /**
+     * `sencrypt:` or `scrypt:`: decrypted to a plain string instead of a SecretString
+     */
+    plain: boolean;
+    /**
+     * Encrypter name, undefined for `encrypt:<value>` when no default encrypter is set
+     */
+    encrypter: string | undefined;
+    data: string;
+    /**
+     * The encrypter is written in the value, false when the default encrypter is used
+     */
+    explicit: boolean;
+}
+/**
+ * Parse an encrypted or to-encrypt configuration value
+ *
+ * `crypt:` and `scrypt:` values always name their encrypter. For `encrypt:` and `sencrypt:`, the
+ * first segment is the encrypter when it is a registered encrypter name: otherwise the whole
+ * remainder is the plain value, encrypted by the default encrypter.
+ *
+ * @param value - the configuration value
+ * @param defaultEncrypter - the encrypter of `encrypt:<value>`
+ * @returns undefined if the value is not an encryption string
+ */
+export declare function parseEncryptedValue(value: string, defaultEncrypter?: string): EncryptedValue | undefined;
+/**
+ * Options of the configuration encryption and decryption
+ */
+export interface ConfigurationEncryptionOptions {
+    /**
+     * The encryption settings, `parameters.configurationEncryption`
+     *
+     * Read from `data.parameters.configurationEncryption` when not given
+     */
+    settings?: ConfigurationEncryption;
+    /**
+     * The application path, relative paths of the encrypters resolve against it
+     */
+    appPath?: string;
+}
+/**
+ * State of one encryption or decryption pass
+ */
+interface EncryptionPass {
+    settings: ConfigurationEncryption;
+    context: EncrypterContext;
+    /**
+     * Encrypters already configured in this pass
+     */
+    configured: Set<string>;
+    /**
+     * Encrypter to re-encrypt the encrypted values with
+     */
+    migrate?: string;
+    upgrade?: boolean;
+}
 export type KeysRegistry = {
     /**
      * Contains the instanceId of the last
@@ -56,20 +158,60 @@ export type KeysRegistry = {
      */
     current: string;
 };
+/**
+ * Context given to {@link StringEncrypter.configure}
+ */
+export interface EncrypterContext {
+    /**
+     * Absolute application path, so relative key paths resolve against it
+     */
+    appPath: string;
+    /**
+     * "encrypt" when called from `webda config encrypt`, "decrypt" at runtime
+     */
+    mode: "encrypt" | "decrypt";
+}
 /**
  * Encrypt/Decrypt string
+ *
+ * The encrypted output is stored after `crypt:<encrypter>:` in a configuration file:
+ * it must be a single-line string.
  */
 export interface StringEncrypter {
+    /**
+     * Optional: receive `parameters.configurationEncryption.encrypters[<name>]`
+     * before the first encrypt or decrypt of a configuration
+     *
+     * It can be called again when the configuration changes.
+     *
+     * @param options - the encrypter options, an empty object if not set
+     * @param context - the application path and the mode
+     */
+    configure?(options: any, context: EncrypterContext): void | Promise<void>;
+    /**
+     * Optional: tell if an encrypted value must be re-encrypted by `webda config encrypt --upgrade`
+     *
+     * Every value is re-encrypted when it is not implemented.
+     *
+     * @param data - the encrypted value
+     * @returns true to re-encrypt it
+     */
+    needsUpgrade?(data: string): boolean;
     /**
      * Encrypt a string
-     * @param data
-     * @returns
+     * @param data - the plain value
+     * @param options - encrypter specific options
+     * @returns the encrypted value
      */
     encrypt(data: string, options?: any): Promise<string>;
     /**
      * Decrypt a string
-     * @param data
-     * @returns
+     *
+     * It must throw if the data cannot be decrypted, never return garbage.
+     *
+     * @param data - the encrypted value
+     * @param options - encrypter specific options
+     * @returns the plain value
      */
     decrypt(data: string, options?: any): Promise<string>;
 }
@@ -80,15 +222,30 @@ export declare class CryptoService<T extends CryptoServiceParameters = CryptoSer
     private static encrypters;
     /**
      * Register an encrypter for configuration
-     * @param name - the name to use
+     *
+     * Values written as `encrypt:<name>:<plain>` are then encrypted by it with `webda config encrypt`,
+     * and `crypt:<name>:<data>` values are decrypted by it when the configuration is loaded.
+     *
+     * Register it as a side effect of a module that the application loads (a Modda file), so it is
+     * available before the services are created.
+     *
+     * @param name - the name to use, letters, digits, `_`, `-` and `.` only
      * @param encrypter - the encrypter implementation
-     * @param encrypter.encrypt - the encrypter.encrypt
-     * @param encrypter.decrypt - the encrypter.decrypt
      */
-    static registerEncrypter(name: string, encrypter: {
-        encrypt: (data: string) => Promise<string>;
-        decrypt: (data: string) => Promise<string>;
-    }): void;
+    static registerEncrypter(name: string, encrypter: StringEncrypter): void;
+    /**
+     * Get a registered encrypter
+     * @param name - the encrypter name
+     * @returns the encrypter or undefined
+     */
+    static getEncrypter(name: string): StringEncrypter | undefined;
+    /**
+     * Get the encrypter for a value, with a helpful error if missing
+     * @param name - the encrypter name
+     * @param path - the configuration path, for the error message
+     * @returns the encrypter
+     */
+    protected static requireEncrypter(name: string, path: (string | number)[]): StringEncrypter;
     currentSymetricKey: string;
     currentAsymetricKey: {
         publicKey: string;
@@ -196,17 +353,233 @@ export declare class CryptoService<T extends CryptoServiceParameters = CryptoSer
      */
     getJWTHeader(token: string): any;
     /**
-     * Encrypt configuration
-     * @param data - the data to process
-     * @returns the result
+     * Start an encryption or decryption pass
+     * @param data - the configuration
+     * @param options - the options
+     * @param path - the path of data
+     * @param mode - encrypt or decrypt
+     * @returns the pass
+     */
+    protected static startPass(data: any, options: ConfigurationEncryptionOptions, path: (string | number)[], mode: "encrypt" | "decrypt"): EncryptionPass;
+    /**
+     * Get an encrypter, configured for this pass
+     * @param name - the encrypter name
+     * @param pass - the current pass
+     * @param path - the configuration path, for messages
+     * @returns the encrypter
      */
-    static encryptConfiguration(data: any): Promise<any>;
+    protected static useEncrypter(name: string, pass: EncryptionPass, path: (string | number)[]): Promise<StringEncrypter>;
     /**
+     * Encrypt the `encrypt:[<encrypter>:]<plain>` and `sencrypt:[<encrypter>:]<plain>` values of a configuration
      *
-     * @param data - the data to process
-     * @returns the result
+     * The structure is modified in place, so a comment-preserving document loaded with
+     * `FileUtils.load` can be saved back with its comments.
+     *
+     * `encrypt:<plain>` uses the default encrypter, `parameters.configurationEncryption.default`. The output
+     * always names its encrypter.
+     *
+     * @param data - the configuration, or a single value
+     * @param options - options
+     * @param options.migrate - also re-encrypt the already encrypted values with this encrypter, with the
+     *   default encrypter when `""`, or with their own encrypter when `true` (same as `upgrade`)
+     * @param options.upgrade - also re-encrypt the already encrypted values with their own encrypter, to its
+     *   current format or key
+     * @param path - the path of data, for error messages
+     * @returns the encrypted data
+     */
+    static encryptConfiguration(data: any, options?: {
+        migrate?: string | boolean;
+        upgrade?: boolean;
+    } & ConfigurationEncryptionOptions, path?: (string | number)[]): Promise<any>;
+    /**
+     * Encrypt the values of a configuration, see {@link encryptConfiguration}
+     * @param data - the configuration, or a single value
+     * @param pass - the current pass
+     * @param path - the path of data
+     * @returns the encrypted data
+     */
+    protected static encryptValues(data: any, pass: EncryptionPass, path: (string | number)[]): Promise<any>;
+    /**
+     * Decrypt one value with an encrypter, with a message that never contains the value
+     * @param encrypter - the encrypter name
+     * @param data - the encrypted data
+     * @param path - the configuration path
+     * @param pass - the current pass, to configure the encrypter
+     * @returns the plain value
      */
-    static decryptConfiguration(data: any): Promise<any>;
+    protected static decryptValue(encrypter: string, data: string, path: (string | number)[], pass?: EncryptionPass): Promise<string>;
+    /**
+     * Decrypt the `crypt:` and `scrypt:` values of a configuration
+     *
+     * - `crypt:<encrypter>:<data>` becomes a {@link SecretString}
+     * - `scrypt:<encrypter>:<data>` becomes a plain string, for a module that cannot handle SecretString
+     *
+     * The input is not modified: a decrypted copy is returned. Only plain objects and
+     * arrays are traversed.
+     *
+     * A value still marked `encrypt:` is kept as is, with a warning.
+     *
+     * @param data - the configuration, or a single value
+     * @param path - the path of data, for messages
+     * @param options - the encryption settings and the application path
+     * @returns the decrypted copy
+     */
+    static decryptConfiguration(data: any, path?: (string | number)[], options?: ConfigurationEncryptionOptions): Promise<any>;
+    /**
+     * Decrypt the values of a configuration, see {@link decryptConfiguration}
+     * @param data - the configuration, or a single value
+     * @param pass - the current pass
+     * @param path - the path of data
+     * @returns the decrypted copy
+     */
+    protected static decryptValues(data: any, pass: EncryptionPass, path: (string | number)[]): Promise<any>;
+    /**
+     * Get the encryption settings of the application, merged with the ones of a configuration file
+     * @param data - the configuration file content
+     * @returns the settings
+     */
+    protected static getEncryptionSettings(data?: any): ConfigurationEncryption;
+    /**
+     * Encrypt the marked values of a configuration file, keeping its comments
+     *
+     * Prefix a value with `encrypt:[<encrypter>:]` (SecretString once decrypted) or
+     * `sencrypt:[<encrypter>:]` (plain string once decrypted) then run this command.
+     *
+     * @param file - the configuration file (json, jsonc or yaml) to update
+     * @param migrate - re-encrypt the already encrypted values with this encrypter, the default one when empty
+     * @param upgrade - re-encrypt the already encrypted values with their own encrypter, to its current format or key
+     * @returns the number of values changed
+     */
+    encryptConfigurationFile(file: string, migrate?: string, upgrade?: boolean): Promise<number>;
+    /**
+     * Encrypt the secrets of the configuration files, keeping their comments, or check them
+     *
+     * Encrypts the values marked `encrypt:` or `sencrypt:`, and the plain values of the secret fields: the fields
+     * typed `SecretString` or tagged `@secret` in their service parameters, marked `x-webda-secret` in the compiled
+     * schemas. The plain secrets are encrypted with the default encrypter.
+     *
+     * Without `file`, it updates the application configuration and the file of the selected deployment.
+     *
+     * With `check`, nothing is written: it fails when a secret is not encrypted. It needs no key, so it runs in CI.
+     * Only the paths are reported, never the values.
+     *
+     * It only needs the loaded application: the configuration is not decrypted and no service is created.
+     *
+     * @param file - the configuration file (json, jsonc or yaml) to update
+     * @param migrate - re-encrypt the already encrypted values with this encrypter, the default one when empty
+     * @param upgrade - re-encrypt the already encrypted values with their own encrypter, to its current format or key
+     * @param check - only check that the secrets are encrypted, write nothing
+     * @param strict - with check, report the values still marked `encrypt:` as failures
+     * @param format - with check, output format: text or json
+     * @param none - with check, accept the values kept in clear text with `crypt:none:`, false to fail on them
+     * @param exclude - secret paths to leave alone, comma-separated: not checked, not auto-encrypted
+     * @returns with check, 1 when a secret is not encrypted, otherwise 0
+     */
+    static encryptConfigurationFile(
+    /** @alias f @description Configuration file to update (json, jsonc or yaml), the application and deployment files by default */
+    file?: string, 
+    /** @description Re-encrypt the already encrypted values with this encrypter, the default one when empty */
+    migrate?: string, 
+    /** @description Re-encrypt the already encrypted values with their own encrypter, to its current format or key */
+    upgrade?: boolean, 
+    /** @description Only check that the secrets are encrypted, write nothing and fail if one is not */
+    check?: boolean, 
+    /** @description With --check, report the values marked encrypt: as failures */
+    strict?: boolean, 
+    /** @description With --check, output format: text or json */
+    format?: "text" | "json", 
+    /** @description With --check, accept the values kept in clear text with crypt:none: (--no-none to fail on them) */
+    none?: boolean, 
+    /** @description Secret paths to leave alone, comma-separated (services.demo.password, units[*].token, $.parameters.**) */
+    exclude?: string): Promise<number>;
+    /**
+     * The configuration files to encrypt or check
+     * @param file - the file given on the command line
+     * @returns the absolute paths: the file, or the application configuration and the selected deployment file
+     */
+    protected static getConfigurationFiles(file?: string): string[];
+    /**
+     * Check that the secrets of configuration files are encrypted
+     * @param files - the files to check
+     * @param options - check options
+     * @param options.strict - report the values still marked `encrypt:` as failures
+     * @param options.format - output format: text or json
+     * @param options.none - accept the values kept in clear text with `crypt:none:`
+     * @param options.exclude - secret paths not checked, comma-separated
+     * @returns 1 when a secret is not encrypted, 0 otherwise
+     */
+    protected static checkFiles(files: string[], options?: {
+        strict?: boolean;
+        format?: "text" | "json";
+        none?: boolean;
+        exclude?: string;
+    }): number;
+    /**
+     * Find the unencrypted secrets of a configuration or deployment file
+     *
+     * A service the file overrides without its type takes the type of the application configuration, and the
+     * file `parameters` are also checked against the services of the application.
+     *
+     * @param data - the file content, as plain JSON
+     * @param exclude - secret paths to leave out, comma-separated patterns, see {@link secretPathExcluder}
+     * @returns the findings, with their location in data, without the values
+     */
+    static findFileSecrets(data: any, exclude?: string | string[]): SecretFinding[];
+    /**
+     * Encrypt the secrets of a configuration file, keeping its comments
+     *
+     * The values marked `encrypt:` or `sencrypt:`, and the plain values of the secret fields, with the default
+     * encrypter.
+     *
+     * @param file - the configuration file (json, jsonc or yaml) to update
+     * @param migrate - re-encrypt the already encrypted values with this encrypter, the default one when empty
+     * @param upgrade - re-encrypt the already encrypted values with their own encrypter, to its current format or key
+     * @param exclude - secret paths not auto-encrypted, comma-separated patterns, see {@link secretPathExcluder}
+     * @returns the number of values changed
+     */
+    static encryptFile(file: string, migrate?: string, upgrade?: boolean, exclude?: string | string[]): Promise<number>;
+    /**
+     * Get the keyring of the `pki` encrypter, as configured for the application
+     * @param data - a configuration file content, its settings override the application ones
+     * @returns the keyring
+     */
+    protected static getPkiKeyring(data?: any): PkiKeyring;
+    /**
+     * Generate a key pair for the `pki` encrypter
+     *
+     * The public key is written in the public keys directory, to commit. The private key is written
+     * outside of it, to store in the runtime secrets (a Kubernetes Secret for example), never in the repository.
+     *
+     * @param kid - the key id
+     * @param bits - the RSA modulus length
+     * @param out - the private key file
+     * @returns the written files
+     */
+    static pkiGenerate(
+    /** @description Key id, for example 2026-10 */
+    kid: string, 
+    /** @description RSA modulus length */
+    bits?: number, 
+    /** @description Private key file, ./<kid>.pem by default */
+    out?: string): Promise<{
+        publicKey: string;
+        privateKey: string;
+    }>;
+    /**
+     * List the public keys of the `pki` encrypter and the number of values encrypted with each key in a file
+     *
+     * A key with no value left can be retired.
+     *
+     * @param file - the configuration file to inspect
+     * @returns the active key, the public keys and the values count by kid
+     */
+    static pkiList(
+    /** @alias f @description Configuration file to inspect (json, jsonc or yaml) */
+    file: string): Promise<{
+        activeKey?: string;
+        publicKeys: string[];
+        values: Record<string, number>;
+    }>;
     /**
      * Decrypt data
      * @param token - the token
@@ -226,6 +599,13 @@ export declare class CryptoService<T extends CryptoServiceParameters = CryptoSer
      */
     rotate(): Promise<void>;
 }
+/**
+ * Prefix of the current encrypted format of the built-in encrypters
+ *
+ * Legacy values (AES-256-CTR, unauthenticated) have no prefix: base64 never contains `:`.
+ */
+export declare const ENCRYPTION_FORMAT_V2 = "v2:";
+export { AuthenticatedEncryption };
 export default CryptoService;
 /**
  * Return the CryptoService

package/lib/services/cryptoservice.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cryptoservice.service.d.ts","sourceRoot":"","sources":["../../src/services/cryptoservice.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1F,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAInE,yEAAyE;AACzE,qBAAa,YAAY;IAMrB,SAAS,CAAC,GAAG,EAAE,MAAM;IACrB,SAAS,CAAC,SAAS,EAAE,MAAM;IAN7B;;;OAGG;IACH,YACY,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACzB;IAEJ;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAO/D;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAEjB;IACD;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAEjB;IACD;;;;;;OAMG;IACH,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAA,UAE5C;CACF;AAED,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAED;;GAEG;AACH,qBAAa,aAAa,CAAC,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CACpF,SAAQ,OAAO,CAAC,CAAC,CACjB,YAAW,eAAe;IAE1B,OAAO,CAAC,MAAM,CAAC,UAAU,CAA0C;IAEnE;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CACtB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE;QAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,QAMtG;IACD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;KAC/B,CAAC;IACF;;OAEG;IACH,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG;YACb,CAAC,EAAE,MAAM,CAAC;YACV,CAAC,EAAE,MAAM,CAAC;SACX,CAAC;KACH,CAAM;IAEP;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ1B;IAED;;;OAGG;IAOG,SAAS,CAAC,OAAO,EAAE,gBAAgB,iBAmBxC;IAED;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAiB7B;IAED;;;OAGG;IACH,qBAAqB,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAOjE;IAED;;;OAGG;IACH,mBAAmB,IAAI,MAAM,CAE5B;IAED;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,CAcpE;IAED;;;;;OAKG;IACU,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrE;IAED;;;;;OAKG;IACU,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS1E;IAED;;;;;OAKG;IACU,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBrE;IAED;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY9C;IAED;;;;OAIG;IACU,SAAS,CAAC,MAAM,KAAA,EAAE,QAAQ,KAAA,iBAkBtC;IAED;;;;;OAKG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAkBjF;IAED;;;;OAIG;IACU,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAe/C;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,OAEzB;IAED;;;;OAIG;IACH,OAAoB,oBAAoB,CAAC,IAAI,EAAE,GAAG,gBAqBjD;IAED;;;;OAIG;IACH,OAAoB,oBAAoB,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAsBhE;IAED;;;;OAIG;IACU,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAUhD;IAED;;;OAGG;IACH,SAAS,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAIvC;IAED;;OAEG;IACG,MAAM,kBA2BX;CACF;eAwBc,aAAa;AAE5B;;;;;;GAMG;AACH,wBAAgB,SAAS,2CAExB"}
+{"version":3,"file":"cryptoservice.service.d.ts","sourceRoot":"","sources":["../../src/services/cryptoservice.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAM7B,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAKL,UAAU,EAEX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAIhF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAInE,OAAO,EAAmE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOxH;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;;IAKvB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,YAAY,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAGzC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/D;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAelC;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAEjB;IACD;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAEjB;IACD;;;OAGG;IACH,MAAM,IAAI,MAAM,CAEf;IACD;;;;;;OAMG;IACH,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,KAAA,EAAE,OAAO,KAAA,EAAE,OAAO,KAAA,UAE5C;CACF;AA+BD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B;;OAEG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAmBxG;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,UAAU,cAAc;IACtB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;OAEG;IACH,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA8CD,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAED;;GAEG;AACH,qBAAa,aAAa,CAAC,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CACpF,SAAQ,OAAO,CAAC,CAAC,CACjB,YAAW,eAAe;IAE1B,OAAO,CAAC,MAAM,CAAC,UAAU,CAA0C;IAEnE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,QAQhE;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE7D;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,eAAe,CAU1F;IACD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;KAC/B,CAAC;IACF;;OAEG;IACH,IAAI,EAAE;QACJ,CAAC,GAAG,EAAE,MAAM,GAAG;YACb,CAAC,EAAE,MAAM,CAAC;YACV,CAAC,EAAE,MAAM,CAAC;SACX,CAAC;KACH,CAAM;IAEP;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ1B;IAED;;;OAGG;IAOG,SAAS,CAAC,OAAO,EAAE,gBAAgB,iBAmBxC;IAED;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAiB7B;IAED;;;OAGG;IACH,qBAAqB,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAQjE;IAED;;;OAGG;IACH,mBAAmB,IAAI,MAAM,CAE5B;IAED;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,CAcpE;IAED;;;;;OAKG;IACU,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrE;IAED;;;;;OAKG;IACU,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS1E;IAED;;;;;OAKG;IACU,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBrE;IAED;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY9C;IAED;;;;OAIG;IACU,SAAS,CAAC,MAAM,KAAA,EAAE,QAAQ,KAAA,iBAkBtC;IAED;;;;;OAKG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAoBjF;IAED;;;;OAIG;IACU,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAe/C;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,OAEzB;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAAM,CAAC,SAAS,CACxB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,8BAA8B,EACvC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,EACzB,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,cAAc,CAQhB;IAED;;;;;;OAMG;IACH,iBAAuB,YAAY,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GACxB,OAAO,CAAC,eAAe,CAAC,CAO1B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAoB,oBAAoB,CACtC,IAAI,EAAE,GAAG,EACT,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,8BAAmC,EAChG,IAAI,GAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,GAC7B,OAAO,CAAC,GAAG,CAAC,CAWd;IAED;;;;;;OAMG;IACH,iBAAuB,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAwC7G;IAED;;;;;;;OAOG;IACH,iBAAuB,YAAY,CACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,EACzB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CASjB;IAED;;;;;;;;;;;;;;;OAeG;IACH,OAAoB,oBAAoB,CACtC,IAAI,EAAE,GAAG,EACT,IAAI,GAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,EAC9B,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,GAAG,CAAC,CAEd;IAED;;;;;;OAMG;IACH,iBAAuB,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CA4B7G;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,uBAAuB,CAO1E;IAED;;;;;;;;;;OAUG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjG;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAKa,wBAAwB;IACnC,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM;IACb,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM;IAChB,kHAAkH;IAClH,OAAO,CAAC,EAAE,OAAO;IACjB,mGAAmG;IACnG,KAAK,GAAE,OAAe;IACtB,+EAA+E;IAC/E,MAAM,GAAE,OAAc;IACtB,6DAA6D;IAC7D,MAAM,GAAE,MAAM,GAAG,MAAe;IAChC,mHAAmH;IACnH,IAAI,GAAE,OAAc;IACpB,0HAA0H;IAC1H,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAUjB;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAY9D;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,MAAM,CAAC,UAAU,CACzB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7F,MAAM,CAsCR;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,EAAE,CAyB9E;IAED;;;;;;;;;;;OAWG;IACH,OAAa,WAAW,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAC1B,OAAO,CAAC,MAAM,CAAC,CAyCjB;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,UAAU,CAErD;IAED;;;;;;;;;;OAUG;IACH,OAKa,WAAW;IACtB,+CAA+C;IAC/C,GAAG,EAAE,MAAM;IACX,sCAAsC;IACtC,IAAI,GAAE,MAAa;IACnB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAiCpD;IAED;;;;;;;OAOG;IACH,OAKa,OAAO;IAClB,gFAAgF;IAChF,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAkCvF;IAED;;;;OAIG;IACU,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAUhD;IAED;;;OAGG;IACH,SAAS,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAIvC;IAED;;OAEG;IACG,MAAM,kBA2BX;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAsD1C,OAAO,EAAE,uBAAuB,EAAE,CAAC;eAEpB,aAAa;AAE5B;;;;;;GAMG;AACH,wBAAgB,SAAS,2CAExB"}