@apart-tech/intelligence-core 1.0.6 → 1.1.0

package/dist/services/node-service.js

@@ -2,28 +2,36 @@ import { tenantWhere, SINGLE_TENANT_ORG_ID } from "../db/tenant.js";
 export class NodeService {
     db;
     embeddings;
+    piiEncryption;
+    piiOptions;
     tenantCtx;
-    constructor(db, embeddings, tenantCtx) {
+    constructor(db, embeddings, tenantCtx, piiEncryption, piiOptions) {
         this.db = db;
         this.embeddings = embeddings;
+        this.piiEncryption = piiEncryption;
+        this.piiOptions = piiOptions;
         this.tenantCtx = tenantCtx ?? { organizationId: SINGLE_TENANT_ORG_ID };
     }
     async create(input) {
+        // Generate embedding from ORIGINAL text (before PII encryption)
         const embedding = await this.embeddings.embed(`${input.title}\n\n${input.content}`);
         const embeddingStr = `[${embedding.join(",")}]`;
+        // Process PII if configured
+        const { title, content, metadata, hasPii } = this.applyPii(input.title, input.content, input.metadata);
         const node = await this.db.node.create({
             data: {
                 type: input.type,
-                title: input.title,
-                content: input.content,
-                metadata: (input.metadata ?? {}),
+                title,
+                content,
+                metadata: (metadata ?? {}),
                 status: input.status ?? "draft",
                 createdBy: input.createdBy,
                 domainId: input.domainId ?? null,
+                hasPii,
                 organizationId: this.tenantCtx.organizationId,
             },
         });
-        // Update embedding and tsvector via raw SQL (Prisma doesn't support Unsupported fields in create)
+        // Update embedding and tsvector via raw SQL using ORIGINAL text
         const orgFilter = tenantWhere(this.tenantCtx);
         await this.db.$executeRaw `
       UPDATE nodes
@@ -36,15 +44,17 @@ export class NodeService {
     }
     async createWithEmbedding(input, embedding) {
         const embeddingStr = `[${embedding.join(",")}]`;
+        const { title, content, metadata, hasPii } = this.applyPii(input.title, input.content, input.metadata);
         const node = await this.db.node.create({
             data: {
                 type: input.type,
-                title: input.title,
-                content: input.content,
-                metadata: (input.metadata ?? {}),
+                title,
+                content,
+                metadata: (metadata ?? {}),
                 status: input.status ?? "draft",
                 createdBy: input.createdBy,
                 domainId: input.domainId ?? null,
+                hasPii,
                 organizationId: this.tenantCtx.organizationId,
             },
         });
@@ -62,16 +72,18 @@ export class NodeService {
         const existing = await this.getById(id);
         if (!existing)
             return null;
-        const title = input.title ?? existing.title;
-        const content = input.content ?? existing.content;
+        const originalTitle = input.title ?? existing.title;
+        const originalContent = input.content ?? existing.content;
+        const { title, content, metadata, hasPii } = this.applyPii(input.title ?? existing.title, input.content ?? existing.content, input.metadata);
         const updated = await this.db.node.update({
             where: { id },
             data: {
-                ...(input.title !== undefined && { title: input.title }),
-                ...(input.content !== undefined && { content: input.content }),
-                ...(input.metadata !== undefined && { metadata: input.metadata }),
+                ...(input.title !== undefined && { title }),
+                ...(input.content !== undefined && { content }),
+                ...(input.metadata !== undefined && { metadata: metadata }),
                 ...(input.type !== undefined && { type: input.type }),
                 ...(input.domainId !== undefined && { domainId: input.domainId }),
+                hasPii,
                 updatedAt: new Date(),
                 version: existing.version + 1,
             },
@@ -81,42 +93,67 @@ export class NodeService {
         await this.db.$executeRaw `
       UPDATE nodes
       SET embedding = ${embeddingStr}::vector,
-          search_vector = to_tsvector('english', ${title} || ' ' || ${content})
+          search_vector = to_tsvector('english', ${originalTitle} || ' ' || ${originalContent})
       WHERE id = ${id}::uuid
         AND ${orgFilter}
     `;
         return updated;
     }
+    async resolveId(idOrPrefix) {
+        // Full UUID: use as-is
+        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(idOrPrefix)) {
+            return idOrPrefix;
+        }
+        // Short prefix: find matching nodes
+        const orgFilter = tenantWhere(this.tenantCtx);
+        const matches = await this.db.$queryRaw `
+      SELECT id FROM nodes
+      WHERE id::text LIKE ${idOrPrefix + '%'}
+        AND ${orgFilter}
+      LIMIT 2
+    `;
+        if (matches.length === 0)
+            return null;
+        if (matches.length > 1) {
+            throw new Error(`Ambiguous ID prefix "${idOrPrefix}" — matches multiple nodes. Use more characters.`);
+        }
+        return matches[0].id;
+    }
     async getById(id) {
-        return this.db.node.findUnique({ where: { id } });
+        const resolvedId = await this.resolveId(id);
+        if (!resolvedId)
+            return null;
+        return this.db.node.findUnique({ where: { id: resolvedId } });
     }
     async update(id, input) {
         const existing = await this.getById(id);
         if (!existing)
             return null;
-        const title = input.title ?? existing.title;
-        const content = input.content ?? existing.content;
+        const originalTitle = input.title ?? existing.title;
+        const originalContent = input.content ?? existing.content;
+        const { title, content, metadata, hasPii } = this.applyPii(originalTitle, originalContent, input.metadata);
         const updated = await this.db.node.update({
             where: { id },
             data: {
-                ...(input.title !== undefined && { title: input.title }),
-                ...(input.content !== undefined && { content: input.content }),
-                ...(input.metadata !== undefined && { metadata: input.metadata }),
+                ...(input.title !== undefined && { title }),
+                ...(input.content !== undefined && { content }),
+                ...(input.metadata !== undefined && { metadata: metadata }),
                 ...(input.type !== undefined && { type: input.type }),
                 ...(input.domainId !== undefined && { domainId: input.domainId }),
+                hasPii,
                 updatedAt: new Date(),
                 version: existing.version + 1,
             },
         });
-        // Re-embed and update tsvector if content changed
+        // Re-embed and update tsvector if content changed (use ORIGINAL text)
         if (input.title || input.content) {
-            const embedding = await this.embeddings.embed(`${title}\n\n${content}`);
+            const embedding = await this.embeddings.embed(`${originalTitle}\n\n${originalContent}`);
             const embeddingStr = `[${embedding.join(",")}]`;
             const orgFilter = tenantWhere(this.tenantCtx);
             await this.db.$executeRaw `
         UPDATE nodes
         SET embedding = ${embeddingStr}::vector,
-            search_vector = to_tsvector('english', ${title} || ' ' || ${content})
+            search_vector = to_tsvector('english', ${originalTitle} || ' ' || ${originalContent})
         WHERE id = ${id}::uuid
           AND ${orgFilter}
       `;
@@ -125,8 +162,11 @@ export class NodeService {
     }
     async setStatus(id, status) {
         try {
+            const resolvedId = await this.resolveId(id);
+            if (!resolvedId)
+                return null;
             return await this.db.node.update({
-                where: { id },
+                where: { id: resolvedId },
                 data: { status, updatedAt: new Date() },
             });
         }
@@ -143,11 +183,13 @@ export class NodeService {
     }
     async delete(id) {
         try {
-            // Delete associated edges first
+            const resolvedId = await this.resolveId(id);
+            if (!resolvedId)
+                return false;
             await this.db.edge.deleteMany({
-                where: { OR: [{ sourceNodeId: id }, { targetNodeId: id }] },
+                where: { OR: [{ sourceNodeId: resolvedId }, { targetNodeId: resolvedId }] },
             });
-            await this.db.node.delete({ where: { id } });
+            await this.db.node.delete({ where: { id: resolvedId } });
             return true;
         }
         catch {
@@ -162,5 +204,26 @@ export class NodeService {
         });
         return result.map((r) => ({ type: r.type, count: r._count.type }));
     }
+    /**
+     * Apply PII detection/encryption to node fields.
+     * Returns processed fields and whether PII was found.
+     */
+    applyPii(title, content, metadata) {
+        if (!this.piiEncryption || !this.piiOptions || this.piiOptions.mode === "disabled") {
+            return { title, content, metadata, hasPii: false };
+        }
+        const result = this.piiEncryption.processNodeFields({ title, content, metadata }, this.piiOptions);
+        // Store the PII report in metadata
+        const finalMetadata = {
+            ...(result.metadata ?? metadata ?? {}),
+            ...(result.report.matchCount > 0 ? { _piiReport: result.report } : {}),
+        };
+        return {
+            title: result.title,
+            content: result.content,
+            metadata: finalMetadata,
+            hasPii: result.report.matchCount > 0,
+        };
+    }
 }
 //# sourceMappingURL=node-service.js.map

package/dist/services/node-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-service.js","sourceRoot":"","sources":["../../src/services/node-service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAExF,MAAM,OAAO,WAAW;IAIZ;IACA;IAJF,SAAS,CAAgB;IAEjC,YACU,EAAgB,EAChB,UAA6B,EACrC,SAAyB;QAFjB,OAAE,GAAF,EAAE,CAAc;QAChB,eAAU,GAAV,UAAU,CAAmB;QAGrC,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAQZ;QACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C,GAAG,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,OAAO,EAAE,CACrC,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAEhD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAA0B;gBACzD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;gBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc;aAC9C;SACF,CAAC,CAAC;QAEH,kGAAkG;QAClG,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;wBAEL,YAAY;mDACe,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,OAAO;mBACtE,IAAI,CAAC,EAAE;cACZ,SAAS;KAClB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAQC,EACD,SAAmB;QAEnB,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAEhD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAA0B;gBACzD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;gBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc;aAC9C;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;wBAEL,YAAY;mDACe,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,OAAO;mBACtE,IAAI,CAAC,EAAE;cACZ,SAAS;KAClB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,EAAU,EACV,KAMC,EACD,SAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE;gBACJ,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;gBACxD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAiC,EAAE,CAAC;gBAC1F,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjE,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;aAC9B;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;wBAEL,YAAY;mDACe,KAAK,cAAc,OAAO;mBAC1D,EAAE;cACP,SAAS;KAClB,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAMC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE;gBACJ,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;gBACxD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAiC,EAAE,CAAC;gBAC1F,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjE,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;aAC9B;SACF,CAAC,CAAC;QAEH,kDAAkD;QAClD,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAEhD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;0BAEL,YAAY;qDACe,KAAK,cAAc,OAAO;qBAC1D,EAAE;gBACP,SAAS;OAClB,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAkB;QAC5C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,KAAK,EAAE,EAAE,EAAE,EAAE;gBACb,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC1B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,CAAC;YACH,gCAAgC;YAChC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE;aAC5D,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACxC,EAAE,EAAE,CAAC,MAAM,CAAC;YACZ,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;CACF"}
+{"version":3,"file":"node-service.js","sourceRoot":"","sources":["../../src/services/node-service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAIxF,MAAM,OAAO,WAAW;IAIZ;IACA;IAEA;IACA;IAPF,SAAS,CAAgB;IAEjC,YACU,EAAgB,EAChB,UAA6B,EACrC,SAAyB,EACjB,aAAoC,EACpC,UAAiC;QAJjC,OAAE,GAAF,EAAE,CAAc;QAChB,eAAU,GAAV,UAAU,CAAmB;QAE7B,kBAAa,GAAb,aAAa,CAAuB;QACpC,eAAU,GAAV,UAAU,CAAuB;QAEzC,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAQZ;QACC,gEAAgE;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C,GAAG,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,OAAO,EAAE,CACrC,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAEhD,4BAA4B;QAC5B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CACxD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK;gBACL,OAAO;gBACP,QAAQ,EAAE,CAAC,QAAQ,IAAI,EAAE,CAA0B;gBACnD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;gBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,MAAM;gBACN,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc;aAC9C;SACF,CAAC,CAAC;QAEH,gEAAgE;QAChE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;wBAEL,YAAY;mDACe,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,OAAO;mBACtE,IAAI,CAAC,EAAE;cACZ,SAAS;KAClB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAQC,EACD,SAAmB;QAEnB,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAEhD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CACxD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK;gBACL,OAAO;gBACP,QAAQ,EAAE,CAAC,QAAQ,IAAI,EAAE,CAA0B;gBACnD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;gBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,MAAM;gBACN,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc;aAC9C;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;wBAEL,YAAY;mDACe,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,OAAO;mBACtE,IAAI,CAAC,EAAE;cACZ,SAAS;KAClB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,EAAU,EACV,KAMC,EACD,SAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;QACpD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;QAE1D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CACxD,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAC7B,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EACjC,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE;gBACJ,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,QAAiC,EAAE,CAAC;gBACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjE,MAAM;gBACN,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;aAC9B;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;wBAEL,YAAY;mDACe,aAAa,cAAc,eAAe;mBAC1E,EAAE;cACP,SAAS;KAClB,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,uBAAuB;QACvB,IAAI,iEAAiE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvF,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,oCAAoC;QACpC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAkB;;4BAEjC,UAAU,GAAG,GAAG;cAC9B,SAAS;;KAElB,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,kDAAkD,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAMC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC;QACpD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;QAE1D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CACxD,aAAa,EACb,eAAe,EACf,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE;gBACJ,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,QAAiC,EAAE,CAAC;gBACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjE,MAAM;gBACN,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;aAC9B;SACF,CAAC,CAAC;QAEH,sEAAsE;QACtE,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,aAAa,OAAO,eAAe,EAAE,CAAC,CAAC;YACxF,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAEhD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAA;;0BAEL,YAAY;qDACe,aAAa,cAAc,eAAe;qBAC1E,EAAE;gBACP,SAAS;OAClB,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAkB;QAC5C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;gBACzB,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC1B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9B,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE;aAC5E,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACxC,EAAE,EAAE,CAAC,MAAM,CAAC;YACZ,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACK,QAAQ,CACd,KAAa,EACb,OAAe,EACf,QAAkC;QAOlC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACjD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAC5B,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,mCAAmC;QACnC,MAAM,aAAa,GAAG;YACpB,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC;SACrC,CAAC;IACJ,CAAC;CACF"}

package/dist/services/org-embedding-config-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-embedding-config-service.d.ts","sourceRoot":"","sources":["../../src/services/org-embedding-config-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAiCnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,yBAAyB;IACxB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,YAAY;IAE9B,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAc/D,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAe7E,GAAG,CACP,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACjG,OAAO,CAAC,kBAAkB,CAAC;IA8BxB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAQvD"}
+{"version":3,"file":"org-embedding-config-service.d.ts","sourceRoot":"","sources":["../../src/services/org-embedding-config-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAgBnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,yBAAyB;IACxB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,YAAY;IAE9B,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAc/D,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAe7E,GAAG,CACP,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACjG,OAAO,CAAC,kBAAkB,CAAC;IA8BxB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAQvD"}

package/dist/services/org-embedding-config-service.js

@@ -1,30 +1,13 @@
-import { createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto";
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 16;
-const TAG_LENGTH = 16;
+import { encryptAesGcm, decryptAesGcm, deriveKey } from "../lib/crypto.js";
 function getEncryptionKey() {
     const secret = process.env.EMBEDDING_KEY_SECRET ?? "apart-default-embedding-key-secret-change-me";
-    // Derive a 32-byte key from the secret
-    return createHash("sha256").update(secret).digest();
+    return deriveKey(secret);
 }
 function encrypt(plaintext) {
-    const key = getEncryptionKey();
-    const iv = randomBytes(IV_LENGTH);
-    const cipher = createCipheriv(ALGORITHM, key, iv);
-    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    // Format: iv:tag:ciphertext (all base64)
-    return `${iv.toString("base64")}:${tag.toString("base64")}:${encrypted.toString("base64")}`;
+    return encryptAesGcm(plaintext, getEncryptionKey());
 }
 function decrypt(encoded) {
-    const key = getEncryptionKey();
-    const [ivB64, tagB64, ciphertextB64] = encoded.split(":");
-    const iv = Buffer.from(ivB64, "base64");
-    const tag = Buffer.from(tagB64, "base64");
-    const ciphertext = Buffer.from(ciphertextB64, "base64");
-    const decipher = createDecipheriv(ALGORITHM, key, iv);
-    decipher.setAuthTag(tag);
-    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    return decryptAesGcm(encoded, getEncryptionKey());
 }
 export class OrgEmbeddingConfigService {
     db;

package/dist/services/org-embedding-config-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-embedding-config-service.js","sourceRoot":"","sources":["../../src/services/org-embedding-config-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGxF,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,8CAA8C,CAAC;IAClG,uCAAuC;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,yCAAyC;IACzC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAcD,MAAM,OAAO,yBAAyB;IAChB;IAApB,YAAoB,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAExC,KAAK,CAAC,GAAG,CAAC,cAAsB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACzD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,cAAsB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACzD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CACP,cAAsB,EACtB,KAAkG;QAElG,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACrD,KAAK,EAAE,EAAE,cAAc,EAAE;YACzB,MAAM,EAAE;gBACN,cAAc;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe,EAAE,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe,EAAE,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC;SACF,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"org-embedding-config-service.js","sourceRoot":"","sources":["../../src/services/org-embedding-config-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3E,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,8CAA8C,CAAC;IAClG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACpD,CAAC;AAcD,MAAM,OAAO,yBAAyB;IAChB;IAApB,YAAoB,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAExC,KAAK,CAAC,GAAG,CAAC,cAAsB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACzD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,cAAsB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACzD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CACP,cAAsB,EACtB,KAAkG;QAElG,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACrD,KAAK,EAAE,EAAE,cAAc,EAAE;YACzB,MAAM,EAAE;gBACN,cAAc;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe,EAAE,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe,EAAE,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC;SACF,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/services/org-pii-config-service.d.ts

@@ -0,0 +1,30 @@
+import type { PrismaClient } from "@prisma/client";
+export type PiiMode = "encrypt" | "detect-warn" | "disabled";
+export interface OrgPiiConfig {
+    mode: PiiMode;
+    allowedPiiTypes: string[];
+    allowBypass: boolean;
+    updatedAt: Date;
+    updatedBy: string;
+}
+export interface OrgPiiConfigWithKey extends OrgPiiConfig {
+    piiKey: Buffer;
+}
+export declare class OrgPiiConfigService {
+    private db;
+    constructor(db: PrismaClient);
+    get(organizationId: string): Promise<OrgPiiConfig | null>;
+    getWithKey(organizationId: string): Promise<OrgPiiConfigWithKey | null>;
+    set(organizationId: string, input: {
+        mode: PiiMode;
+        allowedPiiTypes?: string[];
+        allowBypass?: boolean;
+        updatedBy?: string;
+    }): Promise<OrgPiiConfig>;
+    delete(organizationId: string): Promise<boolean>;
+    /**
+     * Generate a random 32-byte encryption key.
+     */
+    generateKey(): Buffer;
+}
+//# sourceMappingURL=org-pii-config-service.d.ts.map

package/dist/services/org-pii-config-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-pii-config-service.d.ts","sourceRoot":"","sources":["../../src/services/org-pii-config-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAgBnD,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,mBAAmB;IAClB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,YAAY;IAE9B,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAczD,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAevE,GAAG,CACP,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QACL,IAAI,EAAE,OAAO,CAAC;QACd,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,YAAY,CAAC;IAsClB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAStD;;OAEG;IACH,WAAW,IAAI,MAAM;CAGtB"}

package/dist/services/org-pii-config-service.js

@@ -0,0 +1,97 @@
+import { randomBytes } from "node:crypto";
+import { encryptAesGcm, decryptAesGcm, deriveKey } from "../lib/crypto.js";
+function getPiiEncryptionKey() {
+    const secret = process.env.PII_KEY_SECRET ?? "apart-default-pii-key-secret-change-me";
+    return deriveKey(secret);
+}
+function encryptPiiKey(plaintext) {
+    return encryptAesGcm(plaintext, getPiiEncryptionKey());
+}
+function decryptPiiKey(encoded) {
+    return decryptAesGcm(encoded, getPiiEncryptionKey());
+}
+export class OrgPiiConfigService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async get(organizationId) {
+        const config = await this.db.orgPiiConfig.findUnique({
+            where: { organizationId },
+        });
+        if (!config)
+            return null;
+        return {
+            mode: config.mode,
+            allowedPiiTypes: config.allowedPiiTypes,
+            allowBypass: config.allowBypass,
+            updatedAt: config.updatedAt,
+            updatedBy: config.updatedBy,
+        };
+    }
+    async getWithKey(organizationId) {
+        const config = await this.db.orgPiiConfig.findUnique({
+            where: { organizationId },
+        });
+        if (!config)
+            return null;
+        return {
+            mode: config.mode,
+            allowedPiiTypes: config.allowedPiiTypes,
+            allowBypass: config.allowBypass,
+            piiKey: Buffer.from(decryptPiiKey(config.piiKeyEncrypted), "hex"),
+            updatedAt: config.updatedAt,
+            updatedBy: config.updatedBy,
+        };
+    }
+    async set(organizationId, input) {
+        // Check if config already exists to preserve existing key
+        const existing = await this.db.orgPiiConfig.findUnique({
+            where: { organizationId },
+        });
+        const piiKeyEncrypted = existing
+            ? existing.piiKeyEncrypted
+            : encryptPiiKey(this.generateKey().toString("hex"));
+        const config = await this.db.orgPiiConfig.upsert({
+            where: { organizationId },
+            create: {
+                organizationId,
+                mode: input.mode,
+                piiKeyEncrypted,
+                allowedPiiTypes: (input.allowedPiiTypes ?? []),
+                allowBypass: input.allowBypass ?? false,
+                updatedBy: input.updatedBy ?? "api",
+            },
+            update: {
+                mode: input.mode,
+                allowedPiiTypes: (input.allowedPiiTypes ?? existing?.allowedPiiTypes ?? []),
+                allowBypass: input.allowBypass ?? existing?.allowBypass ?? false,
+                updatedAt: new Date(),
+                updatedBy: input.updatedBy ?? "api",
+            },
+        });
+        return {
+            mode: config.mode,
+            allowedPiiTypes: config.allowedPiiTypes,
+            allowBypass: config.allowBypass,
+            updatedAt: config.updatedAt,
+            updatedBy: config.updatedBy,
+        };
+    }
+    async delete(organizationId) {
+        try {
+            await this.db.orgPiiConfig.delete({ where: { organizationId } });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Generate a random 32-byte encryption key.
+     */
+    generateKey() {
+        return randomBytes(32);
+    }
+}
+//# sourceMappingURL=org-pii-config-service.js.map

package/dist/services/org-pii-config-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-pii-config-service.js","sourceRoot":"","sources":["../../src/services/org-pii-config-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3E,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,wCAAwC,CAAC;IACtF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACvD,CAAC;AAgBD,MAAM,OAAO,mBAAmB;IACV;IAApB,YAAoB,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAExC,KAAK,CAAC,GAAG,CAAC,cAAsB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YACnD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAe;YAC5B,eAAe,EAAE,MAAM,CAAC,eAA2B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,cAAsB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YACnD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAe;YAC5B,eAAe,EAAE,MAAM,CAAC,eAA2B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC;YACjE,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CACP,cAAsB,EACtB,KAKC;QAED,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YACrD,KAAK,EAAE,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,QAAQ;YAC9B,CAAC,CAAC,QAAQ,CAAC,eAAe;YAC1B,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC/C,KAAK,EAAE,EAAE,cAAc,EAAE;YACzB,MAAM,EAAE;gBACN,cAAc;gBACd,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,eAAe;gBACf,eAAe,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAA8D;gBAC3G,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,eAAe,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,QAAQ,EAAE,eAAe,IAAI,EAAE,CAA8D;gBACxI,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,KAAK;gBAChE,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC;SACF,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAe;YAC5B,eAAe,EAAE,MAAM,CAAC,eAA2B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,cAAsB;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;CACF"}

package/dist/services/pii-detector-service.d.ts

@@ -0,0 +1,24 @@
+import type { PiiPattern } from "@cdssnc/sanitize-pii";
+export interface PiiMatch {
+    type: string;
+    value: string;
+    start: number;
+    end: number;
+}
+export interface PiiDetectionResult {
+    hasPii: boolean;
+    matches: PiiMatch[];
+}
+export declare class PiiDetectorService {
+    private sanitizer;
+    constructor(customPatterns?: PiiPattern[]);
+    /**
+     * Detect PII in a text string. Returns matches with their positions.
+     */
+    detect(text: string): PiiDetectionResult;
+    /**
+     * Detect PII in all string values of an object (shallow — top-level keys only).
+     */
+    detectInObject(obj: Record<string, unknown>): Record<string, PiiDetectionResult>;
+}
+//# sourceMappingURL=pii-detector-service.d.ts.map

package/dist/services/pii-detector-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-detector-service.d.ts","sourceRoot":"","sources":["../../src/services/pii-detector-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,QAAQ,EAAE,CAAC;CACrB;AAgBD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,SAAS,CAAe;gBAEpB,cAAc,CAAC,EAAE,UAAU,EAAE;IAOzC;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;IAiCxC;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;CASjF"}

package/dist/services/pii-detector-service.js

@@ -0,0 +1,89 @@
+import { PiiSanitizer, defaultPatterns } from "@cdssnc/sanitize-pii";
+/** Additional patterns not included in @cdssnc/sanitize-pii defaults */
+const extraPatterns = [
+    {
+        name: "email",
+        regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+        description: "Email address",
+    },
+    {
+        name: "ssn_us",
+        regex: /\b\d{3}-\d{2}-\d{4}\b/g,
+        description: "US Social Security Number",
+    },
+];
+export class PiiDetectorService {
+    sanitizer;
+    constructor(customPatterns) {
+        this.sanitizer = new PiiSanitizer({
+            patterns: [...defaultPatterns, ...extraPatterns, ...(customPatterns ?? [])],
+            useDefaultPatterns: false,
+        });
+    }
+    /**
+     * Detect PII in a text string. Returns matches with their positions.
+     */
+    detect(text) {
+        if (!text)
+            return { hasPii: false, matches: [] };
+        const detections = this.sanitizer.detectPii(text);
+        const matches = [];
+        for (const detection of detections) {
+            // Find all occurrences of this match in the text
+            let searchFrom = 0;
+            while (searchFrom < text.length) {
+                const idx = text.indexOf(detection.match, searchFrom);
+                if (idx === -1)
+                    break;
+                matches.push({
+                    type: detection.pattern,
+                    value: detection.match,
+                    start: idx,
+                    end: idx + detection.match.length,
+                });
+                searchFrom = idx + detection.match.length;
+            }
+        }
+        // Sort by position (start offset) and deduplicate overlapping matches
+        matches.sort((a, b) => a.start - b.start);
+        const deduplicated = deduplicateMatches(matches);
+        return {
+            hasPii: deduplicated.length > 0,
+            matches: deduplicated,
+        };
+    }
+    /**
+     * Detect PII in all string values of an object (shallow — top-level keys only).
+     */
+    detectInObject(obj) {
+        const results = {};
+        for (const [key, value] of Object.entries(obj)) {
+            if (typeof value === "string") {
+                results[key] = this.detect(value);
+            }
+        }
+        return results;
+    }
+}
+/**
+ * Remove overlapping matches, keeping the longer (more specific) one.
+ */
+function deduplicateMatches(sorted) {
+    if (sorted.length <= 1)
+        return sorted;
+    const result = [sorted[0]];
+    for (let i = 1; i < sorted.length; i++) {
+        const prev = result[result.length - 1];
+        const curr = sorted[i];
+        if (curr.start >= prev.end) {
+            result.push(curr);
+        }
+        else if (curr.end - curr.start > prev.end - prev.start) {
+            // Current match is longer — replace previous
+            result[result.length - 1] = curr;
+        }
+        // Otherwise skip (previous match covers this one)
+    }
+    return result;
+}
+//# sourceMappingURL=pii-detector-service.js.map

package/dist/services/pii-detector-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-detector-service.js","sourceRoot":"","sources":["../../src/services/pii-detector-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAerE,wEAAwE;AACxE,MAAM,aAAa,GAAiB;IAClC;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,eAAe;KAC7B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,2BAA2B;KACzC;CACF,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACrB,SAAS,CAAe;IAEhC,YAAY,cAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC;YAChC,QAAQ,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YAC3E,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAEjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAe,EAAE,CAAC;QAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,iDAAiD;YACjD,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,OAAO,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBACtD,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,MAAM;gBAEtB,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,SAAS,CAAC,OAAO;oBACvB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,GAAG;oBACV,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM;iBAClC,CAAC,CAAC;gBACH,UAAU,GAAG,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjD,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;YAC/B,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,GAA4B;QACzC,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAkB;IAC5C,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtC,MAAM,MAAM,GAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACzD,6CAA6C;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;QACnC,CAAC;QACD,kDAAkD;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/pii-encryption-service.d.ts

@@ -0,0 +1,55 @@
+import type { PiiDetectorService } from "./pii-detector-service.js";
+export interface PiiEncryptionOptions {
+    orgKey?: Buffer;
+    mode: "encrypt" | "detect-warn" | "disabled";
+    allowedPiiTypes?: string[];
+    bypass?: boolean;
+}
+export interface PiiReport {
+    matchCount: number;
+    encryptedCount: number;
+    bypassedCount: number;
+    types: string[];
+    mode: string;
+    bypassed: boolean;
+}
+export interface PiiProcessingResult {
+    text: string;
+    report: PiiReport;
+}
+export declare class PiiEncryptionService {
+    private detector;
+    constructor(detector: PiiDetectorService);
+    /**
+     * Process a text string: detect PII and optionally encrypt matches.
+     */
+    processText(text: string, options: PiiEncryptionOptions): PiiProcessingResult;
+    /**
+     * Process node fields (title, content, metadata) for PII.
+     */
+    processNodeFields(input: {
+        title: string;
+        content: string;
+        metadata?: Record<string, unknown>;
+    }, options: PiiEncryptionOptions): {
+        title: string;
+        content: string;
+        metadata?: Record<string, unknown>;
+        report: PiiReport;
+    };
+    /**
+     * Decrypt all PII tokens in a text string.
+     */
+    decryptText(text: string, orgKey: Buffer): string;
+    /**
+     * Decrypt PII tokens in node fields.
+     */
+    decryptNodeFields<T extends {
+        title: string;
+        content: string;
+        metadata: unknown;
+    }>(node: T, orgKey: Buffer): T;
+    private processMetadata;
+    private decryptMetadataValues;
+}
+//# sourceMappingURL=pii-encryption-service.d.ts.map

package/dist/services/pii-encryption-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-encryption-service.d.ts","sourceRoot":"","sources":["../../src/services/pii-encryption-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,aAAa,GAAG,UAAU,CAAC;IAC7C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAKD,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ;gBAAR,QAAQ,EAAE,kBAAkB;IAEhD;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,mBAAmB;IAkE7E;;OAEG;IACH,iBAAiB,CACf,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAC7E,OAAO,EAAE,oBAAoB,GAC5B;QACD,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,SAAS,CAAC;KACnB;IAkED;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAWjD;;OAEG;IACH,iBAAiB,CAAC,CAAC,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,EAC/E,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,MAAM,GACb,CAAC;IASJ,OAAO,CAAC,eAAe;IAyDvB,OAAO,CAAC,qBAAqB;CAqB9B"}