@apart-tech/intelligence-core 1.0.7 → 1.1.0

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type { Database } from "./db/connection.js";
 export { PrismaClient } from "@prisma/client";
 export { createTenantClient, tenantWhere, SINGLE_TENANT_ORG_ID } from "./db/tenant.js";
 export type { TenantContext } from "./db/tenant.js";
+export { encryptAesGcm, decryptAesGcm, deriveKey } from "./lib/crypto.js";
 export * from "./types/index.js";
 export { loadConfig } from "./config/index.js";
 export { NodeService } from "./services/node-service.js";
@@ -14,6 +15,12 @@ export { WorkspaceService } from "./services/workspace-service.js";
 export type { WorkspaceFilter, CreateWorkspaceInput, UpdateWorkspaceInput } from "./services/workspace-service.js";
 export { CleaningService } from "./services/cleaning-service.js";
 export { OrgEmbeddingConfigService } from "./services/org-embedding-config-service.js";
+export { PiiDetectorService } from "./services/pii-detector-service.js";
+export type { PiiMatch, PiiDetectionResult } from "./services/pii-detector-service.js";
+export { PiiEncryptionService } from "./services/pii-encryption-service.js";
+export type { PiiEncryptionOptions, PiiReport, PiiProcessingResult } from "./services/pii-encryption-service.js";
+export { OrgPiiConfigService } from "./services/org-pii-config-service.js";
+export type { OrgPiiConfig, OrgPiiConfigWithKey, PiiMode } from "./services/org-pii-config-service.js";
 export type { OrgEmbeddingConfig, OrgEmbeddingConfigWithKey } from "./services/org-embedding-config-service.js";
 export type { OrphanNode, DuplicatePair, HealthReport, LinkSuggestion, Island, IslandBridge, ValidationReport, ValidationIssue, ValidationCategory, ValidationSeverity, NormalizeSuggestion, NormalizeReport } from "./services/cleaning-service.js";
 export { createEmbeddingProvider, validateEmbeddingKey, OpenAIEmbeddingProvider, VoyageEmbeddingProvider, OllamaEmbeddingProvider } from "./providers/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAChH,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGrP,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChK,YAAY,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG1E,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AACvG,YAAY,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAChH,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGrP,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChK,YAAY,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -2,6 +2,8 @@
 export { getDb, getTenantDb, closeDb } from "./db/connection.js";
 export { PrismaClient } from "@prisma/client";
 export { createTenantClient, tenantWhere, SINGLE_TENANT_ORG_ID } from "./db/tenant.js";
+// Crypto
+export { encryptAesGcm, decryptAesGcm, deriveKey } from "./lib/crypto.js";
 // Types
 export * from "./types/index.js";
 // Config
@@ -15,6 +17,9 @@ export { DomainService } from "./services/domain-service.js";
 export { WorkspaceService } from "./services/workspace-service.js";
 export { CleaningService } from "./services/cleaning-service.js";
 export { OrgEmbeddingConfigService } from "./services/org-embedding-config-service.js";
+export { PiiDetectorService } from "./services/pii-detector-service.js";
+export { PiiEncryptionService } from "./services/pii-encryption-service.js";
+export { OrgPiiConfigService } from "./services/org-pii-config-service.js";
 // Providers
 export { createEmbeddingProvider, validateEmbeddingKey, OpenAIEmbeddingProvider, VoyageEmbeddingProvider, OllamaEmbeddingProvider } from "./providers/index.js";
 export { BatchingEmbeddingProvider } from "./providers/batching.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAIvF,YAAY;AACZ,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhK,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE1E,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAK3E,YAAY;AACZ,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhK,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lib/__tests__/crypto.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=crypto.test.d.ts.map

package/dist/lib/__tests__/crypto.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/crypto.test.ts"],"names":[],"mappings":""}

package/dist/lib/__tests__/crypto.test.js

@@ -0,0 +1,63 @@
+import { describe, it, expect } from "vitest";
+import { encryptAesGcm, decryptAesGcm, deriveKey } from "../crypto.js";
+describe("crypto", () => {
+    const key = deriveKey("test-secret");
+    describe("deriveKey", () => {
+        it("returns a 32-byte buffer", () => {
+            expect(key.length).toBe(32);
+        });
+        it("is deterministic", () => {
+            expect(deriveKey("test-secret")).toEqual(key);
+        });
+        it("produces different keys for different secrets", () => {
+            expect(deriveKey("other-secret")).not.toEqual(key);
+        });
+    });
+    describe("encryptAesGcm / decryptAesGcm", () => {
+        it("roundtrips plaintext correctly", () => {
+            const plaintext = "hello world";
+            const encrypted = encryptAesGcm(plaintext, key);
+            const decrypted = decryptAesGcm(encrypted, key);
+            expect(decrypted).toBe(plaintext);
+        });
+        it("produces iv:tag:ciphertext format", () => {
+            const encrypted = encryptAesGcm("test", key);
+            const parts = encrypted.split(":");
+            expect(parts).toHaveLength(3);
+            // Each part should be valid base64
+            for (const part of parts) {
+                expect(() => Buffer.from(part, "base64")).not.toThrow();
+            }
+        });
+        it("produces different ciphertext each time (random IV)", () => {
+            const a = encryptAesGcm("same text", key);
+            const b = encryptAesGcm("same text", key);
+            expect(a).not.toBe(b);
+            // But both decrypt to same value
+            expect(decryptAesGcm(a, key)).toBe("same text");
+            expect(decryptAesGcm(b, key)).toBe("same text");
+        });
+        it("fails with wrong key", () => {
+            const encrypted = encryptAesGcm("secret", key);
+            const wrongKey = deriveKey("wrong-secret");
+            expect(() => decryptAesGcm(encrypted, wrongKey)).toThrow();
+        });
+        it("fails with tampered ciphertext", () => {
+            const encrypted = encryptAesGcm("secret", key);
+            const parts = encrypted.split(":");
+            // Tamper with the ciphertext part
+            const tampered = parts[0] + ":" + parts[1] + ":AAAA";
+            expect(() => decryptAesGcm(tampered, key)).toThrow();
+        });
+        it("handles empty string", () => {
+            const encrypted = encryptAesGcm("", key);
+            expect(decryptAesGcm(encrypted, key)).toBe("");
+        });
+        it("handles unicode", () => {
+            const plaintext = "Hello 🌍 — résumé";
+            const encrypted = encryptAesGcm(plaintext, key);
+            expect(decryptAesGcm(encrypted, key)).toBe(plaintext);
+        });
+    });
+});
+//# sourceMappingURL=crypto.test.js.map

package/dist/lib/__tests__/crypto.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/crypto.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEvE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,MAAM,GAAG,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAErC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,SAAS,GAAG,aAAa,CAAC;YAChC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,mCAAmC;YACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,iCAAiC;YACjC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,kCAAkC;YAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;YACrD,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;YACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACtC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/crypto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Derive a 32-byte AES key from a secret string using SHA-256.
+ */
+export declare function deriveKey(secret: string): Buffer;
+/**
+ * Encrypt plaintext using AES-256-GCM.
+ * Returns a string in the format: base64(iv):base64(authTag):base64(ciphertext)
+ */
+export declare function encryptAesGcm(plaintext: string, key: Buffer): string;
+/**
+ * Decrypt an AES-256-GCM encoded string (iv:tag:ciphertext format).
+ */
+export declare function decryptAesGcm(encoded: string, key: Buffer): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQlE"}

package/dist/lib/crypto.js

@@ -0,0 +1,33 @@
+import { createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto";
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 16;
+/**
+ * Derive a 32-byte AES key from a secret string using SHA-256.
+ */
+export function deriveKey(secret) {
+    return createHash("sha256").update(secret).digest();
+}
+/**
+ * Encrypt plaintext using AES-256-GCM.
+ * Returns a string in the format: base64(iv):base64(authTag):base64(ciphertext)
+ */
+export function encryptAesGcm(plaintext, key) {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${iv.toString("base64")}:${tag.toString("base64")}:${encrypted.toString("base64")}`;
+}
+/**
+ * Decrypt an AES-256-GCM encoded string (iv:tag:ciphertext format).
+ */
+export function decryptAesGcm(encoded, key) {
+    const [ivB64, tagB64, ciphertextB64] = encoded.split(":");
+    const iv = Buffer.from(ivB64, "base64");
+    const tag = Buffer.from(tagB64, "base64");
+    const ciphertext = Buffer.from(ciphertextB64, "base64");
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+//# sourceMappingURL=crypto.js.map

package/dist/lib/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC"}

package/dist/services/__tests__/pii-detector-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pii-detector-service.test.d.ts.map

package/dist/services/__tests__/pii-detector-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-detector-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/pii-detector-service.test.ts"],"names":[],"mappings":""}

package/dist/services/__tests__/pii-detector-service.test.js

@@ -0,0 +1,75 @@
+import { describe, it, expect } from "vitest";
+import { PiiDetectorService } from "../pii-detector-service.js";
+describe("PiiDetectorService", () => {
+    const detector = new PiiDetectorService();
+    describe("detect", () => {
+        it("detects email addresses", () => {
+            const result = detector.detect("Contact john@example.com for details");
+            expect(result.hasPii).toBe(true);
+            expect(result.matches).toHaveLength(1);
+            expect(result.matches[0].type).toBe("email");
+            expect(result.matches[0].value).toBe("john@example.com");
+        });
+        it("detects phone numbers", () => {
+            const result = detector.detect("Call me at (555) 123-4567");
+            expect(result.hasPii).toBe(true);
+            expect(result.matches.some((m) => m.type === "phone_number")).toBe(true);
+        });
+        it("detects credit card numbers", () => {
+            const result = detector.detect("Card: 4111-1111-1111-1111");
+            expect(result.hasPii).toBe(true);
+            expect(result.matches.some((m) => m.type === "credit_card")).toBe(true);
+        });
+        it("detects US SSNs", () => {
+            const result = detector.detect("SSN: 123-45-6789");
+            expect(result.hasPii).toBe(true);
+            expect(result.matches.some((m) => m.type === "ssn_us")).toBe(true);
+        });
+        it("returns no matches for clean text", () => {
+            const result = detector.detect("This is a normal sentence about software engineering.");
+            expect(result.hasPii).toBe(false);
+            expect(result.matches).toHaveLength(0);
+        });
+        it("handles empty string", () => {
+            const result = detector.detect("");
+            expect(result.hasPii).toBe(false);
+            expect(result.matches).toHaveLength(0);
+        });
+        it("detects multiple PII types in one string", () => {
+            const result = detector.detect("Email john@example.com or call (555) 123-4567");
+            expect(result.hasPii).toBe(true);
+            const types = result.matches.map((m) => m.type);
+            expect(types).toContain("email");
+            expect(types).toContain("phone_number");
+        });
+        it("includes correct start/end positions", () => {
+            const text = "Contact john@example.com please";
+            const result = detector.detect(text);
+            expect(result.matches).toHaveLength(1);
+            const match = result.matches[0];
+            expect(text.slice(match.start, match.end)).toBe("john@example.com");
+        });
+    });
+    describe("detectInObject", () => {
+        it("detects PII in string values", () => {
+            const results = detector.detectInObject({
+                name: "John",
+                email: "john@example.com",
+                age: 30,
+            });
+            expect(results["email"]).toBeDefined();
+            expect(results["email"].hasPii).toBe(true);
+            // Non-string values should not be in results
+            expect(results["age"]).toBeUndefined();
+        });
+        it("handles object with no PII", () => {
+            const results = detector.detectInObject({
+                title: "Hello world",
+                content: "Just a normal string",
+            });
+            expect(results["title"].hasPii).toBe(false);
+            expect(results["content"].hasPii).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=pii-detector-service.test.js.map

package/dist/services/__tests__/pii-detector-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-detector-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/pii-detector-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAE1C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;YACxF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,iCAAiC,CAAC;YAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC;gBACtC,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,kBAAkB;gBACzB,GAAG,EAAE,EAAE;aACR,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,6CAA6C;YAC7C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC;gBACtC,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/__tests__/pii-encryption-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pii-encryption-service.test.d.ts.map

package/dist/services/__tests__/pii-encryption-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-encryption-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/pii-encryption-service.test.ts"],"names":[],"mappings":""}

package/dist/services/__tests__/pii-encryption-service.test.js

@@ -0,0 +1,151 @@
+import { describe, it, expect } from "vitest";
+import { PiiEncryptionService } from "../pii-encryption-service.js";
+import { PiiDetectorService } from "../pii-detector-service.js";
+import { deriveKey } from "../../lib/crypto.js";
+describe("PiiEncryptionService", () => {
+    const detector = new PiiDetectorService();
+    const service = new PiiEncryptionService(detector);
+    const orgKey = deriveKey("test-org-key");
+    describe("processText", () => {
+        it("encrypts PII and replaces with tokens", () => {
+            const result = service.processText("Email john@example.com for info", {
+                orgKey,
+                mode: "encrypt",
+            });
+            expect(result.text).not.toContain("john@example.com");
+            expect(result.text).toMatch(/\[PII:email:[^\]]+\]/);
+            expect(result.report.matchCount).toBe(1);
+            expect(result.report.encryptedCount).toBe(1);
+            expect(result.report.mode).toBe("encrypt");
+        });
+        it("detect-warn mode reports but does not encrypt", () => {
+            const result = service.processText("Email john@example.com for info", {
+                orgKey,
+                mode: "detect-warn",
+            });
+            expect(result.text).toContain("john@example.com");
+            expect(result.report.matchCount).toBe(1);
+            expect(result.report.encryptedCount).toBe(0);
+            expect(result.report.bypassedCount).toBe(1);
+        });
+        it("disabled mode does no processing", () => {
+            const result = service.processText("Email john@example.com for info", {
+                orgKey,
+                mode: "disabled",
+            });
+            expect(result.text).toBe("Email john@example.com for info");
+            expect(result.report.matchCount).toBe(0);
+        });
+        it("bypass skips encryption", () => {
+            const result = service.processText("Email john@example.com for info", {
+                orgKey,
+                mode: "encrypt",
+                bypass: true,
+            });
+            expect(result.text).toContain("john@example.com");
+            expect(result.report.bypassed).toBe(true);
+            expect(result.report.encryptedCount).toBe(0);
+        });
+        it("allowedPiiTypes skips specified types", () => {
+            const result = service.processText("Email john@example.com, SSN: 123-45-6789", {
+                orgKey,
+                mode: "encrypt",
+                allowedPiiTypes: ["email"],
+            });
+            // Email should still be in plaintext
+            expect(result.text).toContain("john@example.com");
+            // SSN should be encrypted
+            expect(result.text).not.toContain("123-45-6789");
+            expect(result.text).toMatch(/\[PII:ssn_us:[^\]]+\]/);
+        });
+        it("handles text with no PII", () => {
+            const result = service.processText("Just a normal sentence", {
+                orgKey,
+                mode: "encrypt",
+            });
+            expect(result.text).toBe("Just a normal sentence");
+            expect(result.report.matchCount).toBe(0);
+            expect(result.report.encryptedCount).toBe(0);
+        });
+    });
+    describe("decryptText", () => {
+        it("roundtrips: encrypt then decrypt yields original", () => {
+            const original = "Contact john@example.com or call (555) 123-4567";
+            const encrypted = service.processText(original, { orgKey, mode: "encrypt" });
+            const decrypted = service.decryptText(encrypted.text, orgKey);
+            expect(decrypted).toBe(original);
+        });
+        it("leaves non-PII text unchanged", () => {
+            const text = "No PII here";
+            expect(service.decryptText(text, orgKey)).toBe(text);
+        });
+        it("handles wrong key gracefully (leaves tokens intact)", () => {
+            const encrypted = service.processText("Email john@example.com", {
+                orgKey,
+                mode: "encrypt",
+            });
+            const wrongKey = deriveKey("wrong-key");
+            const result = service.decryptText(encrypted.text, wrongKey);
+            // Should still contain the token (decryption failed gracefully)
+            expect(result).toMatch(/\[PII:email:[^\]]+\]/);
+        });
+    });
+    describe("processNodeFields", () => {
+        it("processes title, content, and metadata", () => {
+            const result = service.processNodeFields({
+                title: "Contact john@example.com",
+                content: "Call (555) 123-4567 for details",
+                metadata: { note: "SSN is 123-45-6789" },
+            }, { orgKey, mode: "encrypt" });
+            expect(result.title).not.toContain("john@example.com");
+            expect(result.content).not.toContain("(555) 123-4567");
+            expect(result.report.matchCount).toBeGreaterThan(0);
+            expect(result.report.encryptedCount).toBeGreaterThan(0);
+        });
+        it("disabled mode passes through unchanged", () => {
+            const input = {
+                title: "john@example.com",
+                content: "test",
+                metadata: { key: "value" },
+            };
+            const result = service.processNodeFields(input, { orgKey, mode: "disabled" });
+            expect(result.title).toBe(input.title);
+            expect(result.content).toBe(input.content);
+            expect(result.metadata).toEqual(input.metadata);
+        });
+    });
+    describe("decryptNodeFields", () => {
+        it("decrypts PII in all node fields", () => {
+            const original = {
+                title: "Contact john@example.com",
+                content: "Call (555) 123-4567",
+                metadata: { note: "regular text" },
+            };
+            const encrypted = service.processNodeFields(original, { orgKey, mode: "encrypt" });
+            const node = {
+                id: "test",
+                title: encrypted.title,
+                content: encrypted.content,
+                metadata: encrypted.metadata ?? {},
+            };
+            const decrypted = service.decryptNodeFields(node, orgKey);
+            expect(decrypted.title).toBe(original.title);
+            expect(decrypted.content).toBe(original.content);
+        });
+    });
+    describe("token format", () => {
+        it("produces parseable PII tokens", () => {
+            const result = service.processText("Email john@example.com", {
+                orgKey,
+                mode: "encrypt",
+            });
+            const tokenRegex = /\[PII:(\w+):([A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+)\]/g;
+            const match = tokenRegex.exec(result.text);
+            expect(match).not.toBeNull();
+            expect(match[1]).toBe("email");
+            // The encrypted payload should have 3 colon-separated base64 parts
+            expect(match[2].split(":")).toHaveLength(3);
+        });
+    });
+});
+//# sourceMappingURL=pii-encryption-service.test.js.map

package/dist/services/__tests__/pii-encryption-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-encryption-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/pii-encryption-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAEzC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,iCAAiC,EAAE;gBACpE,MAAM;gBACN,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,iCAAiC,EAAE;gBACpE,MAAM;gBACN,IAAI,EAAE,aAAa;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,iCAAiC,EAAE;gBACpE,MAAM;gBACN,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,iCAAiC,EAAE;gBACpE,MAAM;gBACN,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,0CAA0C,EAAE;gBAC7E,MAAM;gBACN,IAAI,EAAE,SAAS;gBACf,eAAe,EAAE,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC;YAEH,qCAAqC;YACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAClD,0BAA0B;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE;gBAC3D,MAAM;gBACN,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,QAAQ,GAAG,iDAAiD,CAAC;YACnE,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,IAAI,GAAG,aAAa,CAAC;YAC3B,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE;gBAC9D,MAAM;gBACN,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7D,gEAAgE;YAChE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CACtC;gBACE,KAAK,EAAE,0BAA0B;gBACjC,OAAO,EAAE,iCAAiC;gBAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE;aACzC,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAC5B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,KAAK,GAAG;gBACZ,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;aAC3B,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAE9E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,QAAQ,GAAG;gBACf,KAAK,EAAE,0BAA0B;gBACjC,OAAO,EAAE,qBAAqB;gBAC9B,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;aACnC,CAAC;YAEF,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG;gBACX,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;aACnC,CAAC;YAEF,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE;gBAC3D,MAAM;gBACN,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,kEAAkE,CAAC;YACtF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,mEAAmE;YACnE,MAAM,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/node-service.d.ts

@@ -1,11 +1,15 @@
 import type { PrismaClient } from "@prisma/client";
 import type { Node, NodeStatus, EmbeddingProvider } from "../types/index.js";
 import { type TenantContext } from "../db/tenant.js";
+import type { PiiEncryptionService } from "./pii-encryption-service.js";
+import type { PiiEncryptionOptions } from "./pii-encryption-service.js";
 export declare class NodeService {
     private db;
     private embeddings;
+    private piiEncryption?;
+    private piiOptions?;
     private tenantCtx;
-    constructor(db: PrismaClient, embeddings: EmbeddingProvider, tenantCtx?: TenantContext);
+    constructor(db: PrismaClient, embeddings: EmbeddingProvider, tenantCtx?: TenantContext, piiEncryption?: PiiEncryptionService | undefined, piiOptions?: PiiEncryptionOptions | undefined);
     create(input: {
         type: string;
         title: string;
@@ -47,5 +51,10 @@ export declare class NodeService {
         type: string;
         count: number;
     }[]>;
+    /**
+     * Apply PII detection/encryption to node fields.
+     * Returns processed fields and whether PII was found.
+     */
+    private applyPii;
 }
 //# sourceMappingURL=node-service.d.ts.map

package/dist/services/node-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-service.d.ts","sourceRoot":"","sources":["../../src/services/node-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAU,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EACV,IAAI,EACJ,UAAU,EACV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExF,qBAAa,WAAW;IAIpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,UAAU;IAJpB,OAAO,CAAC,SAAS,CAAgB;gBAGvB,EAAE,EAAE,YAAY,EAChB,UAAU,EAAE,iBAAiB,EACrC,SAAS,CAAC,EAAE,aAAa;IAKrB,MAAM,CAAC,KAAK,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCX,mBAAmB,CACvB,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC;IA4BV,mBAAmB,CACvB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,EACD,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAiCjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBrD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAMzC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAsCjB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAa/D,UAAU,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAQvC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpC,SAAS,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAQ9D"}
+{"version":3,"file":"node-service.d.ts","sourceRoot":"","sources":["../../src/services/node-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAU,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EACV,IAAI,EACJ,UAAU,EACV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,qBAAa,WAAW;IAIpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,UAAU;IAElB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,UAAU,CAAC;IAPrB,OAAO,CAAC,SAAS,CAAgB;gBAGvB,EAAE,EAAE,YAAY,EAChB,UAAU,EAAE,iBAAiB,EACrC,SAAS,CAAC,EAAE,aAAa,EACjB,aAAa,CAAC,EAAE,oBAAoB,YAAA,EACpC,UAAU,CAAC,EAAE,oBAAoB,YAAA;IAKrC,MAAM,CAAC,KAAK,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCX,mBAAmB,CACvB,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC;IAmCV,mBAAmB,CACvB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,EACD,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBrD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAMzC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA6CjB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAa/D,UAAU,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAQvC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpC,SAAS,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAS7D;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAgCjB"}