@carlonicora/nestjs-neo4jsonapi 2.7.2 → 2.9.0

package/dist/foundations/ai-connection/index.d.ts

@@ -0,0 +1,12 @@
+export * from "./ai-connection.module";
+export * from "./entities/ai-connection";
+export * from "./entities/ai-connection.meta";
+export * from "./dtos/ai-connection.post.dto";
+export * from "./dtos/ai-connection.put.dto";
+export * from "./dtos/ai-connection.reorder.dto";
+export * from "./registry/ai-provider.registry";
+export * from "./repositories/ai-connection.repository";
+export * from "./services/ai-connection-encryption.service";
+export * from "./services/ai-connection.service";
+export * from "./controllers/ai-connection.controller";
+//# sourceMappingURL=index.d.ts.map

package/dist/foundations/ai-connection/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/ai-connection/index.ts"],"names":[],"mappings":"AACA,cAAc,wBAAwB,CAAC;AAGvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAG9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AAGjD,cAAc,iCAAiC,CAAC;AAGhD,cAAc,yCAAyC,CAAC;AAGxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kCAAkC,CAAC;AAGjD,cAAc,wCAAwC,CAAC"}

package/dist/foundations/ai-connection/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Module
+__exportStar(require("./ai-connection.module"), exports);
+// Entities
+__exportStar(require("./entities/ai-connection"), exports);
+__exportStar(require("./entities/ai-connection.meta"), exports);
+// DTOs
+__exportStar(require("./dtos/ai-connection.post.dto"), exports);
+__exportStar(require("./dtos/ai-connection.put.dto"), exports);
+__exportStar(require("./dtos/ai-connection.reorder.dto"), exports);
+// Registry
+__exportStar(require("./registry/ai-provider.registry"), exports);
+// Repositories
+__exportStar(require("./repositories/ai-connection.repository"), exports);
+// Services
+__exportStar(require("./services/ai-connection-encryption.service"), exports);
+__exportStar(require("./services/ai-connection.service"), exports);
+// Controllers
+__exportStar(require("./controllers/ai-connection.controller"), exports);
+//# sourceMappingURL=index.js.map

package/dist/foundations/ai-connection/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/ai-connection/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS;AACT,yDAAuC;AAEvC,WAAW;AACX,2DAAyC;AACzC,gEAA8C;AAE9C,OAAO;AACP,gEAA8C;AAC9C,+DAA6C;AAC7C,mEAAiD;AAEjD,WAAW;AACX,kEAAgD;AAEhD,eAAe;AACf,0EAAwD;AAExD,WAAW;AACX,8EAA4D;AAC5D,mEAAiD;AAEjD,cAAc;AACd,yEAAuD"}

package/dist/foundations/ai-connection/registry/ai-provider.registry.d.ts

@@ -0,0 +1,54 @@
+import { AiConnectionType } from "../../../core/llm/interfaces/ai-candidate.interface";
+/**
+ * How the admin editor renders a provider field, and how the write-side
+ * validator interprets it.
+ *
+ * - `text`    — free-form string input
+ * - `secret`  — write-only value, encrypted at rest, never serialised back
+ * - `number`  — numeric input
+ * - `boolean` — checkbox
+ * - `select`  — closed set, constrained by {@link AiProviderFieldDescriptor.options}
+ */
+export type AiProviderFieldKind = "text" | "secret" | "number" | "boolean" | "select";
+/**
+ * One configurable field of one provider. Structure only — no display text:
+ * the frontend derives its i18n keys from `field`.
+ */
+export interface AiProviderFieldDescriptor {
+    field: string;
+    kind: AiProviderFieldKind;
+    required?: boolean;
+    options?: string[];
+    default?: string | number | boolean;
+}
+/** The complete field set one provider exposes for one connection type. */
+export interface AiProviderDescriptor {
+    provider: string;
+    fields: AiProviderFieldDescriptor[];
+}
+/**
+ * The single source of truth for which providers each connection type accepts and
+ * which fields each provider exposes. Drives (a) write-side validation, (b) the
+ * admin editor form (served as top-level JSON:API `meta.providerRegistry`), and
+ * (c) resolver normalisation.
+ */
+export declare const AI_PROVIDER_REGISTRY: Record<AiConnectionType, AiProviderDescriptor[]>;
+/**
+ * Write-side gate for an AiConnection: the provider must be legal for the type,
+ * every required field must be present, no unsupported field may be set, closed
+ * sets must be respected, and any URL must survive {@link validateAiUrl} (HTTPS or
+ * loopback, plus the optional AI_URL_ALLOWLIST).
+ *
+ * A PUT that keeps a stored secret sends no secret value, so the caller (the
+ * AiConnection service) merges stored secrets back in BEFORE calling this — the
+ * validator itself needs no special case.
+ *
+ * @throws {BadRequestException} on any registry violation.
+ * @throws {Error} when a url/directUrl fails {@link validateAiUrl}.
+ */
+export declare function validateAiConnectionAttributes(params: {
+    connectionType: string;
+    provider: string;
+    attributes: Record<string, unknown>;
+}): void;
+//# sourceMappingURL=ai-provider.registry.d.ts.map

package/dist/foundations/ai-connection/registry/ai-provider.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider.registry.d.ts","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/registry/ai-provider.registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAGvF;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEtF;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CACrC;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAmMD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAgBjF,CAAC;AAKF;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG,IAAI,CAgCP"}

package/dist/foundations/ai-connection/registry/ai-provider.registry.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_PROVIDER_REGISTRY = void 0;
+exports.validateAiConnectionAttributes = validateAiConnectionAttributes;
+const common_1 = require("@nestjs/common");
+const model_service_1 = require("../../../core/llm/services/model.service");
+/**
+ * `reasoning_effort` is the same closed set everywhere it is offered — it mirrors
+ * REASONING_EFFORTS in `model.service.ts`.
+ */
+const REASONING_EFFORT_FIELD = {
+    field: "reasoningEffort",
+    kind: "select",
+    options: ["none", "minimal", "low", "medium", "high"],
+};
+const MAX_OUTPUT_TOKENS_FIELD = { field: "maxOutputTokens", kind: "number" };
+/**
+ * Per-connection cost overrides for token-billed modalities. A DB connection
+ * carries its own rates so token-usage costing reflects the connection that
+ * actually served the call (spec § Decisions — "Costs").
+ */
+const CHAT_COST_FIELDS = [
+    { field: "inputCostPer1MTokens", kind: "number" },
+    { field: "outputCostPer1MTokens", kind: "number" },
+    { field: "cachedInputCostPer1MTokens", kind: "number" },
+];
+/**
+ * Providers that go through `ModelService.buildChatModel` — the `ai`, `aiLite`,
+ * `aiLarge`, `vision` and `audio` connection types all share this set.
+ */
+const CHAT_PROVIDERS = [
+    {
+        provider: "openrouter",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "url", kind: "text", default: "https://openrouter.ai/api/v1" },
+            { field: "region", kind: "text" },
+            { field: "allowFallbacks", kind: "boolean", default: true },
+            REASONING_EFFORT_FIELD,
+            MAX_OUTPUT_TOKENS_FIELD,
+        ],
+    },
+    {
+        provider: "azure",
+        fields: [
+            { field: "instance", kind: "text", required: true },
+            { field: "model", kind: "text", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "apiVersion", kind: "text", required: true },
+            REASONING_EFFORT_FIELD,
+            MAX_OUTPUT_TOKENS_FIELD,
+        ],
+    },
+    {
+        provider: "vertex",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "region", kind: "text", required: true },
+            { field: "googleCredentialsBase64", kind: "secret", required: true },
+            MAX_OUTPUT_TOKENS_FIELD,
+        ],
+    },
+    {
+        provider: "requesty",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "url", kind: "text", required: true },
+            REASONING_EFFORT_FIELD,
+            MAX_OUTPUT_TOKENS_FIELD,
+        ],
+    },
+    {
+        provider: "ollama",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "url", kind: "text", default: "http://localhost:11434/v1" },
+            MAX_OUTPUT_TOKENS_FIELD,
+        ],
+    },
+    {
+        provider: "llamacpp",
+        fields: [{ field: "url", kind: "text", default: "http://localhost:8033/v1" }],
+    },
+    {
+        provider: "custom",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "url", kind: "text", required: true },
+            { field: "apiKey", kind: "secret" },
+            REASONING_EFFORT_FIELD,
+            MAX_OUTPUT_TOKENS_FIELD,
+        ],
+    },
+];
+/** Appends per-connection-type extra fields to every provider row of that type. */
+const withExtras = (rows, extras) => rows.map((row) => ({ provider: row.provider, fields: [...row.fields, ...extras] }));
+const EMBEDDER_COST_FIELDS = [{ field: "inputCostPer1MTokens", kind: "number" }];
+/**
+ * Embedder providers mirror the `buildInnerEmbedder` switch in `model.service.ts`
+ * (`openrouter`, `requesty`, `openai`, `azure`, `vertex` — `local` throws there and
+ * is therefore not offered).
+ */
+const EMBEDDER_PROVIDERS = [
+    {
+        provider: "openrouter",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "dimensions", kind: "number", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "url", kind: "text", required: true },
+        ],
+    },
+    {
+        provider: "requesty",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "dimensions", kind: "number", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "url", kind: "text", required: true },
+        ],
+    },
+    {
+        provider: "openai",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "dimensions", kind: "number", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+        ],
+    },
+    {
+        provider: "azure",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "dimensions", kind: "number", required: true },
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "instance", kind: "text", required: true },
+            { field: "apiVersion", kind: "text", required: true },
+        ],
+    },
+    {
+        provider: "vertex",
+        fields: [
+            { field: "model", kind: "text", required: true },
+            { field: "dimensions", kind: "number", required: true },
+            { field: "region", kind: "text", required: true },
+            { field: "googleCredentialsBase64", kind: "secret", required: true },
+        ],
+    },
+];
+/**
+ * SDK-based transcription providers, mirroring the `getTranscriber` switch in
+ * `model.service.ts` (`openai` / `azure` — anything else throws there).
+ */
+const TRANSCRIBER_PROVIDERS = [
+    {
+        provider: "openai",
+        fields: [
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "model", kind: "text", required: true },
+        ],
+    },
+    {
+        provider: "azure",
+        fields: [
+            { field: "apiKey", kind: "secret", required: true },
+            { field: "model", kind: "text", required: true },
+            { field: "url", kind: "text", required: true },
+            { field: "apiVersion", kind: "text", required: true },
+        ],
+    },
+];
+/**
+ * Mistral Document AI (OCR). One generic row: the endpoint is fully described by
+ * url + apiVersion, so there is nothing provider-specific to branch on.
+ */
+const DOCUMENT_AI_PROVIDERS = [
+    {
+        provider: "custom",
+        fields: [
+            { field: "apiKey", kind: "secret" },
+            { field: "model", kind: "text" },
+            { field: "url", kind: "text" },
+            { field: "apiVersion", kind: "text" },
+            { field: "costPerPage", kind: "number" },
+        ],
+    },
+];
+/**
+ * The single source of truth for which providers each connection type accepts and
+ * which fields each provider exposes. Drives (a) write-side validation, (b) the
+ * admin editor form (served as top-level JSON:API `meta.providerRegistry`), and
+ * (c) resolver normalisation.
+ */
+exports.AI_PROVIDER_REGISTRY = {
+    ai: withExtras(CHAT_PROVIDERS, CHAT_COST_FIELDS),
+    aiLite: withExtras(CHAT_PROVIDERS, CHAT_COST_FIELDS),
+    aiLarge: withExtras(CHAT_PROVIDERS, CHAT_COST_FIELDS),
+    vision: withExtras(CHAT_PROVIDERS, CHAT_COST_FIELDS),
+    audio: withExtras(CHAT_PROVIDERS, [
+        ...CHAT_COST_FIELDS,
+        { field: "costPerMinute", kind: "number" },
+        { field: "directUrl", kind: "text" },
+        { field: "language", kind: "text" },
+        { field: "directFormat", kind: "select", options: ["multipart", "json"] },
+        { field: "directProvider", kind: "text" },
+    ]),
+    embedder: withExtras(EMBEDDER_PROVIDERS, EMBEDDER_COST_FIELDS),
+    transcriber: TRANSCRIBER_PROVIDERS,
+    documentAi: DOCUMENT_AI_PROVIDERS,
+};
+/** Fields owned by the base entity, always allowed regardless of provider. */
+const BASE_FIELDS = new Set(["name", "connectionType", "provider", "position", "enabled"]);
+/**
+ * Write-side gate for an AiConnection: the provider must be legal for the type,
+ * every required field must be present, no unsupported field may be set, closed
+ * sets must be respected, and any URL must survive {@link validateAiUrl} (HTTPS or
+ * loopback, plus the optional AI_URL_ALLOWLIST).
+ *
+ * A PUT that keeps a stored secret sends no secret value, so the caller (the
+ * AiConnection service) merges stored secrets back in BEFORE calling this — the
+ * validator itself needs no special case.
+ *
+ * @throws {BadRequestException} on any registry violation.
+ * @throws {Error} when a url/directUrl fails {@link validateAiUrl}.
+ */
+function validateAiConnectionAttributes(params) {
+    const rows = exports.AI_PROVIDER_REGISTRY[params.connectionType];
+    if (!rows)
+        throw new common_1.BadRequestException(`Unknown connection type "${params.connectionType}"`);
+    const row = rows.find((r) => r.provider === params.provider);
+    if (!row)
+        throw new common_1.BadRequestException(`Provider "${params.provider}" is not available for connection type "${params.connectionType}"`);
+    const allowed = new Set([...BASE_FIELDS, ...row.fields.map((f) => f.field)]);
+    const present = (name) => {
+        const value = params.attributes[name];
+        return value !== undefined && value !== null && value !== "";
+    };
+    const missing = row.fields.filter((f) => f.required && !present(f.field)).map((f) => f.field);
+    if (missing.length)
+        throw new common_1.BadRequestException(`Missing required field(s) for ${params.provider}: ${missing.join(", ")}`);
+    const unknown = Object.keys(params.attributes).filter((key) => present(key) && !allowed.has(key));
+    if (unknown.length)
+        throw new common_1.BadRequestException(`Field(s) not supported by ${params.provider}: ${unknown.join(", ")}`);
+    for (const field of row.fields) {
+        if (field.options && present(field.field) && !field.options.includes(String(params.attributes[field.field])))
+            throw new common_1.BadRequestException(`"${params.attributes[field.field]}" is not a valid value for ${field.field}`);
+    }
+    for (const urlField of ["url", "directUrl"]) {
+        if (present(urlField))
+            (0, model_service_1.validateAiUrl)(String(params.attributes[urlField]), params.provider);
+    }
+}
+//# sourceMappingURL=ai-provider.registry.js.map

package/dist/foundations/ai-connection/registry/ai-provider.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider.registry.js","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/registry/ai-provider.registry.ts"],"names":[],"mappings":";;;AA2QA,wEAoCC;AA/SD,2CAAqD;AAErD,4EAAyE;AAgCzE;;;GAGG;AACH,MAAM,sBAAsB,GAA8B;IACxD,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;CACtD,CAAC;AAEF,MAAM,uBAAuB,GAA8B,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAExG;;;;GAIG;AACH,MAAM,gBAAgB,GAAgC;IACpD,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClD,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,EAAE;CACxD,CAAC;AAEF;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C;QACE,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE;YACvE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YACjC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;YAC3D,sBAAsB;YACtB,uBAAuB;SACxB;KACF;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACrD,sBAAsB;YACtB,uBAAuB;SACxB;KACF;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpE,uBAAuB;SACxB;KACF;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,sBAAsB;YACtB,uBAAuB;SACxB;KACF;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE;YACpE,uBAAuB;SACxB;KACF;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;KAC9E;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,sBAAsB;YACtB,uBAAuB;SACxB;KACF;CACF,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,GAAG,CAAC,IAA4B,EAAE,MAAmC,EAA0B,EAAE,CAC/G,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtF,MAAM,oBAAoB,GAAgC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE9G;;;;GAIG;AACH,MAAM,kBAAkB,GAA2B;IACjD;QACE,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC/C;KACF;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC/C;KACF;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SACpD;KACF;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;SACtD;KACF;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SACrE;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAA2B;IACpD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;SACjD;KACF;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChD,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;SACtD;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAA2B;IACpD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;YAChC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YAC9B,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;SACzC;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACU,QAAA,oBAAoB,GAAqD;IACpF,EAAE,EAAE,UAAU,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAChD,MAAM,EAAE,UAAU,CAAC,cAAc,EAAE,gBAAgB,CAAC;IACpD,OAAO,EAAE,UAAU,CAAC,cAAc,EAAE,gBAAgB,CAAC;IACrD,MAAM,EAAE,UAAU,CAAC,cAAc,EAAE,gBAAgB,CAAC;IACpD,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE;QAChC,GAAG,gBAAgB;QACnB,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1C,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;QACpC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;QACnC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;QACzE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;KAC1C,CAAC;IACF,QAAQ,EAAE,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAC9D,WAAW,EAAE,qBAAqB;IAClC,UAAU,EAAE,qBAAqB;CAClC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3F;;;;;;;;;;;;GAYG;AACH,SAAgB,8BAA8B,CAAC,MAI9C;IACC,MAAM,IAAI,GAAG,4BAAoB,CAAC,MAAM,CAAC,cAAkC,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;IAE/F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG;QACN,MAAM,IAAI,4BAAmB,CAC3B,aAAa,MAAM,CAAC,QAAQ,2CAA2C,MAAM,CAAC,cAAc,GAAG,CAChG,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9F,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE3G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvG,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1G,MAAM,IAAI,4BAAmB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC;YAAE,IAAA,6BAAa,EAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/foundations/ai-connection/repositories/ai-connection.repository.d.ts

@@ -0,0 +1,52 @@
+import { ClsService } from "nestjs-cls";
+import { AbstractRepository } from "../../../core/neo4j/abstracts/abstract.repository";
+import { Neo4jService } from "../../../core/neo4j/services/neo4j.service";
+import { SecurityService } from "../../../core/security/services/security.service";
+import { AiConnection, AiConnectionDescriptor } from "../entities/ai-connection";
+/**
+ * AiConnectionRepository
+ *
+ * No `buildReturnStatement()` override is needed. The inherited implementation
+ * (abstract.repository.ts) skips the `company` relationship only for
+ * `isCompanyScoped` entities whose edge is `BELONGS_TO`; this descriptor is
+ * `isCompanyScoped: false` with a `CONFIGURES` edge, so the generic loop emits
+ * `OPTIONAL MATCH (aiConnection)-[:CONFIGURES]->(aiConnection_company:Company)`
+ * (optional because `required: false`) and returns `aiConnection_company` —
+ * exactly what the `companyId` computed field reads.
+ */
+export declare class AiConnectionRepository extends AbstractRepository<AiConnection, typeof AiConnectionDescriptor.relationships> {
+    protected readonly descriptor: import("../../..").EntityDescriptor<AiConnection, {
+        company: {
+            model: import("../../..").DataMeta;
+            direction: "out";
+            relationship: string;
+            cardinality: "one";
+            required: false;
+            dtoKey: string;
+            immutable: true;
+        };
+    }>;
+    constructor(neo4j: Neo4jService, securityService: SecurityService, clsService: ClsService);
+    /**
+     * Full-table system read for the resolver snapshot. Unpaginated by design:
+     * this is the resolver's boot/refresh scan over an admin-scale node set
+     * (spec § 2 — scale is trivial, tens of nodes), not a user-facing list.
+     */
+    findAllForResolver(): Promise<AiConnection[]>;
+    /**
+     * The connections named by the reorder request, with their computed
+     * companyId — the service checks they all belong to one chain before
+     * renumbering.
+     */
+    findByIds(params: {
+        ids: string[];
+    }): Promise<AiConnection[]>;
+    /**
+     * Renumbers one chain to the given order. Single parameterized statement —
+     * writeOne because the query contains SET (read transactions reject it).
+     */
+    updatePositions(params: {
+        ids: string[];
+    }): Promise<void>;
+}
+//# sourceMappingURL=ai-connection.repository.d.ts.map

package/dist/foundations/ai-connection/repositories/ai-connection.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-connection.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/repositories/ai-connection.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGjF;;;;;;;;;;GAUG;AACH,qBACa,sBAAuB,SAAQ,kBAAkB,CAC5D,YAAY,EACZ,OAAO,sBAAsB,CAAC,aAAa,CAC5C;IACC,SAAS,CAAC,QAAQ,CAAC,UAAU;;;;;;;;;;OAA0B;gBAE3C,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU;IAIzF;;;;OAIG;IACG,kBAAkB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAUnD;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAWnE;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAUhE"}

package/dist/foundations/ai-connection/repositories/ai-connection.repository.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiConnectionRepository = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_cls_1 = require("nestjs-cls");
+const abstract_repository_1 = require("../../../core/neo4j/abstracts/abstract.repository");
+const neo4j_service_1 = require("../../../core/neo4j/services/neo4j.service");
+const security_service_1 = require("../../../core/security/services/security.service");
+const ai_connection_1 = require("../entities/ai-connection");
+const ai_connection_meta_1 = require("../entities/ai-connection.meta");
+/**
+ * AiConnectionRepository
+ *
+ * No `buildReturnStatement()` override is needed. The inherited implementation
+ * (abstract.repository.ts) skips the `company` relationship only for
+ * `isCompanyScoped` entities whose edge is `BELONGS_TO`; this descriptor is
+ * `isCompanyScoped: false` with a `CONFIGURES` edge, so the generic loop emits
+ * `OPTIONAL MATCH (aiConnection)-[:CONFIGURES]->(aiConnection_company:Company)`
+ * (optional because `required: false`) and returns `aiConnection_company` —
+ * exactly what the `companyId` computed field reads.
+ */
+let AiConnectionRepository = class AiConnectionRepository extends abstract_repository_1.AbstractRepository {
+    constructor(neo4j, securityService, clsService) {
+        super(neo4j, securityService, clsService);
+        this.descriptor = ai_connection_1.AiConnectionDescriptor;
+    }
+    /**
+     * Full-table system read for the resolver snapshot. Unpaginated by design:
+     * this is the resolver's boot/refresh scan over an admin-scale node set
+     * (spec § 2 — scale is trivial, tens of nodes), not a user-facing list.
+     */
+    async findAllForResolver() {
+        const query = this.neo4j.initQuery({ serialiser: ai_connection_1.AiConnectionDescriptor.model });
+        query.query = `
+      ${this.buildDefaultMatch()}
+      ORDER BY ${ai_connection_meta_1.aiConnectionMeta.nodeName}.connectionType ASC, ${ai_connection_meta_1.aiConnectionMeta.nodeName}.position ASC
+      ${this.buildReturnStatement()}
+    `;
+        return this.neo4j.readMany(query);
+    }
+    /**
+     * The connections named by the reorder request, with their computed
+     * companyId — the service checks they all belong to one chain before
+     * renumbering.
+     */
+    async findByIds(params) {
+        const query = this.neo4j.initQuery({ serialiser: ai_connection_1.AiConnectionDescriptor.model });
+        query.queryParams = { ...query.queryParams, ids: params.ids };
+        query.query = `
+      ${this.buildDefaultMatch()}
+      WHERE ${ai_connection_meta_1.aiConnectionMeta.nodeName}.id IN $ids
+      ${this.buildReturnStatement()}
+    `;
+        return this.neo4j.readMany(query);
+    }
+    /**
+     * Renumbers one chain to the given order. Single parameterized statement —
+     * writeOne because the query contains SET (read transactions reject it).
+     */
+    async updatePositions(params) {
+        await this.neo4j.writeOne({
+            query: `
+        UNWIND range(0, size($ids) - 1) AS idx
+        MATCH (${ai_connection_meta_1.aiConnectionMeta.nodeName}:${ai_connection_meta_1.aiConnectionMeta.labelName} { id: $ids[idx] })
+        SET ${ai_connection_meta_1.aiConnectionMeta.nodeName}.position = idx
+      `,
+            queryParams: { ids: params.ids },
+        });
+    }
+};
+exports.AiConnectionRepository = AiConnectionRepository;
+exports.AiConnectionRepository = AiConnectionRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [neo4j_service_1.Neo4jService, security_service_1.SecurityService, nestjs_cls_1.ClsService])
+], AiConnectionRepository);
+//# sourceMappingURL=ai-connection.repository.js.map

package/dist/foundations/ai-connection/repositories/ai-connection.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-connection.repository.js","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/repositories/ai-connection.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAAwC;AACxC,2FAAuF;AACvF,8EAA0E;AAC1E,uFAAmF;AACnF,6DAAiF;AACjF,uEAAkE;AAElE;;;;;;;;;;GAUG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,wCAG3C;IAGC,YAAY,KAAmB,EAAE,eAAgC,EAAE,UAAsB;QACvF,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAHzB,eAAU,GAAG,sCAAsB,CAAC;IAIvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,sCAAsB,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,KAAK,CAAC,KAAK,GAAG;QACV,IAAI,CAAC,iBAAiB,EAAE;iBACf,qCAAgB,CAAC,QAAQ,wBAAwB,qCAAgB,CAAC,QAAQ;QACnF,IAAI,CAAC,oBAAoB,EAAE;KAC9B,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAyB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,sCAAsB,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9D,KAAK,CAAC,KAAK,GAAG;QACV,IAAI,CAAC,iBAAiB,EAAE;cAClB,qCAAgB,CAAC,QAAQ;QAC/B,IAAI,CAAC,oBAAoB,EAAE;KAC9B,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,MAAyB;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE;;iBAEI,qCAAgB,CAAC,QAAQ,IAAI,qCAAgB,CAAC,SAAS;cAC1D,qCAAgB,CAAC,QAAQ;OAChC;YACD,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAvDY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCAOQ,4BAAY,EAAmB,kCAAe,EAAc,uBAAU;GAN9E,sBAAsB,CAuDlC"}

package/dist/foundations/ai-connection/services/ai-connection-encryption.service.d.ts

@@ -0,0 +1,52 @@
+/**
+ * AI Connection Encryption Service
+ *
+ * Provides AES-256-GCM encryption/decryption for AI connection secrets
+ * (`apiKey`, `googleCredentialsBase64`). Secrets are encrypted before storage in
+ * Neo4j and decrypted only when the resolver builds a candidate — they are never
+ * serialised back over the API.
+ *
+ * Mirrors {@link TotpEncryptionService} (the in-package AES-256-GCM canonical),
+ * keyed from `encryption.key` (ENCRYPTION_KEY) instead of the TOTP key.
+ *
+ * Format: IV (12 bytes) + AuthTag (16 bytes) + Ciphertext (base64 encoded)
+ */
+export declare class AiConnectionEncryptionService {
+    private readonly algorithm;
+    private readonly ivLength;
+    private readonly authTagLength;
+    /**
+     * Whether a key is configured at all. Writing a secret without one must fail
+     * loudly at the admin API (fail-closed on write, fail-open on read).
+     */
+    isConfigured(): boolean;
+    /**
+     * Get the encryption key from config.
+     * The key must be exactly 32 bytes (256 bits) for AES-256.
+     */
+    private getKey;
+    /**
+     * Encrypt an AI connection secret using AES-256-GCM.
+     *
+     * @param plaintext - The secret to encrypt (API key or base64 GCP credentials)
+     * @returns The encrypted secret as a base64-encoded string containing IV, auth tag, and ciphertext
+     */
+    encrypt(plaintext: string): string;
+    /**
+     * Decrypt an AI connection secret encrypted with AES-256-GCM.
+     *
+     * @param ciphertext - The base64-encoded encrypted secret (IV + AuthTag + Ciphertext)
+     * @returns The decrypted secret
+     * @throws Error if decryption fails (invalid key, corrupted data, or tampered data)
+     */
+    decrypt(ciphertext: string): string;
+    /**
+     * Verify that the encryption system is properly configured.
+     * Performs a round-trip encryption/decryption test.
+     *
+     * @returns true if encryption is working correctly
+     * @throws Error if encryption is not properly configured
+     */
+    verify(): boolean;
+}
+//# sourceMappingURL=ai-connection-encryption.service.d.ts.map

package/dist/foundations/ai-connection/services/ai-connection-encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-connection-encryption.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/services/ai-connection-encryption.service.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,qBACa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAM;IAEpC;;;OAGG;IACH,YAAY,IAAI,OAAO;IAIvB;;;OAGG;IACH,OAAO,CAAC,MAAM;IAwBd;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAelC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAiBnC;;;;;;OAMG;IACH,MAAM,IAAI,OAAO;CAMlB"}