@dynamatix/gb-schemas 2.17.13 → 2.19.1

package/dist/product-catalogues/product-variant.type.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="../shared/encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/product-catalogues/product-variant.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"product-variant.type.d.ts","sourceRoot":"","sources":["../../product-catalogues/product-variant.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,CAAC,OAAO,WAAW,eAAgB,SAAQ,SAAS;IACtD,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAElB"}
+{"version":3,"file":"product-variant.type.d.ts","sourceRoot":"","sources":["../../product-catalogues/product-variant.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,CAAC,OAAO,WAAW,eAAgB,SAAQ,SAAS;IACtD,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAElB"}

package/dist/properties/property.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="../shared/encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/properties/property.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"property.model.d.ts","sourceRoot":"","sources":["../../properties/property.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAe,MAAM,wBAAwB,CAAC;AA8J5D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}
+{"version":3,"file":"property.model.d.ts","sourceRoot":"","sources":["../../properties/property.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAe,MAAM,wBAAwB,CAAC;AA8J5D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}

package/dist/properties/security.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="../shared/encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/properties/security.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.model.d.ts","sourceRoot":"","sources":["../../properties/security.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,QAAQ,MAAM,UAAU,CAAC;AA6KhC,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}
+{"version":3,"file":"security.model.d.ts","sourceRoot":"","sources":["../../properties/security.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,QAAQ,MAAM,UAAU,CAAC;AA6KhC,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}

package/dist/shared/alert.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/alert.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alert.model.d.ts","sourceRoot":"","sources":["../../shared/alert.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAuC,CAAC;AAExD,eAAe,UAAU,CAAC"}
+{"version":3,"file":"alert.model.d.ts","sourceRoot":"","sources":["../../shared/alert.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAuC,CAAC;AAExD,eAAe,UAAU,CAAC"}

package/dist/shared/api-log.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/api-log.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-log.model.d.ts","sourceRoot":"","sources":["../../shared/api-log.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC;;;GAGG;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0C,CAAC;AAE5D,eAAe,WAAW,CAAC"}
+{"version":3,"file":"api-log.model.d.ts","sourceRoot":"","sources":["../../shared/api-log.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC;;;GAGG;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0C,CAAC;AAE5D,eAAe,WAAW,CAAC"}

package/dist/shared/api-performance.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/api-performance.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-performance.model.d.ts","sourceRoot":"","sources":["../../shared/api-performance.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,eAAe,MAAM,wBAAwB,CAAC;AAyBrD,QAAA,MAAM,sBAAsB;;;;OAAgF,CAAC;AAC7G,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"api-performance.model.d.ts","sourceRoot":"","sources":["../../shared/api-performance.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,eAAe,MAAM,wBAAwB,CAAC;AAyBrD,QAAA,MAAM,sBAAsB;;;;OAAgF,CAAC;AAC7G,eAAe,sBAAsB,CAAC"}

package/dist/shared/api-performance.type.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/api-performance.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-performance.type.d.ts","sourceRoot":"","sources":["../../shared/api-performance.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9F;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,WAAW,EAAE,IAAI,CAAC;IAElB;;OAEG;IACH,MAAM,EAAE,UAAU,CAAC;IAEnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe,EAAE,QAAQ;CAAG;AAE7E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;KACvC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,6BAA6B,CAAC,EAAE;SAC7B,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,MAAM;KACpC,CAAC;CACH;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"api-performance.type.d.ts","sourceRoot":"","sources":["../../shared/api-performance.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9F;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,WAAW,EAAE,IAAI,CAAC;IAElB;;OAEG;IACH,MAAM,EAAE,UAAU,CAAC;IAEnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe,EAAE,QAAQ;CAAG;AAE7E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;KACvC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,6BAA6B,CAAC,EAAE;SAC7B,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,MAAM;KACpC,CAAC;CACH;AAED,eAAe,eAAe,CAAC"}

package/dist/shared/apprivo-sync-journey.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/apprivo-sync-journey.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apprivo-sync-journey.model.d.ts","sourceRoot":"","sources":["../../shared/apprivo-sync-journey.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAoBhC,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAiE,CAAC;AAC/F,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"apprivo-sync-journey.model.d.ts","sourceRoot":"","sources":["../../shared/apprivo-sync-journey.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAoBhC,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAiE,CAAC;AAC/F,eAAe,uBAAuB,CAAC"}

package/dist/shared/checklist.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/checklist.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checklist.model.d.ts","sourceRoot":"","sources":["../../shared/checklist.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAuChC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA+C,CAAC;AAEpE,eAAe,cAAc,CAAC"}
+{"version":3,"file":"checklist.model.d.ts","sourceRoot":"","sources":["../../shared/checklist.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAuChC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA+C,CAAC;AAEpE,eAAe,cAAc,CAAC"}

package/dist/shared/encryption/encrypted-field-map.d.ts

@@ -0,0 +1,141 @@
+/// <reference path="../../value-objects/pound.d.ts" />
+/// <reference path="../../value-objects/account-number.d.ts" />
+/// <reference path="../../value-objects/sort-code.d.ts" />
+/// <reference types="mongoose/types/aggregate" />
+/// <reference types="mongoose/types/callback" />
+/// <reference types="mongoose/types/collection" />
+/// <reference types="mongoose/types/connection" />
+/// <reference types="mongoose/types/cursor" />
+/// <reference types="mongoose/types/document" />
+/// <reference types="mongoose/types/error" />
+/// <reference types="mongoose/types/expressions" />
+/// <reference types="mongoose/types/helpers" />
+/// <reference types="mongoose/types/middlewares" />
+/// <reference types="mongoose/types/indexes" />
+/// <reference types="mongoose/types/models" />
+/// <reference types="mongoose/types/mongooseoptions" />
+/// <reference types="mongoose/types/pipelinestage" />
+/// <reference types="mongoose/types/populate" />
+/// <reference types="mongoose/types/query" />
+/// <reference types="mongoose/types/schemaoptions" />
+/// <reference types="mongoose/types/session" />
+/// <reference types="mongoose/types/types" />
+/// <reference types="mongoose/types/utility" />
+/// <reference types="mongoose/types/validation" />
+/// <reference types="mongoose/types/virtuals" />
+/// <reference types="mongoose/types/schematypes" />
+/// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
+import { Schema, Model } from 'mongoose';
+/**
+ * Augments Mongoose's per-path options with the `ghEncrypt` annotation so a
+ * field is marked for encryption with exactly one line in its schema:
+ *
+ * ```ts
+ * firstName: { type: String, required: true, ghEncrypt: true }
+ * ```
+ */
+declare module 'mongoose' {
+    interface SchemaTypeOptions<T> {
+        /**
+         * Marks this path for RANDOM-mode field-level encryption.
+         * Named `ghEncrypt` because Mongoose reserves `encrypt` for its own
+         * (Enterprise-only) CSFLE schema option.
+         */
+        ghEncrypt?: boolean;
+    }
+}
+/** One encrypted path of a collection, as consumed by the plugin/backfill. */
+export interface EncryptedFieldEntry {
+    /** Dot path of the field (array element paths have no numeric segment). */
+    path: string;
+    /** Encryption mode — always `random`; deterministic is not supported. */
+    mode: 'random';
+    /** Mongoose type instance name (String, Number, Date, …) for tooling. */
+    bsonType: string;
+}
+/** Physical collection name → encrypted field entries. */
+export type EncryptedFieldMap = Record<string, EncryptedFieldEntry[]>;
+/**
+ * Builds the encrypted-field map from `ghEncrypt: true` schema annotations.
+ *
+ * The map is the single source of truth consumed by the Mongoose encryption
+ * plugin (Enc-4), the backfill migration (Enc-6) and — via {@link toJson} —
+ * non-Mongoose consumers such as cat-workflow-engine's decrypt adapter.
+ *
+ * Validation is fail-loud at startup: an annotation on an indexed path, an
+ * ObjectId reference or `_id` throws immediately, because RANDOM ciphertext
+ * can never be queried, joined on, or indexed.
+ */
+export declare class EncryptedFieldMapBuilder {
+    private constructor();
+    /**
+     * Collects all validated `ghEncrypt: true` paths of one schema, recursing
+     * into embedded subdocument schemas and subdocument arrays.
+     *
+     * @param schema - The Mongoose schema to scan.
+     * @param prefix - Path prefix used during recursion; omit at call sites.
+     * @returns Entries sorted in schema declaration order.
+     * @throws Error when an annotated path is indexed, unique, ObjectId or `_id`.
+     * @example
+     * ```ts
+     * const entries = EncryptedFieldMapBuilder.buildForSchema(applicantSchema);
+     * // → [{ path: 'firstName', mode: 'random', bsonType: 'String' }, …]
+     * ```
+     */
+    static buildForSchema(schema: Schema, prefix?: string): EncryptedFieldEntry[];
+    /**
+     * Builds the full map for a set of models, keyed by physical collection
+     * name. Models without any annotated field are omitted.
+     *
+     * @param models - Registered Mongoose models to scan.
+     * @returns Collection name → encrypted field entries.
+     * @example
+     * ```ts
+     * const map = EncryptedFieldMapBuilder.buildForModels([
+     *     ApplicantModel, ApplicationDirectDebitModel
+     * ]);
+     * // → { applicants: […], application_directdebits: […] }
+     * ```
+     */
+    static buildForModels(models: Model<unknown>[]): EncryptedFieldMap;
+    /**
+     * Serialises a map as plain JSON for non-Mongoose consumers (e.g. the
+     * cat-workflow-engine decrypt-on-read adapter).
+     *
+     * @param map - Map produced by {@link buildForModels}.
+     * @returns Pretty-printed JSON string.
+     * @example
+     * ```ts
+     * fs.writeFileSync('encrypted-fields.json', EncryptedFieldMapBuilder.toJson(map));
+     * ```
+     */
+    static toJson(map: EncryptedFieldMap): string;
+    /**
+     * Fail-loud validation of a single annotated path.
+     *
+     * @param path - Full dot path of the annotated field.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema (for schema-level index lookup).
+     * @throws Error describing exactly which rule the annotation violates.
+     * @example
+     * ```ts
+     * // internal use only — called by buildForSchema()
+     * ```
+     */
+    private static validatePath;
+    /**
+     * Detects path-level (`index`/`unique`) and schema-level index coverage.
+     *
+     * @param path - Full dot path relative to the checked schema.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema.
+     * @returns `true` when any index covers the path.
+     * @example
+     * ```ts
+     * // internal use only — called by validatePath()
+     * ```
+     */
+    private static isIndexed;
+}
+//# sourceMappingURL=encrypted-field-map.d.ts.map

package/dist/shared/encryption/encrypted-field-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-field-map.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encrypted-field-map.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAc,KAAK,EAAE,MAAM,UAAU,CAAC;AAErD;;;;;;;GAOG;AACH,OAAO,QAAQ,UAAU,CAAC;IACtB,UAAU,iBAAiB,CAAC,CAAC;QACzB;;;;WAIG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;KACvB;CACJ;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAChC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,QAAQ,CAAC;IACf,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,qBAAa,wBAAwB;IACjC,OAAO;IAEP;;;;;;;;;;;;;OAaG;WACW,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,mBAAmB,EAAE;IAiBhF;;;;;;;;;;;;;OAaG;WACW,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,iBAAiB;IAWzE;;;;;;;;;;OAUG;WACW,MAAM,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM;IAIpD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IAkB3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;CAS3B"}

package/dist/shared/encryption/encrypted-field-map.js

@@ -0,0 +1,126 @@
+/**
+ * Builds the encrypted-field map from `ghEncrypt: true` schema annotations.
+ *
+ * The map is the single source of truth consumed by the Mongoose encryption
+ * plugin (Enc-4), the backfill migration (Enc-6) and — via {@link toJson} —
+ * non-Mongoose consumers such as cat-workflow-engine's decrypt adapter.
+ *
+ * Validation is fail-loud at startup: an annotation on an indexed path, an
+ * ObjectId reference or `_id` throws immediately, because RANDOM ciphertext
+ * can never be queried, joined on, or indexed.
+ */
+export class EncryptedFieldMapBuilder {
+    constructor() { }
+    /**
+     * Collects all validated `ghEncrypt: true` paths of one schema, recursing
+     * into embedded subdocument schemas and subdocument arrays.
+     *
+     * @param schema - The Mongoose schema to scan.
+     * @param prefix - Path prefix used during recursion; omit at call sites.
+     * @returns Entries sorted in schema declaration order.
+     * @throws Error when an annotated path is indexed, unique, ObjectId or `_id`.
+     * @example
+     * ```ts
+     * const entries = EncryptedFieldMapBuilder.buildForSchema(applicantSchema);
+     * // → [{ path: 'firstName', mode: 'random', bsonType: 'String' }, …]
+     * ```
+     */
+    static buildForSchema(schema, prefix = '') {
+        const entries = [];
+        schema.eachPath((path, schemaType) => {
+            const fullPath = prefix ? `${prefix}.${path}` : path;
+            const childSchema = schemaType.schema;
+            if (childSchema) {
+                entries.push(...EncryptedFieldMapBuilder.buildForSchema(childSchema, fullPath));
+                return;
+            }
+            if (schemaType.options?.ghEncrypt === true) {
+                EncryptedFieldMapBuilder.validatePath(fullPath, schemaType, schema);
+                entries.push({ path: fullPath, mode: 'random', bsonType: schemaType.instance });
+            }
+        });
+        return entries;
+    }
+    /**
+     * Builds the full map for a set of models, keyed by physical collection
+     * name. Models without any annotated field are omitted.
+     *
+     * @param models - Registered Mongoose models to scan.
+     * @returns Collection name → encrypted field entries.
+     * @example
+     * ```ts
+     * const map = EncryptedFieldMapBuilder.buildForModels([
+     *     ApplicantModel, ApplicationDirectDebitModel
+     * ]);
+     * // → { applicants: […], application_directdebits: […] }
+     * ```
+     */
+    static buildForModels(models) {
+        const map = {};
+        for (const model of models) {
+            const entries = EncryptedFieldMapBuilder.buildForSchema(model.schema);
+            if (entries.length > 0) {
+                map[model.collection.collectionName] = entries;
+            }
+        }
+        return map;
+    }
+    /**
+     * Serialises a map as plain JSON for non-Mongoose consumers (e.g. the
+     * cat-workflow-engine decrypt-on-read adapter).
+     *
+     * @param map - Map produced by {@link buildForModels}.
+     * @returns Pretty-printed JSON string.
+     * @example
+     * ```ts
+     * fs.writeFileSync('encrypted-fields.json', EncryptedFieldMapBuilder.toJson(map));
+     * ```
+     */
+    static toJson(map) {
+        return JSON.stringify(map, null, 2);
+    }
+    /**
+     * Fail-loud validation of a single annotated path.
+     *
+     * @param path - Full dot path of the annotated field.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema (for schema-level index lookup).
+     * @throws Error describing exactly which rule the annotation violates.
+     * @example
+     * ```ts
+     * // internal use only — called by buildForSchema()
+     * ```
+     */
+    static validatePath(path, schemaType, schema) {
+        if (path === '_id' || path.endsWith('._id')) {
+            throw new Error(`Encrypted-field annotation on '${path}': _id can never be encrypted.`);
+        }
+        if (schemaType.instance === 'ObjectId') {
+            throw new Error(`Encrypted-field annotation on '${path}': ObjectId references cannot be encrypted ` +
+                '(they are join/lookup keys).');
+        }
+        if (EncryptedFieldMapBuilder.isIndexed(path, schemaType, schema)) {
+            throw new Error(`Encrypted-field annotation on '${path}': the path is indexed. RANDOM ciphertext ` +
+                'is unqueryable — drop the index or remove the annotation.');
+        }
+    }
+    /**
+     * Detects path-level (`index`/`unique`) and schema-level index coverage.
+     *
+     * @param path - Full dot path relative to the checked schema.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema.
+     * @returns `true` when any index covers the path.
+     * @example
+     * ```ts
+     * // internal use only — called by validatePath()
+     * ```
+     */
+    static isIndexed(path, schemaType, schema) {
+        if (schemaType.options?.index || schemaType.options?.unique) {
+            return true;
+        }
+        const relativePath = path.split('.').pop();
+        return schema.indexes().some(([keys]) => Object.keys(keys).includes(path) || Object.keys(keys).includes(relativePath));
+    }
+}

package/dist/shared/encryption/encryption.config.d.ts

@@ -0,0 +1,55 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * Immutable configuration for the field-level encryption layer.
+ *
+ * The master key is supplied via the `GH_ENCRYPTION_MASTER_KEY` environment
+ * variable as a base64-encoded 96-byte value and acts as the `local` KMS
+ * provider key for MongoDB Client-Side Field Level Encryption. Validation is
+ * fail-fast: a missing or malformed key throws at bootstrap so services never
+ * start half-configured. Key material is never echoed in error messages.
+ */
+export declare class EncryptionConfig {
+    /** Decoded 96-byte master key used as the `local` KMS provider key. */
+    readonly masterKey: Buffer;
+    /** `db.collection` namespace of the key vault. */
+    readonly keyVaultNamespace: string;
+    /** keyAltName used to resolve/provision the single shared DEK. */
+    readonly keyAltName: string;
+    /** Fixed key vault namespace shared by every Gatehouse service. */
+    static readonly KEY_VAULT_NAMESPACE = "encryption.__keyVault";
+    /** Alt name of the single shared data encryption key (DEK). */
+    static readonly KEY_ALT_NAME = "gatehouse-dek";
+    /** Name of the environment variable carrying the master key. */
+    static readonly MASTER_KEY_ENV_VAR = "GH_ENCRYPTION_MASTER_KEY";
+    /** Required master key length in bytes for the `local` KMS provider. */
+    private static readonly MASTER_KEY_BYTES;
+    private constructor();
+    /**
+     * Builds a validated configuration from an environment map.
+     *
+     * @param env - Environment map, typically `process.env`.
+     * @returns A frozen, validated {@link EncryptionConfig}.
+     * @throws Error when the env var is missing, not base64, or not 96 bytes.
+     * @example
+     * ```ts
+     * const config = EncryptionConfig.load(process.env);
+     * const service = new EncryptionService(config);
+     * ```
+     */
+    static load(env: Record<string, string | undefined>): EncryptionConfig;
+    /**
+     * Decodes and validates the base64 master key without ever including the
+     * supplied value in error messages.
+     *
+     * @param raw - Raw base64 string from the environment.
+     * @returns The decoded 96-byte key.
+     * @throws Error when the value is not strict base64 or has a wrong length.
+     * @example
+     * ```ts
+     * // internal use only — called by EncryptionConfig.load()
+     * ```
+     */
+    private static decodeMasterKey;
+}
+//# sourceMappingURL=encryption.config.d.ts.map

package/dist/shared/encryption/encryption.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.config.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encryption.config.ts"],"names":[],"mappings":";;AAAA;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAcrB,uEAAuE;aACvD,SAAS,EAAE,MAAM;IACjC,kDAAkD;aAClC,iBAAiB,EAAE,MAAM;IACzC,kEAAkE;aAClD,UAAU,EAAE,MAAM;IAlBtC,mEAAmE;IACnE,gBAAuB,mBAAmB,2BAA2B;IAErE,+DAA+D;IAC/D,gBAAuB,YAAY,mBAAmB;IAEtD,gEAAgE;IAChE,gBAAuB,kBAAkB,8BAA8B;IAEvE,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C,OAAO;IASP;;;;;;;;;;;OAWG;WACW,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,gBAAgB;IAgB7E;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;CAiBjC"}

package/dist/shared/encryption/encryption.config.js

@@ -0,0 +1,76 @@
+/**
+ * Immutable configuration for the field-level encryption layer.
+ *
+ * The master key is supplied via the `GH_ENCRYPTION_MASTER_KEY` environment
+ * variable as a base64-encoded 96-byte value and acts as the `local` KMS
+ * provider key for MongoDB Client-Side Field Level Encryption. Validation is
+ * fail-fast: a missing or malformed key throws at bootstrap so services never
+ * start half-configured. Key material is never echoed in error messages.
+ */
+export class EncryptionConfig {
+    constructor(
+    /** Decoded 96-byte master key used as the `local` KMS provider key. */
+    masterKey, 
+    /** `db.collection` namespace of the key vault. */
+    keyVaultNamespace, 
+    /** keyAltName used to resolve/provision the single shared DEK. */
+    keyAltName) {
+        this.masterKey = masterKey;
+        this.keyVaultNamespace = keyVaultNamespace;
+        this.keyAltName = keyAltName;
+    }
+    /**
+     * Builds a validated configuration from an environment map.
+     *
+     * @param env - Environment map, typically `process.env`.
+     * @returns A frozen, validated {@link EncryptionConfig}.
+     * @throws Error when the env var is missing, not base64, or not 96 bytes.
+     * @example
+     * ```ts
+     * const config = EncryptionConfig.load(process.env);
+     * const service = new EncryptionService(config);
+     * ```
+     */
+    static load(env) {
+        const raw = env[EncryptionConfig.MASTER_KEY_ENV_VAR];
+        if (!raw) {
+            throw new Error(`${EncryptionConfig.MASTER_KEY_ENV_VAR} is not set. ` +
+                'Provide a base64-encoded 96-byte master key.');
+        }
+        const masterKey = EncryptionConfig.decodeMasterKey(raw);
+        return new EncryptionConfig(masterKey, EncryptionConfig.KEY_VAULT_NAMESPACE, EncryptionConfig.KEY_ALT_NAME);
+    }
+    /**
+     * Decodes and validates the base64 master key without ever including the
+     * supplied value in error messages.
+     *
+     * @param raw - Raw base64 string from the environment.
+     * @returns The decoded 96-byte key.
+     * @throws Error when the value is not strict base64 or has a wrong length.
+     * @example
+     * ```ts
+     * // internal use only — called by EncryptionConfig.load()
+     * ```
+     */
+    static decodeMasterKey(raw) {
+        const decoded = Buffer.from(raw, 'base64');
+        if (decoded.length === 0 || decoded.toString('base64') !== raw.replace(/\s/g, '')) {
+            throw new Error(`${EncryptionConfig.MASTER_KEY_ENV_VAR} is not valid base64. ` +
+                '(value withheld from this message)');
+        }
+        if (decoded.length !== EncryptionConfig.MASTER_KEY_BYTES) {
+            throw new Error(`${EncryptionConfig.MASTER_KEY_ENV_VAR} must decode to exactly ` +
+                `${EncryptionConfig.MASTER_KEY_BYTES} bytes, got ${decoded.length}. ` +
+                '(value withheld from this message)');
+        }
+        return decoded;
+    }
+}
+/** Fixed key vault namespace shared by every Gatehouse service. */
+EncryptionConfig.KEY_VAULT_NAMESPACE = 'encryption.__keyVault';
+/** Alt name of the single shared data encryption key (DEK). */
+EncryptionConfig.KEY_ALT_NAME = 'gatehouse-dek';
+/** Name of the environment variable carrying the master key. */
+EncryptionConfig.MASTER_KEY_ENV_VAR = 'GH_ENCRYPTION_MASTER_KEY';
+/** Required master key length in bytes for the `local` KMS provider. */
+EncryptionConfig.MASTER_KEY_BYTES = 96;

package/dist/shared/encryption/encryption.init.d.ts

@@ -0,0 +1,66 @@
+import { MongoClient } from 'mongodb';
+import { EncryptionService } from './encryption.service.js';
+/**
+ * Process-wide bootstrap for the encryption layer, mirroring the
+ * `initializeWorkflowMiddleware` pattern used elsewhere in this package.
+ *
+ * Consumer services call {@link EncryptionBootstrap.initialize} exactly once
+ * at startup (right after connecting to MongoDB); everything else — the
+ * Mongoose plugin, repositories, adapters — obtains the shared singleton via
+ * {@link EncryptionBootstrap.getService}.
+ */
+export declare class EncryptionBootstrap {
+    private static service;
+    private constructor();
+    /**
+     * Initializes the singleton {@link EncryptionService} from the
+     * environment and a connected client. Idempotent: repeated calls return
+     * the already-initialized instance.
+     *
+     * @param client - A connected {@link MongoClient}.
+     * @param env - Environment map, defaults to `process.env`.
+     * @returns The initialized singleton service.
+     * @throws Error when `GH_ENCRYPTION_MASTER_KEY` is missing or malformed.
+     * @example
+     * ```ts
+     * await mongoose.connect(uri);
+     * await EncryptionBootstrap.initialize(
+     *     mongoose.connection.getClient() as unknown as MongoClient
+     * );
+     * ```
+     */
+    static initialize(client: MongoClient, env?: Record<string, string | undefined>): Promise<EncryptionService>;
+    /**
+     * Returns the initialized singleton service.
+     *
+     * @returns The shared {@link EncryptionService}.
+     * @throws Error when called before {@link initialize}.
+     * @example
+     * ```ts
+     * const ciphertext = await EncryptionBootstrap.getService().encrypt(value);
+     * ```
+     */
+    static getService(): EncryptionService;
+    /**
+     * Reports whether the encryption layer has been bootstrapped.
+     *
+     * @returns `true` after a successful {@link initialize} call.
+     * @example
+     * ```ts
+     * if (!EncryptionBootstrap.isInitialized()) {
+     *     await EncryptionBootstrap.initialize(client);
+     * }
+     * ```
+     */
+    static isInitialized(): boolean;
+    /**
+     * Tears down the singleton (used by tests and graceful shutdown).
+     *
+     * @example
+     * ```ts
+     * await EncryptionBootstrap.reset();
+     * ```
+     */
+    static reset(): Promise<void>;
+}
+//# sourceMappingURL=encryption.init.d.ts.map

package/dist/shared/encryption/encryption.init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.init.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encryption.init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAkC;IAExD,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;WACiB,UAAU,CAC1B,MAAM,EAAE,WAAW,EACnB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACtD,OAAO,CAAC,iBAAiB,CAAC;IAU7B;;;;;;;;;OASG;WACW,UAAU,IAAI,iBAAiB;IAU7C;;;;;;;;;;OAUG;WACW,aAAa,IAAI,OAAO;IAItC;;;;;;;OAOG;WACiB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAM7C"}