@dynamatix/gb-schemas 2.17.13 → 2.19.1

package/dist/shared/encryption/encryption.init.js

@@ -0,0 +1,86 @@
+import { EncryptionConfig } from './encryption.config.js';
+import { EncryptionService } from './encryption.service.js';
+/**
+ * Process-wide bootstrap for the encryption layer, mirroring the
+ * `initializeWorkflowMiddleware` pattern used elsewhere in this package.
+ *
+ * Consumer services call {@link EncryptionBootstrap.initialize} exactly once
+ * at startup (right after connecting to MongoDB); everything else — the
+ * Mongoose plugin, repositories, adapters — obtains the shared singleton via
+ * {@link EncryptionBootstrap.getService}.
+ */
+export class EncryptionBootstrap {
+    constructor() { }
+    /**
+     * Initializes the singleton {@link EncryptionService} from the
+     * environment and a connected client. Idempotent: repeated calls return
+     * the already-initialized instance.
+     *
+     * @param client - A connected {@link MongoClient}.
+     * @param env - Environment map, defaults to `process.env`.
+     * @returns The initialized singleton service.
+     * @throws Error when `GH_ENCRYPTION_MASTER_KEY` is missing or malformed.
+     * @example
+     * ```ts
+     * await mongoose.connect(uri);
+     * await EncryptionBootstrap.initialize(
+     *     mongoose.connection.getClient() as unknown as MongoClient
+     * );
+     * ```
+     */
+    static async initialize(client, env = process.env) {
+        if (EncryptionBootstrap.service) {
+            return EncryptionBootstrap.service;
+        }
+        const service = new EncryptionService(EncryptionConfig.load(env));
+        await service.init(client);
+        EncryptionBootstrap.service = service;
+        return service;
+    }
+    /**
+     * Returns the initialized singleton service.
+     *
+     * @returns The shared {@link EncryptionService}.
+     * @throws Error when called before {@link initialize}.
+     * @example
+     * ```ts
+     * const ciphertext = await EncryptionBootstrap.getService().encrypt(value);
+     * ```
+     */
+    static getService() {
+        if (!EncryptionBootstrap.service) {
+            throw new Error('Encryption is not initialized. Call EncryptionBootstrap.initialize(client) ' +
+                '(initializeEncryption) at service bootstrap first.');
+        }
+        return EncryptionBootstrap.service;
+    }
+    /**
+     * Reports whether the encryption layer has been bootstrapped.
+     *
+     * @returns `true` after a successful {@link initialize} call.
+     * @example
+     * ```ts
+     * if (!EncryptionBootstrap.isInitialized()) {
+     *     await EncryptionBootstrap.initialize(client);
+     * }
+     * ```
+     */
+    static isInitialized() {
+        return EncryptionBootstrap.service !== null;
+    }
+    /**
+     * Tears down the singleton (used by tests and graceful shutdown).
+     *
+     * @example
+     * ```ts
+     * await EncryptionBootstrap.reset();
+     * ```
+     */
+    static async reset() {
+        if (EncryptionBootstrap.service) {
+            await EncryptionBootstrap.service.close();
+            EncryptionBootstrap.service = null;
+        }
+    }
+}
+EncryptionBootstrap.service = null;

package/dist/shared/encryption/encryption.service.d.ts

@@ -0,0 +1,110 @@
+import { MongoClient, Binary } from 'mongodb';
+import { EncryptionConfig } from './encryption.config.js';
+/**
+ * Explicit Client-Side Field Level Encryption service.
+ *
+ * Wraps the driver's {@link ClientEncryption} with the Gatehouse conventions:
+ * a single shared DEK (alt name `gatehouse-dek`) stored in the
+ * `encryption.__keyVault` collection and wrapped by the `local` master key
+ * from {@link EncryptionConfig}. Only RANDOM
+ * (`AEAD_AES_256_CBC_HMAC_SHA_512-Random`) mode is exposed — encrypted fields
+ * are never queryable, by design. There is deliberately no deterministic API.
+ *
+ * Works against MongoDB Community — explicit encryption needs no mongocryptd
+ * or crypt_shared sidecar.
+ */
+export declare class EncryptionService {
+    private readonly config;
+    private static readonly RANDOM_ALGORITHM;
+    private clientEncryption;
+    private dataKeyId;
+    constructor(config: EncryptionConfig);
+    /**
+     * Initializes the service against a connected client: ensures the key
+     * vault collection and its unique partial index on `keyAltNames`, then
+     * resolves the shared DEK by alt name — creating it on first ever run.
+     * Idempotent and safe to call from multiple services against the same DB.
+     *
+     * @param client - A connected {@link MongoClient} for the target cluster.
+     * @example
+     * ```ts
+     * const service = new EncryptionService(EncryptionConfig.load(process.env));
+     * await service.init(mongoClient);
+     * ```
+     */
+    init(client: MongoClient): Promise<void>;
+    /**
+     * Encrypts a value with the shared DEK in RANDOM mode. The same plaintext
+     * yields different ciphertext on every call, so encrypted fields must
+     * never appear in query filters, sorts, or indexes.
+     *
+     * @param value - Any BSON-serialisable value (string, number, object, array).
+     * @returns Ciphertext as BSON {@link Binary} subtype 6.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const ciphertext = await service.encrypt('AB123456C');
+     * await collection.updateOne({ _id }, { $set: { niNumber: ciphertext } });
+     * ```
+     */
+    encrypt(value: unknown): Promise<Binary>;
+    /**
+     * Decrypts ciphertext previously produced by {@link encrypt}, restoring
+     * the original BSON value (string, number, object or array).
+     *
+     * @param value - BSON {@link Binary} subtype 6 ciphertext.
+     * @returns The original plaintext value.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const plaintext = await service.decrypt(doc.niNumber);
+     * ```
+     */
+    decrypt<T = unknown>(value: Binary): Promise<T>;
+    /**
+     * Releases the underlying libmongocrypt resources. Call on shutdown.
+     *
+     * @example
+     * ```ts
+     * await service.close();
+     * ```
+     */
+    close(): Promise<void>;
+    /**
+     * Creates the key vault's unique partial index on `keyAltNames`, matching
+     * the official CSFLE key vault requirements. Idempotent.
+     *
+     * @param client - Connected client used to reach the key vault namespace.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    private ensureKeyVaultIndex;
+    /**
+     * Resolves the shared DEK by its alt name, creating it if this is the
+     * very first bootstrap of the environment. The unique index guarantees a
+     * concurrent double-create loses cleanly, so this is race-safe.
+     *
+     * @returns The DEK id used for all encrypt operations.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    private resolveOrCreateDataKey;
+    /**
+     * Guards against use before {@link init} with a descriptive error that
+     * tells the caller exactly what to do.
+     *
+     * @param requireKey - Whether the DEK must also be resolved already.
+     * @returns The non-null encryption handle and DEK id.
+     * @throws Error when the service has not been initialized.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    private requireInitialized;
+}
+//# sourceMappingURL=encryption.service.d.ts.map

package/dist/shared/encryption/encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encryption.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,qBAAa,iBAAiB;IAOP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAN1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAElF,OAAO,CAAC,gBAAgB,CAAiC;IAEzD,OAAO,CAAC,SAAS,CAAuB;gBAEJ,MAAM,EAAE,gBAAgB;IAE5D;;;;;;;;;;;;OAYG;IACU,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IASrD;;;;;;;;;;;;;OAaG;IACU,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAQrD;;;;;;;;;;;OAWG;IACU,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5D;;;;;;;OAOG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOnC;;;;;;;;;OASG;YACW,mBAAmB;IAQjC;;;;;;;;;;OAUG;YACW,sBAAsB;IAWpC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;CAe7B"}

package/dist/shared/encryption/encryption.service.js

@@ -0,0 +1,151 @@
+import { ClientEncryption } from 'mongodb';
+/**
+ * Explicit Client-Side Field Level Encryption service.
+ *
+ * Wraps the driver's {@link ClientEncryption} with the Gatehouse conventions:
+ * a single shared DEK (alt name `gatehouse-dek`) stored in the
+ * `encryption.__keyVault` collection and wrapped by the `local` master key
+ * from {@link EncryptionConfig}. Only RANDOM
+ * (`AEAD_AES_256_CBC_HMAC_SHA_512-Random`) mode is exposed — encrypted fields
+ * are never queryable, by design. There is deliberately no deterministic API.
+ *
+ * Works against MongoDB Community — explicit encryption needs no mongocryptd
+ * or crypt_shared sidecar.
+ */
+export class EncryptionService {
+    constructor(config) {
+        this.config = config;
+        this.clientEncryption = null;
+        this.dataKeyId = null;
+    }
+    /**
+     * Initializes the service against a connected client: ensures the key
+     * vault collection and its unique partial index on `keyAltNames`, then
+     * resolves the shared DEK by alt name — creating it on first ever run.
+     * Idempotent and safe to call from multiple services against the same DB.
+     *
+     * @param client - A connected {@link MongoClient} for the target cluster.
+     * @example
+     * ```ts
+     * const service = new EncryptionService(EncryptionConfig.load(process.env));
+     * await service.init(mongoClient);
+     * ```
+     */
+    async init(client) {
+        await this.ensureKeyVaultIndex(client);
+        this.clientEncryption = new ClientEncryption(client, {
+            keyVaultNamespace: this.config.keyVaultNamespace,
+            kmsProviders: { local: { key: this.config.masterKey } }
+        });
+        this.dataKeyId = await this.resolveOrCreateDataKey();
+    }
+    /**
+     * Encrypts a value with the shared DEK in RANDOM mode. The same plaintext
+     * yields different ciphertext on every call, so encrypted fields must
+     * never appear in query filters, sorts, or indexes.
+     *
+     * @param value - Any BSON-serialisable value (string, number, object, array).
+     * @returns Ciphertext as BSON {@link Binary} subtype 6.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const ciphertext = await service.encrypt('AB123456C');
+     * await collection.updateOne({ _id }, { $set: { niNumber: ciphertext } });
+     * ```
+     */
+    async encrypt(value) {
+        const { clientEncryption, dataKeyId } = this.requireInitialized();
+        return clientEncryption.encrypt(value, {
+            keyId: dataKeyId,
+            algorithm: EncryptionService.RANDOM_ALGORITHM
+        });
+    }
+    /**
+     * Decrypts ciphertext previously produced by {@link encrypt}, restoring
+     * the original BSON value (string, number, object or array).
+     *
+     * @param value - BSON {@link Binary} subtype 6 ciphertext.
+     * @returns The original plaintext value.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const plaintext = await service.decrypt(doc.niNumber);
+     * ```
+     */
+    async decrypt(value) {
+        const { clientEncryption } = this.requireInitialized();
+        return clientEncryption.decrypt(value);
+    }
+    /**
+     * Releases the underlying libmongocrypt resources. Call on shutdown.
+     *
+     * @example
+     * ```ts
+     * await service.close();
+     * ```
+     */
+    async close() {
+        if (this.clientEncryption) {
+            this.clientEncryption = null;
+            this.dataKeyId = null;
+        }
+    }
+    /**
+     * Creates the key vault's unique partial index on `keyAltNames`, matching
+     * the official CSFLE key vault requirements. Idempotent.
+     *
+     * @param client - Connected client used to reach the key vault namespace.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    async ensureKeyVaultIndex(client) {
+        const [dbName, collectionName] = this.config.keyVaultNamespace.split('.');
+        await client.db(dbName).collection(collectionName).createIndex({ keyAltNames: 1 }, { unique: true, partialFilterExpression: { keyAltNames: { $exists: true } } });
+    }
+    /**
+     * Resolves the shared DEK by its alt name, creating it if this is the
+     * very first bootstrap of the environment. The unique index guarantees a
+     * concurrent double-create loses cleanly, so this is race-safe.
+     *
+     * @returns The DEK id used for all encrypt operations.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    async resolveOrCreateDataKey() {
+        const { clientEncryption } = this.requireInitialized(false);
+        const existing = await clientEncryption.getKeyByAltName(this.config.keyAltName);
+        if (existing) {
+            return existing._id;
+        }
+        return clientEncryption.createDataKey('local', {
+            keyAltNames: [this.config.keyAltName]
+        });
+    }
+    /**
+     * Guards against use before {@link init} with a descriptive error that
+     * tells the caller exactly what to do.
+     *
+     * @param requireKey - Whether the DEK must also be resolved already.
+     * @returns The non-null encryption handle and DEK id.
+     * @throws Error when the service has not been initialized.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    requireInitialized(requireKey = true) {
+        if (!this.clientEncryption || (requireKey && !this.dataKeyId)) {
+            throw new Error('EncryptionService is not initialized. Call init(mongoClient) at bootstrap ' +
+                'before encrypting or decrypting.');
+        }
+        return {
+            clientEncryption: this.clientEncryption,
+            dataKeyId: this.dataKeyId
+        };
+    }
+}
+EncryptionService.RANDOM_ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_512-Random';

package/dist/shared/encryption/index.d.ts

@@ -0,0 +1,6 @@
+export { EncryptionConfig } from './encryption.config.js';
+export { EncryptionService } from './encryption.service.js';
+export { EncryptionBootstrap } from './encryption.init.js';
+export { EncryptedFieldMapBuilder } from './encrypted-field-map.js';
+export type { EncryptedFieldEntry, EncryptedFieldMap } from './encrypted-field-map.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/encryption/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../shared/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/shared/encryption/index.js

@@ -0,0 +1,4 @@
+export { EncryptionConfig } from './encryption.config.js';
+export { EncryptionService } from './encryption.service.js';
+export { EncryptionBootstrap } from './encryption.init.js';
+export { EncryptedFieldMapBuilder } from './encrypted-field-map.js';

package/dist/shared/index.d.ts

@@ -16,4 +16,6 @@ export { default as IWebhookEvent } from './webhook-event.type';
 export { default as ApiPerformanceLogModel } from './api-performance.model';
 export { default as IApiPerformance } from './api-performance.type';
 export { initializeWorkflowMiddleware, initializeWorkflowMiddlewareWithCheck, isWorkflowMiddlewareConfigured } from './workflow.init';
+export { EncryptionConfig, EncryptionService, EncryptionBootstrap, EncryptedFieldMapBuilder } from './encryption/index.js';
+export type { EncryptedFieldEntry, EncryptedFieldMap } from './encryption/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../shared/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAC,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../shared/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAC,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAGtI,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3H,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/shared/index.js

@@ -14,3 +14,5 @@ export { default as ApiLogModel } from './api-log.model';
 export { default as ApiPerformanceLogModel } from './api-performance.model';
 // Workflow middleware initialization exports
 export { initializeWorkflowMiddleware, initializeWorkflowMiddlewareWithCheck, isWorkflowMiddlewareConfigured } from './workflow.init';
+// Field-level encryption exports
+export { EncryptionConfig, EncryptionService, EncryptionBootstrap, EncryptedFieldMapBuilder } from './encryption/index.js';

package/dist/shared/job-run.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/job-run.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-run.model.d.ts","sourceRoot":"","sources":["../../shared/job-run.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAoB,MAAM,UAAU,CAAC;AAc5C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0C,CAAC;AAC5D,eAAe,WAAW,CAAC"}
+{"version":3,"file":"job-run.model.d.ts","sourceRoot":"","sources":["../../shared/job-run.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAoB,MAAM,UAAU,CAAC;AAc5C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0C,CAAC;AAC5D,eAAe,WAAW,CAAC"}

package/dist/shared/job-setting.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/job-setting.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-setting.model.d.ts","sourceRoot":"","sources":["../../shared/job-setting.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAWhC,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAkD,CAAC;AAExE,eAAe,eAAe,CAAC"}
+{"version":3,"file":"job-setting.model.d.ts","sourceRoot":"","sources":["../../shared/job-setting.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAWhC,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAkD,CAAC;AAExE,eAAe,eAAe,CAAC"}

package/dist/shared/lookup-group.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate.js" />
 /// <reference types="mongoose/types/callback.js" />
 /// <reference types="mongoose/types/collection.js" />

package/dist/shared/lookup-group.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lookup-group.model.d.ts","sourceRoot":"","sources":["../../shared/lookup-group.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAwBhC,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAmD,CAAC;AAC1E,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"lookup-group.model.d.ts","sourceRoot":"","sources":["../../shared/lookup-group.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAwBhC,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAmD,CAAC;AAC1E,eAAe,gBAAgB,CAAC"}

package/dist/shared/lookup.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />
@@ -36,6 +37,7 @@ declare const LookupModel: mongoose.Model<{
     name: string;
     value?: string | null | undefined;
     lookupGroupId?: mongoose.Types.ObjectId | null | undefined;
+    orderValue?: number | null | undefined;
 }, {}, {}, {}, mongoose.Document<unknown, {}, {
     createdAt: NativeDate;
     updatedAt: NativeDate;
@@ -45,6 +47,7 @@ declare const LookupModel: mongoose.Model<{
     name: string;
     value?: string | null | undefined;
     lookupGroupId?: mongoose.Types.ObjectId | null | undefined;
+    orderValue?: number | null | undefined;
 }, {}> & {
     createdAt: NativeDate;
     updatedAt: NativeDate;
@@ -54,6 +57,7 @@ declare const LookupModel: mongoose.Model<{
     name: string;
     value?: string | null | undefined;
     lookupGroupId?: mongoose.Types.ObjectId | null | undefined;
+    orderValue?: number | null | undefined;
 } & {
     _id: mongoose.Types.ObjectId;
 } & {
@@ -69,6 +73,7 @@ declare const LookupModel: mongoose.Model<{
     name: string;
     value?: string | null | undefined;
     lookupGroupId?: mongoose.Types.ObjectId | null | undefined;
+    orderValue?: number | null | undefined;
 }, mongoose.Document<unknown, {}, mongoose.FlatRecord<{
     createdAt: NativeDate;
     updatedAt: NativeDate;
@@ -78,6 +83,7 @@ declare const LookupModel: mongoose.Model<{
     name: string;
     value?: string | null | undefined;
     lookupGroupId?: mongoose.Types.ObjectId | null | undefined;
+    orderValue?: number | null | undefined;
 }>, {}> & mongoose.FlatRecord<{
     createdAt: NativeDate;
     updatedAt: NativeDate;
@@ -87,6 +93,7 @@ declare const LookupModel: mongoose.Model<{
     name: string;
     value?: string | null | undefined;
     lookupGroupId?: mongoose.Types.ObjectId | null | undefined;
+    orderValue?: number | null | undefined;
 }> & {
     _id: mongoose.Types.ObjectId;
 } & {

package/dist/shared/lookup.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lookup.model.d.ts","sourceRoot":"","sources":["../../shared/lookup.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAqChC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAyC,CAAC;AAC3D,eAAe,WAAW,CAAC"}
+{"version":3,"file":"lookup.model.d.ts","sourceRoot":"","sources":["../../shared/lookup.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AA0ChC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAyC,CAAC;AAC3D,eAAe,WAAW,CAAC"}

package/dist/shared/lookup.model.js

@@ -15,6 +15,10 @@ const lookupSchema = new mongoose.Schema({
     value: {
         type: String
     },
+    orderValue: {
+        type: Number,
+        description: "Optional numeric dropdown display order. When set for all lookups in a group, form options sort by this field."
+    },
     isActive: {
         type: Boolean,
         default: true,
@@ -23,6 +27,7 @@ const lookupSchema = new mongoose.Schema({
 }, { timestamps: true });
 lookupSchema.index({ lookupGroupId: 1 });
 lookupSchema.index({ value: 1 });
+lookupSchema.index({ lookupGroupId: 1, orderValue: 1 });
 // Case-insensitive index for name queries
 lookupSchema.index({ name: 1 }, { collation: { locale: "en", strength: 2 } });
 // Compound index for lookupGroupId + name queries

package/dist/shared/schema-doc.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/schema-doc.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-doc.model.d.ts","sourceRoot":"","sources":["../../shared/schema-doc.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAS,MAAM,UAAU,CAAC;AAWzC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAsC,CAAC;AAE3D,eAAe,cAAc,CAAC"}
+{"version":3,"file":"schema-doc.model.d.ts","sourceRoot":"","sources":["../../shared/schema-doc.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAS,MAAM,UAAU,CAAC;AAWzC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAsC,CAAC;AAE3D,eAAe,cAAc,CAAC"}

package/dist/shared/system-parameter.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/system-parameter.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-parameter.model.d.ts","sourceRoot":"","sources":["../../shared/system-parameter.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAgChC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA2D,CAAC;AACtF,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"system-parameter.model.d.ts","sourceRoot":"","sources":["../../shared/system-parameter.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAgChC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA2D,CAAC;AACtF,eAAe,oBAAoB,CAAC"}

package/dist/shared/task-document.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/task-document.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-document.model.d.ts","sourceRoot":"","sources":["../../shared/task-document.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAuBhC,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6D,CAAC;AAEzF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"task-document.model.d.ts","sourceRoot":"","sources":["../../shared/task-document.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAuBhC,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6D,CAAC;AAEzF,eAAe,qBAAqB,CAAC"}

package/dist/shared/task.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/task.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task.model.d.ts","sourceRoot":"","sources":["../../shared/task.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAmBhC,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAqC,CAAC;AACrD,eAAe,SAAS,CAAC"}
+{"version":3,"file":"task.model.d.ts","sourceRoot":"","sources":["../../shared/task.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAmBhC,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAqC,CAAC;AACrD,eAAe,SAAS,CAAC"}

package/dist/shared/webhook-event.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/webhook-event.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-event.model.d.ts","sourceRoot":"","sources":["../../shared/webhook-event.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAoB,MAAM,UAAU,CAAC;AAC5C,OAAO,aAAa,MAAM,sBAAsB,CAAC;;;;;;AA4DjD,wBAAiF"}
+{"version":3,"file":"webhook-event.model.d.ts","sourceRoot":"","sources":["../../shared/webhook-event.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAoB,MAAM,UAAU,CAAC;AAC5C,OAAO,aAAa,MAAM,sBAAsB,CAAC;;;;;;AA4DjD,wBAAiF"}

package/dist/shared/workflow-trigger.model.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/workflow-trigger.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-trigger.model.d.ts","sourceRoot":"","sources":["../../shared/workflow-trigger.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAoB,MAAM,UAAU,CAAC;;AAuD5C,wBAA6H"}
+{"version":3,"file":"workflow-trigger.model.d.ts","sourceRoot":"","sources":["../../shared/workflow-trigger.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAoB,MAAM,UAAU,CAAC;;AAuD5C,wBAA6H"}

package/dist/shared/workflow-trigger.type.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />
 /// <reference types="mongoose/types/collection" />

package/dist/shared/workflow-trigger.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-trigger.type.d.ts","sourceRoot":"","sources":["../../shared/workflow-trigger.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,CAAC,OAAO,WAAW,gBAAiB,SAAQ,QAAQ;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"workflow-trigger.type.d.ts","sourceRoot":"","sources":["../../shared/workflow-trigger.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,CAAC,OAAO,WAAW,gBAAiB,SAAQ,QAAQ;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/shared/workflow.middleware.d.ts

@@ -1,6 +1,7 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference types="mongoose/types/aggregate.js" />
 /// <reference types="mongoose/types/callback.js" />
 /// <reference types="mongoose/types/collection.js" />