@dynamatix/gb-schemas 2.17.13 → 2.20.1

package/dist/properties/property.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"property.model.d.ts","sourceRoot":"","sources":["../../properties/property.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAe,MAAM,wBAAwB,CAAC;AA8J5D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}
+{"version":3,"file":"property.model.d.ts","sourceRoot":"","sources":["../../properties/property.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAe,MAAM,wBAAwB,CAAC;AA8J5D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}

package/dist/properties/security.model.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="../shared/encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/properties/security.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.model.d.ts","sourceRoot":"","sources":["../../properties/security.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,QAAQ,MAAM,UAAU,CAAC;AA6KhC,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}
+{"version":3,"file":"security.model.d.ts","sourceRoot":"","sources":["../../properties/security.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,QAAQ,MAAM,UAAU,CAAC;AA6KhC,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA6C,CAAC;AACjE,eAAe,aAAa,CAAC"}

package/dist/shared/alert.model.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/shared/alert.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alert.model.d.ts","sourceRoot":"","sources":["../../shared/alert.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAuC,CAAC;AAExD,eAAe,UAAU,CAAC"}
+{"version":3,"file":"alert.model.d.ts","sourceRoot":"","sources":["../../shared/alert.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAuC,CAAC;AAExD,eAAe,UAAU,CAAC"}

package/dist/shared/api-log.model.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/shared/api-log.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-log.model.d.ts","sourceRoot":"","sources":["../../shared/api-log.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC;;;GAGG;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0C,CAAC;AAE5D,eAAe,WAAW,CAAC"}
+{"version":3,"file":"api-log.model.d.ts","sourceRoot":"","sources":["../../shared/api-log.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAyBhC;;;GAGG;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0C,CAAC;AAE5D,eAAe,WAAW,CAAC"}

package/dist/shared/api-performance.model.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/shared/api-performance.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-performance.model.d.ts","sourceRoot":"","sources":["../../shared/api-performance.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,eAAe,MAAM,wBAAwB,CAAC;AAyBrD,QAAA,MAAM,sBAAsB;;;;OAAgF,CAAC;AAC7G,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"api-performance.model.d.ts","sourceRoot":"","sources":["../../shared/api-performance.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,eAAe,MAAM,wBAAwB,CAAC;AAyBrD,QAAA,MAAM,sBAAsB;;;;OAAgF,CAAC;AAC7G,eAAe,sBAAsB,CAAC"}

package/dist/shared/api-performance.type.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/shared/api-performance.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-performance.type.d.ts","sourceRoot":"","sources":["../../shared/api-performance.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9F;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,WAAW,EAAE,IAAI,CAAC;IAElB;;OAEG;IACH,MAAM,EAAE,UAAU,CAAC;IAEnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe,EAAE,QAAQ;CAAG;AAE7E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;KACvC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,6BAA6B,CAAC,EAAE;SAC7B,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,MAAM;KACpC,CAAC;CACH;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"api-performance.type.d.ts","sourceRoot":"","sources":["../../shared/api-performance.type.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9F;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,WAAW,EAAE,IAAI,CAAC;IAElB;;OAEG;IACH,MAAM,EAAE,UAAU,CAAC;IAEnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe,EAAE,QAAQ;CAAG;AAE7E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;IACF,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;KACvC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,6BAA6B,CAAC,EAAE;SAC7B,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,MAAM;KACpC,CAAC;CACH;AAED,eAAe,eAAe,CAAC"}

package/dist/shared/apprivo-sync-journey.model.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/shared/apprivo-sync-journey.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apprivo-sync-journey.model.d.ts","sourceRoot":"","sources":["../../shared/apprivo-sync-journey.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAoBhC,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAiE,CAAC;AAC/F,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"apprivo-sync-journey.model.d.ts","sourceRoot":"","sources":["../../shared/apprivo-sync-journey.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAoBhC,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAiE,CAAC;AAC/F,eAAe,uBAAuB,CAAC"}

package/dist/shared/checklist.model.d.ts

@@ -1,5 +1,6 @@
 /// <reference path="../value-objects/pound.d.ts" />
 /// <reference path="../value-objects/account-number.d.ts" />
+/// <reference path="encryption/encrypted-field-map.d.ts" />
 /// <reference path="../value-objects/sort-code.d.ts" />
 /// <reference types="mongoose/types/aggregate" />
 /// <reference types="mongoose/types/callback" />

package/dist/shared/checklist.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checklist.model.d.ts","sourceRoot":"","sources":["../../shared/checklist.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAuChC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA+C,CAAC;AAEpE,eAAe,cAAc,CAAC"}
+{"version":3,"file":"checklist.model.d.ts","sourceRoot":"","sources":["../../shared/checklist.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAuChC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA+C,CAAC;AAEpE,eAAe,cAAc,CAAC"}

package/dist/shared/encryption/encrypted-field-map.d.ts

@@ -0,0 +1,146 @@
+/// <reference path="../../value-objects/pound.d.ts" />
+/// <reference path="../../value-objects/account-number.d.ts" />
+/// <reference path="../../value-objects/sort-code.d.ts" />
+/// <reference types="mongoose/types/aggregate" />
+/// <reference types="mongoose/types/callback" />
+/// <reference types="mongoose/types/collection" />
+/// <reference types="mongoose/types/connection" />
+/// <reference types="mongoose/types/cursor" />
+/// <reference types="mongoose/types/document" />
+/// <reference types="mongoose/types/error" />
+/// <reference types="mongoose/types/expressions" />
+/// <reference types="mongoose/types/helpers" />
+/// <reference types="mongoose/types/middlewares" />
+/// <reference types="mongoose/types/indexes" />
+/// <reference types="mongoose/types/models" />
+/// <reference types="mongoose/types/mongooseoptions" />
+/// <reference types="mongoose/types/pipelinestage" />
+/// <reference types="mongoose/types/populate" />
+/// <reference types="mongoose/types/query" />
+/// <reference types="mongoose/types/schemaoptions" />
+/// <reference types="mongoose/types/session" />
+/// <reference types="mongoose/types/types" />
+/// <reference types="mongoose/types/utility" />
+/// <reference types="mongoose/types/validation" />
+/// <reference types="mongoose/types/virtuals" />
+/// <reference types="mongoose/types/schematypes" />
+/// <reference types="mongoose/types/inferschematype" />
+/// <reference types="mongoose/types/inferrawdoctype" />
+import { Schema, Model } from 'mongoose';
+/**
+ * Augments Mongoose's per-path options with the `ghEncrypt` annotation so a
+ * field is marked for encryption with exactly one line in its schema:
+ *
+ * ```ts
+ * firstName: { type: String, required: true, ghEncrypt: true }
+ * ```
+ */
+declare module 'mongoose' {
+    interface SchemaTypeOptions<T> {
+        /**
+         * Marks this path for RANDOM-mode field-level encryption.
+         * Named `ghEncrypt` because Mongoose reserves `encrypt` for its own
+         * (Enterprise-only) CSFLE schema option.
+         */
+        ghEncrypt?: boolean;
+        /**
+         * Original BSON type of a `ghEncrypt` path, stashed by the plugin
+         * when it re-types the path to `Mixed` (ciphertext is Binary).
+         */
+        ghOriginalType?: string;
+    }
+}
+/** One encrypted path of a collection, as consumed by the plugin/backfill. */
+export interface EncryptedFieldEntry {
+    /** Dot path of the field (array element paths have no numeric segment). */
+    path: string;
+    /** Encryption mode — always `random`; deterministic is not supported. */
+    mode: 'random';
+    /** Mongoose type instance name (String, Number, Date, …) for tooling. */
+    bsonType: string;
+}
+/** Physical collection name → encrypted field entries. */
+export type EncryptedFieldMap = Record<string, EncryptedFieldEntry[]>;
+/**
+ * Builds the encrypted-field map from `ghEncrypt: true` schema annotations.
+ *
+ * The map is the single source of truth consumed by the Mongoose encryption
+ * plugin (Enc-4), the backfill migration (Enc-6) and — via {@link toJson} —
+ * non-Mongoose consumers such as cat-workflow-engine's decrypt adapter.
+ *
+ * Validation is fail-loud at startup: an annotation on an indexed path, an
+ * ObjectId reference or `_id` throws immediately, because RANDOM ciphertext
+ * can never be queried, joined on, or indexed.
+ */
+export declare class EncryptedFieldMapBuilder {
+    private constructor();
+    /**
+     * Collects all validated `ghEncrypt: true` paths of one schema, recursing
+     * into embedded subdocument schemas and subdocument arrays.
+     *
+     * @param schema - The Mongoose schema to scan.
+     * @param prefix - Path prefix used during recursion; omit at call sites.
+     * @returns Entries sorted in schema declaration order.
+     * @throws Error when an annotated path is indexed, unique, ObjectId or `_id`.
+     * @example
+     * ```ts
+     * const entries = EncryptedFieldMapBuilder.buildForSchema(applicantSchema);
+     * // → [{ path: 'firstName', mode: 'random', bsonType: 'String' }, …]
+     * ```
+     */
+    static buildForSchema(schema: Schema, prefix?: string): EncryptedFieldEntry[];
+    /**
+     * Builds the full map for a set of models, keyed by physical collection
+     * name. Models without any annotated field are omitted.
+     *
+     * @param models - Registered Mongoose models to scan.
+     * @returns Collection name → encrypted field entries.
+     * @example
+     * ```ts
+     * const map = EncryptedFieldMapBuilder.buildForModels([
+     *     ApplicantModel, ApplicationDirectDebitModel
+     * ]);
+     * // → { applicants: […], application_directdebits: […] }
+     * ```
+     */
+    static buildForModels(models: Model<unknown>[]): EncryptedFieldMap;
+    /**
+     * Serialises a map as plain JSON for non-Mongoose consumers (e.g. the
+     * cat-workflow-engine decrypt-on-read adapter).
+     *
+     * @param map - Map produced by {@link buildForModels}.
+     * @returns Pretty-printed JSON string.
+     * @example
+     * ```ts
+     * fs.writeFileSync('encrypted-fields.json', EncryptedFieldMapBuilder.toJson(map));
+     * ```
+     */
+    static toJson(map: EncryptedFieldMap): string;
+    /**
+     * Fail-loud validation of a single annotated path.
+     *
+     * @param path - Full dot path of the annotated field.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema (for schema-level index lookup).
+     * @throws Error describing exactly which rule the annotation violates.
+     * @example
+     * ```ts
+     * // internal use only — called by buildForSchema()
+     * ```
+     */
+    private static validatePath;
+    /**
+     * Detects path-level (`index`/`unique`) and schema-level index coverage.
+     *
+     * @param path - Full dot path relative to the checked schema.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema.
+     * @returns `true` when any index covers the path.
+     * @example
+     * ```ts
+     * // internal use only — called by validatePath()
+     * ```
+     */
+    private static isIndexed;
+}
+//# sourceMappingURL=encrypted-field-map.d.ts.map

package/dist/shared/encryption/encrypted-field-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-field-map.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encrypted-field-map.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAc,KAAK,EAAE,MAAM,UAAU,CAAC;AAErD;;;;;;;GAOG;AACH,OAAO,QAAQ,UAAU,CAAC;IACtB,UAAU,iBAAiB,CAAC,CAAC;QACzB;;;;WAIG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;KAC3B;CACJ;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAChC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,QAAQ,CAAC;IACf,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,qBAAa,wBAAwB;IACjC,OAAO;IAEP;;;;;;;;;;;;;OAaG;WACW,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,mBAAmB,EAAE;IAqBhF;;;;;;;;;;;;;OAaG;WACW,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,iBAAiB;IAWzE;;;;;;;;;;OAUG;WACW,MAAM,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM;IAIpD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IAkB3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;CAS3B"}

package/dist/shared/encryption/encrypted-field-map.js

@@ -0,0 +1,130 @@
+/**
+ * Builds the encrypted-field map from `ghEncrypt: true` schema annotations.
+ *
+ * The map is the single source of truth consumed by the Mongoose encryption
+ * plugin (Enc-4), the backfill migration (Enc-6) and — via {@link toJson} —
+ * non-Mongoose consumers such as cat-workflow-engine's decrypt adapter.
+ *
+ * Validation is fail-loud at startup: an annotation on an indexed path, an
+ * ObjectId reference or `_id` throws immediately, because RANDOM ciphertext
+ * can never be queried, joined on, or indexed.
+ */
+export class EncryptedFieldMapBuilder {
+    constructor() { }
+    /**
+     * Collects all validated `ghEncrypt: true` paths of one schema, recursing
+     * into embedded subdocument schemas and subdocument arrays.
+     *
+     * @param schema - The Mongoose schema to scan.
+     * @param prefix - Path prefix used during recursion; omit at call sites.
+     * @returns Entries sorted in schema declaration order.
+     * @throws Error when an annotated path is indexed, unique, ObjectId or `_id`.
+     * @example
+     * ```ts
+     * const entries = EncryptedFieldMapBuilder.buildForSchema(applicantSchema);
+     * // → [{ path: 'firstName', mode: 'random', bsonType: 'String' }, …]
+     * ```
+     */
+    static buildForSchema(schema, prefix = '') {
+        const entries = [];
+        schema.eachPath((path, schemaType) => {
+            const fullPath = prefix ? `${prefix}.${path}` : path;
+            const childSchema = schemaType.schema;
+            if (childSchema) {
+                entries.push(...EncryptedFieldMapBuilder.buildForSchema(childSchema, fullPath));
+                return;
+            }
+            if (schemaType.options?.ghEncrypt === true) {
+                EncryptedFieldMapBuilder.validatePath(fullPath, schemaType, schema);
+                entries.push({
+                    path: fullPath,
+                    mode: 'random',
+                    bsonType: schemaType.options?.ghOriginalType ?? schemaType.instance
+                });
+            }
+        });
+        return entries;
+    }
+    /**
+     * Builds the full map for a set of models, keyed by physical collection
+     * name. Models without any annotated field are omitted.
+     *
+     * @param models - Registered Mongoose models to scan.
+     * @returns Collection name → encrypted field entries.
+     * @example
+     * ```ts
+     * const map = EncryptedFieldMapBuilder.buildForModels([
+     *     ApplicantModel, ApplicationDirectDebitModel
+     * ]);
+     * // → { applicants: […], application_directdebits: […] }
+     * ```
+     */
+    static buildForModels(models) {
+        const map = {};
+        for (const model of models) {
+            const entries = EncryptedFieldMapBuilder.buildForSchema(model.schema);
+            if (entries.length > 0) {
+                map[model.collection.collectionName] = entries;
+            }
+        }
+        return map;
+    }
+    /**
+     * Serialises a map as plain JSON for non-Mongoose consumers (e.g. the
+     * cat-workflow-engine decrypt-on-read adapter).
+     *
+     * @param map - Map produced by {@link buildForModels}.
+     * @returns Pretty-printed JSON string.
+     * @example
+     * ```ts
+     * fs.writeFileSync('encrypted-fields.json', EncryptedFieldMapBuilder.toJson(map));
+     * ```
+     */
+    static toJson(map) {
+        return JSON.stringify(map, null, 2);
+    }
+    /**
+     * Fail-loud validation of a single annotated path.
+     *
+     * @param path - Full dot path of the annotated field.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema (for schema-level index lookup).
+     * @throws Error describing exactly which rule the annotation violates.
+     * @example
+     * ```ts
+     * // internal use only — called by buildForSchema()
+     * ```
+     */
+    static validatePath(path, schemaType, schema) {
+        if (path === '_id' || path.endsWith('._id')) {
+            throw new Error(`Encrypted-field annotation on '${path}': _id can never be encrypted.`);
+        }
+        if (schemaType.instance === 'ObjectId') {
+            throw new Error(`Encrypted-field annotation on '${path}': ObjectId references cannot be encrypted ` +
+                '(they are join/lookup keys).');
+        }
+        if (EncryptedFieldMapBuilder.isIndexed(path, schemaType, schema)) {
+            throw new Error(`Encrypted-field annotation on '${path}': the path is indexed. RANDOM ciphertext ` +
+                'is unqueryable — drop the index or remove the annotation.');
+        }
+    }
+    /**
+     * Detects path-level (`index`/`unique`) and schema-level index coverage.
+     *
+     * @param path - Full dot path relative to the checked schema.
+     * @param schemaType - The path's resolved schema type.
+     * @param schema - The owning schema.
+     * @returns `true` when any index covers the path.
+     * @example
+     * ```ts
+     * // internal use only — called by validatePath()
+     * ```
+     */
+    static isIndexed(path, schemaType, schema) {
+        if (schemaType.options?.index || schemaType.options?.unique) {
+            return true;
+        }
+        const relativePath = path.split('.').pop();
+        return schema.indexes().some(([keys]) => Object.keys(keys).includes(path) || Object.keys(keys).includes(relativePath));
+    }
+}

package/dist/shared/encryption/encryption-filter.guard.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Fail-loud guard for queries that touch RANDOM-encrypted fields.
+ *
+ * RANDOM ciphertext is unqueryable: any filter, equality, range, regex or
+ * sort on an encrypted path would silently match nothing (or garbage).
+ * The guard converts that class of production data bug into an immediate,
+ * descriptive error at the call site — in CI, not in front of a customer.
+ */
+export declare class EncryptionFilterGuard {
+    private constructor();
+    /**
+     * Asserts that neither the filter nor the sort of a query references an
+     * encrypted path. Recurses through `$and` / `$or` / `$nor` branches and
+     * flags parent-object matches (e.g. filtering on a whole subdocument
+     * that contains encrypted leaves).
+     *
+     * @param filter - The query filter as returned by `Query.getFilter()`.
+     * @param sort - The sort spec (object or string form) from query options.
+     * @param encryptedPaths - Dot paths of all encrypted fields of the model.
+     * @throws Error naming the offending path when the query is unsafe.
+     * @example
+     * ```ts
+     * EncryptionFilterGuard.assertQuerySafe(
+     *     { $or: [{ firstName: 'Ann' }] }, undefined, ['firstName']
+     * ); // → throws: firstName is RANDOM-encrypted and cannot be filtered
+     * ```
+     */
+    static assertQuerySafe(filter: Record<string, unknown> | null | undefined, sort: Record<string, unknown> | string | null | undefined, encryptedPaths: string[]): void;
+    /**
+     * Recursively walks one filter node, throwing on any encrypted-path key.
+     *
+     * @param node - Filter object or logical-operator branch.
+     * @param encryptedPaths - Dot paths of all encrypted fields.
+     * @throws Error when a key covers an encrypted path.
+     * @example
+     * ```ts
+     * // internal use only — called by assertQuerySafe()
+     * ```
+     */
+    private static walkFilter;
+    /**
+     * Asserts that no sort key covers an encrypted path (random ciphertext
+     * has no meaningful order).
+     *
+     * @param sort - Sort spec in object (`{ field: 1 }`) or string (`'-field'`) form.
+     * @param encryptedPaths - Dot paths of all encrypted fields.
+     * @throws Error when a sort key covers an encrypted path.
+     * @example
+     * ```ts
+     * // internal use only — called by assertQuerySafe()
+     * ```
+     */
+    private static assertSortSafe;
+    /**
+     * Matches a filter/sort key against the encrypted paths, including
+     * parent-object keys (`bankWizardCheck` covers its encrypted leaves)
+     * and child keys under an encrypted leaf.
+     *
+     * @param key - The filter or sort key to test.
+     * @param encryptedPaths - Dot paths of all encrypted fields.
+     * @returns The covered encrypted path, or `undefined` when safe.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    private static matchEncryptedPath;
+}
+//# sourceMappingURL=encryption-filter.guard.d.ts.map

package/dist/shared/encryption/encryption-filter.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-filter.guard.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encryption-filter.guard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAC9B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;WACW,eAAe,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACzD,cAAc,EAAE,MAAM,EAAE,GACzB,IAAI;IAOP;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAkBzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAqB7B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;CAKpC"}

package/dist/shared/encryption/encryption-filter.guard.js

@@ -0,0 +1,103 @@
+/**
+ * Fail-loud guard for queries that touch RANDOM-encrypted fields.
+ *
+ * RANDOM ciphertext is unqueryable: any filter, equality, range, regex or
+ * sort on an encrypted path would silently match nothing (or garbage).
+ * The guard converts that class of production data bug into an immediate,
+ * descriptive error at the call site — in CI, not in front of a customer.
+ */
+export class EncryptionFilterGuard {
+    constructor() { }
+    /**
+     * Asserts that neither the filter nor the sort of a query references an
+     * encrypted path. Recurses through `$and` / `$or` / `$nor` branches and
+     * flags parent-object matches (e.g. filtering on a whole subdocument
+     * that contains encrypted leaves).
+     *
+     * @param filter - The query filter as returned by `Query.getFilter()`.
+     * @param sort - The sort spec (object or string form) from query options.
+     * @param encryptedPaths - Dot paths of all encrypted fields of the model.
+     * @throws Error naming the offending path when the query is unsafe.
+     * @example
+     * ```ts
+     * EncryptionFilterGuard.assertQuerySafe(
+     *     { $or: [{ firstName: 'Ann' }] }, undefined, ['firstName']
+     * ); // → throws: firstName is RANDOM-encrypted and cannot be filtered
+     * ```
+     */
+    static assertQuerySafe(filter, sort, encryptedPaths) {
+        EncryptionFilterGuard.assertSortSafe(sort, encryptedPaths);
+        if (filter) {
+            EncryptionFilterGuard.walkFilter(filter, encryptedPaths);
+        }
+    }
+    /**
+     * Recursively walks one filter node, throwing on any encrypted-path key.
+     *
+     * @param node - Filter object or logical-operator branch.
+     * @param encryptedPaths - Dot paths of all encrypted fields.
+     * @throws Error when a key covers an encrypted path.
+     * @example
+     * ```ts
+     * // internal use only — called by assertQuerySafe()
+     * ```
+     */
+    static walkFilter(node, encryptedPaths) {
+        for (const [key, value] of Object.entries(node)) {
+            if (key === '$and' || key === '$or' || key === '$nor') {
+                for (const branch of value ?? []) {
+                    EncryptionFilterGuard.walkFilter(branch, encryptedPaths);
+                }
+                continue;
+            }
+            const hit = EncryptionFilterGuard.matchEncryptedPath(key, encryptedPaths);
+            if (hit) {
+                throw new Error(`Query filter references '${key}': '${hit}' is RANDOM-encrypted and can never be ` +
+                    'filtered, matched or compared. Query a plaintext predicate field instead.');
+            }
+        }
+    }
+    /**
+     * Asserts that no sort key covers an encrypted path (random ciphertext
+     * has no meaningful order).
+     *
+     * @param sort - Sort spec in object (`{ field: 1 }`) or string (`'-field'`) form.
+     * @param encryptedPaths - Dot paths of all encrypted fields.
+     * @throws Error when a sort key covers an encrypted path.
+     * @example
+     * ```ts
+     * // internal use only — called by assertQuerySafe()
+     * ```
+     */
+    static assertSortSafe(sort, encryptedPaths) {
+        if (!sort) {
+            return;
+        }
+        const keys = typeof sort === 'string'
+            ? sort.split(/\s+/).filter(Boolean).map((key) => key.replace(/^-/, ''))
+            : Object.keys(sort);
+        for (const key of keys) {
+            const hit = EncryptionFilterGuard.matchEncryptedPath(key, encryptedPaths);
+            if (hit) {
+                throw new Error(`Sort key '${key}': '${hit}' is RANDOM-encrypted — ciphertext has no meaningful ` +
+                    'order. Sort on a plaintext field instead.');
+            }
+        }
+    }
+    /**
+     * Matches a filter/sort key against the encrypted paths, including
+     * parent-object keys (`bankWizardCheck` covers its encrypted leaves)
+     * and child keys under an encrypted leaf.
+     *
+     * @param key - The filter or sort key to test.
+     * @param encryptedPaths - Dot paths of all encrypted fields.
+     * @returns The covered encrypted path, or `undefined` when safe.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static matchEncryptedPath(key, encryptedPaths) {
+        return encryptedPaths.find((path) => key === path || path.startsWith(`${key}.`) || key.startsWith(`${path}.`));
+    }
+}

package/dist/shared/encryption/encryption.config.d.ts

@@ -0,0 +1,55 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * Immutable configuration for the field-level encryption layer.
+ *
+ * The master key is supplied via the `GH_ENCRYPTION_MASTER_KEY` environment
+ * variable as a base64-encoded 96-byte value and acts as the `local` KMS
+ * provider key for MongoDB Client-Side Field Level Encryption. Validation is
+ * fail-fast: a missing or malformed key throws at bootstrap so services never
+ * start half-configured. Key material is never echoed in error messages.
+ */
+export declare class EncryptionConfig {
+    /** Decoded 96-byte master key used as the `local` KMS provider key. */
+    readonly masterKey: Buffer;
+    /** `db.collection` namespace of the key vault. */
+    readonly keyVaultNamespace: string;
+    /** keyAltName used to resolve/provision the single shared DEK. */
+    readonly keyAltName: string;
+    /** Fixed key vault namespace shared by every Gatehouse service. */
+    static readonly KEY_VAULT_NAMESPACE = "encryption.__keyVault";
+    /** Alt name of the single shared data encryption key (DEK). */
+    static readonly KEY_ALT_NAME = "gatehouse-dek";
+    /** Name of the environment variable carrying the master key. */
+    static readonly MASTER_KEY_ENV_VAR = "GH_ENCRYPTION_MASTER_KEY";
+    /** Required master key length in bytes for the `local` KMS provider. */
+    private static readonly MASTER_KEY_BYTES;
+    private constructor();
+    /**
+     * Builds a validated configuration from an environment map.
+     *
+     * @param env - Environment map, typically `process.env`.
+     * @returns A frozen, validated {@link EncryptionConfig}.
+     * @throws Error when the env var is missing, not base64, or not 96 bytes.
+     * @example
+     * ```ts
+     * const config = EncryptionConfig.load(process.env);
+     * const service = new EncryptionService(config);
+     * ```
+     */
+    static load(env: Record<string, string | undefined>): EncryptionConfig;
+    /**
+     * Decodes and validates the base64 master key without ever including the
+     * supplied value in error messages.
+     *
+     * @param raw - Raw base64 string from the environment.
+     * @returns The decoded 96-byte key.
+     * @throws Error when the value is not strict base64 or has a wrong length.
+     * @example
+     * ```ts
+     * // internal use only — called by EncryptionConfig.load()
+     * ```
+     */
+    private static decodeMasterKey;
+}
+//# sourceMappingURL=encryption.config.d.ts.map

package/dist/shared/encryption/encryption.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.config.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encryption.config.ts"],"names":[],"mappings":";;AAAA;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAcrB,uEAAuE;aACvD,SAAS,EAAE,MAAM;IACjC,kDAAkD;aAClC,iBAAiB,EAAE,MAAM;IACzC,kEAAkE;aAClD,UAAU,EAAE,MAAM;IAlBtC,mEAAmE;IACnE,gBAAuB,mBAAmB,2BAA2B;IAErE,+DAA+D;IAC/D,gBAAuB,YAAY,mBAAmB;IAEtD,gEAAgE;IAChE,gBAAuB,kBAAkB,8BAA8B;IAEvE,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C,OAAO;IASP;;;;;;;;;;;OAWG;WACW,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,gBAAgB;IAgB7E;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;CAiBjC"}