@dynamatix/gb-schemas 2.17.13 → 2.20.1

package/dist/shared/encryption/encryption.plugin.js

@@ -0,0 +1,372 @@
+import { Schema } from 'mongoose';
+import { EncryptedFieldMapBuilder } from './encrypted-field-map.js';
+import { EncryptionBootstrap } from './encryption.init.js';
+import { EncryptionFilterGuard } from './encryption-filter.guard.js';
+const READ_HOOKS = ['findOne', 'findOneAndUpdate', 'findOneAndReplace', 'findOneAndDelete'];
+const WRITE_QUERY_HOOKS = ['updateOne', 'updateMany', 'findOneAndUpdate', 'findOneAndReplace', 'replaceOne'];
+const GUARDED_HOOKS = [
+    'find', 'findOne', 'countDocuments', 'updateOne', 'updateMany', 'findOneAndUpdate',
+    'findOneAndReplace', 'replaceOne', 'deleteOne', 'deleteMany', 'findOneAndDelete'
+];
+const UPDATE_CONTAINERS = ['$set', '$setOnInsert'];
+/**
+ * Global Mongoose plugin routing `ghEncrypt: true` fields through the
+ * {@link EncryptionService} — plumbing only, no crypto in hooks.
+ *
+ * Write hooks (`save`, `insertMany`, update/replace queries) encrypt
+ * annotated values to BSON Binary subtype 6; read hooks (`find`, `findOne`,
+ * `findOneAnd*`, `distinct`) decrypt hydrated docs and `.lean()` results.
+ * Filters and sorts on encrypted paths fail loud via
+ * {@link EncryptionFilterGuard}. When {@link EncryptionBootstrap} is not
+ * initialized, every hook is a transparent pass-through so consumers that
+ * have not opted in keep working on plaintext.
+ *
+ * Annotated paths are re-typed to `Mixed` (original type stashed in
+ * `ghOriginalType`) so ciphertext survives Mongoose casting. Aggregation is
+ * not interceptable and is handled per call site (Enc-5).
+ */
+export class EncryptionPlugin {
+    constructor() { }
+    /**
+     * Applies the plugin to a schema: validates and collects annotated
+     * paths, re-types them to `Mixed`, and registers guard/write/read hooks.
+     * No-op for schemas without annotations; safe to call more than once
+     * (encrypt/decrypt transforms are idempotent).
+     *
+     * @param schema - The Mongoose schema to instrument.
+     * @example
+     * ```ts
+     * const applicantSchema = new mongoose.Schema({
+     *     firstName: { type: String, ghEncrypt: true }
+     * });
+     * EncryptionPlugin.apply(applicantSchema);
+     * ```
+     */
+    static apply(schema) {
+        const entries = EncryptedFieldMapBuilder.buildForSchema(schema);
+        if (entries.length === 0) {
+            return;
+        }
+        for (const entry of entries) {
+            EncryptionPlugin.retypeToMixed(schema, entry);
+        }
+        const paths = entries.map((entry) => entry.path);
+        EncryptionPlugin.registerGuardHooks(schema, paths);
+        EncryptionPlugin.registerWriteHooks(schema, paths);
+        EncryptionPlugin.registerReadHooks(schema, paths);
+    }
+    /**
+     * Re-types one annotated path to `Mixed` so Binary ciphertext is not
+     * mangled by the original String/Number cast, stashing the original
+     * BSON type in `ghOriginalType` for the field-map/tooling.
+     *
+     * @param schema - The owning schema.
+     * @param entry - The annotated path being re-typed.
+     * @example
+     * ```ts
+     * // internal use only — called by apply()
+     * ```
+     */
+    static retypeToMixed(schema, entry) {
+        const schemaType = schema.path(entry.path);
+        const options = {
+            ...schemaType.options,
+            type: Schema.Types.Mixed,
+            ghOriginalType: entry.bsonType
+        };
+        const nested = entry.path
+            .split('.')
+            .reverse()
+            .reduce((acc, segment) => ({ [segment]: acc }), options);
+        schema.add(nested);
+    }
+    /**
+     * Registers fail-loud filter/sort guards on every query hook.
+     *
+     * @param schema - The owning schema.
+     * @param paths - Encrypted dot paths of the schema.
+     * @example
+     * ```ts
+     * // internal use only — called by apply()
+     * ```
+     */
+    static registerGuardHooks(schema, paths) {
+        schema.pre([...GUARDED_HOOKS], function () {
+            if (!EncryptionBootstrap.isInitialized()) {
+                return;
+            }
+            const sort = this.getOptions().sort;
+            EncryptionFilterGuard.assertQuerySafe(this.getFilter(), sort, paths);
+        });
+    }
+    /**
+     * Registers encrypt-on-write hooks: `save`, `insertMany` and the
+     * update/replace query family (`$set`, `$setOnInsert`, dot paths,
+     * parent-object values and full replacement docs).
+     *
+     * @param schema - The owning schema.
+     * @param paths - Encrypted dot paths of the schema.
+     * @example
+     * ```ts
+     * // internal use only — called by apply()
+     * ```
+     */
+    static registerWriteHooks(schema, paths) {
+        schema.pre('save', async function () {
+            await EncryptionPlugin.transformDocument(this, paths, EncryptionPlugin.encryptTransform());
+        });
+        schema.pre('insertMany', async function (_model, docs) {
+            for (const doc of docs ?? []) {
+                await EncryptionPlugin.transformTarget(doc, paths, EncryptionPlugin.encryptTransform());
+            }
+        });
+        schema.pre([...WRITE_QUERY_HOOKS], async function () {
+            const update = this.getUpdate();
+            if (update) {
+                await EncryptionPlugin.encryptUpdate(update, paths);
+            }
+        });
+    }
+    /**
+     * Registers decrypt-on-read hooks: `find`, the `findOne*` family,
+     * `distinct`, plus post-`save`/`insertMany` restores so callers keep
+     * seeing plaintext on the documents they just persisted.
+     *
+     * @param schema - The owning schema.
+     * @param paths - Encrypted dot paths of the schema.
+     * @example
+     * ```ts
+     * // internal use only — called by apply()
+     * ```
+     */
+    static registerReadHooks(schema, paths) {
+        const decrypt = (target) => EncryptionPlugin.transformTarget(target, paths, EncryptionPlugin.decryptTransform());
+        schema.post('find', async function (docs) {
+            for (const doc of docs ?? []) {
+                await decrypt(doc);
+            }
+        });
+        schema.post([...READ_HOOKS], async function (doc) {
+            await decrypt(doc);
+        });
+        schema.post('save', async function () {
+            await decrypt(this);
+        });
+        schema.post('insertMany', async function (docs) {
+            for (const doc of docs ?? []) {
+                await decrypt(doc);
+            }
+        });
+        schema.post('distinct', async function (values) {
+            const service = EncryptionPlugin.activeService();
+            if (!service || !Array.isArray(values)) {
+                return;
+            }
+            for (let index = 0; index < values.length; index += 1) {
+                if (EncryptionPlugin.isCiphertext(values[index])) {
+                    values[index] = await service.decrypt(values[index]);
+                }
+            }
+        });
+    }
+    /**
+     * Encrypts annotated values inside an update object: exact dot-path
+     * keys, parent-object values containing encrypted leaves, and full
+     * replacement documents (updates without atomic operators).
+     *
+     * @param update - The mutable update object from `Query.getUpdate()`.
+     * @param paths - Encrypted dot paths of the schema.
+     * @example
+     * ```ts
+     * // internal use only — called by the update-query pre hook
+     * ```
+     */
+    static async encryptUpdate(update, paths) {
+        const transform = EncryptionPlugin.encryptTransform();
+        const hasOperators = Object.keys(update).some((key) => key.startsWith('$'));
+        if (!hasOperators) {
+            await EncryptionPlugin.transformTarget(update, paths, transform);
+            return;
+        }
+        for (const container of UPDATE_CONTAINERS) {
+            const target = update[container];
+            if (!target) {
+                continue;
+            }
+            for (const [key, value] of Object.entries(target)) {
+                for (const path of paths) {
+                    if (key === path) {
+                        target[key] = await transform(value);
+                    }
+                    else if (path.startsWith(`${key}.`)) {
+                        await EncryptionPlugin.transformPlain(value, path.slice(key.length + 1).split('.'), transform);
+                    }
+                }
+            }
+        }
+    }
+    /**
+     * Applies a value transform to every encrypted path of one target,
+     * dispatching between hydrated documents (getter-free `get`/`set`) and
+     * plain objects (`.lean()` results, insert payloads).
+     *
+     * @param target - Hydrated document or plain object; non-objects no-op.
+     * @param paths - Encrypted dot paths of the schema.
+     * @param transform - Value transform (encrypt or decrypt).
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static async transformTarget(target, paths, transform) {
+        if (!target || typeof target !== 'object') {
+            return;
+        }
+        const doc = target;
+        const isDocument = typeof doc.get === 'function' && typeof doc.set === 'function';
+        for (const path of paths) {
+            if (isDocument) {
+                await EncryptionPlugin.transformDocPath(doc, path, transform);
+            }
+            else {
+                await EncryptionPlugin.transformPlain(target, path.split('.'), transform);
+            }
+        }
+    }
+    /**
+     * Applies a transform to every encrypted path of one hydrated document.
+     *
+     * @param doc - The hydrated Mongoose document.
+     * @param paths - Encrypted dot paths of the schema.
+     * @param transform - Value transform (encrypt or decrypt).
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static async transformDocument(doc, paths, transform) {
+        for (const path of paths) {
+            await EncryptionPlugin.transformDocPath(doc, path, transform);
+        }
+    }
+    /**
+     * Transforms one dot path on a hydrated document, reading with getters
+     * disabled so value-object formatters never leak into ciphertext.
+     *
+     * @param doc - The hydrated Mongoose document.
+     * @param path - Encrypted dot path.
+     * @param transform - Value transform (encrypt or decrypt).
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static async transformDocPath(doc, path, transform) {
+        const value = doc.get(path, null, { getters: false });
+        if (value === null || value === undefined) {
+            return;
+        }
+        const next = await transform(value);
+        if (next !== value) {
+            doc.set(path, next);
+        }
+    }
+    /**
+     * Transforms one segmented path on a plain object, descending nested
+     * objects and fanning out over arrays.
+     *
+     * @param target - Plain object (or array element) being walked.
+     * @param segments - Remaining path segments.
+     * @param transform - Value transform (encrypt or decrypt).
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static async transformPlain(target, segments, transform) {
+        if (target === null || target === undefined || typeof target !== 'object') {
+            return;
+        }
+        if (Array.isArray(target)) {
+            for (const element of target) {
+                await EncryptionPlugin.transformPlain(element, segments, transform);
+            }
+            return;
+        }
+        const [head, ...rest] = segments;
+        if (rest.length === 0) {
+            const value = target[head];
+            if (value !== null && value !== undefined) {
+                target[head] = await transform(value);
+            }
+            return;
+        }
+        await EncryptionPlugin.transformPlain(target[head], rest, transform);
+    }
+    /**
+     * Builds the encrypt transform: plaintext → Binary; ciphertext and the
+     * uninitialized-bootstrap case pass through untouched.
+     *
+     * @returns Async value transform used by all write hooks.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static encryptTransform() {
+        return async (value) => {
+            const service = EncryptionPlugin.activeService();
+            if (!service || EncryptionPlugin.isCiphertext(value)) {
+                return value;
+            }
+            return service.encrypt(value);
+        };
+    }
+    /**
+     * Builds the decrypt transform: Binary → plaintext; non-ciphertext and
+     * the uninitialized-bootstrap case pass through untouched.
+     *
+     * @returns Async value transform used by all read hooks.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static decryptTransform() {
+        return async (value) => {
+            const service = EncryptionPlugin.activeService();
+            if (!service || !EncryptionPlugin.isCiphertext(value)) {
+                return value;
+            }
+            return service.decrypt(value);
+        };
+    }
+    /**
+     * Returns the bootstrapped service, or `null` when encryption is not
+     * initialized (pass-through mode for non-opted-in consumers).
+     *
+     * @returns The active {@link EncryptionService} or `null`.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static activeService() {
+        return EncryptionBootstrap.isInitialized() ? EncryptionBootstrap.getService() : null;
+    }
+    /**
+     * Duck-type check for BSON Binary subtype 6 (encrypted) values.
+     *
+     * @param value - Candidate value.
+     * @returns `true` when the value is ciphertext.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    static isCiphertext(value) {
+        const candidate = value;
+        return Boolean(candidate && typeof candidate === 'object' &&
+            candidate._bsontype === 'Binary' && candidate.sub_type === 6);
+    }
+}

package/dist/shared/encryption/encryption.service.d.ts

@@ -0,0 +1,110 @@
+import { MongoClient, Binary } from 'mongodb';
+import { EncryptionConfig } from './encryption.config.js';
+/**
+ * Explicit Client-Side Field Level Encryption service.
+ *
+ * Wraps the driver's {@link ClientEncryption} with the Gatehouse conventions:
+ * a single shared DEK (alt name `gatehouse-dek`) stored in the
+ * `encryption.__keyVault` collection and wrapped by the `local` master key
+ * from {@link EncryptionConfig}. Only RANDOM
+ * (`AEAD_AES_256_CBC_HMAC_SHA_512-Random`) mode is exposed — encrypted fields
+ * are never queryable, by design. There is deliberately no deterministic API.
+ *
+ * Works against MongoDB Community — explicit encryption needs no mongocryptd
+ * or crypt_shared sidecar.
+ */
+export declare class EncryptionService {
+    private readonly config;
+    private static readonly RANDOM_ALGORITHM;
+    private clientEncryption;
+    private dataKeyId;
+    constructor(config: EncryptionConfig);
+    /**
+     * Initializes the service against a connected client: ensures the key
+     * vault collection and its unique partial index on `keyAltNames`, then
+     * resolves the shared DEK by alt name — creating it on first ever run.
+     * Idempotent and safe to call from multiple services against the same DB.
+     *
+     * @param client - A connected {@link MongoClient} for the target cluster.
+     * @example
+     * ```ts
+     * const service = new EncryptionService(EncryptionConfig.load(process.env));
+     * await service.init(mongoClient);
+     * ```
+     */
+    init(client: MongoClient): Promise<void>;
+    /**
+     * Encrypts a value with the shared DEK in RANDOM mode. The same plaintext
+     * yields different ciphertext on every call, so encrypted fields must
+     * never appear in query filters, sorts, or indexes.
+     *
+     * @param value - Any BSON-serialisable value (string, number, object, array).
+     * @returns Ciphertext as BSON {@link Binary} subtype 6.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const ciphertext = await service.encrypt('AB123456C');
+     * await collection.updateOne({ _id }, { $set: { niNumber: ciphertext } });
+     * ```
+     */
+    encrypt(value: unknown): Promise<Binary>;
+    /**
+     * Decrypts ciphertext previously produced by {@link encrypt}, restoring
+     * the original BSON value (string, number, object or array).
+     *
+     * @param value - BSON {@link Binary} subtype 6 ciphertext.
+     * @returns The original plaintext value.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const plaintext = await service.decrypt(doc.niNumber);
+     * ```
+     */
+    decrypt<T = unknown>(value: Binary): Promise<T>;
+    /**
+     * Releases the underlying libmongocrypt resources. Call on shutdown.
+     *
+     * @example
+     * ```ts
+     * await service.close();
+     * ```
+     */
+    close(): Promise<void>;
+    /**
+     * Creates the key vault's unique partial index on `keyAltNames`, matching
+     * the official CSFLE key vault requirements. Idempotent.
+     *
+     * @param client - Connected client used to reach the key vault namespace.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    private ensureKeyVaultIndex;
+    /**
+     * Resolves the shared DEK by its alt name, creating it if this is the
+     * very first bootstrap of the environment. The unique index guarantees a
+     * concurrent double-create loses cleanly, so this is race-safe.
+     *
+     * @returns The DEK id used for all encrypt operations.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    private resolveOrCreateDataKey;
+    /**
+     * Guards against use before {@link init} with a descriptive error that
+     * tells the caller exactly what to do.
+     *
+     * @param requireKey - Whether the DEK must also be resolved already.
+     * @returns The non-null encryption handle and DEK id.
+     * @throws Error when the service has not been initialized.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    private requireInitialized;
+}
+//# sourceMappingURL=encryption.service.d.ts.map

package/dist/shared/encryption/encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.d.ts","sourceRoot":"","sources":["../../../shared/encryption/encryption.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,qBAAa,iBAAiB;IAOP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAN1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAElF,OAAO,CAAC,gBAAgB,CAAiC;IAEzD,OAAO,CAAC,SAAS,CAAuB;gBAEJ,MAAM,EAAE,gBAAgB;IAE5D;;;;;;;;;;;;OAYG;IACU,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IASrD;;;;;;;;;;;;;OAaG;IACU,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAQrD;;;;;;;;;;;OAWG;IACU,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5D;;;;;;;OAOG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOnC;;;;;;;;;OASG;YACW,mBAAmB;IAQjC;;;;;;;;;;OAUG;YACW,sBAAsB;IAWpC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;CAe7B"}

package/dist/shared/encryption/encryption.service.js

@@ -0,0 +1,151 @@
+import { ClientEncryption } from 'mongodb';
+/**
+ * Explicit Client-Side Field Level Encryption service.
+ *
+ * Wraps the driver's {@link ClientEncryption} with the Gatehouse conventions:
+ * a single shared DEK (alt name `gatehouse-dek`) stored in the
+ * `encryption.__keyVault` collection and wrapped by the `local` master key
+ * from {@link EncryptionConfig}. Only RANDOM
+ * (`AEAD_AES_256_CBC_HMAC_SHA_512-Random`) mode is exposed — encrypted fields
+ * are never queryable, by design. There is deliberately no deterministic API.
+ *
+ * Works against MongoDB Community — explicit encryption needs no mongocryptd
+ * or crypt_shared sidecar.
+ */
+export class EncryptionService {
+    constructor(config) {
+        this.config = config;
+        this.clientEncryption = null;
+        this.dataKeyId = null;
+    }
+    /**
+     * Initializes the service against a connected client: ensures the key
+     * vault collection and its unique partial index on `keyAltNames`, then
+     * resolves the shared DEK by alt name — creating it on first ever run.
+     * Idempotent and safe to call from multiple services against the same DB.
+     *
+     * @param client - A connected {@link MongoClient} for the target cluster.
+     * @example
+     * ```ts
+     * const service = new EncryptionService(EncryptionConfig.load(process.env));
+     * await service.init(mongoClient);
+     * ```
+     */
+    async init(client) {
+        await this.ensureKeyVaultIndex(client);
+        this.clientEncryption = new ClientEncryption(client, {
+            keyVaultNamespace: this.config.keyVaultNamespace,
+            kmsProviders: { local: { key: this.config.masterKey } }
+        });
+        this.dataKeyId = await this.resolveOrCreateDataKey();
+    }
+    /**
+     * Encrypts a value with the shared DEK in RANDOM mode. The same plaintext
+     * yields different ciphertext on every call, so encrypted fields must
+     * never appear in query filters, sorts, or indexes.
+     *
+     * @param value - Any BSON-serialisable value (string, number, object, array).
+     * @returns Ciphertext as BSON {@link Binary} subtype 6.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const ciphertext = await service.encrypt('AB123456C');
+     * await collection.updateOne({ _id }, { $set: { niNumber: ciphertext } });
+     * ```
+     */
+    async encrypt(value) {
+        const { clientEncryption, dataKeyId } = this.requireInitialized();
+        return clientEncryption.encrypt(value, {
+            keyId: dataKeyId,
+            algorithm: EncryptionService.RANDOM_ALGORITHM
+        });
+    }
+    /**
+     * Decrypts ciphertext previously produced by {@link encrypt}, restoring
+     * the original BSON value (string, number, object or array).
+     *
+     * @param value - BSON {@link Binary} subtype 6 ciphertext.
+     * @returns The original plaintext value.
+     * @throws Error when called before {@link init}.
+     * @example
+     * ```ts
+     * const plaintext = await service.decrypt(doc.niNumber);
+     * ```
+     */
+    async decrypt(value) {
+        const { clientEncryption } = this.requireInitialized();
+        return clientEncryption.decrypt(value);
+    }
+    /**
+     * Releases the underlying libmongocrypt resources. Call on shutdown.
+     *
+     * @example
+     * ```ts
+     * await service.close();
+     * ```
+     */
+    async close() {
+        if (this.clientEncryption) {
+            this.clientEncryption = null;
+            this.dataKeyId = null;
+        }
+    }
+    /**
+     * Creates the key vault's unique partial index on `keyAltNames`, matching
+     * the official CSFLE key vault requirements. Idempotent.
+     *
+     * @param client - Connected client used to reach the key vault namespace.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    async ensureKeyVaultIndex(client) {
+        const [dbName, collectionName] = this.config.keyVaultNamespace.split('.');
+        await client.db(dbName).collection(collectionName).createIndex({ keyAltNames: 1 }, { unique: true, partialFilterExpression: { keyAltNames: { $exists: true } } });
+    }
+    /**
+     * Resolves the shared DEK by its alt name, creating it if this is the
+     * very first bootstrap of the environment. The unique index guarantees a
+     * concurrent double-create loses cleanly, so this is race-safe.
+     *
+     * @returns The DEK id used for all encrypt operations.
+     * @example
+     * ```ts
+     * // internal use only — called by init()
+     * ```
+     */
+    async resolveOrCreateDataKey() {
+        const { clientEncryption } = this.requireInitialized(false);
+        const existing = await clientEncryption.getKeyByAltName(this.config.keyAltName);
+        if (existing) {
+            return existing._id;
+        }
+        return clientEncryption.createDataKey('local', {
+            keyAltNames: [this.config.keyAltName]
+        });
+    }
+    /**
+     * Guards against use before {@link init} with a descriptive error that
+     * tells the caller exactly what to do.
+     *
+     * @param requireKey - Whether the DEK must also be resolved already.
+     * @returns The non-null encryption handle and DEK id.
+     * @throws Error when the service has not been initialized.
+     * @example
+     * ```ts
+     * // internal use only
+     * ```
+     */
+    requireInitialized(requireKey = true) {
+        if (!this.clientEncryption || (requireKey && !this.dataKeyId)) {
+            throw new Error('EncryptionService is not initialized. Call init(mongoClient) at bootstrap ' +
+                'before encrypting or decrypting.');
+        }
+        return {
+            clientEncryption: this.clientEncryption,
+            dataKeyId: this.dataKeyId
+        };
+    }
+}
+EncryptionService.RANDOM_ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_512-Random';

package/dist/shared/encryption/index.d.ts

@@ -0,0 +1,8 @@
+export { EncryptionConfig } from './encryption.config.js';
+export { EncryptionService } from './encryption.service.js';
+export { EncryptionBootstrap } from './encryption.init.js';
+export { EncryptedFieldMapBuilder } from './encrypted-field-map.js';
+export { EncryptionPlugin } from './encryption.plugin.js';
+export { EncryptionFilterGuard } from './encryption-filter.guard.js';
+export type { EncryptedFieldEntry, EncryptedFieldMap } from './encrypted-field-map.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/encryption/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../shared/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/shared/encryption/index.js

@@ -0,0 +1,6 @@
+export { EncryptionConfig } from './encryption.config.js';
+export { EncryptionService } from './encryption.service.js';
+export { EncryptionBootstrap } from './encryption.init.js';
+export { EncryptedFieldMapBuilder } from './encrypted-field-map.js';
+export { EncryptionPlugin } from './encryption.plugin.js';
+export { EncryptionFilterGuard } from './encryption-filter.guard.js';

package/dist/shared/index.d.ts

@@ -16,4 +16,6 @@ export { default as IWebhookEvent } from './webhook-event.type';
 export { default as ApiPerformanceLogModel } from './api-performance.model';
 export { default as IApiPerformance } from './api-performance.type';
 export { initializeWorkflowMiddleware, initializeWorkflowMiddlewareWithCheck, isWorkflowMiddlewareConfigured } from './workflow.init';
+export { EncryptionConfig, EncryptionService, EncryptionBootstrap, EncryptedFieldMapBuilder, EncryptionPlugin, EncryptionFilterGuard } from './encryption/index.js';
+export type { EncryptedFieldEntry, EncryptedFieldMap } from './encryption/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../shared/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAC,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../shared/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAC,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAGtI,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACpK,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/shared/index.js

@@ -14,3 +14,5 @@ export { default as ApiLogModel } from './api-log.model';
 export { default as ApiPerformanceLogModel } from './api-performance.model';
 // Workflow middleware initialization exports
 export { initializeWorkflowMiddleware, initializeWorkflowMiddlewareWithCheck, isWorkflowMiddlewareConfigured } from './workflow.init';
+// Field-level encryption exports
+export { EncryptionConfig, EncryptionService, EncryptionBootstrap, EncryptedFieldMapBuilder, EncryptionPlugin, EncryptionFilterGuard } from './encryption/index.js';