@mj-biz-apps/common-server 5.43.0 → 5.44.0

package/dist/custom/activity-content-cipher.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The cipher this host protects captured content with.
+ *
+ * WHAT IT IS FOR. `ActivitySyncRunDetail.CapturedContent` holds content from messages the engine
+ * deliberately declined to ingest, kept so an auditor asking "what was in the message you did not
+ * file?" has an answer. Its own description settles how: *"Ciphertext, always — never plaintext,
+ * whatever the policy... Encrypted through MJ's EncryptionEngine against an MJ: Encryption Keys row;
+ * this app never implements its own crypto."*
+ *
+ * WHY IT LIVES HERE. `common-activity-sync` holds to the second half of that sentence by taking no
+ * runtime dependency on the Encryption engine and asking a host for a cipher instead. This package
+ * already depends on MJ's engines, already runs at MJAPI startup, and already fills the other two
+ * seams the same way — so it fills this one too.
+ *
+ * That last part is the whole point. A seam nothing implements is the defect this subsystem keeps
+ * being cleaned of: `ActivityFileSink` is exported, documented and registered, and its `Store()` has
+ * no caller on any real path. This interface ships WITH its implementation so it never reaches that
+ * state.
+ *
+ * @module @mj-biz-apps/common-server
+ */
+import type { UserInfo } from '@memberjunction/core';
+import { type ActivityContentCipher } from '@mj-biz-apps/common-activity-sync';
+/**
+ * Encrypts through MJ, and does nothing else.
+ *
+ * NO DECRYPTION, deliberately. `ActivityContentCipher` has one method because the sync engine never
+ * needs to read captured content back — that is an audit action performed by a person holding the
+ * key. An engine that cannot decrypt cannot leak, and keeping the interface to one direction means
+ * the capability is not sitting there to be misused later.
+ */
+export declare class MJActivityContentCipher implements ActivityContentCipher {
+    /**
+     * The user is forwarded because the SEAM carries it, not because this engine needs it.
+     *
+     * `Encrypt` only consults `contextUser` when the engine has not been configured, and by the time
+     * any capture runs it always has: `setupSQLServerClient` calls `StartupManager.Startup()`, which
+     * configures this engine with a system user. That holds even when key validation FAILS — `Loaded`
+     * means the metadata loaded, and the key-material check is a separate step. Measured in a fresh
+     * process against a host with no usable key: with and without a user, `Encrypt` returns the same
+     * error either way.
+     *
+     * So this forwards an argument MJ does not presently read. It is still right to forward: MJ's own
+     * `ResolverBase` passes the user at both of its call sites rather than trusting startup, and the
+     * interface's contract is written for hosts whose cipher must reach key material as somebody.
+     *
+     * @throws whatever `EncryptionEngine` throws for a missing or unusable key. Throwing is correct:
+     *         the engine records the failure as a run issue and saves the decision without content.
+     *         The alternative — returning the plaintext, or an empty string — would put unprotected
+     *         content in a column whose contract is "ciphertext, always".
+     */
+    Encrypt(plaintext: string, encryptionKeyID: string, contextUser: UserInfo): Promise<string>;
+}
+/**
+ * Register it. Called from `LoadBizAppsCommonServer` at MJAPI startup.
+ *
+ * Unconditional, and cheap to be so: registering a cipher does not turn retention on. Retention is
+ * off unless a provider type or connection sets `SkippedContentPolicy` above `None`, and the engine
+ * refuses to run at all if a policy asks for capture that this host cannot encrypt. Registering
+ * always means that refusal is about the POLICY being wrong, never about the host being half-wired.
+ */
+export declare function LoadActivityContentCipher(): void;
+//# sourceMappingURL=activity-content-cipher.d.ts.map

package/dist/custom/activity-content-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-content-cipher.d.ts","sourceRoot":"","sources":["../../src/custom/activity-content-cipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAiC,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE9G;;;;;;;GAOG;AACH,qBAAa,uBAAwB,YAAW,qBAAqB;IACjE;;;;;;;;;;;;;;;;;;OAkBG;IACU,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;CAG3G;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}

package/dist/custom/activity-content-cipher.js

@@ -0,0 +1,46 @@
+import { EncryptionEngine } from '@memberjunction/encryption';
+import { RegisterActivityContentCipher } from '@mj-biz-apps/common-activity-sync';
+/**
+ * Encrypts through MJ, and does nothing else.
+ *
+ * NO DECRYPTION, deliberately. `ActivityContentCipher` has one method because the sync engine never
+ * needs to read captured content back — that is an audit action performed by a person holding the
+ * key. An engine that cannot decrypt cannot leak, and keeping the interface to one direction means
+ * the capability is not sitting there to be misused later.
+ */
+export class MJActivityContentCipher {
+    /**
+     * The user is forwarded because the SEAM carries it, not because this engine needs it.
+     *
+     * `Encrypt` only consults `contextUser` when the engine has not been configured, and by the time
+     * any capture runs it always has: `setupSQLServerClient` calls `StartupManager.Startup()`, which
+     * configures this engine with a system user. That holds even when key validation FAILS — `Loaded`
+     * means the metadata loaded, and the key-material check is a separate step. Measured in a fresh
+     * process against a host with no usable key: with and without a user, `Encrypt` returns the same
+     * error either way.
+     *
+     * So this forwards an argument MJ does not presently read. It is still right to forward: MJ's own
+     * `ResolverBase` passes the user at both of its call sites rather than trusting startup, and the
+     * interface's contract is written for hosts whose cipher must reach key material as somebody.
+     *
+     * @throws whatever `EncryptionEngine` throws for a missing or unusable key. Throwing is correct:
+     *         the engine records the failure as a run issue and saves the decision without content.
+     *         The alternative — returning the plaintext, or an empty string — would put unprotected
+     *         content in a column whose contract is "ciphertext, always".
+     */
+    async Encrypt(plaintext, encryptionKeyID, contextUser) {
+        return EncryptionEngine.Instance.Encrypt(plaintext, encryptionKeyID, contextUser);
+    }
+}
+/**
+ * Register it. Called from `LoadBizAppsCommonServer` at MJAPI startup.
+ *
+ * Unconditional, and cheap to be so: registering a cipher does not turn retention on. Retention is
+ * off unless a provider type or connection sets `SkippedContentPolicy` above `None`, and the engine
+ * refuses to run at all if a policy asks for capture that this host cannot encrypt. Registering
+ * always means that refusal is about the POLICY being wrong, never about the host being half-wired.
+ */
+export function LoadActivityContentCipher() {
+    RegisterActivityContentCipher(new MJActivityContentCipher());
+}
+//# sourceMappingURL=activity-content-cipher.js.map

package/dist/custom/activity-content-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-content-cipher.js","sourceRoot":"","sources":["../../src/custom/activity-content-cipher.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAA8B,MAAM,mCAAmC,CAAC;AAE9G;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAChC;;;;;;;;;;;;;;;;;;OAkBG;IACI,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,eAAuB,EAAE,WAAqB;QAClF,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IACtF,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB;IACrC,6BAA6B,CAAC,IAAI,uBAAuB,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/index.d.ts

@@ -21,5 +21,6 @@ export declare function LoadBizAppsCommonServer(): void;
 export { SyncActivitiesAction, LoadSyncActivitiesAction } from './custom/sync-activities.action.js';
 export { LogActivityAction, LoadLogActivityAction } from './custom/log-activity.action.js';
 export { GraphTransportFactory, LoadGraphTransportFactory } from './custom/graph-transport-factory.js';
+export { MJActivityContentCipher, LoadActivityContentCipher } from './custom/activity-content-cipher.js';
 export { LoadLiveMailboxPolicyFromEnv, ENV_GROUP, ENV_ACCEPTED_RISK, ENV_CONFIRMED_BY, ENV_CONFIRMED_AT, } from './custom/live-mailbox-policy.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AAIrC,OAAO,0CAA0C,CAAC;AAQlD,OAAO,0BAA0B,CAAC;AAMlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAOlF,oFAAoF;AACpF,eAAO,MAAM,cAAc,UAAsD,CAAC;AAElF;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAa9C;AAED,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACvG,OAAO,EACH,4BAA4B,EAC5B,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACnB,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AAIrC,OAAO,0CAA0C,CAAC;AASlD,OAAO,0BAA0B,CAAC;AAMlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAOlF,oFAAoF;AACpF,eAAO,MAAM,cAAc,UAAsD,CAAC;AAElF;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAkB9C;AAED,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACzG,OAAO,EACH,4BAA4B,EAC5B,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACnB,MAAM,iCAAiC,CAAC"}

package/dist/index.js

@@ -16,6 +16,7 @@ import { LoadSyncActivitiesAction } from './custom/sync-activities.action.js';
 import { LoadLogActivityAction } from './custom/log-activity.action.js';
 import { LoadGraphTransportFactory } from './custom/graph-transport-factory.js';
 import { LoadLiveMailboxPolicyFromEnv } from './custom/live-mailbox-policy.js';
+import { LoadActivityContentCipher } from './custom/activity-content-cipher.js';
 // Import generated GraphQL resolvers
 import './generated/generated.js';
 // Re-export the manifest for consumers
@@ -43,9 +44,15 @@ export function LoadBizAppsCommonServer() {
     // And that attestation, when this deployment has one. Absent, every live read stays refused;
     // partially configured, this THROWS during bootstrap rather than leaving a misleading refusal.
     LoadLiveMailboxPolicyFromEnv();
+    // And the cipher that protects content captured from messages the engine declined to ingest.
+    // Registering it turns nothing on: retention is off unless a policy asks for it. What it does is
+    // make the engine's refusal, when a policy DOES ask, be about the policy rather than about this
+    // host being half-wired.
+    LoadActivityContentCipher();
 }
 export { SyncActivitiesAction, LoadSyncActivitiesAction } from './custom/sync-activities.action.js';
 export { LogActivityAction, LoadLogActivityAction } from './custom/log-activity.action.js';
 export { GraphTransportFactory, LoadGraphTransportFactory } from './custom/graph-transport-factory.js';
+export { MJActivityContentCipher, LoadActivityContentCipher } from './custom/activity-content-cipher.js';
 export { LoadLiveMailboxPolicyFromEnv, ENV_GROUP, ENV_ACCEPTED_RISK, ENV_CONFIRMED_BY, ENV_CONFIRMED_AT, } from './custom/live-mailbox-policy.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,yEAAyE;AACzE,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AAErC,qEAAqE;AACrE,4DAA4D;AAC5D,OAAO,0CAA0C,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,qCAAqC;AACrC,OAAO,0BAA0B,CAAC;AAKlC,uCAAuC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACnC,0DAA0D;IAC1D,kFAAkF;IAClF,sBAAsB,EAAE,CAAC;IACzB,wBAAwB,EAAE,CAAC;IAC3B,qBAAqB,EAAE,CAAC;IACxB,2FAA2F;IAC3F,4FAA4F;IAC5F,oDAAoD;IACpD,yBAAyB,EAAE,CAAC;IAC5B,6FAA6F;IAC7F,+FAA+F;IAC/F,4BAA4B,EAAE,CAAC;AACnC,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACvG,OAAO,EACH,4BAA4B,EAC5B,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACnB,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,yEAAyE;AACzE,OAAO,8BAA8B,CAAC;AACtC,OAAO,6BAA6B,CAAC;AAErC,qEAAqE;AACrE,4DAA4D;AAC5D,OAAO,0CAA0C,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAEhF,qCAAqC;AACrC,OAAO,0BAA0B,CAAC;AAKlC,uCAAuC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACnC,0DAA0D;IAC1D,kFAAkF;IAClF,sBAAsB,EAAE,CAAC;IACzB,wBAAwB,EAAE,CAAC;IAC3B,qBAAqB,EAAE,CAAC;IACxB,2FAA2F;IAC3F,4FAA4F;IAC5F,oDAAoD;IACpD,yBAAyB,EAAE,CAAC;IAC5B,6FAA6F;IAC7F,+FAA+F;IAC/F,4BAA4B,EAAE,CAAC;IAC/B,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,yBAAyB;IACzB,yBAAyB,EAAE,CAAC;AAChC,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACzG,OAAO,EACH,4BAA4B,EAC5B,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACnB,MAAM,iCAAiC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mj-biz-apps/common-server",
   "type": "module",
-  "version": "5.43.0",
+  "version": "5.44.0",
   "description": "BizApps Common server bootstrap - GraphQL resolvers and class registrations for the Common business entities Open App",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,10 +18,10 @@
     "vitest": "^3.2.4"
   },
   "dependencies": {
-    "@mj-biz-apps/common-activity-sync": "5.43.0",
-    "@mj-biz-apps/common-core-entities-server": "5.43.0",
-    "@mj-biz-apps/common-entities": "5.43.0",
-    "@mj-biz-apps/common-actions": "5.43.0",
+    "@mj-biz-apps/common-activity-sync": "5.44.0",
+    "@mj-biz-apps/common-core-entities-server": "5.44.0",
+    "@mj-biz-apps/common-entities": "5.44.0",
+    "@mj-biz-apps/common-actions": "5.44.0",
     "class-validator": "^0.14.3"
   },
   "peerDependencies": {
@@ -30,6 +30,7 @@
     "@memberjunction/communication-types": "^6.1.0-edge.6",
     "@memberjunction/core": "^6.1.0-edge.6",
     "@memberjunction/credentials": "^6.1.0-edge.6",
+    "@memberjunction/encryption": "^6.1.0-edge.6",
     "@memberjunction/global": "^6.1.0-edge.6",
     "@memberjunction/server": "^6.1.0-edge.6",
     "@memberjunction/sqlserver-dataprovider": "^6.1.0-edge.6"