@open-mercato/shared 0.6.4-develop.4038.1.91ce075c8a → 0.6.4-develop.4106.1.12c205a613

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 212 entry points
+[build:shared] found 213 entry points
 [build:shared] built successfully

package/dist/lib/encryption/kms.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { generateDek, hashForLookup } from "./aes.js";
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from "./toggles.js";
+import { parseBooleanToken } from "../boolean.js";
 import { fetchWithTimeout, resolveTimeoutMs } from "../http/fetchWithTimeout.js";
 const DEFAULT_VAULT_REQUEST_TIMEOUT_MS = 1e3;
 function resolveVaultRequestTimeoutMs() {
@@ -63,15 +64,13 @@ function normalizeEnv(value) {
 function resolveDerivedKeySecret() {
   const candidates = [
     { value: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? null, envName: "TENANT_DATA_ENCRYPTION_FALLBACK_KEY" },
-    { value: process.env.TENANT_DATA_ENCRYPTION_KEY ?? null, envName: "TENANT_DATA_ENCRYPTION_KEY" },
-    { value: process.env.AUTH_SECRET ?? null, envName: "AUTH_SECRET" },
-    { value: process.env.NEXTAUTH_SECRET ?? null, envName: "NEXTAUTH_SECRET" }
+    { value: process.env.TENANT_DATA_ENCRYPTION_KEY ?? null, envName: "TENANT_DATA_ENCRYPTION_KEY" }
   ];
   for (const raw of candidates) {
     const normalized = normalizeEnv(raw.value ?? void 0);
     if (normalized) return { secret: normalized, source: "explicit", envName: raw.envName };
   }
-  if (process.env.NODE_ENV !== "production") {
+  if (process.env.NODE_ENV !== "production" && parseBooleanToken(process.env.ALLOW_DERIVED_KMS_FALLBACK) === true) {
     return { secret: "om-dev-tenant-encryption", source: "dev-default", envName: "DEV_DEFAULT" };
   }
   return null;

package/dist/lib/encryption/kms.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/kms.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport { generateDek, hashForLookup } from './aes'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from './toggles'\nimport { fetchWithTimeout, resolveTimeoutMs } from '../http/fetchWithTimeout'\n\nconst DEFAULT_VAULT_REQUEST_TIMEOUT_MS = 1_000\n\nfunction resolveVaultRequestTimeoutMs(): number {\n  const raw = process.env.VAULT_REQUEST_TIMEOUT_MS\n  const parsed = raw ? Number.parseInt(raw, 10) : undefined\n  return resolveTimeoutMs(parsed, DEFAULT_VAULT_REQUEST_TIMEOUT_MS)\n}\n\nexport type TenantDek = {\n  tenantId: string\n  key: string // base64\n  fetchedAt: number\n}\n\nexport interface KmsService {\n  getTenantDek(tenantId: string): Promise<TenantDek | null>\n  createTenantDek(tenantId: string): Promise<TenantDek | null>\n  isHealthy(): boolean\n}\n\nclass FallbackKmsService implements KmsService {\n  private notified = false\n  constructor(\n    private readonly primary: KmsService,\n    private readonly fallback: KmsService | null,\n    private readonly onFallback?: () => void,\n  ) {}\n\n  isHealthy(): boolean {\n    return this.primary.isHealthy() || Boolean(this.fallback?.isHealthy?.())\n  }\n\n  private notifyFallback() {\n    if (this.notified) return\n    this.notified = true\n    this.onFallback?.()\n  }\n\n  private async fromPrimary<T>(op: () => Promise<T | null>): Promise<T | null> {\n    try {\n      return await op()\n    } catch (err) {\n      console.warn('\u26A0\uFE0F [encryption][kms] Primary KMS failed, will try fallback', {\n        error: (err as Error)?.message || String(err),\n      })\n      return null\n    }\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.getTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.getTenantDek(tenantId)\n    }\n    return null\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.createTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.createTenantDek(tenantId)\n    }\n    return null\n  }\n}\n\ntype VaultClientOpts = {\n  vaultAddr?: string\n  vaultToken?: string\n  mountPath?: string\n  ttlMs?: number\n  requestTimeoutMs?: number\n}\n\ntype VaultReadResponse = {\n  data?: { data?: { key?: string; version?: number }; metadata?: Record<string, unknown> }\n}\n\nfunction normalizeEnv(value: string | undefined): string {\n  if (!value) return ''\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\ntype DerivedSecret = { secret: string; source: 'explicit' | 'dev-default'; envName: string }\n\nfunction resolveDerivedKeySecret(): DerivedSecret | null {\n  const candidates: Array<{ value: string | null; envName: string }> = [\n    { value: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_FALLBACK_KEY' },\n    { value: process.env.TENANT_DATA_ENCRYPTION_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_KEY' },\n    { value: process.env.AUTH_SECRET ?? null, envName: 'AUTH_SECRET' },\n    { value: process.env.NEXTAUTH_SECRET ?? null, envName: 'NEXTAUTH_SECRET' },\n  ]\n  for (const raw of candidates) {\n    const normalized = normalizeEnv(raw.value ?? undefined)\n    if (normalized) return { secret: normalized, source: 'explicit', envName: raw.envName }\n  }\n  if (process.env.NODE_ENV !== 'production') {\n    return { secret: 'om-dev-tenant-encryption', source: 'dev-default', envName: 'DEV_DEFAULT' }\n  }\n  return null\n}\n\nexport class NoopKmsService implements KmsService {\n  isHealthy(): boolean { return !isTenantDataEncryptionEnabled() }\n  async getTenantDek(): Promise<TenantDek | null> { return null }\n  async createTenantDek(): Promise<TenantDek | null> { return null }\n}\n\nclass DerivedKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    // Derive a stable root key from the provided secret so derived tenant keys are deterministic\n    this.root = crypto.createHash('sha256').update(secret).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nexport class HashicorpVaultKmsService implements KmsService {\n  private cache = new Map<string, TenantDek>()\n  private readonly vaultAddr: string\n  private readonly vaultToken: string\n  private readonly mountPath: string\n  private readonly ttlMs: number\n  private readonly requestTimeoutMs: number\n  private healthy = true\n  private readonly debugEnabled: boolean\n  private static loggedInit = false\n\n  constructor(opts: VaultClientOpts = {}) {\n    this.vaultAddr = normalizeEnv(opts.vaultAddr || process.env.VAULT_ADDR || '')\n    this.vaultToken = normalizeEnv(opts.vaultToken || process.env.VAULT_TOKEN || '')\n    this.mountPath = (opts.mountPath || process.env.VAULT_KV_PATH || 'secret/data').replace(/\\/+$/, '')\n    this.ttlMs = opts.ttlMs ?? 15 * 60 * 1000\n    this.requestTimeoutMs = resolveTimeoutMs(opts.requestTimeoutMs, resolveVaultRequestTimeoutMs())\n    this.debugEnabled = isEncryptionDebugEnabled()\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      if (this.debugEnabled) {\n        console.warn('\u26A0\uFE0F [encryption][kms] Vault misconfigured (missing VAULT_ADDR or VAULT_TOKEN)')\n      }\n    }\n    if (this.healthy && !HashicorpVaultKmsService.loggedInit && this.debugEnabled) {\n      HashicorpVaultKmsService.loggedInit = true\n      if(this.debugEnabled) {\n        console.info('\uD83D\uDD10 [encryption][kms] Hashicorp Vault KMS enabled')\n      }\n    }\n  }\n\n  isHealthy(): boolean {\n    return this.healthy\n  }\n\n  private now(): number {\n    return Date.now()\n  }\n\n  private cacheHit(tenantId: string): TenantDek | null {\n    const entry = this.cache.get(tenantId)\n    if (!entry) return null\n    if (this.now() - entry.fetchedAt > this.ttlMs) {\n      this.cache.delete(tenantId)\n      return null\n    }\n    return entry\n  }\n\n  private async readVault(path: string): Promise<VaultReadResponse | null> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      return null\n    }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'GET',\n        headers: { 'X-Vault-Token': this.vaultToken },\n        timeoutMs: this.requestTimeoutMs,\n      })\n      if (!res.ok) {\n        this.healthy = res.status < 500\n        console.warn('\u26A0\uFE0F [encryption][kms] Vault read failed', { path, status: res.status })\n        return null\n      }\n      if (this.debugEnabled) {\n        console.info('\uD83D\uDD0D [encryption][kms] Vault read ok', { path })\n      }\n      return (await res.json()) as VaultReadResponse\n    } catch (err) {\n      this.healthy = false\n      console.warn('\u26A0\uFE0F [encryption][kms] Vault read error', {\n        path,\n        error: (err as Error)?.message || String(err),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      return null\n    }\n  }\n\n  private async writeVault(path: string, key: string): Promise<boolean> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      return false\n    }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'POST',\n        headers: {\n          'X-Vault-Token': this.vaultToken,\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify({ data: { key } }),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      this.healthy = res.ok\n      if (!res.ok) {\n        console.warn('\u26A0\uFE0F [encryption][kms] Vault write failed', { path, status: res.status })\n      }\n      return res.ok\n    } catch (err) {\n      this.healthy = false\n      console.warn('\u26A0\uFE0F [encryption][kms] Vault write error', {\n        path,\n        error: (err as Error)?.message || String(err),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      return false\n    }\n  }\n\n  private buildKeyPath(tenantId: string): string {\n    const suffix = `tenant_key_${tenantId}`\n    const normalizedMount = this.mountPath.replace(/^\\/+/, '')\n    return `${normalizedMount}/${suffix}`\n  }\n\n  private remember(entry: TenantDek): TenantDek {\n    this.cache.set(entry.tenantId, entry)\n    return entry\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const cached = this.cacheHit(tenantId)\n    if (cached) return cached\n    const path = this.buildKeyPath(tenantId)\n    const res = await this.readVault(path)\n    const key = res?.data?.data?.key\n    if (!key) {\n      console.warn('\u26A0\uFE0F [encryption][kms] No tenant DEK found in Vault', { tenantId, path })\n      return null\n    }\n    const dek: TenantDek = { tenantId, key, fetchedAt: this.now() }\n    return this.remember(dek)\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const key = generateDek()\n    const path = this.buildKeyPath(tenantId)\n    const ok = await this.writeVault(path, key)\n    if (ok) {\n      console.info('\uD83D\uDD11 [encryption][kms] Stored tenant DEK in Vault', { tenantId, path })\n    } else {\n      console.warn('\u26A0\uFE0F [encryption][kms] Failed to store tenant DEK in Vault', { tenantId, path })\n    }\n    if (!ok) return null\n    return this.remember({ tenantId, key, fetchedAt: this.now() })\n  }\n}\n\nlet loggedDerivedKeyFallbackBanner = false\n\nfunction logDerivedKeyFallbackBanner(opts: DerivedSecret): void {\n  if (process.env.NODE_ENV === 'test' || loggedDerivedKeyFallbackBanner) return\n  loggedDerivedKeyFallbackBanner = true\n  const redBg = '\\x1b[41m'\n  const white = '\\x1b[97m'\n  const reset = '\\x1b[0m'\n  const width = 110\n  const border = `${redBg}${white}${'\u2501'.repeat(width)}${reset}`\n  const isProduction = process.env.NODE_ENV === 'production'\n  const sourceLine =\n    opts.source === 'explicit' ? `Source: ${opts.envName}` : 'Source: dev default secret (do NOT use in production)'\n  const body = [\n    '\uD83D\uDEA8 Using derived tenant encryption keys (Vault unavailable / no DEK)',\n    sourceLine,\n    isProduction ? 'Secret: [redacted in production]' : `Secret: ${opts.secret}`,\n    'Persist this secret securely. Without it, encrypted tenant data cannot be recovered after restart.',\n  ]\n  console.warn(border)\n  for (const line of body) {\n    const padded = line.padEnd(width - 2, ' ')\n    console.warn(`${redBg}${white} ${padded} ${reset}`)\n  }\n  console.warn(border)\n}\n\nexport function createKmsService(): KmsService {\n  if (!isTenantDataEncryptionEnabled()) return new NoopKmsService()\n  const primary = new HashicorpVaultKmsService()\n\n  const derived = resolveDerivedKeySecret()\n  const fallback = derived ? new DerivedKmsService(derived.secret) : null\n  const notifyFallback = derived\n    ? () => {\n        logDerivedKeyFallbackBanner(derived)\n      }\n    : undefined\n\n  if (!primary.isHealthy()) {\n    if (fallback) {\n      notifyFallback?.()\n      return fallback\n    }\n    console.warn(\n      '\u26A0\uFE0F [encryption][kms] Vault not healthy or misconfigured (missing VAULT_ADDR/VAULT_TOKEN) and no fallback secret provided; falling back to noop KMS',\n    )\n    return new NoopKmsService()\n  }\n\n  if (fallback) {\n    return new FallbackKmsService(primary, fallback, notifyFallback)\n  }\n\n  return primary\n}\n\nexport { hashForLookup }\n"],
-  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,aAAa,qBAAqB;AAC3C,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,kBAAkB,wBAAwB;AAEnD,MAAM,mCAAmC;AAEzC,SAAS,+BAAuC;AAC9C,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAChD,SAAO,iBAAiB,QAAQ,gCAAgC;AAClE;AAcA,MAAM,mBAAyC;AAAA,EAE7C,YACmB,SACA,UACA,YACjB;AAHiB;AACA;AACA;AAJnB,SAAQ,WAAW;AAAA,EAKhB;AAAA,EAEH,YAAqB;AACnB,WAAO,KAAK,QAAQ,UAAU,KAAK,QAAQ,KAAK,UAAU,YAAY,CAAC;AAAA,EACzE;AAAA,EAEQ,iBAAiB;AACvB,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,MAAc,YAAe,IAAgD;AAC3E,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,KAAK;AACZ,cAAQ,KAAK,wEAA8D;AAAA,QACzE,OAAQ,KAAe,WAAW,OAAO,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,aAAa,QAAQ,CAAC;AAC5E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,aAAa,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,gBAAgB,QAAQ,CAAC;AAC/E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,gBAAgB,QAAQ;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACF;AAcA,SAAS,aAAa,OAAmC;AACvD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAIA,SAAS,0BAAgD;AACvD,QAAM,aAA+D;AAAA,IACnE,EAAE,OAAO,QAAQ,IAAI,uCAAuC,MAAM,SAAS,sCAAsC;AAAA,IACjH,EAAE,OAAO,QAAQ,IAAI,8BAA8B,MAAM,SAAS,6BAA6B;AAAA,IAC/F,EAAE,OAAO,QAAQ,IAAI,eAAe,MAAM,SAAS,cAAc;AAAA,IACjE,EAAE,OAAO,QAAQ,IAAI,mBAAmB,MAAM,SAAS,kBAAkB;AAAA,EAC3E;AACA,aAAW,OAAO,YAAY;AAC5B,UAAM,aAAa,aAAa,IAAI,SAAS,MAAS;AACtD,QAAI,WAAY,QAAO,EAAE,QAAQ,YAAY,QAAQ,YAAY,SAAS,IAAI,QAAQ;AAAA,EACxF;AACA,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,WAAO,EAAE,QAAQ,4BAA4B,QAAQ,eAAe,SAAS,cAAc;AAAA,EAC7F;AACA,SAAO;AACT;AAEO,MAAM,eAAqC;AAAA,EAChD,YAAqB;AAAE,WAAO,CAAC,8BAA8B;AAAA,EAAE;AAAA,EAC/D,MAAM,eAA0C;AAAE,WAAO;AAAA,EAAK;AAAA,EAC9D,MAAM,kBAA6C;AAAE,WAAO;AAAA,EAAK;AACnE;AAEA,MAAM,kBAAwC;AAAA,EAE5C,YAAY,QAAgB;AAE1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO;AAAA,EAChE;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEO,MAAM,yBAA+C;AAAA,EAW1D,YAAY,OAAwB,CAAC,GAAG;AAVxC,SAAQ,QAAQ,oBAAI,IAAuB;AAM3C,SAAQ,UAAU;AAKhB,SAAK,YAAY,aAAa,KAAK,aAAa,QAAQ,IAAI,cAAc,EAAE;AAC5E,SAAK,aAAa,aAAa,KAAK,cAAc,QAAQ,IAAI,eAAe,EAAE;AAC/E,SAAK,aAAa,KAAK,aAAa,QAAQ,IAAI,iBAAiB,eAAe,QAAQ,QAAQ,EAAE;AAClG,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,6BAA6B,CAAC;AAC9F,SAAK,eAAe,yBAAyB;AAC7C,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,UAAI,KAAK,cAAc;AACrB,gBAAQ,KAAK,wFAA8E;AAAA,MAC7F;AAAA,IACF;AACA,QAAI,KAAK,WAAW,CAAC,yBAAyB,cAAc,KAAK,cAAc;AAC7E,+BAAyB,aAAa;AACtC,UAAG,KAAK,cAAc;AACpB,gBAAQ,KAAK,yDAAkD;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAAA,EArBA;AAAA,SAAe,aAAa;AAAA;AAAA,EAuB5B,YAAqB;AACnB,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,MAAc;AACpB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA,EAEQ,SAAS,UAAoC;AACnD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,OAAO;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,MAAiD;AACvE,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,iBAAiB,KAAK,WAAW;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,aAAK,UAAU,IAAI,SAAS;AAC5B,gBAAQ,KAAK,oDAA0C,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AACnF,eAAO;AAAA,MACT;AACA,UAAI,KAAK,cAAc;AACrB,gBAAQ,KAAK,6CAAsC,EAAE,KAAK,CAAC;AAAA,MAC7D;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB,SAAS,KAAK;AACZ,WAAK,UAAU;AACf,cAAQ,KAAK,mDAAyC;AAAA,QACpD;AAAA,QACA,OAAQ,KAAe,WAAW,OAAO,GAAG;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,MAAc,KAA+B;AACpE,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAAA,QACtC,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,WAAK,UAAU,IAAI;AACnB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ,KAAK,qDAA2C,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,MACtF;AACA,aAAO,IAAI;AAAA,IACb,SAAS,KAAK;AACZ,WAAK,UAAU;AACf,cAAQ,KAAK,oDAA0C;AAAA,QACrD;AAAA,QACA,OAAQ,KAAe,WAAW,OAAO,GAAG;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,aAAa,UAA0B;AAC7C,UAAM,SAAS,cAAc,QAAQ;AACrC,UAAM,kBAAkB,KAAK,UAAU,QAAQ,QAAQ,EAAE;AACzD,WAAO,GAAG,eAAe,IAAI,MAAM;AAAA,EACrC;AAAA,EAEQ,SAAS,OAA6B;AAC5C,SAAK,MAAM,IAAI,MAAM,UAAU,KAAK;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,UAAM,SAAS,KAAK,SAAS,QAAQ;AACrC,QAAI,OAAQ,QAAO;AACnB,UAAM,OAAO,KAAK,aAAa,QAAQ;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,IAAI;AACrC,UAAM,MAAM,KAAK,MAAM,MAAM;AAC7B,QAAI,CAAC,KAAK;AACR,cAAQ,KAAK,+DAAqD,EAAE,UAAU,KAAK,CAAC;AACpF,aAAO;AAAA,IACT;AACA,UAAM,MAAiB,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE;AAC9D,WAAO,KAAK,SAAS,GAAG;AAAA,EAC1B;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,UAAM,MAAM,YAAY;AACxB,UAAM,OAAO,KAAK,aAAa,QAAQ;AACvC,UAAM,KAAK,MAAM,KAAK,WAAW,MAAM,GAAG;AAC1C,QAAI,IAAI;AACN,cAAQ,KAAK,0DAAmD,EAAE,UAAU,KAAK,CAAC;AAAA,IACpF,OAAO;AACL,cAAQ,KAAK,sEAA4D,EAAE,UAAU,KAAK,CAAC;AAAA,IAC7F;AACA,QAAI,CAAC,GAAI,QAAO;AAChB,WAAO,KAAK,SAAS,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EAC/D;AACF;AAEA,IAAI,iCAAiC;AAErC,SAAS,4BAA4B,MAA2B;AAC9D,MAAI,QAAQ,IAAI,aAAa,UAAU,+BAAgC;AACvE,mCAAiC;AACjC,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAI,OAAO,KAAK,CAAC,GAAG,KAAK;AAC3D,QAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,QAAM,aACJ,KAAK,WAAW,aAAa,WAAW,KAAK,OAAO,KAAK;AAC3D,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA,eAAe,qCAAqC,WAAW,KAAK,MAAM;AAAA,IAC1E;AAAA,EACF;AACA,UAAQ,KAAK,MAAM;AACnB,aAAW,QAAQ,MAAM;AACvB,UAAM,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACzC,YAAQ,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,EAAE;AAAA,EACpD;AACA,UAAQ,KAAK,MAAM;AACrB;AAEO,SAAS,mBAA+B;AAC7C,MAAI,CAAC,8BAA8B,EAAG,QAAO,IAAI,eAAe;AAChE,QAAM,UAAU,IAAI,yBAAyB;AAE7C,QAAM,UAAU,wBAAwB;AACxC,QAAM,WAAW,UAAU,IAAI,kBAAkB,QAAQ,MAAM,IAAI;AACnE,QAAM,iBAAiB,UACnB,MAAM;AACJ,gCAA4B,OAAO;AAAA,EACrC,IACA;AAEJ,MAAI,CAAC,QAAQ,UAAU,GAAG;AACxB,QAAI,UAAU;AACZ,uBAAiB;AACjB,aAAO;AAAA,IACT;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,IAAI,eAAe;AAAA,EAC5B;AAEA,MAAI,UAAU;AACZ,WAAO,IAAI,mBAAmB,SAAS,UAAU,cAAc;AAAA,EACjE;AAEA,SAAO;AACT;",
+  "sourcesContent": ["import crypto from 'node:crypto'\nimport { generateDek, hashForLookup } from './aes'\nimport { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from './toggles'\nimport { parseBooleanToken } from '../boolean'\nimport { fetchWithTimeout, resolveTimeoutMs } from '../http/fetchWithTimeout'\n\nconst DEFAULT_VAULT_REQUEST_TIMEOUT_MS = 1_000\n\nfunction resolveVaultRequestTimeoutMs(): number {\n  const raw = process.env.VAULT_REQUEST_TIMEOUT_MS\n  const parsed = raw ? Number.parseInt(raw, 10) : undefined\n  return resolveTimeoutMs(parsed, DEFAULT_VAULT_REQUEST_TIMEOUT_MS)\n}\n\nexport type TenantDek = {\n  tenantId: string\n  key: string // base64\n  fetchedAt: number\n}\n\nexport interface KmsService {\n  getTenantDek(tenantId: string): Promise<TenantDek | null>\n  createTenantDek(tenantId: string): Promise<TenantDek | null>\n  isHealthy(): boolean\n}\n\nclass FallbackKmsService implements KmsService {\n  private notified = false\n  constructor(\n    private readonly primary: KmsService,\n    private readonly fallback: KmsService | null,\n    private readonly onFallback?: () => void,\n  ) {}\n\n  isHealthy(): boolean {\n    return this.primary.isHealthy() || Boolean(this.fallback?.isHealthy?.())\n  }\n\n  private notifyFallback() {\n    if (this.notified) return\n    this.notified = true\n    this.onFallback?.()\n  }\n\n  private async fromPrimary<T>(op: () => Promise<T | null>): Promise<T | null> {\n    try {\n      return await op()\n    } catch (err) {\n      console.warn('\u26A0\uFE0F [encryption][kms] Primary KMS failed, will try fallback', {\n        error: (err as Error)?.message || String(err),\n      })\n      return null\n    }\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.getTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.getTenantDek(tenantId)\n    }\n    return null\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (this.primary.isHealthy()) {\n      const dek = await this.fromPrimary(() => this.primary.createTenantDek(tenantId))\n      if (dek) return dek\n    }\n    if (this.fallback?.isHealthy()) {\n      this.notifyFallback()\n      return this.fallback.createTenantDek(tenantId)\n    }\n    return null\n  }\n}\n\ntype VaultClientOpts = {\n  vaultAddr?: string\n  vaultToken?: string\n  mountPath?: string\n  ttlMs?: number\n  requestTimeoutMs?: number\n}\n\ntype VaultReadResponse = {\n  data?: { data?: { key?: string; version?: number }; metadata?: Record<string, unknown> }\n}\n\nfunction normalizeEnv(value: string | undefined): string {\n  if (!value) return ''\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\ntype DerivedSecret = { secret: string; source: 'explicit' | 'dev-default'; envName: string }\n\nfunction resolveDerivedKeySecret(): DerivedSecret | null {\n  const candidates: Array<{ value: string | null; envName: string }> = [\n    { value: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_FALLBACK_KEY' },\n    { value: process.env.TENANT_DATA_ENCRYPTION_KEY ?? null, envName: 'TENANT_DATA_ENCRYPTION_KEY' },\n  ]\n  for (const raw of candidates) {\n    const normalized = normalizeEnv(raw.value ?? undefined)\n    if (normalized) return { secret: normalized, source: 'explicit', envName: raw.envName }\n  }\n  if (\n    process.env.NODE_ENV !== 'production'\n    && parseBooleanToken(process.env.ALLOW_DERIVED_KMS_FALLBACK) === true\n  ) {\n    return { secret: 'om-dev-tenant-encryption', source: 'dev-default', envName: 'DEV_DEFAULT' }\n  }\n  return null\n}\n\nexport class NoopKmsService implements KmsService {\n  isHealthy(): boolean { return !isTenantDataEncryptionEnabled() }\n  async getTenantDek(): Promise<TenantDek | null> { return null }\n  async createTenantDek(): Promise<TenantDek | null> { return null }\n}\n\nclass DerivedKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    // Derive a stable root key from the provided secret so derived tenant keys are deterministic\n    this.root = crypto.createHash('sha256').update(secret).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nexport class HashicorpVaultKmsService implements KmsService {\n  private cache = new Map<string, TenantDek>()\n  private readonly vaultAddr: string\n  private readonly vaultToken: string\n  private readonly mountPath: string\n  private readonly ttlMs: number\n  private readonly requestTimeoutMs: number\n  private healthy = true\n  private readonly debugEnabled: boolean\n  private static loggedInit = false\n\n  constructor(opts: VaultClientOpts = {}) {\n    this.vaultAddr = normalizeEnv(opts.vaultAddr || process.env.VAULT_ADDR || '')\n    this.vaultToken = normalizeEnv(opts.vaultToken || process.env.VAULT_TOKEN || '')\n    this.mountPath = (opts.mountPath || process.env.VAULT_KV_PATH || 'secret/data').replace(/\\/+$/, '')\n    this.ttlMs = opts.ttlMs ?? 15 * 60 * 1000\n    this.requestTimeoutMs = resolveTimeoutMs(opts.requestTimeoutMs, resolveVaultRequestTimeoutMs())\n    this.debugEnabled = isEncryptionDebugEnabled()\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      if (this.debugEnabled) {\n        console.warn('\u26A0\uFE0F [encryption][kms] Vault misconfigured (missing VAULT_ADDR or VAULT_TOKEN)')\n      }\n    }\n    if (this.healthy && !HashicorpVaultKmsService.loggedInit && this.debugEnabled) {\n      HashicorpVaultKmsService.loggedInit = true\n      if(this.debugEnabled) {\n        console.info('\uD83D\uDD10 [encryption][kms] Hashicorp Vault KMS enabled')\n      }\n    }\n  }\n\n  isHealthy(): boolean {\n    return this.healthy\n  }\n\n  private now(): number {\n    return Date.now()\n  }\n\n  private cacheHit(tenantId: string): TenantDek | null {\n    const entry = this.cache.get(tenantId)\n    if (!entry) return null\n    if (this.now() - entry.fetchedAt > this.ttlMs) {\n      this.cache.delete(tenantId)\n      return null\n    }\n    return entry\n  }\n\n  private async readVault(path: string): Promise<VaultReadResponse | null> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      return null\n    }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'GET',\n        headers: { 'X-Vault-Token': this.vaultToken },\n        timeoutMs: this.requestTimeoutMs,\n      })\n      if (!res.ok) {\n        this.healthy = res.status < 500\n        console.warn('\u26A0\uFE0F [encryption][kms] Vault read failed', { path, status: res.status })\n        return null\n      }\n      if (this.debugEnabled) {\n        console.info('\uD83D\uDD0D [encryption][kms] Vault read ok', { path })\n      }\n      return (await res.json()) as VaultReadResponse\n    } catch (err) {\n      this.healthy = false\n      console.warn('\u26A0\uFE0F [encryption][kms] Vault read error', {\n        path,\n        error: (err as Error)?.message || String(err),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      return null\n    }\n  }\n\n  private async writeVault(path: string, key: string): Promise<boolean> {\n    if (!this.vaultAddr || !this.vaultToken) {\n      this.healthy = false\n      return false\n    }\n    try {\n      const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {\n        method: 'POST',\n        headers: {\n          'X-Vault-Token': this.vaultToken,\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify({ data: { key } }),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      this.healthy = res.ok\n      if (!res.ok) {\n        console.warn('\u26A0\uFE0F [encryption][kms] Vault write failed', { path, status: res.status })\n      }\n      return res.ok\n    } catch (err) {\n      this.healthy = false\n      console.warn('\u26A0\uFE0F [encryption][kms] Vault write error', {\n        path,\n        error: (err as Error)?.message || String(err),\n        timeoutMs: this.requestTimeoutMs,\n      })\n      return false\n    }\n  }\n\n  private buildKeyPath(tenantId: string): string {\n    const suffix = `tenant_key_${tenantId}`\n    const normalizedMount = this.mountPath.replace(/^\\/+/, '')\n    return `${normalizedMount}/${suffix}`\n  }\n\n  private remember(entry: TenantDek): TenantDek {\n    this.cache.set(entry.tenantId, entry)\n    return entry\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const cached = this.cacheHit(tenantId)\n    if (cached) return cached\n    const path = this.buildKeyPath(tenantId)\n    const res = await this.readVault(path)\n    const key = res?.data?.data?.key\n    if (!key) {\n      console.warn('\u26A0\uFE0F [encryption][kms] No tenant DEK found in Vault', { tenantId, path })\n      return null\n    }\n    const dek: TenantDek = { tenantId, key, fetchedAt: this.now() }\n    return this.remember(dek)\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    const key = generateDek()\n    const path = this.buildKeyPath(tenantId)\n    const ok = await this.writeVault(path, key)\n    if (ok) {\n      console.info('\uD83D\uDD11 [encryption][kms] Stored tenant DEK in Vault', { tenantId, path })\n    } else {\n      console.warn('\u26A0\uFE0F [encryption][kms] Failed to store tenant DEK in Vault', { tenantId, path })\n    }\n    if (!ok) return null\n    return this.remember({ tenantId, key, fetchedAt: this.now() })\n  }\n}\n\nlet loggedDerivedKeyFallbackBanner = false\n\nfunction logDerivedKeyFallbackBanner(opts: DerivedSecret): void {\n  if (process.env.NODE_ENV === 'test' || loggedDerivedKeyFallbackBanner) return\n  loggedDerivedKeyFallbackBanner = true\n  const redBg = '\\x1b[41m'\n  const white = '\\x1b[97m'\n  const reset = '\\x1b[0m'\n  const width = 110\n  const border = `${redBg}${white}${'\u2501'.repeat(width)}${reset}`\n  const isProduction = process.env.NODE_ENV === 'production'\n  const sourceLine =\n    opts.source === 'explicit' ? `Source: ${opts.envName}` : 'Source: dev default secret (do NOT use in production)'\n  const body = [\n    '\uD83D\uDEA8 Using derived tenant encryption keys (Vault unavailable / no DEK)',\n    sourceLine,\n    isProduction ? 'Secret: [redacted in production]' : `Secret: ${opts.secret}`,\n    'Persist this secret securely. Without it, encrypted tenant data cannot be recovered after restart.',\n  ]\n  console.warn(border)\n  for (const line of body) {\n    const padded = line.padEnd(width - 2, ' ')\n    console.warn(`${redBg}${white} ${padded} ${reset}`)\n  }\n  console.warn(border)\n}\n\nexport function createKmsService(): KmsService {\n  if (!isTenantDataEncryptionEnabled()) return new NoopKmsService()\n  const primary = new HashicorpVaultKmsService()\n\n  const derived = resolveDerivedKeySecret()\n  const fallback = derived ? new DerivedKmsService(derived.secret) : null\n  const notifyFallback = derived\n    ? () => {\n        logDerivedKeyFallbackBanner(derived)\n      }\n    : undefined\n\n  if (!primary.isHealthy()) {\n    if (fallback) {\n      notifyFallback?.()\n      return fallback\n    }\n    console.warn(\n      '\u26A0\uFE0F [encryption][kms] Vault not healthy or misconfigured (missing VAULT_ADDR/VAULT_TOKEN) and no fallback secret provided; falling back to noop KMS',\n    )\n    return new NoopKmsService()\n  }\n\n  if (fallback) {\n    return new FallbackKmsService(primary, fallback, notifyFallback)\n  }\n\n  return primary\n}\n\nexport { hashForLookup }\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,aAAa,qBAAqB;AAC3C,SAAS,0BAA0B,qCAAqC;AACxE,SAAS,yBAAyB;AAClC,SAAS,kBAAkB,wBAAwB;AAEnD,MAAM,mCAAmC;AAEzC,SAAS,+BAAuC;AAC9C,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,OAAO,SAAS,KAAK,EAAE,IAAI;AAChD,SAAO,iBAAiB,QAAQ,gCAAgC;AAClE;AAcA,MAAM,mBAAyC;AAAA,EAE7C,YACmB,SACA,UACA,YACjB;AAHiB;AACA;AACA;AAJnB,SAAQ,WAAW;AAAA,EAKhB;AAAA,EAEH,YAAqB;AACnB,WAAO,KAAK,QAAQ,UAAU,KAAK,QAAQ,KAAK,UAAU,YAAY,CAAC;AAAA,EACzE;AAAA,EAEQ,iBAAiB;AACvB,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,MAAc,YAAe,IAAgD;AAC3E,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,KAAK;AACZ,cAAQ,KAAK,wEAA8D;AAAA,QACzE,OAAQ,KAAe,WAAW,OAAO,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,aAAa,QAAQ,CAAC;AAC5E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,aAAa,QAAQ;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,QAAI,KAAK,QAAQ,UAAU,GAAG;AAC5B,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,KAAK,QAAQ,gBAAgB,QAAQ,CAAC;AAC/E,UAAI,IAAK,QAAO;AAAA,IAClB;AACA,QAAI,KAAK,UAAU,UAAU,GAAG;AAC9B,WAAK,eAAe;AACpB,aAAO,KAAK,SAAS,gBAAgB,QAAQ;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AACF;AAcA,SAAS,aAAa,OAAmC;AACvD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAIA,SAAS,0BAAgD;AACvD,QAAM,aAA+D;AAAA,IACnE,EAAE,OAAO,QAAQ,IAAI,uCAAuC,MAAM,SAAS,sCAAsC;AAAA,IACjH,EAAE,OAAO,QAAQ,IAAI,8BAA8B,MAAM,SAAS,6BAA6B;AAAA,EACjG;AACA,aAAW,OAAO,YAAY;AAC5B,UAAM,aAAa,aAAa,IAAI,SAAS,MAAS;AACtD,QAAI,WAAY,QAAO,EAAE,QAAQ,YAAY,QAAQ,YAAY,SAAS,IAAI,QAAQ;AAAA,EACxF;AACA,MACE,QAAQ,IAAI,aAAa,gBACtB,kBAAkB,QAAQ,IAAI,0BAA0B,MAAM,MACjE;AACA,WAAO,EAAE,QAAQ,4BAA4B,QAAQ,eAAe,SAAS,cAAc;AAAA,EAC7F;AACA,SAAO;AACT;AAEO,MAAM,eAAqC;AAAA,EAChD,YAAqB;AAAE,WAAO,CAAC,8BAA8B;AAAA,EAAE;AAAA,EAC/D,MAAM,eAA0C;AAAE,WAAO;AAAA,EAAK;AAAA,EAC9D,MAAM,kBAA6C;AAAE,WAAO;AAAA,EAAK;AACnE;AAEA,MAAM,kBAAwC;AAAA,EAE5C,YAAY,QAAgB;AAE1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO;AAAA,EAChE;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEO,MAAM,yBAA+C;AAAA,EAW1D,YAAY,OAAwB,CAAC,GAAG;AAVxC,SAAQ,QAAQ,oBAAI,IAAuB;AAM3C,SAAQ,UAAU;AAKhB,SAAK,YAAY,aAAa,KAAK,aAAa,QAAQ,IAAI,cAAc,EAAE;AAC5E,SAAK,aAAa,aAAa,KAAK,cAAc,QAAQ,IAAI,eAAe,EAAE;AAC/E,SAAK,aAAa,KAAK,aAAa,QAAQ,IAAI,iBAAiB,eAAe,QAAQ,QAAQ,EAAE;AAClG,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,6BAA6B,CAAC;AAC9F,SAAK,eAAe,yBAAyB;AAC7C,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,UAAI,KAAK,cAAc;AACrB,gBAAQ,KAAK,wFAA8E;AAAA,MAC7F;AAAA,IACF;AACA,QAAI,KAAK,WAAW,CAAC,yBAAyB,cAAc,KAAK,cAAc;AAC7E,+BAAyB,aAAa;AACtC,UAAG,KAAK,cAAc;AACpB,gBAAQ,KAAK,yDAAkD;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAAA,EArBA;AAAA,SAAe,aAAa;AAAA;AAAA,EAuB5B,YAAqB;AACnB,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,MAAc;AACpB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA,EAEQ,SAAS,UAAoC;AACnD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,OAAO;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,MAAiD;AACvE,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,iBAAiB,KAAK,WAAW;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,aAAK,UAAU,IAAI,SAAS;AAC5B,gBAAQ,KAAK,oDAA0C,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AACnF,eAAO;AAAA,MACT;AACA,UAAI,KAAK,cAAc;AACrB,gBAAQ,KAAK,6CAAsC,EAAE,KAAK,CAAC;AAAA,MAC7D;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB,SAAS,KAAK;AACZ,WAAK,UAAU;AACf,cAAQ,KAAK,mDAAyC;AAAA,QACpD;AAAA,QACA,OAAQ,KAAe,WAAW,OAAO,GAAG;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,MAAc,KAA+B;AACpE,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,WAAK,UAAU;AACf,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM,iBAAiB,GAAG,KAAK,SAAS,OAAO,IAAI,IAAI;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,KAAK;AAAA,UACtB,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAAA,QACtC,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,WAAK,UAAU,IAAI;AACnB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ,KAAK,qDAA2C,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,MACtF;AACA,aAAO,IAAI;AAAA,IACb,SAAS,KAAK;AACZ,WAAK,UAAU;AACf,cAAQ,KAAK,oDAA0C;AAAA,QACrD;AAAA,QACA,OAAQ,KAAe,WAAW,OAAO,GAAG;AAAA,QAC5C,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,aAAa,UAA0B;AAC7C,UAAM,SAAS,cAAc,QAAQ;AACrC,UAAM,kBAAkB,KAAK,UAAU,QAAQ,QAAQ,EAAE;AACzD,WAAO,GAAG,eAAe,IAAI,MAAM;AAAA,EACrC;AAAA,EAEQ,SAAS,OAA6B;AAC5C,SAAK,MAAM,IAAI,MAAM,UAAU,KAAK;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,UAAM,SAAS,KAAK,SAAS,QAAQ;AACrC,QAAI,OAAQ,QAAO;AACnB,UAAM,OAAO,KAAK,aAAa,QAAQ;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,IAAI;AACrC,UAAM,MAAM,KAAK,MAAM,MAAM;AAC7B,QAAI,CAAC,KAAK;AACR,cAAQ,KAAK,+DAAqD,EAAE,UAAU,KAAK,CAAC;AACpF,aAAO;AAAA,IACT;AACA,UAAM,MAAiB,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE;AAC9D,WAAO,KAAK,SAAS,GAAG;AAAA,EAC1B;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,UAAM,MAAM,YAAY;AACxB,UAAM,OAAO,KAAK,aAAa,QAAQ;AACvC,UAAM,KAAK,MAAM,KAAK,WAAW,MAAM,GAAG;AAC1C,QAAI,IAAI;AACN,cAAQ,KAAK,0DAAmD,EAAE,UAAU,KAAK,CAAC;AAAA,IACpF,OAAO;AACL,cAAQ,KAAK,sEAA4D,EAAE,UAAU,KAAK,CAAC;AAAA,IAC7F;AACA,QAAI,CAAC,GAAI,QAAO;AAChB,WAAO,KAAK,SAAS,EAAE,UAAU,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EAC/D;AACF;AAEA,IAAI,iCAAiC;AAErC,SAAS,4BAA4B,MAA2B;AAC9D,MAAI,QAAQ,IAAI,aAAa,UAAU,+BAAgC;AACvE,mCAAiC;AACjC,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,SAAI,OAAO,KAAK,CAAC,GAAG,KAAK;AAC3D,QAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,QAAM,aACJ,KAAK,WAAW,aAAa,WAAW,KAAK,OAAO,KAAK;AAC3D,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA,eAAe,qCAAqC,WAAW,KAAK,MAAM;AAAA,IAC1E;AAAA,EACF;AACA,UAAQ,KAAK,MAAM;AACnB,aAAW,QAAQ,MAAM;AACvB,UAAM,SAAS,KAAK,OAAO,QAAQ,GAAG,GAAG;AACzC,YAAQ,KAAK,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,EAAE;AAAA,EACpD;AACA,UAAQ,KAAK,MAAM;AACrB;AAEO,SAAS,mBAA+B;AAC7C,MAAI,CAAC,8BAA8B,EAAG,QAAO,IAAI,eAAe;AAChE,QAAM,UAAU,IAAI,yBAAyB;AAE7C,QAAM,UAAU,wBAAwB;AACxC,QAAM,WAAW,UAAU,IAAI,kBAAkB,QAAQ,MAAM,IAAI;AACnE,QAAM,iBAAiB,UACnB,MAAM;AACJ,gCAA4B,OAAO;AAAA,EACrC,IACA;AAEJ,MAAI,CAAC,QAAQ,UAAU,GAAG;AACxB,QAAI,UAAU;AACZ,uBAAiB;AACjB,aAAO;AAAA,IACT;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,IAAI,eAAe;AAAA,EAC5B;AAEA,MAAI,UAAU;AACZ,WAAO,IAAI,mBAAmB,SAAS,UAAU,cAAc;AAAA,EACjE;AAEA,SAAO;AACT;",
   "names": []
 }

package/dist/lib/encryption/tenantDataEncryptionService.js

@@ -174,6 +174,12 @@ class TenantDataEncryptionService {
       await this.cache.delete(tag);
     }
   }
+  async getEncryptedFieldNames(entityId, tenantId, organizationId) {
+    if (!this.isEnabled()) return [];
+    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null });
+    if (!map || !map.fields?.length) return [];
+    return map.fields.map((rule) => rule.field).filter((field) => typeof field === "string" && field.trim().length > 0);
+  }
   encryptFields(obj, fields, dek) {
     const clone = { ...obj };
     for (const rule of fields) {

package/dist/lib/encryption/tenantDataEncryptionService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/encryption/tenantDataEncryptionService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    // eslint-disable-next-line no-console\n    console.debug(`${event} [tenant-encryption]`, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n *\n * NOTE (issue #1810 follow-up): `decryptFields` no longer calls this helper for\n * entity-field decryption \u2014 typed string columns whose contents happen to look\n * like JSON (e.g. a display name `{\"a\":1}`) must remain raw strings to avoid\n * downstream React-render crashes. Callers that legitimately need the parse\n * (audit-log jsonb columns, custom-field rotation, encryption CLI) MUST invoke\n * `parseDecryptedFieldValue` themselves on the decrypted payload.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n\n  constructor(\n    private em: EntityManager,\n    opts?: { cache?: CacheStrategy; kms?: KmsService }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached) return cached\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async resolveDekForEncrypt(tenantId: string | null): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    const created = await this.kms.createTenantDek(tenantId)\n    if (created) this.dekCache.set(tenantId, created)\n    return created ?? null\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn: any = (this.em as any)?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length ? rows[0] : null\n    if (!row) return null\n    return {\n      entityId: row.entity_id || row.entityId || key.entityId,\n      fields: Array.isArray(row.fields_json)\n        ? (row.fields_json as EncryptedFieldRule[])\n        : Array.isArray(row.fieldsJson)\n          ? (row.fieldsJson as EncryptedFieldRule[])\n          : [],\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return resolved\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return mem\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return cached as EncryptionMapRecord\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return loaded\n    }\n    return null\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tag = cacheKey({ entityId, tenantId, organizationId })\n    this.memoryCache.delete(tag)\n    this.inflightMaps.delete(tag)\n    this.missCache.delete(tag)\n    if (this.cache && typeof (this.cache as any).delete === 'function') {\n      await (this.cache as any).delete(tag)\n    }\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n       // Avoid double-encrypting already encrypted payloads\n      if (isEncryptedPayload(value)) continue\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      // Entity fields are typed columns (string/text). Never auto-parse to an object \u2014\n      // it triggers React-render crashes when a string value happens to be valid JSON\n      // (issue #1810 follow-up). Custom field values use a separate helper that\n      // preserves their typed-JSON contract.\n      clone[key] = decrypted\n    }\n    return clone\n  }\n\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.resolveDekForEncrypt(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.encryptFields(payload, map.fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.getDek(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.decryptFields(payload, map.fields, dek)\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,mBAAmB,mBAAmB,qBAAqB;AACpE,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AAmBxE,MAAM,kBAAkB,IAAI,KAAK;AAEjC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AAEF,YAAQ,MAAM,GAAG,KAAK,wBAAwB,OAAO;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAqBO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEO,MAAM,4BAA4B;AAAA,EAYvC,YACU,IACR,MACA;AAFQ;AANV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAMvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AAAA,EAC3C;AAAA,EAjBA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EAgBzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,UAAoD;AACrF,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AACvE,UAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,QAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAa,KAAK,IAAY,gBAAgB;AACpD,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,WAAY,QAAO;AACxD,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,CAAC,IAAI;AAC3D,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,IAAI,aAAa,IAAI,YAAY,IAAI;AAAA,MAC/C,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAChC,IAAI,cACL,MAAM,QAAQ,IAAI,UAAU,IACzB,IAAI,aACL,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO;AAAA,MACvB;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO;AAChB,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,MAAM,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC;AAC3D,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,aAAa,OAAO,GAAG;AAC5B,SAAK,UAAU,OAAO,GAAG;AACzB,QAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,YAAO,KAAK,MAAc,OAAO,GAAG;AAAA,IACtC;AAAA,EACF;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAE3C,UAAI,mBAAmB,KAAK,EAAG;AAC/B,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AAKxB,YAAM,GAAG,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,qBAAqB,YAAY,IAAI;AAC5D,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,YAAY,IAAI;AAC9C,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'\nimport { createKmsService, type KmsService, type TenantDek } from './kms'\nimport { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'\nimport { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'\n\nexport type EncryptedFieldRule = {\n  field: string\n  hashField?: string | null\n}\n\nexport type EncryptionMapRecord = {\n  entityId: string\n  fields: EncryptedFieldRule[]\n}\n\ntype MapCacheKey = {\n  entityId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nconst MAP_MISS_TTL_MS = 5 * 60 * 1000\n\nfunction cacheKey(key: MapCacheKey): string {\n  return [\n    'encmap',\n    key.entityId.toLowerCase(),\n    key.tenantId ?? 'null',\n    key.organizationId ?? 'null',\n  ].join(':')\n}\n\nfunction debug(event: string, payload: Record<string, unknown>) {\n  if (!isEncryptionDebugEnabled()) return\n  try {\n    // eslint-disable-next-line no-console\n    console.debug(`${event} [tenant-encryption]`, payload)\n  } catch {\n    // ignore\n  }\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nfunction findKey(obj: Record<string, unknown>, key: string): string | null {\n  const candidates = [key, toSnakeCase(key), toCamelCase(key)]\n  for (const candidate of candidates) {\n    if (Object.prototype.hasOwnProperty.call(obj, candidate)) return candidate\n  }\n  return null\n}\n\n/**\n * Decode a decrypted entity-field payload back into its original value.\n *\n * The encrypt path stores raw strings unwrapped and JSON-stringifies non-string\n * values. Blindly running `JSON.parse` on every decrypted value would coerce\n * text columns whose contents happen to be valid JSON primitives \u2014 e.g. the\n * string `\"123\"` \u2014 back into numbers/booleans, which then breaks string-typed\n * consumers (see issue #1734). Only restructure the value when the decrypted\n * payload is unambiguously a JSON object or array; otherwise return the raw\n * decrypted string. Numeric/boolean entity columns are not in any current\n * encryption map, so this is backward-compatible.\n *\n * NOTE (issue #1810 follow-up): `decryptFields` no longer calls this helper for\n * entity-field decryption \u2014 typed string columns whose contents happen to look\n * like JSON (e.g. a display name `{\"a\":1}`) must remain raw strings to avoid\n * downstream React-render crashes. Callers that legitimately need the parse\n * (audit-log jsonb columns, custom-field rotation, encryption CLI) MUST invoke\n * `parseDecryptedFieldValue` themselves on the decrypted payload.\n */\nexport function parseDecryptedFieldValue(decrypted: string): unknown {\n  if (decrypted.length === 0) return decrypted\n  const first = decrypted[0]\n  if (first !== '{' && first !== '[') return decrypted\n  try {\n    return JSON.parse(decrypted)\n  } catch {\n    return decrypted\n  }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nexport class TenantDataEncryptionService {\n  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()\n  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()\n  private static globalDekCache = new Map<string, TenantDek>()\n  private static globalMissCache = new Map<string, number>()\n  private readonly kms: KmsService\n  private readonly cache?: CacheStrategy\n  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache\n  private readonly dekCache = TenantDataEncryptionService.globalDekCache\n  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps\n  private readonly missCache = TenantDataEncryptionService.globalMissCache\n\n  constructor(\n    private em: EntityManager,\n    opts?: { cache?: CacheStrategy; kms?: KmsService }\n  ) {\n    this.cache = opts?.cache\n    this.kms = opts?.kms ?? createKmsService()\n  }\n\n  isEnabled(): boolean {\n    return isTenantDataEncryptionEnabled() && this.kms.isHealthy()\n  }\n\n  async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    const cached = this.dekCache.get(tenantId)\n    if (cached) return cached\n    const dek = await this.kms.getTenantDek(tenantId)\n    if (!dek) {\n      debug('\uD83D\uDD0E dek.miss', { tenantId })\n    } else {\n      debug('\u2705 dek.hit', { tenantId })\n    }\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async resolveDekForEncrypt(tenantId: string | null): Promise<TenantDek | null> {\n    const existing = await this.getDek(tenantId)\n    if (existing || !tenantId) return existing ?? null\n    if (typeof this.kms.createTenantDek !== 'function') return existing ?? null\n    const created = await this.kms.createTenantDek(tenantId)\n    if (created) this.dekCache.set(tenantId, created)\n    return created ?? null\n  }\n\n  async createDek(tenantId: string): Promise<TenantDek | null> {\n    const dek = await this.kms.createTenantDek(tenantId)\n    if (dek) this.dekCache.set(tenantId, dek)\n    return dek\n  }\n\n  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.\n    const conn: any = (this.em as any)?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') return null\n    const sql = `\n      select entity_id, fields_json\n      from encryption_maps\n      where entity_id = ?\n        and tenant_id is not distinct from ?\n        and organization_id is not distinct from ?\n        and is_active = true\n        and deleted_at is null\n      limit 1\n    `\n    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])\n    const row = Array.isArray(rows) && rows.length ? rows[0] : null\n    if (!row) return null\n    return {\n      entityId: row.entity_id || row.entityId || key.entityId,\n      fields: Array.isArray(row.fields_json)\n        ? (row.fields_json as EncryptedFieldRule[])\n        : Array.isArray(row.fieldsJson)\n          ? (row.fieldsJson as EncryptedFieldRule[])\n          : [],\n    }\n  }\n\n  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {\n    const shouldSkipLookup = (tag: string) => {\n      const expiresAt = this.missCache.get(tag)\n      if (!expiresAt) return false\n      if (expiresAt > Date.now()) return true\n      this.missCache.delete(tag)\n      return false\n    }\n    const recordMiss = (tag: string) => {\n      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)\n    }\n\n    const candidates: MapCacheKey[] = [\n      key,\n      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },\n      { entityId: key.entityId, tenantId: null, organizationId: null },\n    ]\n    for (const candidate of candidates) {\n      const tag = cacheKey(candidate)\n      if (shouldSkipLookup(tag)) continue\n      if (this.inflightMaps.has(tag)) {\n        const pending = this.inflightMaps.get(tag)!\n        const resolved = await pending\n        if (resolved) return resolved\n      }\n      const mem = this.memoryCache.get(tag)\n      if (mem) return mem\n      if (this.cache && typeof this.cache.get === 'function') {\n        const cached = await this.cache.get(tag)\n        if (cached) return cached as EncryptionMapRecord\n      }\n      const pending = this.fetchMap(candidate)\n      this.inflightMaps.set(tag, pending)\n      const loaded = await pending\n      this.inflightMaps.delete(tag)\n      if (!loaded) {\n        recordMiss(tag)\n        debug('\uD83D\uDD0D encmap.miss', {\n          entityId: candidate.entityId,\n          tenantId: candidate.tenantId,\n          organizationId: candidate.organizationId,\n        })\n        continue\n      }\n      this.missCache.delete(tag)\n      this.memoryCache.set(tag, loaded)\n      if (this.cache && typeof this.cache.set === 'function') {\n        await this.cache.set(tag, loaded, { ttl: 300 })\n      }\n      return loaded\n    }\n    return null\n  }\n\n  async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {\n    const tag = cacheKey({ entityId, tenantId, organizationId })\n    this.memoryCache.delete(tag)\n    this.inflightMaps.delete(tag)\n    this.missCache.delete(tag)\n    if (this.cache && typeof (this.cache as any).delete === 'function') {\n      await (this.cache as any).delete(tag)\n    }\n  }\n\n  async getEncryptedFieldNames(\n    entityId: string,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<string[]> {\n    if (!this.isEnabled()) return []\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) return []\n    return map.fields\n      .map((rule) => rule.field)\n      .filter((field): field is string => typeof field === 'string' && field.trim().length > 0)\n  }\n\n  private encryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (value === null || value === undefined) continue\n       // Avoid double-encrypting already encrypted payloads\n      if (isEncryptedPayload(value)) continue\n      const serialized = typeof value === 'string' ? value : JSON.stringify(value)\n      const payload = encryptWithAesGcm(serialized, dek.key)\n      clone[key] = payload.value\n      if (rule.hashField) {\n        const hashKey = findKey(clone, rule.hashField) ?? rule.hashField\n        clone[hashKey] = hashForLookup(serialized)\n      }\n    }\n    return clone\n  }\n\n  private decryptFields(\n    obj: Record<string, unknown>,\n    fields: EncryptedFieldRule[],\n    dek: TenantDek\n  ): Record<string, unknown> {\n    const clone: Record<string, unknown> = { ...obj }\n    const maybeDecrypt = (payload: string): string | null => {\n      const first = decryptWithAesGcm(payload, dek.key)\n      if (first === null) return null\n      // Handle accidental double-encryption: if the first pass still looks like a v1 payload, try once more.\n      const parts = first.split(':')\n      if (parts.length === 4 && parts[3] === 'v1') {\n        const second = decryptWithAesGcm(first, dek.key)\n        return second ?? first\n      }\n      return first\n    }\n    for (const rule of fields) {\n      const key = findKey(clone, rule.field)\n      if (!key) continue\n      const value = clone[key]\n      if (typeof value !== 'string') continue\n      const decrypted = maybeDecrypt(value)\n      if (decrypted === null) continue\n      // Entity fields are typed columns (string/text). Never auto-parse to an object \u2014\n      // it triggers React-render crashes when a string value happens to be valid JSON\n      // (issue #1810 follow-up). Custom field values use a separate helper that\n      // preserves their typed-JSON contract.\n      clone[key] = decrypted\n    }\n    return clone\n  }\n\n  async encryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!this.isEnabled()) {\n      debug('\u26AA\uFE0F encrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.resolveDekForEncrypt(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F encrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F encrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD12 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.encryptFields(payload, map.fields, dek)\n  }\n\n  async decryptEntityPayload(\n    entityId: string,\n    payload: Record<string, unknown>,\n    tenantId: string | null | undefined,\n    organizationId?: string | null\n  ): Promise<Record<string, unknown>> {\n    if (!isTenantDataEncryptionEnabled()) {\n      debug('\u26AA\uFE0F decrypt.skip.disabled', { entityId, tenantId })\n      return payload\n    }\n    const dek = await this.getDek(tenantId ?? null)\n    if (!dek) {\n      debug('\u26A0\uFE0F decrypt.skip.no-dek', { entityId, tenantId })\n      return payload\n    }\n    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })\n    if (!map || !map.fields?.length) {\n      debug('\u26AA\uFE0F decrypt.skip.no-map', { entityId, tenantId })\n      return payload\n    }\n    debug('\uD83D\uDD13 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })\n    return this.decryptFields(payload, map.fields, dek)\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,mBAAmB,mBAAmB,qBAAqB;AACpE,SAAS,wBAAyD;AAClE,SAAS,+BAA+B,gCAAgC;AAmBxE,MAAM,kBAAkB,IAAI,KAAK;AAEjC,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL;AAAA,IACA,IAAI,SAAS,YAAY;AAAA,IACzB,IAAI,YAAY;AAAA,IAChB,IAAI,kBAAkB;AAAA,EACxB,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,MAAM,OAAe,SAAkC;AAC9D,MAAI,CAAC,yBAAyB,EAAG;AACjC,MAAI;AAEF,YAAQ,MAAM,GAAG,KAAK,wBAAwB,OAAO;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAEA,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAEtD,SAAS,QAAQ,KAA8B,KAA4B;AACzE,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAqBO,SAAS,yBAAyB,WAA4B;AACnE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,QAAQ,UAAU,CAAC;AACzB,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEO,MAAM,4BAA4B;AAAA,EAYvC,YACU,IACR,MACA;AAFQ;AANV,SAAiB,cAAc,4BAA4B;AAC3D,SAAiB,WAAW,4BAA4B;AACxD,SAAiB,eAAe,4BAA4B;AAC5D,SAAiB,YAAY,4BAA4B;AAMvD,SAAK,QAAQ,MAAM;AACnB,SAAK,MAAM,MAAM,OAAO,iBAAiB;AAAA,EAC3C;AAAA,EAjBA;AAAA,SAAe,oBAAoB,oBAAI,IAAiC;AAAA;AAAA,EACxE;AAAA,SAAe,qBAAqB,oBAAI,IAAiD;AAAA;AAAA,EACzF;AAAA,SAAe,iBAAiB,oBAAI,IAAuB;AAAA;AAAA,EAC3D;AAAA,SAAe,kBAAkB,oBAAI,IAAoB;AAAA;AAAA,EAgBzD,YAAqB;AACnB,WAAO,8BAA8B,KAAK,KAAK,IAAI,UAAU;AAAA,EAC/D;AAAA,EAEA,MAAM,OAAO,UAAgE;AAC3E,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,OAAQ,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,IAAI,aAAa,QAAQ;AAChD,QAAI,CAAC,KAAK;AACR,YAAM,sBAAe,EAAE,SAAS,CAAC;AAAA,IACnC,OAAO;AACL,YAAM,kBAAa,EAAE,SAAS,CAAC;AAAA,IACjC;AACA,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,UAAoD;AACrF,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAC3C,QAAI,YAAY,CAAC,SAAU,QAAO,YAAY;AAC9C,QAAI,OAAO,KAAK,IAAI,oBAAoB,WAAY,QAAO,YAAY;AACvE,UAAM,UAAU,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACvD,QAAI,QAAS,MAAK,SAAS,IAAI,UAAU,OAAO;AAChD,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,UAAU,UAA6C;AAC3D,UAAM,MAAM,MAAM,KAAK,IAAI,gBAAgB,QAAQ;AACnD,QAAI,IAAK,MAAK,SAAS,IAAI,UAAU,GAAG;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAuD;AAE5E,UAAM,OAAa,KAAK,IAAY,gBAAgB;AACpD,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,WAAY,QAAO;AACxD,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,IAAI,UAAU,IAAI,YAAY,MAAM,IAAI,kBAAkB,IAAI,CAAC;AACrG,UAAM,MAAM,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,CAAC,IAAI;AAC3D,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,UAAU,IAAI,aAAa,IAAI,YAAY,IAAI;AAAA,MAC/C,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAChC,IAAI,cACL,MAAM,QAAQ,IAAI,UAAU,IACzB,IAAI,aACL,CAAC;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAuD;AAC1E,UAAM,mBAAmB,CAAC,QAAgB;AACxC,YAAM,YAAY,KAAK,UAAU,IAAI,GAAG;AACxC,UAAI,CAAC,UAAW,QAAO;AACvB,UAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,WAAK,UAAU,OAAO,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAgB;AAClC,WAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe;AAAA,IACtD;AAEA,UAAM,aAA4B;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,UAAU,IAAI,YAAY,MAAM,gBAAgB,KAAK;AAAA,MAC/E,EAAE,UAAU,IAAI,UAAU,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACjE;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,MAAM,SAAS,SAAS;AAC9B,UAAI,iBAAiB,GAAG,EAAG;AAC3B,UAAI,KAAK,aAAa,IAAI,GAAG,GAAG;AAC9B,cAAMA,WAAU,KAAK,aAAa,IAAI,GAAG;AACzC,cAAM,WAAW,MAAMA;AACvB,YAAI,SAAU,QAAO;AAAA,MACvB;AACA,YAAM,MAAM,KAAK,YAAY,IAAI,GAAG;AACpC,UAAI,IAAK,QAAO;AAChB,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG;AACvC,YAAI,OAAQ,QAAO;AAAA,MACrB;AACA,YAAM,UAAU,KAAK,SAAS,SAAS;AACvC,WAAK,aAAa,IAAI,KAAK,OAAO;AAClC,YAAM,SAAS,MAAM;AACrB,WAAK,aAAa,OAAO,GAAG;AAC5B,UAAI,CAAC,QAAQ;AACX,mBAAW,GAAG;AACd,cAAM,yBAAkB;AAAA,UACtB,UAAU,UAAU;AAAA,UACpB,UAAU,UAAU;AAAA,UACpB,gBAAgB,UAAU;AAAA,QAC5B,CAAC;AACD;AAAA,MACF;AACA,WAAK,UAAU,OAAO,GAAG;AACzB,WAAK,YAAY,IAAI,KAAK,MAAM;AAChC,UAAI,KAAK,SAAS,OAAO,KAAK,MAAM,QAAQ,YAAY;AACtD,cAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,UAAkB,UAAyB,gBAA8C;AAC3G,UAAM,MAAM,SAAS,EAAE,UAAU,UAAU,eAAe,CAAC;AAC3D,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,aAAa,OAAO,GAAG;AAC5B,SAAK,UAAU,OAAO,GAAG;AACzB,QAAI,KAAK,SAAS,OAAQ,KAAK,MAAc,WAAW,YAAY;AAClE,YAAO,KAAK,MAAc,OAAO,GAAG;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,uBACJ,UACA,UACA,gBACmB;AACnB,QAAI,CAAC,KAAK,UAAU,EAAG,QAAO,CAAC;AAC/B,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,OAAQ,QAAO,CAAC;AACzC,WAAO,IAAI,OACR,IAAI,CAAC,SAAS,KAAK,KAAK,EACxB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAC5F;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,UAAU,QAAQ,UAAU,OAAW;AAE3C,UAAI,mBAAmB,KAAK,EAAG;AAC/B,YAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC3E,YAAM,UAAU,kBAAkB,YAAY,IAAI,GAAG;AACrD,YAAM,GAAG,IAAI,QAAQ;AACrB,UAAI,KAAK,WAAW;AAClB,cAAM,UAAU,QAAQ,OAAO,KAAK,SAAS,KAAK,KAAK;AACvD,cAAM,OAAO,IAAI,cAAc,UAAU;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,cACN,KACA,QACA,KACyB;AACzB,UAAM,QAAiC,EAAE,GAAG,IAAI;AAChD,UAAM,eAAe,CAAC,YAAmC;AACvD,YAAM,QAAQ,kBAAkB,SAAS,IAAI,GAAG;AAChD,UAAI,UAAU,KAAM,QAAO;AAE3B,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,MAAM;AAC3C,cAAM,SAAS,kBAAkB,OAAO,IAAI,GAAG;AAC/C,eAAO,UAAU;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,QAAQ;AACzB,YAAM,MAAM,QAAQ,OAAO,KAAK,KAAK;AACrC,UAAI,CAAC,IAAK;AACV,YAAM,QAAQ,MAAM,GAAG;AACvB,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,YAAY,aAAa,KAAK;AACpC,UAAI,cAAc,KAAM;AAKxB,YAAM,GAAG,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,KAAK,UAAU,GAAG;AACrB,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,qBAAqB,YAAY,IAAI;AAC5D,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AAAA,EAEA,MAAM,qBACJ,UACA,SACA,UACA,gBACkC;AAClC,QAAI,CAAC,8BAA8B,GAAG;AACpC,YAAM,sCAA4B,EAAE,UAAU,SAAS,CAAC;AACxD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,YAAY,IAAI;AAC9C,QAAI,CAAC,KAAK;AACR,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,YAAY,MAAM,gBAAgB,kBAAkB,KAAK,CAAC;AAC9G,QAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,QAAQ;AAC/B,YAAM,oCAA0B,EAAE,UAAU,SAAS,CAAC;AACtD,aAAO;AAAA,IACT;AACA,UAAM,4BAAqB,EAAE,UAAU,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,CAAC;AAC5F,WAAO,KAAK,cAAc,SAAS,IAAI,QAAQ,GAAG;AAAA,EACpD;AACF;",
   "names": ["pending"]
 }

package/dist/lib/query/encrypted-sort.js

@@ -0,0 +1,64 @@
+import { SortDir } from "./types.js";
+const toSnakeCase = (value) => value.replace(/([A-Z])/g, "_$1").replace(/__/g, "_").toLowerCase();
+const toCamelCase = (value) => value.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+function fieldNameCandidates(field) {
+  const raw = String(field || "").trim();
+  if (!raw) return [];
+  const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)];
+  if (raw.startsWith("cf:")) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, "_"));
+  return Array.from(new Set(candidates));
+}
+async function resolveEncryptedSortFields(service, entity, sortFields, tenantId, organizationId) {
+  if (!service?.getEncryptedFieldNames) return /* @__PURE__ */ new Set();
+  if (service.isEnabled && !service.isEnabled()) return /* @__PURE__ */ new Set();
+  const encrypted = await service.getEncryptedFieldNames(entity, tenantId ?? null, organizationId ?? null);
+  const encryptedCandidates = /* @__PURE__ */ new Set();
+  for (const field of encrypted) {
+    for (const candidate of fieldNameCandidates(field)) encryptedCandidates.add(candidate);
+  }
+  const result = /* @__PURE__ */ new Set();
+  for (const field of sortFields) {
+    if (field.startsWith("cf:")) continue;
+    const matches = fieldNameCandidates(field).some((candidate) => encryptedCandidates.has(candidate));
+    if (matches) result.add(field);
+  }
+  return result;
+}
+function readField(row, field) {
+  for (const candidate of fieldNameCandidates(field)) {
+    if (Object.prototype.hasOwnProperty.call(row, candidate)) return row[candidate];
+  }
+  return void 0;
+}
+function compareValues(left, right) {
+  const leftMissing = left === null || left === void 0;
+  const rightMissing = right === null || right === void 0;
+  if (leftMissing && rightMissing) return 0;
+  if (leftMissing) return 1;
+  if (rightMissing) return -1;
+  if (left instanceof Date && right instanceof Date) return left.getTime() - right.getTime();
+  if (typeof left === "number" && typeof right === "number") return left - right;
+  if (typeof left === "boolean" && typeof right === "boolean") return Number(left) - Number(right);
+  return String(left).localeCompare(String(right), void 0, {
+    sensitivity: "base",
+    numeric: true
+  });
+}
+function sortRowsInMemory(rows, sorts) {
+  return [...rows].sort((left, right) => {
+    for (const sort of sorts) {
+      const direction = sort.dir === SortDir.Desc ? -1 : 1;
+      const compared = compareValues(readField(left, sort.field), readField(right, sort.field));
+      if (compared !== 0) return compared * direction;
+    }
+    const leftId = readField(left, "id");
+    const rightId = readField(right, "id");
+    return compareValues(leftId, rightId);
+  });
+}
+export {
+  fieldNameCandidates,
+  resolveEncryptedSortFields,
+  sortRowsInMemory
+};
+//# sourceMappingURL=encrypted-sort.js.map

package/dist/lib/query/encrypted-sort.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/query/encrypted-sort.ts"],
+  "sourcesContent": ["import type { EntityId } from '@open-mercato/shared/modules/entities'\nimport { SortDir, type Sort } from './types'\n\nexport type QueryEncryptionService = {\n  getEncryptedFieldNames?: (\n    entityId: EntityId,\n    tenantId?: string | null,\n    organizationId?: string | null,\n  ) => Promise<readonly string[]>\n  isEnabled?: () => boolean\n}\n\nconst toSnakeCase = (value: string): string =>\n  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()\n\nconst toCamelCase = (value: string): string =>\n  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())\n\nexport function fieldNameCandidates(field: string): string[] {\n  const raw = String(field || '').trim()\n  if (!raw) return []\n  const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)]\n  if (raw.startsWith('cf:')) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, '_'))\n  return Array.from(new Set(candidates))\n}\n\nexport async function resolveEncryptedSortFields(\n  service: QueryEncryptionService | null | undefined,\n  entity: EntityId,\n  sortFields: readonly string[],\n  tenantId?: string | null,\n  organizationId?: string | null,\n): Promise<Set<string>> {\n  if (!service?.getEncryptedFieldNames) return new Set()\n  if (service.isEnabled && !service.isEnabled()) return new Set()\n  const encrypted = await service.getEncryptedFieldNames(entity, tenantId ?? null, organizationId ?? null)\n  const encryptedCandidates = new Set<string>()\n  for (const field of encrypted) {\n    for (const candidate of fieldNameCandidates(field)) encryptedCandidates.add(candidate)\n  }\n  const result = new Set<string>()\n  for (const field of sortFields) {\n    if (field.startsWith('cf:')) continue\n    const matches = fieldNameCandidates(field).some((candidate) => encryptedCandidates.has(candidate))\n    if (matches) result.add(field)\n  }\n  return result\n}\n\nfunction readField(row: Record<string, unknown>, field: string): unknown {\n  for (const candidate of fieldNameCandidates(field)) {\n    if (Object.prototype.hasOwnProperty.call(row, candidate)) return row[candidate]\n  }\n  return undefined\n}\n\nfunction compareValues(left: unknown, right: unknown): number {\n  const leftMissing = left === null || left === undefined\n  const rightMissing = right === null || right === undefined\n  if (leftMissing && rightMissing) return 0\n  if (leftMissing) return 1\n  if (rightMissing) return -1\n  if (left instanceof Date && right instanceof Date) return left.getTime() - right.getTime()\n  if (typeof left === 'number' && typeof right === 'number') return left - right\n  if (typeof left === 'boolean' && typeof right === 'boolean') return Number(left) - Number(right)\n  return String(left).localeCompare(String(right), undefined, {\n    sensitivity: 'base',\n    numeric: true,\n  })\n}\n\nexport function sortRowsInMemory<T extends Record<string, unknown>>(\n  rows: readonly T[],\n  sorts: readonly Sort[],\n): T[] {\n  return [...rows].sort((left, right) => {\n    for (const sort of sorts) {\n      const direction = sort.dir === SortDir.Desc ? -1 : 1\n      const compared = compareValues(readField(left, sort.field), readField(right, sort.field))\n      if (compared !== 0) return compared * direction\n    }\n    const leftId = readField(left, 'id')\n    const rightId = readField(right, 'id')\n    return compareValues(leftId, rightId)\n  })\n}\n"],
+  "mappings": "AACA,SAAS,eAA0B;AAWnC,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,YAAY,KAAK,EAAE,QAAQ,OAAO,GAAG,EAAE,YAAY;AAEnE,MAAM,cAAc,CAAC,UACnB,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAE/C,SAAS,oBAAoB,OAAyB;AAC3D,QAAM,MAAM,OAAO,SAAS,EAAE,EAAE,KAAK;AACrC,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,aAAa,CAAC,KAAK,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;AAC3D,MAAI,IAAI,WAAW,KAAK,EAAG,YAAW,KAAK,IAAI,QAAQ,kBAAkB,GAAG,CAAC;AAC7E,SAAO,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC;AACvC;AAEA,eAAsB,2BACpB,SACA,QACA,YACA,UACA,gBACsB;AACtB,MAAI,CAAC,SAAS,uBAAwB,QAAO,oBAAI,IAAI;AACrD,MAAI,QAAQ,aAAa,CAAC,QAAQ,UAAU,EAAG,QAAO,oBAAI,IAAI;AAC9D,QAAM,YAAY,MAAM,QAAQ,uBAAuB,QAAQ,YAAY,MAAM,kBAAkB,IAAI;AACvG,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,aAAW,SAAS,WAAW;AAC7B,eAAW,aAAa,oBAAoB,KAAK,EAAG,qBAAoB,IAAI,SAAS;AAAA,EACvF;AACA,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,YAAY;AAC9B,QAAI,MAAM,WAAW,KAAK,EAAG;AAC7B,UAAM,UAAU,oBAAoB,KAAK,EAAE,KAAK,CAAC,cAAc,oBAAoB,IAAI,SAAS,CAAC;AACjG,QAAI,QAAS,QAAO,IAAI,KAAK;AAAA,EAC/B;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAA8B,OAAwB;AACvE,aAAW,aAAa,oBAAoB,KAAK,GAAG;AAClD,QAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,EAAG,QAAO,IAAI,SAAS;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,MAAe,OAAwB;AAC5D,QAAM,cAAc,SAAS,QAAQ,SAAS;AAC9C,QAAM,eAAe,UAAU,QAAQ,UAAU;AACjD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,YAAa,QAAO;AACxB,MAAI,aAAc,QAAO;AACzB,MAAI,gBAAgB,QAAQ,iBAAiB,KAAM,QAAO,KAAK,QAAQ,IAAI,MAAM,QAAQ;AACzF,MAAI,OAAO,SAAS,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO;AACzE,MAAI,OAAO,SAAS,aAAa,OAAO,UAAU,UAAW,QAAO,OAAO,IAAI,IAAI,OAAO,KAAK;AAC/F,SAAO,OAAO,IAAI,EAAE,cAAc,OAAO,KAAK,GAAG,QAAW;AAAA,IAC1D,aAAa;AAAA,IACb,SAAS;AAAA,EACX,CAAC;AACH;AAEO,SAAS,iBACd,MACA,OACK;AACL,SAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,UAAU;AACrC,eAAW,QAAQ,OAAO;AACxB,YAAM,YAAY,KAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,YAAM,WAAW,cAAc,UAAU,MAAM,KAAK,KAAK,GAAG,UAAU,OAAO,KAAK,KAAK,CAAC;AACxF,UAAI,aAAa,EAAG,QAAO,WAAW;AAAA,IACxC;AACA,UAAM,SAAS,UAAU,MAAM,IAAI;AACnC,UAAM,UAAU,UAAU,OAAO,IAAI;AACrC,WAAO,cAAc,QAAQ,OAAO;AAAA,EACtC,CAAC;AACH;",
+  "names": []
+}

package/dist/lib/query/engine.js

@@ -8,6 +8,7 @@ import {
 import { resolveSearchConfig } from "../search/config.js";
 import { tokenizeText } from "../search/tokenize.js";
 import { runBeforeQueryPipeline, runAfterQueryPipeline } from "./query-extension-runner.js";
+import { resolveEncryptedSortFields, sortRowsInMemory } from "./encrypted-sort.js";
 const entityTableCache = /* @__PURE__ */ new Map();
 const pluralizeBaseName = (name) => {
   if (!name) return name;
@@ -376,8 +377,30 @@ class BasicQueryEngine {
       applyJoinFilterOp,
       columnExists: (tbl, column) => this.columnExists(tbl, column)
     });
+    const fallbackOrgId = opts.organizationId ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null);
+    const encryptionService = this.getEncryptionService();
+    const resolvedSorts = [];
+    for (const s of opts.sort || []) {
+      if (s.field.startsWith("cf:")) {
+        resolvedSorts.push(s);
+      } else {
+        const column = await this.resolveBaseColumn(table, s.field);
+        if (column) resolvedSorts.push({ ...s, field: column });
+      }
+    }
+    const encryptedSortFields = await resolveEncryptedSortFields(
+      encryptionService,
+      entity,
+      resolvedSorts.filter((sort) => !sort.field.startsWith("cf:")).map((sort) => sort.field),
+      opts.tenantId ?? null,
+      fallbackOrgId
+    );
+    const requiresPlaintextSort = encryptedSortFields.size > 0;
     if (opts.fields && opts.fields.length) {
-      const cols = opts.fields.filter((f) => !f.startsWith("cf:"));
+      const cols = new Set(opts.fields.filter((f) => !f.startsWith("cf:")));
+      if (requiresPlaintextSort) {
+        for (const field of encryptedSortFields) cols.add(field);
+      }
       for (const c of cols) {
         q = q.select(sql.ref(qualify(c)).as(c));
       }
@@ -576,7 +599,7 @@ class BasicQueryEngine {
         );
       }
     }
-    for (const s of opts.sort || []) {
+    for (const s of resolvedSorts) {
       if (s.field.startsWith("cf:")) {
         const key = s.field.slice(3);
         const alias = sanitize(`cf:${key}`);
@@ -587,11 +610,9 @@ class BasicQueryEngine {
             cfSelectedAliases.push(alias);
           }
         }
-        q = q.orderBy(alias, s.dir ?? "asc");
+        if (!requiresPlaintextSort) q = q.orderBy(alias, s.dir ?? "asc");
       } else {
-        const column = await this.resolveBaseColumn(table, s.field);
-        if (!column) continue;
-        q = q.orderBy(qualify(column), s.dir ?? "asc");
+        if (!requiresPlaintextSort) q = q.orderBy(qualify(s.field), s.dir ?? "asc");
       }
     }
     const page = opts.page?.page ?? 1;
@@ -603,7 +624,8 @@ class BasicQueryEngine {
     const countBuilder = hasJoinedAggregates ? q.clearSelect().clearOrderBy().clearGroupBy().select(sql`count(distinct ${sql.ref(`${table}.id`)})`.as("count")) : q.clearSelect().clearOrderBy().select(sql`count(distinct ${sql.ref(`${table}.id`)})`.as("count"));
     const countRow = await countBuilder.executeTakeFirst();
     const total = Number(countRow?.count ?? 0);
-    const items = await q.limit(pageSize).offset((page - 1) * pageSize).execute();
+    const dataQuery = requiresPlaintextSort ? q : q.limit(pageSize).offset((page - 1) * pageSize);
+    const items = await dataQuery.execute();
     if (cfJsonAliases.size > 0) {
       for (const row of items) {
         for (const alias of cfJsonAliases) {
@@ -628,11 +650,10 @@ class BasicQueryEngine {
         }
       }
     }
-    const svc = this.getEncryptionService();
+    const svc = encryptionService;
     const decryptPayload = svc?.decryptEntityPayload?.bind(svc);
     let decryptedItems = items;
     if (decryptPayload) {
-      const fallbackOrgId = opts.organizationId ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null);
       decryptedItems = await Promise.all(
         items.map(async (item) => {
           try {
@@ -650,7 +671,8 @@ class BasicQueryEngine {
         })
       );
     }
-    let queryResult = { items: decryptedItems, page, pageSize, total };
+    const pagedItems = requiresPlaintextSort ? sortRowsInMemory(decryptedItems, resolvedSorts).slice((page - 1) * pageSize, page * pageSize) : decryptedItems;
+    let queryResult = { items: pagedItems, page, pageSize, total };
     if (ext && extensionCtx) {
       const diCtx = ext.resolve ? { resolve: ext.resolve } : noop;
       queryResult = await runAfterQueryPipeline(