const defaultEncryptionMaps = [
  {
    // `webhook_secret` is a tenant-scoped signing credential, never used in a
    // WHERE/ILIKE lookup (it is loaded via the settings row, then compared with
    // timingSafeEqual), so it is safe — and required — to encrypt at rest.
    entityId: "inbox_ops:inbox_settings",
    fields: [
      { field: "webhook_secret" }
    ]
  },
  {
    entityId: "inbox_ops:inbox_email",
    fields: [
      { field: "subject" },
      { field: "raw_text" },
      { field: "raw_html" },
      { field: "cleaned_text" },
      { field: "thread_messages" },
      { field: "forwarded_by_address" },
      { field: "forwarded_by_name" },
      { field: "to_address" },
      { field: "reply_to" },
      { field: "processing_error" }
    ]
  },
  {
    entityId: "inbox_ops:inbox_proposal",
    fields: [
      { field: "summary" },
      { field: "participants" },
      { field: "translations" }
    ]
  },
  {
    entityId: "inbox_ops:inbox_proposal_action",
    fields: [
      { field: "description" },
      { field: "payload" },
      { field: "execution_error" }
    ]
  },
  {
    entityId: "inbox_ops:inbox_discrepancy",
    fields: [
      { field: "description" },
      { field: "expected_value" },
      { field: "found_value" }
    ]
  }
];
var encryption_default = defaultEncryptionMaps;
export {
  encryption_default as default,
  defaultEncryptionMaps
};
//# sourceMappingURL=encryption.js.map
