{
  "name": "Enterprise Reversible PII Masking Vault for n8n AI Workflows",
  "version": "2.4.0",
  "license": "Commercial Single-Organization License",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "ai-intake-webhook",
        "responseMode": "responseNode"
      },
      "id": "node-ingress-webhook",
      "name": "1. Customer Payload Ingress",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        220,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "// AES-256-GCM Deterministic Reversible Tokenizer\nconst crypto = require('crypto');\nconst SECRET = $env.PII_VAULT_SECRET || 'change-me-32-byte-secret-key-000';\nconst vault = {};\nlet text = $input.first().json.body || '';\n\nconst patterns = {\n  EMAIL: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/g,\n  PHONE: /(\\+?\\d{1,3}[-.\\s]?)?\\(?\\d{3}\\)?[-.\\s]?\\d{3}[-.\\s]?\\d{4}/g,\n  SSN: /\\b\\d{3}-\\d{2}-\\d{4}\\b/g,\n  CARD: /\\b(?:\\d[ -]*?){13,16}\\b/g\n};\n\nfor (const [type, regex] of Object.entries(patterns)) {\n  text = text.replace(regex, (match) => {\n    const hash = crypto.createHmac('sha256', SECRET).update(match).digest('hex').slice(0, 6).toUpperCase();\n    const token = `<${type}_${hash}>`;\n    vault[token] = match;\n    return token;\n  });\n}\n\nreturn [{ json: { sanitized_prompt: text, vault_map: vault, timestamp: new Date().toISOString() } }];"
      },
      "id": "node-pii-tokenizer",
      "name": "2. Reversible PII Tokenizer (Zero-Leak Guard)",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        480,
        300
      ]
    },
    {
      "parameters": {
        "model": "gpt-4o",
        "prompt": "={{ $json.sanitized_prompt }}",
        "systemMessage": "You are a support & operations assistant. Preserve all symbolic tokens like <EMAIL_XXXXXX>, <PHONE_XXXXXX>, <SSN_XXXXXX> exactly as written in your output."
      },
      "id": "node-llm-agent",
      "name": "3. Zero-PII LLM Execution",
      "type": "@n8n/n8n-nodes-langchain.chainLlm",
      "typeVersion": 1.4,
      "position": [
        760,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "// Reversible Detokenizer: Restore real customer PII inside private VPC before CRM/Email action\nlet llmOutput = $input.first().json.text || '';\nconst vault = $('2. Reversible PII Tokenizer (Zero-Leak Guard)').first().json.vault_map || {};\n\nfor (const [token, realValue] of Object.entries(vault)) {\n  llmOutput = llmOutput.split(token).join(realValue);\n}\n\nreturn [{ json: { restored_payload: llmOutput, tokens_restored: Object.keys(vault).length, compliance_verified: true } }];"
      },
      "id": "node-pii-detokenizer",
      "name": "4. Private VPC Detokenizer (Restore Context)",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        1040,
        300
      ]
    }
  ],
  "connections": {
    "1. Customer Payload Ingress": {
      "main": [
        [
          {
            "node": "2. Reversible PII Tokenizer (Zero-Leak Guard)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "2. Reversible PII Tokenizer (Zero-Leak Guard)": {
      "main": [
        [
          {
            "node": "3. Zero-PII LLM Execution",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "3. Zero-PII LLM Execution": {
      "main": [
        [
          {
            "node": "4. Private VPC Detokenizer (Restore Context)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}