feat: Add pii-ingestion-gate kit#269
Open
Pavitra-programmers wants to merge 20 commits into
Open
Conversation
Contributor
WalkthroughChangesPII Ingestion Gate
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Pavitra-programmers
changed the title
Contributor
:robot_face: AgentKit Structural ValidationNew Contributions Detected
Check Results
🎉 All checks passed! This contribution follows the AgentKit structure. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 16
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
kits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_user.md (1)
1-4: 🩺 Stability & Availability | 🔵 TrivialMonitor output size for context limits.
Greetings, agent. Your mission, should you choose to accept it, involves monitoring the size of the
InstructorLLMNode_301.outputpayload in production. If the scanned document is massive, this JSON structure could exceed the context window of our downstream analysis model. Consider adding a length check or chunking strategy upstream to prevent our operations from being compromised. This message will self-destruct in five seconds.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_user.md` around lines 1 - 4, Limit the size of the InstructorLLMNode_301.output payload before it is interpolated into the audit-summary prompt. Add an upstream length check or chunking strategy that keeps each downstream analysis request within the model’s context window while preserving complete processing of oversized scanned documents.kits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_system.md (1)
22-25: 🔒 Security & Privacy | 🔵 TrivialEstablish a downstream protocol for live credentials.
Agent, a critical briefing: if the redaction engine flags a live API key in the
notes, we need a rapid-response protocol in the field to automatically intercept and rotate it. Relying on manual review could give the syndicate enough time to infiltrate our systems. I advise setting up an automated alert trigger based on these notes in the orchestration layer.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_system.md` around lines 22 - 25, Update the redaction workflow around the safe_to_index and notes output fields to establish the downstream live-credential protocol: ensure notes clearly flag detected live API keys with actionable context, and expose that signal in the structured response for orchestration to automatically alert and initiate credential interception and rotation. Preserve the existing schema-only response requirement.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/pii-ingestion-gate/.gitignore`:
- Around line 3-5: Update the .gitignore environment-file rules to ignore all
.env variants recursively, including files such as apps/.env.production and
apps/.env.development, while explicitly unignoring the intended example
template. Preserve the existing local-environment exclusions.
In `@kits/pii-ingestion-gate/apps/actions/orchestrate.ts`:
- Line 3: Update the orchestration flow to import and use the parent kit’s
../../lamatic.config step definitions instead of duplicating flow configuration
through environment variables; revise the flow wiring in the action logic around
the affected lines while preserving the existing execution behavior.
- Around line 51-55: Prevent parsed audit reports from being rendered as raw
React children: in kits/pii-ingestion-gate/apps/actions/orchestrate.ts lines
51-55, preserve report as text or return a typed report shape; in
kits/pii-ingestion-gate/apps/app/page.tsx lines 306-313, serialize structured
reports before rendering. Use the existing data normalization flow and ensure
both string and structured report values render safely.
- Around line 72-97: Update the scanDocument and redactDocument server actions
to require authenticated authorization before invoking runFlow, and enforce
per-user or per-request rate limits using the project’s existing authorization
and throttling mechanisms. Reject unauthorized or rate-limited requests without
submitting document data, while preserving the existing flow IDs and action
result behavior for permitted requests.
In `@kits/pii-ingestion-gate/apps/app/globals.css`:
- Around line 8-10: Update the body styling in globals.css to define and consume
CSS custom properties for the background and text colors instead of using
hardcoded color values directly. Keep the existing visual colors unchanged while
moving them into reusable variables.
In `@kits/pii-ingestion-gate/apps/app/page.tsx`:
- Around line 396-398: The footer text in the page component makes an
unsupported claim about document storage. Update the footer to state only that
this app does not store document content locally, and add a link to the
applicable Lamatic/provider retention or privacy policy for downstream handling.
- Around line 100-247: The Home component’s document form must use the required
react-hook-form, Zod, and shadcn/ui stack instead of manual input state and
validation. In kits/pii-ingestion-gate/apps/app/page.tsx lines 100-247, define a
Zod schema, wire the Document and Policy fields through react-hook-form, display
schema validation through shadcn/ui form controls, and preserve the existing
run, sample-loading, tab, and error behavior. In
kits/pii-ingestion-gate/apps/package.json lines 11-28, add the required
react-hook-form and Zod dependencies.
- Around line 201-225: Associate the “Document” and “Policy” labels with their
controls by adding stable, unique IDs to the textarea and input and matching
those IDs through each label’s htmlFor attribute. Update only the field markup
around the document and policy controls, preserving existing behavior and
styling.
In `@kits/pii-ingestion-gate/apps/next.config.mjs`:
- Around line 3-4: Remove the ignoreBuildErrors and ignoreDuringBuilds settings
from the next.config.mjs TypeScript and ESLint configuration. In tsconfig.json,
enable strict checking and resolve all resulting type contract errors so both
build-time TypeScript and ESLint failures are enforced.
In `@kits/pii-ingestion-gate/apps/package.json`:
- Line 13: Update the lamatic dependency in apps/package.json from latest to a
reviewed fixed version or approved version range, keeping the dependency
declaration otherwise unchanged.
In `@kits/pii-ingestion-gate/constitutions/default.md`:
- Around line 53-54: Capitalize “Markdown” consistently in the specified
directives: update “markdown code fences” in
kits/pii-ingestion-gate/constitutions/default.md lines 53-54, “markdown fences”
in kits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_system.md
line 39, and “Plain markdown” in
kits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_system.md line
9 to use “Markdown”.
In `@kits/pii-ingestion-gate/flows/scan-document.ts`:
- Around line 64-66: Populate githubUrl, documentationUrl, and deployUrl in the
metadata for scan-document.ts (lines 64-66) and redact-document.ts (lines 61-63)
with the correct flow URLs before deployment.
In
`@kits/pii-ingestion-gate/model-configs/scan-document_detect-sensitive-data.ts`:
- Around line 11-13: Update the configName field in the scan-document
sensitive-data model configuration from the generic "configA" placeholder to a
descriptive unique name such as "detect-sensitive-data-config", while leaving
params and model_name unchanged.
In
`@kits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_system.md`:
- Line 9: Update the financial-data description in the prompt to replace “IBAN
numbers” with “IBANs,” while preserving the surrounding credit/debit card, bank
account, and salary references.
In `@kits/pii-ingestion-gate/README.md`:
- Around line 116-118: The quickstart documentation incorrectly sends blocked
results to Redact; update the sample flow in kits/pii-ingestion-gate/README.md
lines 116-118 and kits/pii-ingestion-gate/agent.md lines 60-62 to use a
needs_redaction verdict for redaction, or explicitly reject blocked results
before any sanitization. Keep both quickstarts consistent with the
blocked-document guardrail.
- Line 77: Update the opening fenced code block in the README to include an
explicit language label, preferably text, so the repository tree block satisfies
markdownlint MD040.
---
Outside diff comments:
In
`@kits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_system.md`:
- Around line 22-25: Update the redaction workflow around the safe_to_index and
notes output fields to establish the downstream live-credential protocol: ensure
notes clearly flag detected live API keys with actionable context, and expose
that signal in the structured response for orchestration to automatically alert
and initiate credential interception and rotation. Preserve the existing
schema-only response requirement.
In `@kits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_user.md`:
- Around line 1-4: Limit the size of the InstructorLLMNode_301.output payload
before it is interpolated into the audit-summary prompt. Add an upstream length
check or chunking strategy that keeps each downstream analysis request within
the model’s context window while preserving complete processing of oversized
scanned documents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: f7cc4072-1485-4573-9627-07fa4cb17e51
⛔ Files ignored due to path filters (1)
kits/pii-ingestion-gate/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (28)
kits/pii-ingestion-gate/.env.examplekits/pii-ingestion-gate/.gitignorekits/pii-ingestion-gate/README.mdkits/pii-ingestion-gate/agent.mdkits/pii-ingestion-gate/apps/.env.examplekits/pii-ingestion-gate/apps/.gitignorekits/pii-ingestion-gate/apps/actions/orchestrate.tskits/pii-ingestion-gate/apps/app/globals.csskits/pii-ingestion-gate/apps/app/layout.tsxkits/pii-ingestion-gate/apps/app/page.tsxkits/pii-ingestion-gate/apps/lib/lamatic-client.tskits/pii-ingestion-gate/apps/next.config.mjskits/pii-ingestion-gate/apps/package.jsonkits/pii-ingestion-gate/apps/postcss.config.mjskits/pii-ingestion-gate/apps/tsconfig.jsonkits/pii-ingestion-gate/constitutions/default.mdkits/pii-ingestion-gate/flows/redact-document.tskits/pii-ingestion-gate/flows/scan-document.tskits/pii-ingestion-gate/lamatic.config.tskits/pii-ingestion-gate/model-configs/redact-document_redact-sensitive-data.tskits/pii-ingestion-gate/model-configs/scan-document_detect-sensitive-data.tskits/pii-ingestion-gate/model-configs/scan-document_write-audit-summary.tskits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_system.mdkits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_user.mdkits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_system.mdkits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_user.mdkits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_system.mdkits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_user.md
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (3)
kits/pii-ingestion-gate/apps/actions/orchestrate.ts (2)
73-97: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftSecure the privileged flow actions before deployment.
Agent, we have an unsecured channel! Any operative can currently invoke these server actions using the project API key, allowing anonymous quota exhaustion and arbitrary PII submission. Your mission is to require authentication and enforce per-user/request rate limits before this intel gets into the wrong hands.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/pii-ingestion-gate/apps/actions/orchestrate.ts` around lines 73 - 97, Secure the scanDocument and redactDocument server actions by requiring an authenticated caller before invoking runFlow, and enforce the project’s existing per-user/request rate-limiting mechanism for each request. Reject unauthenticated or rate-limited calls without submitting the document, while preserving the current flow IDs, payloads, and ActionResult behavior for authorized requests.
73-97: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winMission directive: derive flow wiring from
../../lamatic.config.Agent, your mission, should you choose to accept it, is to import and use the parent kit’s
../../lamatic.configstep definitions instead of duplicating flow configuration through environment variables. This is a strict mission parameter from headquarters.As per coding guidelines, "Kit Next.js apps must import and use
../../lamatic.configto read step definitions from the parent kit."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/pii-ingestion-gate/apps/actions/orchestrate.ts` around lines 73 - 97, Update scanDocument and redactDocument to derive their flow definitions from the parent kit’s ../../lamatic.config instead of process.env flow IDs. Import the configuration and pass the corresponding configured step definitions into runFlow, removing the environment-variable wiring while preserving the existing document and policy inputs.Source: Coding guidelines
kits/pii-ingestion-gate/apps/app/page.tsx (1)
100-255: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy liftThe document form bypasses the required form/component stack.
Agent, headquarters requires standard-issue gear for this operation. The current form relies on makeshift state (
useState) instead of the officially sanctionedreact-hook-form,Zod, andshadcn/uicontrols.As per coding guidelines, kit apps must use "shadcn/ui components, react-hook-form + zod for forms". Please equip this form with the proper toolkit to complete the mission.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/pii-ingestion-gate/apps/app/page.tsx` around lines 100 - 255, The Home component’s document and policy form uses local useState and native controls instead of the required react-hook-form, Zod, and shadcn/ui stack. Define a Zod schema for the document and optional policy, initialize react-hook-form in Home, and replace the textarea, input, validation, and submit flow with the corresponding shadcn/ui Form, FormField, FormItem, FormLabel, FormControl, and FormMessage components while preserving scan/redact behavior and sample loading.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@kits/pii-ingestion-gate/apps/actions/orchestrate.ts`:
- Around line 73-97: Secure the scanDocument and redactDocument server actions
by requiring an authenticated caller before invoking runFlow, and enforce the
project’s existing per-user/request rate-limiting mechanism for each request.
Reject unauthenticated or rate-limited calls without submitting the document,
while preserving the current flow IDs, payloads, and ActionResult behavior for
authorized requests.
- Around line 73-97: Update scanDocument and redactDocument to derive their flow
definitions from the parent kit’s ../../lamatic.config instead of process.env
flow IDs. Import the configuration and pass the corresponding configured step
definitions into runFlow, removing the environment-variable wiring while
preserving the existing document and policy inputs.
In `@kits/pii-ingestion-gate/apps/app/page.tsx`:
- Around line 100-255: The Home component’s document and policy form uses local
useState and native controls instead of the required react-hook-form, Zod, and
shadcn/ui stack. Define a Zod schema for the document and optional policy,
initialize react-hook-form in Home, and replace the textarea, input, validation,
and submit flow with the corresponding shadcn/ui Form, FormField, FormItem,
FormLabel, FormControl, and FormMessage components while preserving scan/redact
behavior and sample loading.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: c7c3c31d-9c9d-405c-a51b-28166ab39c2d
⛔ Files ignored due to path filters (1)
kits/pii-ingestion-gate/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (14)
kits/pii-ingestion-gate/.gitignorekits/pii-ingestion-gate/README.mdkits/pii-ingestion-gate/agent.mdkits/pii-ingestion-gate/apps/.gitignorekits/pii-ingestion-gate/apps/actions/orchestrate.tskits/pii-ingestion-gate/apps/app/globals.csskits/pii-ingestion-gate/apps/app/page.tsxkits/pii-ingestion-gate/apps/package.jsonkits/pii-ingestion-gate/constitutions/default.mdkits/pii-ingestion-gate/flows/redact-document.tskits/pii-ingestion-gate/flows/scan-document.tskits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_system.mdkits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_system.mdkits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_system.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/pii-ingestion-gate/.env.example`:
- Around line 9-11: Update the GATE_ACCESS_CODE configuration and its handling
in assertAuthorized so production or public deployments fail closed instead of
allowing an unset code to bypass authorization. Require a non-empty access code
by default, while preserving an explicit configuration path for trusted private
environments that intentionally disable public access.
In `@kits/pii-ingestion-gate/apps/actions/orchestrate.ts`:
- Around line 21-47: The in-memory requestLog rate limiter is not shared or
durable across serverless instances. Update withinRateLimit and its requestLog
integration to use a centralized Redis-backed store, preserving the existing
clientKey-based sliding-window limits and allowing the required asynchronous
operations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: f2a57f3e-6ba8-4115-9b19-3218ded6ddef
⛔ Files ignored due to path filters (1)
kits/pii-ingestion-gate/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (19)
kits/pii-ingestion-gate/.env.examplekits/pii-ingestion-gate/README.mdkits/pii-ingestion-gate/agent.mdkits/pii-ingestion-gate/apps/.env.examplekits/pii-ingestion-gate/apps/actions/orchestrate.tskits/pii-ingestion-gate/apps/app/page.tsxkits/pii-ingestion-gate/apps/components/ui/button.tsxkits/pii-ingestion-gate/apps/components/ui/input.tsxkits/pii-ingestion-gate/apps/components/ui/label.tsxkits/pii-ingestion-gate/apps/components/ui/textarea.tsxkits/pii-ingestion-gate/apps/lib/utils.tskits/pii-ingestion-gate/apps/next.config.mjskits/pii-ingestion-gate/apps/package.jsonkits/pii-ingestion-gate/apps/tsconfig.jsonkits/pii-ingestion-gate/flows/redact-document.tskits/pii-ingestion-gate/flows/scan-document.tskits/pii-ingestion-gate/model-configs/redact-document_redact-sensitive-data.tskits/pii-ingestion-gate/model-configs/scan-document_detect-sensitive-data.tskits/pii-ingestion-gate/model-configs/scan-document_write-audit-summary.ts
💤 Files with no reviewable changes (1)
- kits/pii-ingestion-gate/apps/next.config.mjs
Author
|
@coderabbitai resolve |
Contributor
✅ Action performedComments resolved and changes approved. |
Contributor
|
Hi @Pavitra-programmers! 👋 Before this PR can be reviewed by maintainers, please resolve all comments and requested changes from the CodeRabbit automated review. Steps to follow:
This helps keep the review process efficient for everyone. Thank you! 🙏 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
1. Select Contribution Type
kits/<category>/<kit-name>/)bundles/<bundle-name>/)templates/<template-name>/)2. General Requirements
kebab-caseand matches the flow IDREADME.md(purpose, setup, usage)3. File Structure (Check what applies)
config.jsonpresent with valid metadata (name, description, tags, steps, author, env keys)flows/<flow-name>/(where applicable) include:config.json(Lamatic flow export)inputs.jsonmeta.jsonREADME.md.env.examplewith placeholder values only (kits only)config.jsonnode graphs (changes via Lamatic Studio export)4. Validation
npm install && npm run devworks locally (kits: UI runs; bundles/templates: flows are valid)[kit] Add <name> for <use case>)kits/pii-ingestion-gate/kit scaffold and kit docs:kits/pii-ingestion-gate/lamatic.config.ts(kit metadata + mandatory pipeline steps wiring deployed flow IDs)kits/pii-ingestion-gate/README.md(purpose, setup, usage, security constraints, verification/testing guidance)kits/pii-ingestion-gate/agent.md(agent/flow reference for scan + redact)kits/pii-ingestion-gate/constitutions/default.md(end-to-end privacy/security rules + output constraints)kits/pii-ingestion-gate/.env.example(Lamatic Studio/API + flow ID placeholders, optionalGATE_ACCESS_CODE)kits/pii-ingestion-gate/.gitignorekits/pii-ingestion-gate/flows/scan-document.ts(“scan-document”):triggerNode(graphqlNode “API Request”),dynamicNode(InstructorLLMNode “Detect Sensitive Data”, dynamicLLMNode“Write Audit Summary”),responseNode(graphqlResponseNode “API Response”)defaultEdgewiring trigger → instructor → LLM → response, plus trigger → response edge for response routing (responseNodeedge type){ analysis, report }with structured verdict/risk/findings + an audit markdown summary; sensitive raw values are never emitted (via strict JSON schema + prompts/constitution).kits/pii-ingestion-gate/flows/redact-document.ts(“redact-document”):triggerNode(graphqlNode “API Request”),dynamicNode(InstructorLLMNode “Redact Sensitive Data”),responseNode(graphqlResponseNode “API Response”)defaultEdgewiring trigger → instructor → response, plusresponseEdgefrom trigger to response node{ result }withredacted_document,safe_to_index, andredactions[]audit trail using typed placeholders.kits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_system.mdkits/pii-ingestion-gate/prompts/scan-document_detect-sensitive-data_user.mdkits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_system.mdkits/pii-ingestion-gate/prompts/scan-document_write-audit-summary_user.mdkits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_system.mdkits/pii-ingestion-gate/prompts/redact-document_redact-sensitive-data_user.mdkits/pii-ingestion-gate/model-configs/scan-document_detect-sensitive-data.tskits/pii-ingestion-gate/model-configs/scan-document_write-audit-summary.tskits/pii-ingestion-gate/model-configs/redact-document_redact-sensitive-data.tskits/pii-ingestion-gate/apps/package.jsonkits/pii-ingestion-gate/apps/package-lock.jsonkits/pii-ingestion-gate/apps/tsconfig.jsonkits/pii-ingestion-gate/apps/next.config.mjskits/pii-ingestion-gate/apps/postcss.config.mjskits/pii-ingestion-gate/apps/app/layout.tsx(metadata + root layout)kits/pii-ingestion-gate/apps/app/page.tsx(Scan/Redact UI; form validation + result rendering)kits/pii-ingestion-gate/apps/app/globals.csskits/pii-ingestion-gate/apps/actions/orchestrate.ts(server actionsscanDocument/redactDocument, sharedrunFlow, optional access-code authorization, input validation, rate limiting, SDK response normalization)kits/pii-ingestion-gate/apps/lib/lamatic-client.ts(cached Lamatic SDK client with env validation)kits/pii-ingestion-gate/apps/lib/utils.ts(cnutility)kits/pii-ingestion-gate/apps/.env.example+kits/pii-ingestion-gate/apps/.gitignorekits/pii-ingestion-gate/apps/components/ui/button.tsxkits/pii-ingestion-gate/apps/components/ui/input.tsxkits/pii-ingestion-gate/apps/components/ui/label.tsxkits/pii-ingestion-gate/apps/components/ui/textarea.tsx