libmongocrypt-helper 1.7.4.0.1002 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-find-range-payload-private.h

@@ -17,9 +17,9 @@
 #ifndef MC_FLE2_FIND_RANGE_PAYLOAD_PRIVATE_H
 #define MC_FLE2_FIND_RANGE_PAYLOAD_PRIVATE_H
 
-#include "mongocrypt.h"
-#include "mongocrypt-private.h"
 #include "mongocrypt-buffer-private.h"
+#include "mongocrypt-private.h"
+#include "mongocrypt.h"
 
 #include "mc-array-private.h"
 #include "mc-fle2-range-operator-private.h"
@@ -30,9 +30,9 @@
  * for the representation in the MongoDB server.
  */
 typedef struct {
-   mc_array_t edgeFindTokenSetArray;           // g
-   _mongocrypt_buffer_t serverEncryptionToken; // e
-   int64_t maxContentionCounter;               // cm
+    mc_array_t edgeFindTokenSetArray;           // g
+    _mongocrypt_buffer_t serverEncryptionToken; // e
+    int64_t maxContentionFactor;                // cm
 } mc_FLE2FindRangePayloadEdgesInfo_t;
 
 /**
@@ -49,47 +49,44 @@ typedef struct {
  * bson is a BSON document of this form:
  * g: array<EdgeFindTokenSet> // Array of Edges
  * e: <binary> // ServerDataEncryptionLevel1Token
- * cm: <int64> // Queryable Encryption max counter
+ * cm: <int64> // Queryable Encryption max contentionFactor
  */
 typedef struct {
-   struct {
-      mc_FLE2FindRangePayloadEdgesInfo_t value;
-      bool set;
-   } payload;
-   // payloadId Id of payload - must be paired with another payload.
-   int32_t payloadId;
-   // firstOperator represents the first query operator for which this payload
-   // was generated.
-   mc_FLE2RangeOperator_t firstOperator;
-   // secondOperator represents the second query operator for which this payload
-   // was generated. Only populated for two-sided ranges. It is 0 if unset.
-   mc_FLE2RangeOperator_t secondOperator;
+    struct {
+        mc_FLE2FindRangePayloadEdgesInfo_t value;
+        bool set;
+    } payload;
+
+    // payloadId Id of payload - must be paired with another payload.
+    int32_t payloadId;
+    // firstOperator represents the first query operator for which this payload
+    // was generated.
+    mc_FLE2RangeOperator_t firstOperator;
+    // secondOperator represents the second query operator for which this payload
+    // was generated. Only populated for two-sided ranges. It is 0 if unset.
+    mc_FLE2RangeOperator_t secondOperator;
 } mc_FLE2FindRangePayload_t;
 
 /**
  * EdgeFindTokenSet is the following BSON document:
- * d: <binary> // EDCDerivedFromDataTokenAndCounter
- * s: <binary> // ESCDerivedFromDataTokenAndCounter
- * c: <binary> // ECCDerivedFromDataTokenAndCounter
+ * d: <binary> // EDCDerivedFromDataTokenAndContentionFactor
+ * s: <binary> // ESCDerivedFromDataTokenAndContentionFactor
+ * c: <binary> // ECCDerivedFromDataTokenAndContentionFactor
  *
  * Instances of mc_EdgeFindTokenSet_t are expected to be owned by
  * mc_FLE2FindRangePayload_t and are freed in
  * mc_FLE2FindRangePayload_cleanup.
  */
 typedef struct {
-   _mongocrypt_buffer_t edcDerivedToken; // d
-   _mongocrypt_buffer_t escDerivedToken; // s
-   _mongocrypt_buffer_t eccDerivedToken; // c
+    _mongocrypt_buffer_t edcDerivedToken; // d
+    _mongocrypt_buffer_t escDerivedToken; // s
+    _mongocrypt_buffer_t eccDerivedToken; // c
 } mc_EdgeFindTokenSet_t;
 
-void
-mc_FLE2FindRangePayload_init (mc_FLE2FindRangePayload_t *payload);
+void mc_FLE2FindRangePayload_init(mc_FLE2FindRangePayload_t *payload);
 
-bool
-mc_FLE2FindRangePayload_serialize (const mc_FLE2FindRangePayload_t *payload,
-                                   bson_t *out);
+bool mc_FLE2FindRangePayload_serialize(const mc_FLE2FindRangePayload_t *payload, bson_t *out);
 
-void
-mc_FLE2FindRangePayload_cleanup (mc_FLE2FindRangePayload_t *payload);
+void mc_FLE2FindRangePayload_cleanup(mc_FLE2FindRangePayload_t *payload);
 
 #endif /* MC_FLE2_FIND_RANGE_PAYLOAD_PRIVATE_H */

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-find-range-payload-v2.c

@@ -0,0 +1,173 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <bson/bson.h>
+
+#include "mc-fle2-find-range-payload-private-v2.h"
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt.h"
+
+void mc_FLE2FindRangePayloadV2_init(mc_FLE2FindRangePayloadV2_t *payload) {
+    BSON_ASSERT_PARAM(payload);
+    *payload = (mc_FLE2FindRangePayloadV2_t){{{{0}}}};
+    _mc_array_init(&payload->payload.value.edgeFindTokenSetArray, sizeof(mc_EdgeFindTokenSetV2_t));
+}
+
+static void mc_EdgeFindTokenSetV2_cleanup(mc_EdgeFindTokenSetV2_t *etc) {
+    if (!etc) {
+        return;
+    }
+    _mongocrypt_buffer_cleanup(&etc->edcDerivedToken);
+    _mongocrypt_buffer_cleanup(&etc->escDerivedToken);
+    _mongocrypt_buffer_cleanup(&etc->serverDerivedFromDataToken);
+}
+
+void mc_FLE2FindRangePayloadV2_cleanup(mc_FLE2FindRangePayloadV2_t *payload) {
+    if (!payload) {
+        return;
+    }
+    // Free all EdgeFindTokenSet entries.
+    for (size_t i = 0; i < payload->payload.value.edgeFindTokenSetArray.len; i++) {
+        mc_EdgeFindTokenSetV2_t entry =
+            _mc_array_index(&payload->payload.value.edgeFindTokenSetArray, mc_EdgeFindTokenSetV2_t, i);
+        mc_EdgeFindTokenSetV2_cleanup(&entry);
+    }
+    _mc_array_destroy(&payload->payload.value.edgeFindTokenSetArray);
+}
+
+#define APPEND_BINDATA(out, name, value)                                                                               \
+    if (!_mongocrypt_buffer_append(&(value), out, name, -1)) {                                                         \
+        return false;                                                                                                  \
+    }
+
+bool mc_FLE2FindRangePayloadV2_serialize(const mc_FLE2FindRangePayloadV2_t *payload, bson_t *out, bool use_range_v2) {
+    BSON_ASSERT_PARAM(out);
+    BSON_ASSERT_PARAM(payload);
+
+    // Append "payload" if this is not a stub.
+    if (payload->payload.set) {
+        bson_t payload_bson;
+
+        if (!BSON_APPEND_DOCUMENT_BEGIN(out, "payload", &payload_bson)) {
+            return false;
+        }
+        // Append "payload.g" array of EdgeTokenSets.
+        bson_t g_bson;
+        if (!BSON_APPEND_ARRAY_BEGIN(&payload_bson, "g", &g_bson)) {
+            return false;
+        }
+
+        uint32_t g_index = 0;
+        for (size_t i = 0; i < payload->payload.value.edgeFindTokenSetArray.len; i++) {
+            mc_EdgeFindTokenSetV2_t etc =
+                _mc_array_index(&payload->payload.value.edgeFindTokenSetArray, mc_EdgeFindTokenSetV2_t, i);
+            bson_t etc_bson;
+
+            const char *g_index_string;
+            char storage[16];
+            bson_uint32_to_string(g_index, &g_index_string, storage, sizeof(storage));
+
+            if (!BSON_APPEND_DOCUMENT_BEGIN(&g_bson, g_index_string, &etc_bson)) {
+                return false;
+            }
+
+            etc.edcDerivedToken.subtype = BSON_SUBTYPE_BINARY;
+            etc.escDerivedToken.subtype = BSON_SUBTYPE_BINARY;
+            etc.serverDerivedFromDataToken.subtype = BSON_SUBTYPE_BINARY;
+
+            APPEND_BINDATA(&etc_bson, "d", etc.edcDerivedToken);
+            APPEND_BINDATA(&etc_bson, "s", etc.escDerivedToken);
+            APPEND_BINDATA(&etc_bson, "l", etc.serverDerivedFromDataToken);
+
+            if (!bson_append_document_end(&g_bson, &etc_bson)) {
+                return false;
+            }
+            if (g_index == UINT32_MAX) {
+                break;
+            }
+            g_index++;
+        }
+
+        if (!bson_append_array_end(&payload_bson, &g_bson)) {
+            return false;
+        }
+
+        // Append "payload.cm".
+        if (!BSON_APPEND_INT64(&payload_bson, "cm", payload->payload.value.maxContentionFactor)) {
+            return false;
+        }
+
+        if (!bson_append_document_end(out, &payload_bson)) {
+            return false;
+        }
+    }
+
+    // Append "payloadId"
+    if (!BSON_APPEND_INT32(out, "payloadId", payload->payloadId)) {
+        return false;
+    }
+
+    // Append "firstOperator".
+    if (!BSON_APPEND_INT32(out, "firstOperator", payload->firstOperator)) {
+        return false;
+    }
+
+    // Append "secondOperator" if present.
+    if (payload->secondOperator != FLE2RangeOperator_kNone
+        && !BSON_APPEND_INT32(out, "secondOperator", payload->secondOperator)) {
+        return false;
+    }
+
+    if (use_range_v2) {
+        // Encode parameters that were used to generate the mincover.
+        // The crypto parameters are all optionally set. Find payloads may come in pairs (a lower and upper bound).
+        // One of the pair includes the mincover. The other payload was not generated with crypto parameters.
+
+        if (payload->sparsity.set) {
+            if (!BSON_APPEND_INT64(out, "sp", payload->sparsity.value)) {
+                return false;
+            }
+        }
+
+        if (payload->precision.set) {
+            if (!BSON_APPEND_INT32(out, "pn", payload->precision.value)) {
+                return false;
+            }
+        }
+
+        if (payload->trimFactor.set) {
+            if (!BSON_APPEND_INT32(out, "tf", payload->trimFactor.value)) {
+                return false;
+            }
+        }
+
+        if (payload->indexMin.value_type != BSON_TYPE_EOD) {
+            if (!BSON_APPEND_VALUE(out, "mn", &payload->indexMin)) {
+                return false;
+            }
+        }
+
+        if (payload->indexMax.value_type != BSON_TYPE_EOD) {
+            if (!BSON_APPEND_VALUE(out, "mx", &payload->indexMax)) {
+                return false;
+            }
+        }
+    }
+
+    return true;
+}
+
+#undef APPEND_BINDATA

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-find-range-payload.c

@@ -17,142 +17,123 @@
 #include <bson/bson.h>
 
 #include "mc-fle2-find-range-payload-private.h"
-#include "mongocrypt.h"
 #include "mongocrypt-buffer-private.h"
+#include "mongocrypt.h"
 
-void
-mc_FLE2FindRangePayload_init (mc_FLE2FindRangePayload_t *payload)
-{
-   BSON_ASSERT_PARAM (payload);
-   *payload = (mc_FLE2FindRangePayload_t){{{{0}}}};
-   _mc_array_init (&payload->payload.value.edgeFindTokenSetArray,
-                   sizeof (mc_EdgeFindTokenSet_t));
+void mc_FLE2FindRangePayload_init(mc_FLE2FindRangePayload_t *payload) {
+    BSON_ASSERT_PARAM(payload);
+    *payload = (mc_FLE2FindRangePayload_t){{{{0}}}};
+    _mc_array_init(&payload->payload.value.edgeFindTokenSetArray, sizeof(mc_EdgeFindTokenSet_t));
 }
 
-static void
-mc_EdgeFindTokenSet_cleanup (mc_EdgeFindTokenSet_t *etc)
-{
-   if (!etc) {
-      return;
-   }
-   _mongocrypt_buffer_cleanup (&etc->edcDerivedToken);
-   _mongocrypt_buffer_cleanup (&etc->escDerivedToken);
-   _mongocrypt_buffer_cleanup (&etc->eccDerivedToken);
+static void mc_EdgeFindTokenSet_cleanup(mc_EdgeFindTokenSet_t *etc) {
+    if (!etc) {
+        return;
+    }
+    _mongocrypt_buffer_cleanup(&etc->edcDerivedToken);
+    _mongocrypt_buffer_cleanup(&etc->escDerivedToken);
+    _mongocrypt_buffer_cleanup(&etc->eccDerivedToken);
 }
 
-void
-mc_FLE2FindRangePayload_cleanup (mc_FLE2FindRangePayload_t *payload)
-{
-   if (!payload) {
-      return;
-   }
-   _mongocrypt_buffer_cleanup (&payload->payload.value.serverEncryptionToken);
-   // Free all EdgeFindTokenSet entries.
-   for (size_t i = 0; i < payload->payload.value.edgeFindTokenSetArray.len;
-        i++) {
-      mc_EdgeFindTokenSet_t entry =
-         _mc_array_index (&payload->payload.value.edgeFindTokenSetArray,
-                          mc_EdgeFindTokenSet_t,
-                          i);
-      mc_EdgeFindTokenSet_cleanup (&entry);
-   }
-   _mc_array_destroy (&payload->payload.value.edgeFindTokenSetArray);
+void mc_FLE2FindRangePayload_cleanup(mc_FLE2FindRangePayload_t *payload) {
+    if (!payload) {
+        return;
+    }
+    _mongocrypt_buffer_cleanup(&payload->payload.value.serverEncryptionToken);
+    // Free all EdgeFindTokenSet entries.
+    for (size_t i = 0; i < payload->payload.value.edgeFindTokenSetArray.len; i++) {
+        mc_EdgeFindTokenSet_t entry =
+            _mc_array_index(&payload->payload.value.edgeFindTokenSetArray, mc_EdgeFindTokenSet_t, i);
+        mc_EdgeFindTokenSet_cleanup(&entry);
+    }
+    _mc_array_destroy(&payload->payload.value.edgeFindTokenSetArray);
 }
 
-#define APPEND_BINDATA(out, name, subtype, value)              \
-   if (!_mongocrypt_buffer_append (&(value), out, name, -1)) { \
-      return false;                                            \
-   }
-
-bool
-mc_FLE2FindRangePayload_serialize (const mc_FLE2FindRangePayload_t *payload,
-                                   bson_t *out)
-{
-   BSON_ASSERT_PARAM (out);
-   BSON_ASSERT_PARAM (payload);
-
-   // Append "payload" if this is not a stub.
-   if (payload->payload.set) {
-      bson_t payload_bson;
-
-      if (!BSON_APPEND_DOCUMENT_BEGIN (out, "payload", &payload_bson)) {
-         return false;
-      }
-      // Append "payload.g" array of EdgeTokenSets.
-      bson_t g_bson;
-      if (!BSON_APPEND_ARRAY_BEGIN (&payload_bson, "g", &g_bson)) {
-         return false;
-      }
-
-      uint32_t g_index = 0;
-      for (size_t i = 0; i < payload->payload.value.edgeFindTokenSetArray.len;
-           i++) {
-         mc_EdgeFindTokenSet_t etc =
-            _mc_array_index (&payload->payload.value.edgeFindTokenSetArray,
-                             mc_EdgeFindTokenSet_t,
-                             i);
-         bson_t etc_bson;
-
-         const char *g_index_string;
-         char storage[16];
-         bson_uint32_to_string (
-            g_index, &g_index_string, storage, sizeof (storage));
-
-         if (!BSON_APPEND_DOCUMENT_BEGIN (&g_bson, g_index_string, &etc_bson)) {
+#define APPEND_BINDATA(out, name, value)                                                                               \
+    if (!_mongocrypt_buffer_append(&(value), out, name, -1)) {                                                         \
+        return false;                                                                                                  \
+    }
+
+bool mc_FLE2FindRangePayload_serialize(const mc_FLE2FindRangePayload_t *payload, bson_t *out) {
+    BSON_ASSERT_PARAM(out);
+    BSON_ASSERT_PARAM(payload);
+
+    // Append "payload" if this is not a stub.
+    if (payload->payload.set) {
+        bson_t payload_bson;
+
+        if (!BSON_APPEND_DOCUMENT_BEGIN(out, "payload", &payload_bson)) {
             return false;
-         }
+        }
+        // Append "payload.g" array of EdgeTokenSets.
+        bson_t g_bson;
+        if (!BSON_APPEND_ARRAY_BEGIN(&payload_bson, "g", &g_bson)) {
+            return false;
+        }
+
+        uint32_t g_index = 0;
+        for (size_t i = 0; i < payload->payload.value.edgeFindTokenSetArray.len; i++) {
+            mc_EdgeFindTokenSet_t etc =
+                _mc_array_index(&payload->payload.value.edgeFindTokenSetArray, mc_EdgeFindTokenSet_t, i);
+            bson_t etc_bson;
+
+            const char *g_index_string;
+            char storage[16];
+            bson_uint32_to_string(g_index, &g_index_string, storage, sizeof(storage));
+
+            if (!BSON_APPEND_DOCUMENT_BEGIN(&g_bson, g_index_string, &etc_bson)) {
+                return false;
+            }
+
+            etc.edcDerivedToken.subtype = BSON_SUBTYPE_BINARY;
+            etc.escDerivedToken.subtype = BSON_SUBTYPE_BINARY;
+            etc.eccDerivedToken.subtype = BSON_SUBTYPE_BINARY;
+
+            APPEND_BINDATA(&etc_bson, "d", etc.edcDerivedToken);
+            APPEND_BINDATA(&etc_bson, "s", etc.escDerivedToken);
+            APPEND_BINDATA(&etc_bson, "c", etc.eccDerivedToken);
+
+            if (!bson_append_document_end(&g_bson, &etc_bson)) {
+                return false;
+            }
+            if (g_index == UINT32_MAX) {
+                break;
+            }
+            g_index++;
+        }
+
+        if (!bson_append_array_end(&payload_bson, &g_bson)) {
+            return false;
+        }
 
-         APPEND_BINDATA (
-            &etc_bson, "d", BSON_SUBTYPE_BINARY, etc.edcDerivedToken);
-         APPEND_BINDATA (
-            &etc_bson, "s", BSON_SUBTYPE_BINARY, etc.escDerivedToken);
-         APPEND_BINDATA (
-            &etc_bson, "c", BSON_SUBTYPE_BINARY, etc.eccDerivedToken);
+        // Append "payload.e" and "payload.cm".
+        APPEND_BINDATA(&payload_bson, "e", payload->payload.value.serverEncryptionToken);
+        if (!BSON_APPEND_INT64(&payload_bson, "cm", payload->payload.value.maxContentionFactor)) {
+            return false;
+        }
 
-         if (!bson_append_document_end (&g_bson, &etc_bson)) {
+        if (!bson_append_document_end(out, &payload_bson)) {
             return false;
-         }
-         if (g_index == UINT32_MAX)
-            break;
-         g_index++;
-      }
-
-      if (!bson_append_array_end (&payload_bson, &g_bson)) {
-         return false;
-      }
-
-      // Append "payload.e" and "payload.cm".
-      APPEND_BINDATA (&payload_bson,
-                      "e",
-                      BSON_SUBTYPE_BINARY,
-                      payload->payload.value.serverEncryptionToken);
-      if (!BSON_APPEND_INT64 (&payload_bson,
-                              "cm",
-                              payload->payload.value.maxContentionCounter)) {
-         return false;
-      }
-
-      if (!bson_append_document_end (out, &payload_bson)) {
-         return false;
-      }
-   }
-
-   // Append "payloadId"
-   if (!BSON_APPEND_INT32 (out, "payloadId", payload->payloadId)) {
-      return false;
-   }
-
-   // Append "firstOperator".
-   if (!BSON_APPEND_INT32 (out, "firstOperator", payload->firstOperator)) {
-      return false;
-   }
-
-   // Append "secondOperator" if present.
-   if (payload->secondOperator != FLE2RangeOperator_kNone &&
-       !BSON_APPEND_INT32 (out, "secondOperator", payload->secondOperator)) {
-      return false;
-   }
-
-   return true;
+        }
+    }
+
+    // Append "payloadId"
+    if (!BSON_APPEND_INT32(out, "payloadId", payload->payloadId)) {
+        return false;
+    }
+
+    // Append "firstOperator".
+    if (!BSON_APPEND_INT32(out, "firstOperator", payload->firstOperator)) {
+        return false;
+    }
+
+    // Append "secondOperator" if present.
+    if (payload->secondOperator != FLE2RangeOperator_kNone
+        && !BSON_APPEND_INT32(out, "secondOperator", payload->secondOperator)) {
+        return false;
+    }
+
+    return true;
 }
+
 #undef APPEND_BINDATA

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-insert-update-payload-private-v2.h

@@ -0,0 +1,130 @@
+/*
+ * Copyright 2022-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MC_FLE2_INSERT_UPDATE_PAYLOAD_PRIVATE_V2_H
+#define MC_FLE2_INSERT_UPDATE_PAYLOAD_PRIVATE_V2_H
+
+#include <bson/bson.h>
+
+#include "mc-array-private.h"
+#include "mc-optional-private.h"
+#include "mongocrypt-buffer-private.h"
+#include "mongocrypt-private.h"
+#include "mongocrypt.h"
+
+/**
+ * FLE2InsertUpdatePayloadV2 represents an FLE2 payload of an indexed field to
+ * insert or update. It is created client side.
+ *
+ * FLE2InsertUpdatePayloadV2 has the following data layout:
+ *
+ * struct {
+ *   uint8_t fle_blob_subtype = 11;
+ *   uint8_t bson[];
+ * } FLE2InsertUpdatePayloadV2;
+ *
+ * bson is a BSON document of this form:
+ * d: <binary> // EDCDerivedFromDataTokenAndContentionFactor
+ * s: <binary> // ESCDerivedFromDataTokenAndContentionFactor
+ * p: <binary> // Encrypted Tokens
+ * u: <UUID>   // Index KeyId
+ * t: <int32>  // Encrypted type
+ * v: <binary> // Encrypted value
+ * e: <binary> // ServerDataEncryptionLevel1Token
+ * l: <binary> // ServerDerivedFromDataToken
+ * k: <int64> // Randomly sampled contention factor value
+ * g: array<EdgeTokenSetV2> // Array of Edges. Only included for range payloads.
+ * sp: optional<int64> // Sparsity. Only included for range payloads.
+ * pn: optional<int32> // Precision. Only included for range payloads.
+ * tf: optional<int32> // Trim Factor. Only included for range payloads.
+ * mn: optional<any> // Index Min. Only included for range payloads.
+ * mx: optional<any> // Index Max. Only included for range payloads.
+ *
+ * p is the result of:
+ * Encrypt(
+ * key=ECOCToken,
+ * plaintext=(
+ *    ESCDerivedFromDataTokenAndContentionFactor)
+ * )
+ *
+ * v is the result of:
+ * UserKeyId || EncryptAEAD(
+ *    key=UserKey,
+ *    plaintext=value
+ *    associated_data=UserKeyId)
+ */
+
+typedef struct {
+    _mongocrypt_buffer_t edcDerivedToken;            // d
+    _mongocrypt_buffer_t escDerivedToken;            // s
+    _mongocrypt_buffer_t encryptedTokens;            // p
+    _mongocrypt_buffer_t indexKeyId;                 // u
+    bson_type_t valueType;                           // t
+    _mongocrypt_buffer_t value;                      // v
+    _mongocrypt_buffer_t serverEncryptionToken;      // e
+    _mongocrypt_buffer_t serverDerivedFromDataToken; // l
+    int64_t contentionFactor;                        // k
+    mc_array_t edgeTokenSetArray;                    // g
+    mc_optional_int64_t sparsity;                    // sp
+    mc_optional_int32_t precision;                   // pn
+    mc_optional_int32_t trimFactor;                  // tf
+    bson_value_t indexMin;                           // mn
+    bson_value_t indexMax;                           // mx
+    _mongocrypt_buffer_t plaintext;
+    _mongocrypt_buffer_t userKeyId;
+} mc_FLE2InsertUpdatePayloadV2_t;
+
+/**
+ * EdgeTokenSetV2 is the following BSON document:
+ * d: <binary> // EDCDerivedFromDataTokenAndContentionFactor
+ * s: <binary> // ESCDerivedFromDataTokenAndContentionFactor
+ * l: <binary> // ServerDerivedFromDataToken
+ * p: <binary> // Encrypted Tokens
+ *
+ * Instances of mc_EdgeTokenSetV2_t are expected to be owned by
+ * mc_FLE2InsertUpdatePayloadV2_t and are freed in
+ * mc_FLE2InsertUpdatePayloadV2_cleanup.
+ */
+typedef struct {
+    _mongocrypt_buffer_t edcDerivedToken;            // d
+    _mongocrypt_buffer_t escDerivedToken;            // s
+    _mongocrypt_buffer_t serverDerivedFromDataToken; // l
+    _mongocrypt_buffer_t encryptedTokens;            // p
+} mc_EdgeTokenSetV2_t;
+
+void mc_FLE2InsertUpdatePayloadV2_init(mc_FLE2InsertUpdatePayloadV2_t *payload);
+
+bool mc_FLE2InsertUpdatePayloadV2_parse(mc_FLE2InsertUpdatePayloadV2_t *out,
+                                        const _mongocrypt_buffer_t *in,
+                                        mongocrypt_status_t *status);
+
+/* mc_FLE2InsertUpdatePayloadV2_decrypt decrypts ciphertext.
+ * Returns NULL and sets @status on error. It is an error to call before
+ * mc_FLE2InsertUpdatePayloadV2_parse. */
+const _mongocrypt_buffer_t *mc_FLE2InsertUpdatePayloadV2_decrypt(_mongocrypt_crypto_t *crypto,
+                                                                 mc_FLE2InsertUpdatePayloadV2_t *iup,
+                                                                 const _mongocrypt_buffer_t *user_key,
+                                                                 mongocrypt_status_t *status);
+
+bool mc_FLE2InsertUpdatePayloadV2_serialize(const mc_FLE2InsertUpdatePayloadV2_t *payload, bson_t *out);
+
+bool mc_FLE2InsertUpdatePayloadV2_serializeForRange(const mc_FLE2InsertUpdatePayloadV2_t *payload,
+                                                    bson_t *out,
+                                                    bool use_range_v2);
+
+void mc_FLE2InsertUpdatePayloadV2_cleanup(mc_FLE2InsertUpdatePayloadV2_t *payload);
+
+#endif /* MC_FLE2_INSERT_UPDATE_PAYLOAD_PRIVATE_V2_H */