@anteros/core 0.0.33 → 0.0.34

package/tests/crypto.test.ts

@@ -1,5 +1,7 @@
-import { describe, it, expect } from "bun:test";
-import { useSymCrypt, useAsymCrypt } from "../utils/crypto";
+import { describe, it, expect, afterAll } from "bun:test";
+import { useSymCrypt, useAsymCrypt, resolve } from "../utils/crypto";
+import { cfg, formatConfig } from "../server/config";
+import utils from "../utils";
 
 describe("crypto — symmetric AES-256-GCM", () => {
     it("round-trips a string", async () => {
@@ -57,6 +59,191 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const c = useSymCrypt({ secret: "s" });
         await expect(c.decrypt("YWJjZA==")).rejects.toThrow();
     });
+
+    it("decrypt(cipher, true, fields) decrypts the listed sub-fields inside the JSON", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        // json contenant des sous-champs chiffrés (convention field-level : JSON.stringify)
+        const encZip = await c.encrypt(JSON.stringify("75000"));
+        const encPhone = await c.encrypt(JSON.stringify("0600000000"));
+        const container = await c.encrypt({ city: "Paris", zip: encZip, contact: { phone: encPhone } });
+
+        const dec = await c.decrypt<any>(container, true, ["zip", "contact.phone"]);
+        expect(dec.city).toBe("Paris");
+        expect(dec.zip).toBe("75000");
+        expect(dec.contact.phone).toBe("0600000000");
+
+        // sans les champs → sous-champs toujours chiffrés
+        const raw = await c.decrypt<any>(container, true);
+        expect(raw.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(raw.city).toBe("Paris");
+    });
+
+    it("decrypt(jsonObject, true, fields) decrypts sub-fields of a plaintext json container", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const encZip = await c.encrypt(JSON.stringify("69001"));
+        const json = { street: "Rue X", zip: encZip, tags: [{ code: encZip }] };
+
+        const dec = await c.decrypt<any>(json, true, ["zip", "tags.0.code"]);
+        expect(dec.street).toBe("Rue X");
+        expect(dec.zip).toBe("69001");
+        expect(dec.tags[0].code).toBe("69001");
+    });
+
+    it("decrypt(..., fields) keeps non-ciphertext values as-is", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const json = { city: "Paris", note: "plain text", zip: await c.encrypt(JSON.stringify("75000")) };
+        const dec = await c.decrypt<any>(json, true, ["zip", "note", "missing"]);
+        expect(dec.city).toBe("Paris");
+        expect(dec.note).toBe("plain text"); // pas un ciphertext → inchangé
+        expect(dec.zip).toBe("75000");
+    });
+
+    it("decrypt handles an ARRAY of json objects with encrypted fields", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const encZip = await c.encrypt(JSON.stringify("69001"));
+        const encOther = await c.encrypt(JSON.stringify("69002"));
+
+        // array conteneur direct (ex: doc.addresses renvoyé par une requête)
+        const arr = [
+            { city: "Lyon", zip: encZip },
+            { city: "Villeurbanne", zip: encOther },
+        ];
+        const dec = await c.decrypt<any>(arr, true, ["zip"]);
+        expect(dec[0].zip).toBe("69001");
+        expect(dec[1].zip).toBe("69002");
+        expect(dec[0].city).toBe("Lyon"); // non-chiffré conservé
+        expect(dec).not.toBe(arr); // copie, pas de mutation
+        expect(arr[0]!.zip).toMatch(/^[A-Za-z0-9+/=]+$/); // input intact
+
+        // ciphertext dont le plaintext est un array de json
+        const encContainer = await c.encrypt([{ zip: encZip }, { zip: encOther }]);
+        const dec2 = await c.decrypt<any>(encContainer, true, ["zip"]);
+        expect(dec2[0].zip).toBe("69001");
+        expect(dec2[1].zip).toBe("69002");
+    });
+});
+
+describe("crypto — key rotation (versioned secrets)", () => {
+    it("decrypts old ciphertexts after rotating the secret", async () => {
+        const old = useSymCrypt({ secret: "v1-secret" }); // version 1 par défaut
+        const enc = await old.encrypt({ apiKey: "sk-rot" });
+
+        // Rotation : nouvelle clé active v2, l'ancienne conservée en decrypt-only
+        const rotated = useSymCrypt({ secret: "v2-secret", version: 2, previousSecrets: { 1: "v1-secret" } });
+        const dec = await rotated.decrypt<{ apiKey: string }>(enc, true);
+        expect(dec.apiKey).toBe("sk-rot");
+    });
+
+    it("tags new ciphertexts with the active version", async () => {
+        const c = useSymCrypt({ secret: "s", version: 2 });
+        const enc = await c.encrypt("data");
+        const buf = Buffer.from(enc, "base64");
+        expect(buf[0]).toBe(2);
+        // round-trip avec la même instance
+        const dec = await c.decrypt(enc);
+        expect(dec).toBe("data");
+    });
+
+    it("still decrypts legacy ciphertexts (no version byte)", async () => {
+        const c = useSymCrypt({ secret: "s" });
+        const enc = await c.encrypt("legacy");
+        // Simule un ciphertext produit AVANT la rotation (format sans octet de version)
+        const legacy = Buffer.from(Buffer.from(enc, "base64").subarray(1)).toString("base64");
+        const dec = await c.decrypt(legacy);
+        expect(dec).toBe("legacy");
+    });
+
+    it("the old secret cannot decrypt data encrypted with the new key", async () => {
+        const c = useSymCrypt({ secret: "v2", version: 2, previousSecrets: { 1: "v1" } });
+        const enc = await c.encrypt("new-data");
+        const old = useSymCrypt({ secret: "v1" });
+        await expect(old.decrypt(enc)).rejects.toThrow();
+    });
+
+    it("binds ciphertexts to the config default AAD when none is passed", async () => {
+        const c = useSymCrypt({ secret: "s", aad: "myapp:prod" });
+        const enc = await c.encrypt({ apiKey: "sk-aad" });
+
+        // même instance → OK (défaut appliqué au decrypt aussi)
+        const dec = await c.decrypt<{ apiKey: string }>(enc, true);
+        expect(dec.apiKey).toBe("sk-aad");
+
+        // sans l'AAD config → échec (tag invalide)
+        const other = useSymCrypt({ secret: "s" });
+        await expect(other.decrypt(enc, true)).rejects.toThrow();
+    });
+
+    it("explicit AAD wins over the config default", async () => {
+        const c = useSymCrypt({ secret: "s", aad: "default:ctx" });
+        const enc = await c.encrypt("x", "explicit:ctx");
+        const dec = await c.decrypt(enc, false, "explicit:ctx");
+        expect(dec).toBe("x");
+        // le défaut ne déchiffre pas le chiffré lié à l'explicite
+        await expect(c.decrypt(enc, false, "default:ctx")).rejects.toThrow();
+    });
+
+    it("legacy ciphertexts (no AAD) still decrypt after a default AAD is configured", async () => {
+        const legacy = useSymCrypt({ secret: "s" }); // chiffré SANS AAD (ancien comportement)
+        const enc = await legacy.encrypt("old-data");
+
+        const c = useSymCrypt({ secret: "s", aad: "myapp:prod" }); // config avec AAD par défaut
+        const dec = await c.decrypt(enc);
+        expect(dec).toBe("old-data");
+    });
+});
+
+describe("crypto — encryption mode (server.encryption.mode)", () => {
+    afterAll(() => {
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000 }, tenants: [] });
+    });
+
+    it("boot validation: symmetric mode requires a secret", () => {
+        delete (cfg.server as any).encryption;
+        expect(() => formatConfig({
+            server: { port: 4000, encryption: { mode: "symmetric" } },
+            tenants: [],
+        })).toThrow(/symmetric.*requires a secret/);
+    });
+
+    it("boot validation: asymmetric mode requires a privateKey", () => {
+        delete (cfg.server as any).encryption;
+        expect(() => formatConfig({
+            server: { port: 4000, encryption: { mode: "asymmetric" } },
+            tenants: [],
+        })).toThrow(/asymmetric.*requires a privateKey/);
+    });
+
+    it("useSymCrypt() without explicit secret rejects an asymmetric mode", () => {
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000, encryption: { mode: "asymmetric", privateKey: {} as any } }, tenants: [] });
+        expect(() => useSymCrypt()).toThrow(/mode is 'asymmetric'/);
+    });
+
+    it("resolve() returns the instance matching the configured mode", async () => {
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000 }, tenants: [] });
+        const priv = await useAsymCrypt().exportPrivateKey(); // pair fraîche, pas de mode config
+
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000, encryption: { mode: "symmetric", secret: "cfg" } }, tenants: [] });
+        const sym = resolve();
+        const enc = await sym.encrypt({ a: 1 });
+        expect((await sym.decrypt<{ a: number }>(enc, true)).a).toBe(1);
+
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000, encryption: { mode: "asymmetric", privateKey: priv } }, tenants: [] });
+        const asym = resolve();
+        const enc2 = await asym.encrypt("hi");
+        const dec2 = await asym.decrypt(enc2);
+        expect(dec2).toBe("hi");
+    });
+
+    it("resolve() throws when mode is missing", () => {
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000 }, tenants: [] });
+        expect(() => resolve()).toThrow(/mode is required/);
+    });
 });
 
 describe("crypto — asymmetric RSA-OAEP envelope", () => {
@@ -98,4 +285,77 @@ describe("crypto — asymmetric RSA-OAEP envelope", () => {
         // Missing context → rejected
         await expect(a.decrypt(enc, true)).rejects.toThrow();
     });
+
+    it("decrypt(cipher, true, fields) decrypts listed sub-fields (asym)", async () => {
+        const a = useAsymCrypt();
+        const encZip = await a.encrypt(JSON.stringify("75000"));
+        const container = await a.encrypt({ city: "Paris", zip: encZip });
+
+        const dec = await a.decrypt<any>(container, true, ["zip"]);
+        expect(dec.city).toBe("Paris");
+        expect(dec.zip).toBe("75000");
+    });
+});
+
+describe("crypto — public surface", () => {
+    it("is exposed via utils.crypt (not a top-level crypto export)", async () => {
+        expect(typeof utils.crypt.useSymCrypt).toBe("function");
+        expect(typeof utils.crypt.useAsymCrypt).toBe("function");
+        expect(typeof utils.crypt.resolve).toBe("function");
+        const top: any = await import("../index");
+        expect(top.crypto).toBeUndefined();
+    });
+});
+
+describe("crypto — server config defaults (server.encryption)", () => {
+    afterAll(() => {
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000 }, tenants: [] });
+    });
+
+    it("useSymCrypt() without args uses server.encryption.secret", async () => {
+        formatConfig({
+            server: { port: 4000, encryption: { mode: "symmetric", secret: "cfg-secret" } },
+            tenants: [],
+        });
+        const c = useSymCrypt();
+        const enc = await c.encrypt({ apiKey: "sk-x" });
+        const dec = await c.decrypt<{ apiKey: string }>(enc, true);
+        expect(dec.apiKey).toBe("sk-x");
+    });
+
+    it("useSymCrypt() throws a clear error when no secret is available", () => {
+        delete (cfg.server as any).encryption; // formatConfig merges — reset explicit
+        formatConfig({ server: { port: 4000 }, tenants: [] });
+        delete Bun.env.APP_SECRET;
+        expect(() => useSymCrypt()).toThrow(/missing secret/);
+    });
+
+    it("useAsymCrypt() without args uses server.encryption.privateKey (JWK)", async () => {
+        const gen = useAsymCrypt();
+        const priv = await gen.exportPrivateKey();
+
+        formatConfig({
+            server: { port: 4000, encryption: { mode: "asymmetric", privateKey: priv } },
+            tenants: [],
+        });
+        const enc = await gen.encrypt("cfg-asym");
+        const c = useAsymCrypt(); // pas de privateKey → prend cfg
+        const dec = await c.decrypt(enc);
+        expect(dec).toBe("cfg-asym");
+    });
+
+    it("useAsymCrypt() accepts privateKey as a JSON string", async () => {
+        const gen = useAsymCrypt();
+        const priv = await gen.exportPrivateKey();
+
+        formatConfig({
+            server: { port: 4000, encryption: { mode: "asymmetric", privateKey: JSON.stringify(priv) } },
+            tenants: [],
+        });
+        const enc = await gen.encrypt("json-key");
+        const c = useAsymCrypt();
+        const dec = await c.decrypt(enc);
+        expect(dec).toBe("json-key");
+    });
 });

package/tests/field-encryption.test.ts

@@ -0,0 +1,193 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { ObjectId } from "mongodb";
+import { useRest } from "../database/rest";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { syncCollections } from "../database/collection";
+import { resolve } from "../utils/crypto";
+
+const TENANT = "enc-test";
+const DB = "mongodb://localhost:27017/_DB_ENC_TEST";
+
+let rest: InstanceType<typeof useRest>;
+
+function encCollection(fields: any[]) {
+    return { _tenant_: TENANT, slug: "patients", fields, api: { access: { "*": true } } };
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000, encryption: { mode: "symmetric", secret: "field-enc-secret" } },
+        tenants: [{ id: TENANT, dir: "enc-tenant", database: { uri: DB } }],
+    });
+    await syncTenants();
+    await syncCollections();
+    (cfg as any).collections = [encCollection([
+        { name: "name", type: "string" },
+        { name: "ssn", type: "string", encryption: true },           // champ chiffré
+        { name: "profile", type: "json", encryption: true },          // objet chiffré
+        { name: "age", type: "number" },
+        { name: "address", type: "json", encryptionOptions: { path: "zip" } },          // json : seul address.zip est chiffré
+        { name: "contacts", type: "json", encryptionOptions: { path: ["phone", "email"] } }, // plusieurs chemins
+        { name: "addresses", type: "json", encryptionOptions: { path: "zip" } },        // array de json
+    ])];
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+});
+
+afterAll(async () => {
+    delete (cfg.server as any).encryption;
+    formatConfig({ server: { port: 4000 }, tenants: [] });
+    try { await rest.db.collection("patients").drop(); } catch {}
+});
+
+describe("field-level encryption", () => {
+    it("insert stores ciphertext in Mongo but returns plaintext", async () => {
+        const doc: any = await rest.insertOne("patients", { name: "John", ssn: "123-45-6789", profile: { city: "Paris", zip: 75000 }, age: 42 });
+
+        // réponse API = plaintext
+        expect(doc.ssn).toBe("123-45-6789");
+        expect(doc.profile).toEqual({ city: "Paris", zip: 75000 });
+
+        // en base = ciphertext (version byte + IV + data)
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        expect(raw).not.toBeNull();
+        expect(raw!.ssn).not.toBe("123-45-6789");
+        expect(typeof raw!.ssn).toBe("string");
+        expect(raw!.ssn).toMatch(/^[A-Za-z0-9+/=]+$/); // base64
+        expect(raw!.profile).not.toEqual({ city: "Paris" });
+        // champ non chiffré intact
+        expect(raw!.name).toBe("John");
+        expect(raw!.age).toBe(42);
+    });
+
+    it("find / findOne return ciphertext (no decrypt on output)", async () => {
+        const list: any = await rest.find("patients", { $match: { name: "John" } });
+        // lecture = ciphertext (jamais décrypté automatiquement)
+        expect(list[0].ssn).not.toBe("123-45-6789");
+        expect(list[0].ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(list[0].profile).not.toEqual({ city: "Paris", zip: 75000 });
+        // champs non chiffrés intacts
+        expect(list[0].name).toBe("John");
+
+        const one: any = await rest.findOne("patients", list[0]._id);
+        expect(one.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
+
+        // décryptage MANUEL explicite (utils.crypt.resolve())
+        const cipher = resolve();
+        const dec = await cipher.decrypt<string>(one.ssn, true);
+        expect(dec).toBe("123-45-6789");
+    });
+
+    it("update via $set encrypts the new value (returns ciphertext)", async () => {
+        const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "John" } }))[0]!._id);
+        const updated: any = await rest.updateOne("patients", doc._id, { $set: { ssn: "987-65-4321" } });
+
+        // retour = ciphertext (plus de décryptage automatique)
+        expect(updated.ssn).not.toBe("987-65-4321");
+        expect(updated.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
+        // base = nouveau ciphertext
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        expect(raw).not.toBeNull();
+        expect(raw!.ssn).not.toBe("987-65-4321");
+    });
+
+    it("insertMany encrypts every doc", async () => {
+        await rest.insertMany("patients", [
+            { name: "A", ssn: "111-11-1111" },
+            { name: "B", ssn: "222-22-2222" },
+        ]);
+        const raw = await rest.db.collection("patients").find({ name: { $in: ["A", "B"] } }).toArray();
+        for (const r of raw) expect(r.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
+        const list: any = await rest.find("patients", { $match: { name: { $in: ["A", "B"] } } });
+        // lecture = ciphertext, décrypté manuellement
+        for (const d of list) expect(d.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
+    });
+
+    it("rejects operators that cannot work on ciphertext ($inc on an encrypted field)", async () => {
+        const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "John" } }))[0]!._id);
+        await expect(
+            rest.updateOne("patients", doc._id, { $set: { ssn: "x" }, $inc: { age: 1 } }) // $inc sur age (non chiffré) OK
+        ).resolves.toBeTruthy();
+        await expect(
+            rest.updateOne("patients", doc._id, { $set: { ssn: "y" }, $inc: { ssn: 1 } as any }) // $inc sur champ chiffré → rejeté
+        ).rejects.toThrow(/ENCRYPTED_FIELD_OPERATOR|not supported/);
+    });
+
+    it("throws ENCRYPTION_NOT_CONFIGURED when server.encryption is missing", async () => {
+        delete (cfg.server as any).encryption;
+        formatConfig({ server: { port: 4000 }, tenants: [] });
+        await expect(rest.insertOne("patients", { name: "NoCfg", ssn: "000-00-0000" }))
+            .rejects.toThrow(/ENCRYPTION_NOT_CONFIGURED|server\.encryption/);
+
+        // restore config pour les tests suivants
+        formatConfig({ server: { port: 4000, encryption: { mode: "symmetric", secret: "field-enc-secret" } }, tenants: [] });
+    });
+});
+
+describe("field-level encryption — encryptionOptions.path (json sub-paths)", () => {
+    it("encrypts only the configured sub-path of a json field", async () => {
+        const doc: any = await rest.insertOne("patients", {
+            name: "Alice",
+            address: { street: "Rue X", city: "Paris", zip: "75000" },
+        });
+        // réponse = plaintext partout
+        expect(doc.address.zip).toBe("75000");
+        expect(doc.address.city).toBe("Paris");
+
+        // en base : seul zip est ciphertext, le reste est en clair
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        expect(raw!.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(raw!.address.city).toBe("Paris");
+        expect(raw!.address.street).toBe("Rue X");
+
+        // lecture rest = ciphertext au path, plaintext ailleurs
+        const list: any = await rest.find("patients", { $match: { name: "Alice" } });
+        expect(list[0].address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(list[0].address.city).toBe("Paris");
+
+        // décryptage manuel
+        const cipher = resolve();
+        const zip = await cipher.decrypt<string>(list[0].address.zip, true);
+        expect(zip).toBe("75000");
+    });
+
+    it("supports multiple paths and array-of-json", async () => {
+        const doc: any = await rest.insertOne("patients", {
+            name: "Bob",
+            contacts: { phone: "0600000000", email: "bob@x.io", note: "public" },
+            addresses: [{ zip: "69001" }, { zip: "69002", city: "Lyon" }],
+        });
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        // array de json : chaque élément chiffré sur son zip
+        expect(raw!.addresses[0].zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(raw!.addresses[1].zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(raw!.addresses[1].city).toBe("Lyon"); // non-chiffré intact
+        // multiple paths
+        expect(raw!.contacts.phone).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(raw!.contacts.email).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(raw!.contacts.note).toBe("public");
+    });
+
+    it("encrypts the path on $set replacement and dot-notation $set", async () => {
+        const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "Alice" } }))[0]!._id);
+
+        // $set du json complet → zip re-chiffré dans le remplacement
+        const up1: any = await rest.updateOne("patients", doc._id, { $set: { address: { city: "Nice", zip: "06000" } } });
+        expect(up1.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        expect(up1.address.city).toBe("Nice");
+
+        // dot-notation $set sur le path exact → valeur chiffrée
+        const up2: any = await rest.updateOne("patients", doc._id, { $set: { "address.zip": "06100" } });
+        expect(up2.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
+        const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
+        const cipher = resolve();
+        expect(await cipher.decrypt<string>(raw!.address.zip, true)).toBe("06100");
+    });
+
+    it("rejects $inc on an encrypted sub-path", async () => {
+        const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "Bob" } }))[0]!._id);
+        await expect(
+            rest.updateOne("patients", doc._id, { $inc: { "addresses.0.zip": 1 } as any })
+        ).rejects.toThrow(/ENCRYPTED_FIELD_OPERATOR|not supported/);
+    });
+});

package/types/config.d.ts

@@ -95,6 +95,21 @@ export type ServerConfig = {
             /** Max `_id` tags per cached entry — large results are tagged up to this count (default: 50000; each tag costs ~0.18µs per cache hit) */
             maxTags?: number;
         };
+        /** Encryption keys — defaults used by utils.crypt.useSymCrypt() / utils.crypt.useAsymCrypt() */
+        encryption?: {
+            /** REQUIRED — encryption mode: 'symmetric' (AES-256-GCM) or 'asymmetric' (RSA-OAEP envelope) */
+            mode: 'symmetric' | 'asymmetric';
+            /** Symmetric AES-256-GCM secret (useSymCrypt) — required when mode is 'symmetric'. Falls back to env APP_SECRET */
+            secret?: string;
+            /** Version of the active secret — written into new ciphertexts (default: 1) */
+            version?: number;
+            /** Older secrets for decrypt-only — key rotation, e.g. { 1: 'v1-secret' } */
+            previousSecrets?: Record<number, string>;
+            /** Default AAD context — bound to every ciphertext when no explicit AAD is passed. Must stay stable (changing it makes old data undecryptable) */
+            aad?: string;
+            /** Asymmetric RSA-OAEP private key JWK for decryption (useAsymCrypt) — required when mode is 'asymmetric'. Object or JSON string */
+            privateKey?: JsonWebKey | string;
+        };
     }
     tenants: Tenant[];
 }

package/types/field.d.ts

@@ -53,6 +53,12 @@ export type Field = {
     enumOptions?: enumOptions;
     slugOptions?: SlugOptions;
     unique?: boolean | 1 | 0; // Mongo-style: true/1 → unique index, false/0 → non-unique
+    /** Encrypt this field's values at rest (uses server.encryption + the configured mode) */
+    encryption?: boolean;
+    /** Encrypt sub-path(s) inside a json / array-of-json field (dot notation) — e.g. { path: 'zip' } on field 'address' encrypts address.zip */
+    encryptionOptions?: {
+        path?: string | string[];
+    };
     nullable?: boolean;
     empty?: boolean;
     defaultValue?: number | string | boolean | object | array<any>;