@cipherstash/protect-ffi 0.17.0 → 0.18.0-9

package/lib/index.cjs

@@ -1,11 +1,12 @@
 "use strict";
 // This module is the CJS entry point for the library.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decryptBulkFallible = exports.decryptBulk = exports.decrypt = exports.encryptBulk = exports.encrypt = exports.newClient = void 0;
+exports.decryptBulkFallible = exports.decryptBulk = exports.decrypt = exports.isEncrypted = exports.encryptBulk = exports.encrypt = exports.newClient = void 0;
 var load_cjs_1 = require("./load.cjs");
 Object.defineProperty(exports, "newClient", { enumerable: true, get: function () { return load_cjs_1.newClient; } });
 Object.defineProperty(exports, "encrypt", { enumerable: true, get: function () { return load_cjs_1.encrypt; } });
 Object.defineProperty(exports, "encryptBulk", { enumerable: true, get: function () { return load_cjs_1.encryptBulk; } });
+Object.defineProperty(exports, "isEncrypted", { enumerable: true, get: function () { return load_cjs_1.isEncrypted; } });
 Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return load_cjs_1.decrypt; } });
 Object.defineProperty(exports, "decryptBulk", { enumerable: true, get: function () { return load_cjs_1.decryptBulk; } });
 Object.defineProperty(exports, "decryptBulkFallible", { enumerable: true, get: function () { return load_cjs_1.decryptBulkFallible; } });

package/lib/index.d.cts

@@ -1,50 +1,87 @@
-export { newClient, encrypt, encryptBulk, decrypt, decryptBulk, decryptBulkFallible, } from './load.cjs';
+export { newClient, encrypt, encryptBulk, isEncrypted, decrypt, decryptBulk, decryptBulkFallible, } from './load.cjs';
 declare const sym: unique symbol;
 export type Client = {
     readonly [sym]: unknown;
 };
 declare module './load.cjs' {
     function newClient(opts: NewClientOptions): Promise<Client>;
-    function encrypt(client: Client, opts: EncryptOptions): Promise<Encrypted>;
-    function decrypt(client: Client, opts: DecryptOptions): Promise<JsPlaintext>;
-    function encryptBulk(client: Client, opts: EncryptBulkOptions): Promise<Encrypted[]>;
-    function decryptBulk(client: Client, opts: DecryptBulkOptions): Promise<JsPlaintext[]>;
-    function decryptBulkFallible(client: Client, opts: DecryptBulkOptions): Promise<DecryptResult[]>;
+    function encrypt<T extends EncryptConfig>(client: Client, opts: EncryptOptions<T>): Promise<AnyEncrypted<T>>;
+    function decrypt<T extends EncryptConfig>(client: Client, opts: DecryptOptions<T>): Promise<JsPlaintext>;
+    function isEncrypted<T extends EncryptConfig>(encrypted: AnyEncrypted<T>): boolean;
+    function encryptQuery<T extends EncryptConfig, Q extends EncryptedQueryTerm>(client: Client, opts: QueryOptions<T>): Promise<Q>;
+    function encryptBulk<T extends EncryptConfig>(client: Client, opts: EncryptBulkOptions<T>): Promise<AnyEncrypted<T>[]>;
+    function decryptBulk<T extends EncryptConfig>(client: Client, opts: DecryptBulkOptions<T>): Promise<JsPlaintext[]>;
+    function decryptBulkFallible<T extends EncryptConfig>(client: Client, opts: DecryptBulkOptions<T>): Promise<DecryptResult[]>;
 }
 export type DecryptResult = {
     data: string;
 } | {
     error: string;
 };
-export type EncryptPayload = {
+export type EncryptPayload<T extends EncryptConfig> = {
     plaintext: JsPlaintext;
-    column: string;
-    table: string;
-    lockContext?: Context;
-};
-export type BulkDecryptPayload = {
-    ciphertext: Encrypted;
-    lockContext?: Context;
+    lockContext?: Context[];
+} & Identifier<T>;
+export type BulkDecryptPayload<T extends EncryptConfig> = {
+    ciphertext: AnyEncrypted<T>;
+    lockContext?: Context[];
 };
 export type CtsToken = {
     accessToken: string;
     expiry: number;
 };
 export type Context = {
-    identityClaim: string[];
-};
-export type Encrypted = {
-    k: string;
-    c: string;
-    ob: string[] | null;
-    bf: number[] | null;
-    hm: string | null;
-    i: {
-        c: string;
-        t: string;
-    };
+    identityClaim: string;
+} | {
+    tag: string;
+};
+export type Versioned = {
     v: number;
 };
+export type Base85Ciphertext = string;
+export type BloomFilter = number[];
+export type HMAC = string;
+export type EncodedBlockOREArray = string[];
+export type EncodedFixedLengthORE = string;
+export type EncodedVariableLengthORE = string;
+export type JSONPathSelector = string;
+export type EncryptedCell<T extends EncryptConfig> = Versioned & {
+    k: 'ct';
+    c: Base85Ciphertext;
+    ob: EncodedBlockOREArray | null;
+    bf: BloomFilter | null;
+    hm: HMAC | null;
+    i: Identifier<T>;
+};
+export type EncryptedSV<T extends EncryptConfig> = Versioned & {
+    k: 'sv';
+    sv: SteVecEncryptedEntry[];
+    i: Identifier<T>;
+};
+export type EncryptedSVE = {
+    k: 'sve';
+    sve: SteVecEncryptedEntry;
+};
+export type AnyEncrypted<T extends EncryptConfig> = EncryptedCell<T> | EncryptedSV<T> | EncryptedSVE;
+export type SteVecEncryptedEntry = {
+    c: Base85Ciphertext;
+    parent_is_array: boolean;
+} & SteVecTerm & {
+    s: JSONPathSelector;
+};
+export type SteVecQuery = {
+    svq: SteQueryVecEntry[];
+};
+export type SteQueryVecEntry = {
+    s: JSONPathSelector;
+} & SteVecTerm;
+export type SteVecTerm = {
+    hm: HMAC;
+} | {
+    ocf: EncodedFixedLengthORE;
+} | {
+    ocv: EncodedVariableLengthORE;
+};
 export type EncryptConfig = {
     v: number;
     tables: Record<string, Record<string, Column>>;
@@ -101,29 +138,56 @@ export type ClientOpts = {
     accessKey?: string;
     clientId?: string;
     clientKey?: string;
+    keyset?: IdentifiedBy;
 };
+export type IdentifiedBy = string;
 export type JsPlaintext = string | number | Record<string, unknown> | JsPlaintext[];
-export type EncryptOptions = {
+export type EncryptOptions<T extends EncryptConfig> = {
     plaintext: JsPlaintext;
-    column: string;
-    table: string;
-    lockContext?: Context;
+    lockContext?: Context[];
     serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
-};
-export type EncryptBulkOptions = {
-    plaintexts: EncryptPayload[];
+} & Identifier<T>;
+export type EncryptBulkOptions<T extends EncryptConfig> = {
+    plaintexts: EncryptPayload<T>[];
     serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
-export type DecryptOptions = {
-    ciphertext: Encrypted;
-    lockContext?: Context;
+export type DecryptOptions<T extends EncryptConfig> = {
+    ciphertext: AnyEncrypted<T>;
+    lockContext?: Context[];
     serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
-export type DecryptBulkOptions = {
-    ciphertexts: BulkDecryptPayload[];
+export type DecryptBulkOptions<T extends EncryptConfig> = {
+    ciphertexts: BulkDecryptPayload<T>[];
     serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
+export type QueryOptions<T extends EncryptConfig> = {
+    plaintext: JsPlaintext;
+    operator: QueryOperator;
+} & Identifier<T>;
+export type NumericOperator = '>' | '>=' | '<' | '<=' | '=';
+export type StringOperator = '~~' | '~~*' | '=';
+export type JsonbOperator = '@>' | '<@' | '->';
+export type QueryOperator = NumericOperator | StringOperator | JsonbOperator;
+export type EncryptedQueryTerm = {};
+export interface RangeQuery extends EncryptedQueryTerm {
+    ob: EncodedBlockOREArray;
+}
+export interface MatchQuery extends EncryptedQueryTerm {
+    bf: BloomFilter;
+}
+export interface ExactQuery extends EncryptedQueryTerm {
+    hm: HMAC;
+}
+export interface JsonSelect extends EncryptedQueryTerm {
+    s: JSONPathSelector;
+}
+export interface JsonContainsQuery extends EncryptedQueryTerm {
+    sv: SteQueryVecEntry[];
+}
+export interface JsonIsContainedByQuery extends EncryptedQueryTerm {
+    sv: SteQueryVecEntry[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/protect-ffi",
-  "version": "0.17.0",
+  "version": "0.18.0-9",
   "description": "",
   "main": "./lib/index.cjs",
   "scripts": {
@@ -60,10 +60,10 @@
     "@neon-rs/load": "^0.1.82"
   },
   "optionalDependencies": {
-    "@cipherstash/protect-ffi-win32-x64-msvc": "0.17.0",
-    "@cipherstash/protect-ffi-darwin-x64": "0.17.0",
-    "@cipherstash/protect-ffi-darwin-arm64": "0.17.0",
-    "@cipherstash/protect-ffi-linux-x64-gnu": "0.17.0",
-    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.17.0"
+    "@cipherstash/protect-ffi-win32-x64-msvc": "0.18.0-9",
+    "@cipherstash/protect-ffi-darwin-x64": "0.18.0-9",
+    "@cipherstash/protect-ffi-darwin-arm64": "0.18.0-9",
+    "@cipherstash/protect-ffi-linux-x64-gnu": "0.18.0-9",
+    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.18.0-9"
   }
 }