@cipherstash/protect-ffi 0.18.0-9 → 0.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/lib/index.d.cts +98 -103
  2. package/lib/load.cjs +1 -0
  3. package/package.json +15 -7
package/lib/index.d.cts CHANGED
@@ -5,83 +5,99 @@ export type Client = {
5
5
  };
6
6
  declare module './load.cjs' {
7
7
  function newClient(opts: NewClientOptions): Promise<Client>;
8
- function encrypt<T extends EncryptConfig>(client: Client, opts: EncryptOptions<T>): Promise<AnyEncrypted<T>>;
9
- function decrypt<T extends EncryptConfig>(client: Client, opts: DecryptOptions<T>): Promise<JsPlaintext>;
10
- function isEncrypted<T extends EncryptConfig>(encrypted: AnyEncrypted<T>): boolean;
11
- function encryptQuery<T extends EncryptConfig, Q extends EncryptedQueryTerm>(client: Client, opts: QueryOptions<T>): Promise<Q>;
12
- function encryptBulk<T extends EncryptConfig>(client: Client, opts: EncryptBulkOptions<T>): Promise<AnyEncrypted<T>[]>;
13
- function decryptBulk<T extends EncryptConfig>(client: Client, opts: DecryptBulkOptions<T>): Promise<JsPlaintext[]>;
14
- function decryptBulkFallible<T extends EncryptConfig>(client: Client, opts: DecryptBulkOptions<T>): Promise<DecryptResult[]>;
8
+ function encrypt(client: Client, opts: EncryptOptions): Promise<Encrypted>;
9
+ function decrypt(client: Client, opts: DecryptOptions): Promise<JsPlaintext>;
10
+ function isEncrypted(encrypted: Encrypted): boolean;
11
+ function encryptBulk(client: Client, opts: EncryptBulkOptions): Promise<Encrypted[]>;
12
+ function decryptBulk(client: Client, opts: DecryptBulkOptions): Promise<JsPlaintext[]>;
13
+ function decryptBulkFallible(client: Client, opts: DecryptBulkOptions): Promise<DecryptResult[]>;
15
14
  }
16
15
  export type DecryptResult = {
17
16
  data: string;
18
17
  } | {
19
18
  error: string;
20
19
  };
21
- export type EncryptPayload<T extends EncryptConfig> = {
20
+ export type EncryptPayload = {
22
21
  plaintext: JsPlaintext;
23
- lockContext?: Context[];
24
- } & Identifier<T>;
25
- export type BulkDecryptPayload<T extends EncryptConfig> = {
26
- ciphertext: AnyEncrypted<T>;
27
- lockContext?: Context[];
22
+ column: string;
23
+ table: string;
24
+ lockContext?: Context;
25
+ };
26
+ export type BulkDecryptPayload = {
27
+ ciphertext: Encrypted;
28
+ lockContext?: Context;
28
29
  };
29
30
  export type CtsToken = {
30
31
  accessToken: string;
31
32
  expiry: number;
32
33
  };
33
34
  export type Context = {
34
- identityClaim: string;
35
- } | {
36
- tag: string;
37
- };
38
- export type Versioned = {
35
+ identityClaim: string[];
36
+ };
37
+ /**
38
+ * Represents encrypted data in the EQL format.
39
+ *
40
+ * This TypeScript type mirrors the Rust `EqlCiphertext` structure from `cipherstash-client`.
41
+ * The Rust type hierarchy is:
42
+ * - `EqlCiphertext` (identifier + version + body)
43
+ * - `EqlCiphertextBody` (ciphertext + SEM fields + array flag)
44
+ * - `EqlSEM` (all searchable encrypted metadata fields)
45
+ *
46
+ * In the serialized JSON format, `#[serde(flatten)]` is used in Rust to produce a flat
47
+ * structure where all fields appear at the top level rather than nested.
48
+ *
49
+ * Note: The ciphertext field (c) is serialized in MessagePack Base85 format.
50
+ */
51
+ export type Encrypted = {
52
+ /** The table and column identifier */
53
+ i: {
54
+ t: string;
55
+ c: string;
56
+ };
57
+ /** The encryption version */
39
58
  v: number;
40
- };
41
- export type Base85Ciphertext = string;
42
- export type BloomFilter = number[];
43
- export type HMAC = string;
44
- export type EncodedBlockOREArray = string[];
45
- export type EncodedFixedLengthORE = string;
46
- export type EncodedVariableLengthORE = string;
47
- export type JSONPathSelector = string;
48
- export type EncryptedCell<T extends EncryptConfig> = Versioned & {
49
- k: 'ct';
50
- c: Base85Ciphertext;
51
- ob: EncodedBlockOREArray | null;
52
- bf: BloomFilter | null;
53
- hm: HMAC | null;
54
- i: Identifier<T>;
55
- };
56
- export type EncryptedSV<T extends EncryptConfig> = Versioned & {
57
- k: 'sv';
58
- sv: SteVecEncryptedEntry[];
59
- i: Identifier<T>;
60
- };
61
- export type EncryptedSVE = {
62
- k: 'sve';
63
- sve: SteVecEncryptedEntry;
64
- };
65
- export type AnyEncrypted<T extends EncryptConfig> = EncryptedCell<T> | EncryptedSV<T> | EncryptedSVE;
66
- export type SteVecEncryptedEntry = {
67
- c: Base85Ciphertext;
68
- parent_is_array: boolean;
69
- } & SteVecTerm & {
70
- s: JSONPathSelector;
71
- };
72
- export type SteVecQuery = {
73
- svq: SteQueryVecEntry[];
74
- };
75
- export type SteQueryVecEntry = {
76
- s: JSONPathSelector;
77
- } & SteVecTerm;
78
- export type SteVecTerm = {
79
- hm: HMAC;
80
- } | {
81
- ocf: EncodedFixedLengthORE;
82
- } | {
83
- ocv: EncodedVariableLengthORE;
84
- };
59
+ /** The encrypted ciphertext (mp_base85 encoded, optional for query-mode payloads) */
60
+ c?: string;
61
+ /** Whether this encrypted value is part of an array */
62
+ a?: boolean;
63
+ /** ORE block index for 64-bit integers */
64
+ ob?: string[];
65
+ /** Bloom filter for approximate match queries */
66
+ bf?: number[];
67
+ /** HMAC-SHA256 hash for exact matches */
68
+ hm?: string;
69
+ /** Selector value for field selection (SteVec) */
70
+ s?: string;
71
+ /** Blake3 hash for exact matches (SteVec) */
72
+ b3?: string;
73
+ /** ORE CLLW fixed-width index for 64-bit values (SteVec) */
74
+ ocf?: string;
75
+ /** ORE CLLW variable-width index for strings (SteVec) */
76
+ ocv?: string;
77
+ /** Structured encryption vector entries (recursive) */
78
+ sv?: EqlCiphertextBody[];
79
+ };
80
+ /**
81
+ * Body of an EQL ciphertext, used recursively in SteVec entries.
82
+ */
83
+ export type EqlCiphertextBody = {
84
+ /** The encrypted ciphertext (mp_base85 encoded) */
85
+ c?: string;
86
+ /** Whether this entry is part of an array */
87
+ a?: boolean;
88
+ /** Selector value for field selection */
89
+ s?: string;
90
+ /** Blake3 hash for exact matches */
91
+ b3?: string;
92
+ /** ORE CLLW fixed-width index */
93
+ ocf?: string;
94
+ /** ORE CLLW variable-width index */
95
+ ocv?: string;
96
+ /** Nested SteVec entries (for deeply nested JSON) */
97
+ sv?: EqlCiphertextBody[];
98
+ };
99
+ /** @deprecated Use EqlCiphertextBody instead */
100
+ export type SteVecEntry = EqlCiphertextBody;
85
101
  export type EncryptConfig = {
86
102
  v: number;
87
103
  tables: Record<string, Record<string, Column>>;
@@ -90,7 +106,7 @@ export type Column = {
90
106
  cast_as?: CastAs;
91
107
  indexes?: Indexes;
92
108
  };
93
- export type CastAs = 'big_int' | 'boolean' | 'date' | 'real' | 'double' | 'int' | 'small_int' | 'text' | 'jsonb';
109
+ export type CastAs = 'bigint' | 'boolean' | 'date' | 'number' | 'string' | 'json';
94
110
  type TablesOf<C extends EncryptConfig> = C['tables'];
95
111
  export type Identifier<C extends EncryptConfig> = {
96
112
  [T in keyof TablesOf<C>]: {
@@ -138,56 +154,35 @@ export type ClientOpts = {
138
154
  accessKey?: string;
139
155
  clientId?: string;
140
156
  clientKey?: string;
141
- keyset?: IdentifiedBy;
157
+ keyset?: KeysetIdentifier;
158
+ };
159
+ export type KeysetIdentifier = {
160
+ Uuid: string;
161
+ } | {
162
+ Name: string;
142
163
  };
143
- export type IdentifiedBy = string;
144
164
  export type JsPlaintext = string | number | Record<string, unknown> | JsPlaintext[];
145
- export type EncryptOptions<T extends EncryptConfig> = {
165
+ export type EncryptOptions = {
146
166
  plaintext: JsPlaintext;
147
- lockContext?: Context[];
167
+ column: string;
168
+ table: string;
169
+ lockContext?: Context;
148
170
  serviceToken?: CtsToken;
149
171
  unverifiedContext?: Record<string, unknown>;
150
- } & Identifier<T>;
151
- export type EncryptBulkOptions<T extends EncryptConfig> = {
152
- plaintexts: EncryptPayload<T>[];
172
+ };
173
+ export type EncryptBulkOptions = {
174
+ plaintexts: EncryptPayload[];
153
175
  serviceToken?: CtsToken;
154
176
  unverifiedContext?: Record<string, unknown>;
155
177
  };
156
- export type DecryptOptions<T extends EncryptConfig> = {
157
- ciphertext: AnyEncrypted<T>;
158
- lockContext?: Context[];
178
+ export type DecryptOptions = {
179
+ ciphertext: Encrypted;
180
+ lockContext?: Context;
159
181
  serviceToken?: CtsToken;
160
182
  unverifiedContext?: Record<string, unknown>;
161
183
  };
162
- export type DecryptBulkOptions<T extends EncryptConfig> = {
163
- ciphertexts: BulkDecryptPayload<T>[];
184
+ export type DecryptBulkOptions = {
185
+ ciphertexts: BulkDecryptPayload[];
164
186
  serviceToken?: CtsToken;
165
187
  unverifiedContext?: Record<string, unknown>;
166
188
  };
167
- export type QueryOptions<T extends EncryptConfig> = {
168
- plaintext: JsPlaintext;
169
- operator: QueryOperator;
170
- } & Identifier<T>;
171
- export type NumericOperator = '>' | '>=' | '<' | '<=' | '=';
172
- export type StringOperator = '~~' | '~~*' | '=';
173
- export type JsonbOperator = '@>' | '<@' | '->';
174
- export type QueryOperator = NumericOperator | StringOperator | JsonbOperator;
175
- export type EncryptedQueryTerm = {};
176
- export interface RangeQuery extends EncryptedQueryTerm {
177
- ob: EncodedBlockOREArray;
178
- }
179
- export interface MatchQuery extends EncryptedQueryTerm {
180
- bf: BloomFilter;
181
- }
182
- export interface ExactQuery extends EncryptedQueryTerm {
183
- hm: HMAC;
184
- }
185
- export interface JsonSelect extends EncryptedQueryTerm {
186
- s: JSONPathSelector;
187
- }
188
- export interface JsonContainsQuery extends EncryptedQueryTerm {
189
- sv: SteQueryVecEntry[];
190
- }
191
- export interface JsonIsContainedByQuery extends EncryptedQueryTerm {
192
- sv: SteQueryVecEntry[];
193
- }
package/lib/load.cjs CHANGED
@@ -12,6 +12,7 @@ module.exports = require('@neon-rs/load').proxy({
12
12
  'darwin-x64': () => require('@cipherstash/protect-ffi-darwin-x64'),
13
13
  'darwin-arm64': () => require('@cipherstash/protect-ffi-darwin-arm64'),
14
14
  'linux-x64-gnu': () => require('@cipherstash/protect-ffi-linux-x64-gnu'),
15
+ 'linux-x64-musl': () => require('@cipherstash/protect-ffi-linux-x64-musl'),
15
16
  'linux-arm64-gnu': () => require('@cipherstash/protect-ffi-linux-arm64-gnu'),
16
17
  },
17
18
  debug: () => require('../index.node'),
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cipherstash/protect-ffi",
3
- "version": "0.18.0-9",
3
+ "version": "0.19.0",
4
4
  "description": "",
5
5
  "main": "./lib/index.cjs",
6
6
  "scripts": {
@@ -45,7 +45,14 @@
45
45
  "neon": {
46
46
  "type": "library",
47
47
  "org": "@cipherstash",
48
- "platforms": "common",
48
+ "platforms": [
49
+ "darwin-x64",
50
+ "darwin-arm64",
51
+ "win32-x64-msvc",
52
+ "linux-x64-gnu",
53
+ "linux-arm64-gnu",
54
+ "linux-x64-musl"
55
+ ],
49
56
  "load": "./src/load.cts",
50
57
  "prefix": "protect-ffi-"
51
58
  },
@@ -60,10 +67,11 @@
60
67
  "@neon-rs/load": "^0.1.82"
61
68
  },
62
69
  "optionalDependencies": {
63
- "@cipherstash/protect-ffi-win32-x64-msvc": "0.18.0-9",
64
- "@cipherstash/protect-ffi-darwin-x64": "0.18.0-9",
65
- "@cipherstash/protect-ffi-darwin-arm64": "0.18.0-9",
66
- "@cipherstash/protect-ffi-linux-x64-gnu": "0.18.0-9",
67
- "@cipherstash/protect-ffi-linux-arm64-gnu": "0.18.0-9"
70
+ "@cipherstash/protect-ffi-darwin-x64": "0.19.0",
71
+ "@cipherstash/protect-ffi-darwin-arm64": "0.19.0",
72
+ "@cipherstash/protect-ffi-win32-x64-msvc": "0.19.0",
73
+ "@cipherstash/protect-ffi-linux-x64-gnu": "0.19.0",
74
+ "@cipherstash/protect-ffi-linux-arm64-gnu": "0.19.0",
75
+ "@cipherstash/protect-ffi-linux-x64-musl": "0.19.0"
68
76
  }
69
77
  }