@cipherstash/protect-ffi 0.18.1 → 0.20.0

package/lib/index.cjs

@@ -1,11 +1,13 @@
 "use strict";
 // This module is the CJS entry point for the library.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decryptBulkFallible = exports.decryptBulk = exports.decrypt = exports.isEncrypted = exports.encryptBulk = exports.encrypt = exports.newClient = void 0;
+exports.decryptBulkFallible = exports.decryptBulk = exports.decrypt = exports.isEncrypted = exports.encryptQueryBulk = exports.encryptQuery = exports.encryptBulk = exports.encrypt = exports.newClient = void 0;
 var load_cjs_1 = require("./load.cjs");
 Object.defineProperty(exports, "newClient", { enumerable: true, get: function () { return load_cjs_1.newClient; } });
 Object.defineProperty(exports, "encrypt", { enumerable: true, get: function () { return load_cjs_1.encrypt; } });
 Object.defineProperty(exports, "encryptBulk", { enumerable: true, get: function () { return load_cjs_1.encryptBulk; } });
+Object.defineProperty(exports, "encryptQuery", { enumerable: true, get: function () { return load_cjs_1.encryptQuery; } });
+Object.defineProperty(exports, "encryptQueryBulk", { enumerable: true, get: function () { return load_cjs_1.encryptQueryBulk; } });
 Object.defineProperty(exports, "isEncrypted", { enumerable: true, get: function () { return load_cjs_1.isEncrypted; } });
 Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return load_cjs_1.decrypt; } });
 Object.defineProperty(exports, "decryptBulk", { enumerable: true, get: function () { return load_cjs_1.decryptBulk; } });

package/lib/index.d.cts

@@ -1,4 +1,4 @@
-export { newClient, encrypt, encryptBulk, isEncrypted, decrypt, decryptBulk, decryptBulkFallible, } from './load.cjs';
+export { newClient, encrypt, encryptBulk, encryptQuery, encryptQueryBulk, isEncrypted, decrypt, decryptBulk, decryptBulkFallible, } from './load.cjs';
 declare const sym: unique symbol;
 export type Client = {
     readonly [sym]: unknown;
@@ -11,6 +11,8 @@ declare module './load.cjs' {
     function encryptBulk(client: Client, opts: EncryptBulkOptions): Promise<Encrypted[]>;
     function decryptBulk(client: Client, opts: DecryptBulkOptions): Promise<JsPlaintext[]>;
     function decryptBulkFallible(client: Client, opts: DecryptBulkOptions): Promise<DecryptResult[]>;
+    function encryptQuery(client: Client, opts: EncryptQueryOptions): Promise<Encrypted>;
+    function encryptQueryBulk(client: Client, opts: EncryptQueryBulkOptions): Promise<Encrypted[]>;
 }
 export type DecryptResult = {
     data: string;
@@ -34,32 +36,70 @@ export type CtsToken = {
 export type Context = {
     identityClaim: string[];
 };
+/**
+ * Represents encrypted data in the EQL format.
+ *
+ * This TypeScript type mirrors the Rust `EqlCiphertext` structure from `cipherstash-client`.
+ * The Rust type hierarchy is:
+ * - `EqlCiphertext` (identifier + version + body)
+ *   - `EqlCiphertextBody` (ciphertext + SEM fields + array flag)
+ *     - `EqlSEM` (all searchable encrypted metadata fields)
+ *
+ * In the serialized JSON format, `#[serde(flatten)]` is used in Rust to produce a flat
+ * structure where all fields appear at the top level rather than nested.
+ *
+ * Note: The ciphertext field (c) is serialized in MessagePack Base85 format.
+ */
 export type Encrypted = {
-    k: 'ct';
-    c: string;
-    ob: string[] | null;
-    bf: number[] | null;
-    hm: string | null;
+    /** The table and column identifier */
     i: {
-        c: string;
         t: string;
-    };
-    v: number;
-} | {
-    k: 'sv';
-    sv: SteVecEncryptedEntry[];
-    i: {
         c: string;
-        t: string;
     };
+    /** The encryption version */
     v: number;
-};
-export type SteVecEncryptedEntry = {
-    tokenized_selector: string;
-    term: string;
-    record: string;
-    parent_is_array: boolean;
-};
+    /** The encrypted ciphertext (mp_base85 encoded, optional for query-mode payloads) */
+    c?: string;
+    /** Whether this encrypted value is part of an array */
+    a?: boolean;
+    /** ORE block index for 64-bit integers */
+    ob?: string[];
+    /** Bloom filter for approximate match queries */
+    bf?: number[];
+    /** HMAC-SHA256 hash for exact matches */
+    hm?: string;
+    /** Selector value for field selection (SteVec) */
+    s?: string;
+    /** Blake3 hash for exact matches (SteVec) */
+    b3?: string;
+    /** ORE CLLW fixed-width index for 64-bit values (SteVec) */
+    ocf?: string;
+    /** ORE CLLW variable-width index for strings (SteVec) */
+    ocv?: string;
+    /** Structured encryption vector entries (recursive) */
+    sv?: EqlCiphertextBody[];
+};
+/**
+ * Body of an EQL ciphertext, used recursively in SteVec entries.
+ */
+export type EqlCiphertextBody = {
+    /** The encrypted ciphertext (mp_base85 encoded) */
+    c?: string;
+    /** Whether this entry is part of an array */
+    a?: boolean;
+    /** Selector value for field selection */
+    s?: string;
+    /** Blake3 hash for exact matches */
+    b3?: string;
+    /** ORE CLLW fixed-width index */
+    ocf?: string;
+    /** ORE CLLW variable-width index */
+    ocv?: string;
+    /** Nested SteVec entries (for deeply nested JSON) */
+    sv?: EqlCiphertextBody[];
+};
+/** @deprecated Use EqlCiphertextBody instead */
+export type SteVecEntry = EqlCiphertextBody;
 export type EncryptConfig = {
     v: number;
     tables: Record<string, Record<string, Column>>;
@@ -148,3 +188,28 @@ export type DecryptBulkOptions = {
     serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
+export type IndexTypeName = 'ste_vec' | 'match' | 'ore' | 'unique';
+export type QueryOpName = 'default' | 'ste_vec_selector' | 'ste_vec_term';
+export type EncryptQueryOptions = {
+    plaintext: JsPlaintext;
+    column: string;
+    table: string;
+    indexType: IndexTypeName;
+    queryOp?: QueryOpName;
+    lockContext?: Context;
+    serviceToken?: CtsToken;
+    unverifiedContext?: Record<string, unknown>;
+};
+export type QueryPayload = {
+    plaintext: JsPlaintext;
+    column: string;
+    table: string;
+    indexType: IndexTypeName;
+    queryOp?: QueryOpName;
+    lockContext?: Context;
+};
+export type EncryptQueryBulkOptions = {
+    queries: QueryPayload[];
+    serviceToken?: CtsToken;
+    unverifiedContext?: Record<string, unknown>;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/protect-ffi",
-  "version": "0.18.1",
+  "version": "0.20.0",
   "description": "",
   "main": "./lib/index.cjs",
   "scripts": {
@@ -67,11 +67,11 @@
     "@neon-rs/load": "^0.1.82"
   },
   "optionalDependencies": {
-    "@cipherstash/protect-ffi-darwin-x64": "0.18.1",
-    "@cipherstash/protect-ffi-darwin-arm64": "0.18.1",
-    "@cipherstash/protect-ffi-win32-x64-msvc": "0.18.1",
-    "@cipherstash/protect-ffi-linux-x64-gnu": "0.18.1",
-    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.18.1",
-    "@cipherstash/protect-ffi-linux-x64-musl": "0.18.1"
+    "@cipherstash/protect-ffi-darwin-x64": "0.20.0",
+    "@cipherstash/protect-ffi-darwin-arm64": "0.20.0",
+    "@cipherstash/protect-ffi-win32-x64-msvc": "0.20.0",
+    "@cipherstash/protect-ffi-linux-x64-gnu": "0.20.0",
+    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.20.0",
+    "@cipherstash/protect-ffi-linux-x64-musl": "0.20.0"
   }
 }