@cipherstash/protect-ffi 0.23.0 → 0.25.0

package/lib/index.cjs

@@ -126,7 +126,7 @@ function newClient(opts) {
     return wrapAsync(() => native.newClient({
         encryptConfig: (0, normalizeEncryptConfig_js_1.normalizeEncryptConfig)(opts.encryptConfig),
         clientOpts: (0, credentials_js_1.withEnvCredentials)(opts.clientOpts),
-    }));
+    }, opts.strategy));
 }
 function encrypt(client, opts) {
     return wrapAsync(() => native.encrypt(client, opts));

package/lib/index.d.cts

@@ -6,7 +6,7 @@ export type Client = {
     readonly [sym]: unknown;
 };
 declare module './load.cjs' {
-    function newClient(opts: NativeNewClientOptions): Promise<Client>;
+    function newClient(opts: NativeNewClientOptions, strategy?: AuthStrategy): Promise<Client>;
     function encrypt(client: Client, opts: EncryptOptions): Promise<Encrypted>;
     function decrypt(client: Client, opts: DecryptOptions): Promise<JsPlaintext>;
     function isEncrypted(encrypted: unknown): boolean;
@@ -60,10 +60,6 @@ export type BulkDecryptPayload = {
     ciphertext: Encrypted;
     lockContext?: Context;
 };
-export type CtsToken = {
-    accessToken: string;
-    expiry: number;
-};
 export type Context = {
     identityClaim: string[];
 };
@@ -254,6 +250,22 @@ export type TokenFilter = {
 export type NewClientOptions = {
     encryptConfig: EncryptConfig;
     clientOpts?: ClientOpts;
+    /**
+     * Caller-supplied auth strategy. When provided, `getToken()` is invoked on
+     * every ZeroKMS request and `clientOpts.creds` is ignored for auth (the
+     * client key is still required). Without this, the native side builds an
+     * AutoStrategy from env / profile / `clientOpts.creds`.
+     */
+    strategy?: AuthStrategy;
+};
+/**
+ * Auth strategy shape compatible with `@cipherstash/auth` strategies (e.g.
+ * `AccessKeyStrategy`). Only `getToken` is required.
+ */
+export type AuthStrategy = {
+    getToken: () => Promise<{
+        token: string;
+    }>;
 };
 /** Options passed to the native `newClient` after vocabulary normalization. */
 type NativeNewClientOptions = {
@@ -281,23 +293,19 @@ export type EncryptOptions = {
     column: string;
     table: string;
     lockContext?: Context;
-    serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
 export type EncryptBulkOptions = {
     plaintexts: EncryptPayload[];
-    serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
 export type DecryptOptions = {
     ciphertext: Encrypted;
     lockContext?: Context;
-    serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
 export type DecryptBulkOptions = {
     ciphertexts: BulkDecryptPayload[];
-    serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
 export type IndexTypeName = 'ste_vec' | 'match' | 'ore' | 'unique';
@@ -309,7 +317,6 @@ export type EncryptQueryOptions = {
     indexType: IndexTypeName;
     queryOp?: QueryOpName;
     lockContext?: Context;
-    serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };
 export type QueryPayload = {
@@ -322,6 +329,5 @@ export type QueryPayload = {
 };
 export type EncryptQueryBulkOptions = {
     queries: QueryPayload[];
-    serviceToken?: CtsToken;
     unverifiedContext?: Record<string, unknown>;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/protect-ffi",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "",
   "main": "./lib/index.cjs",
   "scripts": {
@@ -26,25 +26,45 @@
     "prepack": "tsc &&neon update",
     "version": "neon bump --binaries platforms && git add .",
     "release": "gh workflow run release.yml -f dryrun=false -f version=patch",
-    "dryrun": "gh workflow run publish.yml -f dryrun=true"
+    "dryrun": "gh workflow run publish.yml -f dryrun=true",
+    "build:wasm": "wasm-pack build crates/protect-ffi --target bundler --out-dir ../../dist/wasm --no-pack",
+    "postbuild:wasm": "node scripts/inline-wasm.mjs"
   },
   "author": "",
   "license": "ISC",
   "exports": {
     ".": {
-      "import": {
-        "types": "./lib/index.d.mts",
-        "default": "./lib/index.mjs"
+      "node": {
+        "import": {
+          "types": "./lib/index.d.mts",
+          "default": "./lib/index.mjs"
+        },
+        "require": {
+          "types": "./lib/index.d.cts",
+          "default": "./lib/index.cjs"
+        }
       },
-      "require": {
-        "types": "./lib/index.d.cts",
-        "default": "./lib/index.cjs"
-      }
+      "default": "./dist/wasm/protect_ffi.js"
+    },
+    "./wasm": {
+      "types": "./dist/wasm/protect_ffi.d.ts",
+      "default": "./dist/wasm/protect_ffi.js"
+    },
+    "./wasm-inline": {
+      "types": "./dist/wasm/protect_ffi.d.ts",
+      "default": "./dist/wasm/protect_ffi_inline.js"
     }
   },
   "types": "./lib/index.d.cts",
   "files": [
-    "lib/**/*.?({c,m}){t,j}s"
+    "lib/**/*.?({c,m}){t,j}s",
+    "dist/wasm/package.json",
+    "dist/wasm/protect_ffi.js",
+    "dist/wasm/protect_ffi_bg.js",
+    "dist/wasm/protect_ffi_bg.wasm",
+    "dist/wasm/protect_ffi.d.ts",
+    "dist/wasm/protect_ffi_bg.wasm.d.ts",
+    "dist/wasm/protect_ffi_inline.js"
   ],
   "neon": {
     "type": "library",
@@ -75,11 +95,11 @@
     "vite": "^8.0.5"
   },
   "optionalDependencies": {
-    "@cipherstash/protect-ffi-darwin-x64": "0.23.0",
-    "@cipherstash/protect-ffi-darwin-arm64": "0.23.0",
-    "@cipherstash/protect-ffi-win32-x64-msvc": "0.23.0",
-    "@cipherstash/protect-ffi-linux-x64-gnu": "0.23.0",
-    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.23.0",
-    "@cipherstash/protect-ffi-linux-x64-musl": "0.23.0"
+    "@cipherstash/protect-ffi-darwin-x64": "0.25.0",
+    "@cipherstash/protect-ffi-darwin-arm64": "0.25.0",
+    "@cipherstash/protect-ffi-win32-x64-msvc": "0.25.0",
+    "@cipherstash/protect-ffi-linux-x64-gnu": "0.25.0",
+    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.25.0",
+    "@cipherstash/protect-ffi-linux-x64-musl": "0.25.0"
   }
 }