@cipherstash/stack 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +11 -14
- package/dist/bin/stash.js +90 -57
- package/dist/bin/stash.js.map +1 -1
- package/dist/{chunk-SJ7JO4ME.js → chunk-JLI27P46.js} +1 -1
- package/dist/chunk-JLI27P46.js.map +1 -0
- package/dist/{chunk-2GZMIJFO.js → chunk-MW6D52V2.js} +69 -43
- package/dist/chunk-MW6D52V2.js.map +1 -0
- package/dist/{chunk-5DCT6YU2.js → chunk-OAPLZLR5.js} +7 -3
- package/dist/{chunk-5DCT6YU2.js.map → chunk-OAPLZLR5.js.map} +1 -1
- package/dist/{chunk-7XRPN2KX.js → chunk-TBAIVO6T.js} +26 -23
- package/dist/chunk-TBAIVO6T.js.map +1 -0
- package/dist/{client-BxJG56Ey.d.cts → client-Bf0Xw2xo.d.cts} +44 -26
- package/dist/{client-DtGq9dJp.d.ts → client-Kfp8OsPB.d.ts} +44 -26
- package/dist/client.cjs +25 -22
- package/dist/client.cjs.map +1 -1
- package/dist/client.d.cts +2 -2
- package/dist/client.d.ts +2 -2
- package/dist/client.js +5 -5
- package/dist/drizzle/index.cjs +19 -16
- package/dist/drizzle/index.cjs.map +1 -1
- package/dist/drizzle/index.d.cts +5 -5
- package/dist/drizzle/index.d.ts +5 -5
- package/dist/drizzle/index.js +2 -2
- package/dist/drizzle/index.js.map +1 -1
- package/dist/dynamodb/index.cjs.map +1 -1
- package/dist/dynamodb/index.d.cts +10 -10
- package/dist/dynamodb/index.d.ts +10 -10
- package/dist/dynamodb/index.js.map +1 -1
- package/dist/identity/index.cjs +6 -2
- package/dist/identity/index.cjs.map +1 -1
- package/dist/identity/index.js +1 -1
- package/dist/index.cjs +94 -61
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +3 -3
- package/dist/index.d.ts +3 -3
- package/dist/index.js +7 -7
- package/dist/schema/index.cjs +31 -28
- package/dist/schema/index.cjs.map +1 -1
- package/dist/schema/index.d.cts +1 -1
- package/dist/schema/index.d.ts +1 -1
- package/dist/schema/index.js +11 -11
- package/dist/secrets/index.cjs +90 -57
- package/dist/secrets/index.cjs.map +1 -1
- package/dist/secrets/index.d.cts +1 -1
- package/dist/secrets/index.d.ts +1 -1
- package/dist/secrets/index.js +4 -4
- package/dist/secrets/index.js.map +1 -1
- package/dist/supabase/index.cjs +7 -7
- package/dist/supabase/index.cjs.map +1 -1
- package/dist/supabase/index.d.cts +3 -3
- package/dist/supabase/index.d.ts +3 -3
- package/dist/supabase/index.js +3 -3
- package/dist/supabase/index.js.map +1 -1
- package/dist/{types-public-BCj1L4fi.d.ts → types-public-0CzBV45X.d.cts} +100 -58
- package/dist/{types-public-BCj1L4fi.d.cts → types-public-0CzBV45X.d.ts} +100 -58
- package/dist/types-public.cjs.map +1 -1
- package/dist/types-public.d.cts +1 -1
- package/dist/types-public.d.ts +1 -1
- package/dist/types-public.js +1 -1
- package/package.json +1 -1
- package/dist/chunk-2GZMIJFO.js.map +0 -1
- package/dist/chunk-7XRPN2KX.js.map +0 -1
- package/dist/chunk-SJ7JO4ME.js.map +0 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n EncryptedColumn,\n EncryptedTable,\n EncryptedTableColumn,\n EncryptedField,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n Encrypted as CipherStashEncrypted,\n JsPlaintext,\n QueryOpName,\n newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'> | null\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted | null\n\nexport type EncryptPayload = JsPlaintext | null\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n /**\n * The CipherStash workspace CRN (Cloud Resource Name).\n * Format: `crn:<region>.aws:<workspace-id>`.\n * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n * If omitted, the SDK reads from the environment or TOML config files.\n */\n workspaceCrn?: string\n\n /**\n * The API access key used for authenticating with the CipherStash API.\n * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n * Obtain this from the CipherStash dashboard after creating a workspace.\n */\n accessKey?: string\n\n /**\n * The client identifier used to authenticate with CipherStash services.\n * Can also be set via the `CS_CLIENT_ID` environment variable.\n * Generated during workspace onboarding in the CipherStash dashboard.\n */\n clientId?: string\n\n /**\n * The client key material used in combination with ZeroKMS for encryption operations.\n * Can also be set via the `CS_CLIENT_KEY` environment variable.\n * Generated during workspace onboarding in the CipherStash dashboard.\n */\n clientKey?: string\n\n /**\n * An optional keyset identifier for multi-tenant encryption.\n * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n * Keysets are created and managed in the CipherStash dashboard.\n */\n keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n config?: ClientConfig\n logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n column: EncryptedColumn | EncryptedField\n table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n | 'eql'\n | 'composite-literal'\n | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n value: JsPlaintext\n column: EncryptedColumn\n table: EncryptedTable<EncryptedTableColumn>\n returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL, composite literal string, or null */\nexport type EncryptedQueryResult = Encrypted | string | null\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n [K in keyof T as T[K] extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n [K in keyof T as T[K] extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n [K in keyof T as T[K] extends Encrypted ? K : never]: string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n [K in keyof T]: [K] extends [keyof S]\n ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n ? Encrypted\n : T[K]\n : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n id?: string\n plaintext: JsPlaintext | null\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n | 'orderAndRange'\n | 'freeTextSearch'\n | 'equality'\n | 'steVecSelector'\n | 'steVecTerm'\n | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n orderAndRange: 'orderAndRange',\n freeTextSearch: 'freeTextSearch',\n equality: 'equality',\n steVecSelector: 'steVecSelector',\n steVecTerm: 'steVecTerm',\n searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n orderAndRange: 'ore',\n freeTextSearch: 'match',\n equality: 'unique',\n steVecSelector: 'ste_vec',\n steVecTerm: 'ste_vec',\n searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n steVecSelector: 'ste_vec_selector',\n steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n column: EncryptedColumn\n table: EncryptedTable<EncryptedTableColumn>\n queryType?: QueryTypeName\n returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n value: JsPlaintext | null\n}\n"],"mappings":";AA6NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}
|
|
@@ -6,29 +6,29 @@ import {
|
|
|
6
6
|
import {
|
|
7
7
|
queryTypeToFfi,
|
|
8
8
|
queryTypeToQueryOp
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-JLI27P46.js";
|
|
10
10
|
import {
|
|
11
11
|
EncryptionErrorTypes,
|
|
12
12
|
createRequestLogger,
|
|
13
13
|
initStackLogger,
|
|
14
14
|
loadWorkSpaceId,
|
|
15
15
|
logger
|
|
16
|
-
} from "./chunk-
|
|
16
|
+
} from "./chunk-OAPLZLR5.js";
|
|
17
17
|
import {
|
|
18
18
|
buildEncryptConfig,
|
|
19
19
|
encryptConfigSchema
|
|
20
|
-
} from "./chunk-
|
|
20
|
+
} from "./chunk-TBAIVO6T.js";
|
|
21
21
|
|
|
22
|
-
// src/encryption/
|
|
22
|
+
// src/encryption/index.ts
|
|
23
23
|
import { withResult as withResult11 } from "@byteslice/result";
|
|
24
24
|
import { newClient } from "@cipherstash/protect-ffi";
|
|
25
25
|
|
|
26
|
-
// src/encryption/
|
|
26
|
+
// src/encryption/helpers/type-guards.ts
|
|
27
27
|
function isScalarQueryTermArray(value) {
|
|
28
28
|
return Array.isArray(value) && value.length > 0 && typeof value[0] === "object" && value[0] !== null && "column" in value[0] && "table" in value[0];
|
|
29
29
|
}
|
|
30
30
|
|
|
31
|
-
// src/encryption/
|
|
31
|
+
// src/encryption/helpers/error-code.ts
|
|
32
32
|
import {
|
|
33
33
|
ProtectError as FfiProtectError
|
|
34
34
|
} from "@cipherstash/protect-ffi";
|
|
@@ -36,13 +36,13 @@ function getErrorCode(error) {
|
|
|
36
36
|
return error instanceof FfiProtectError ? error.code : void 0;
|
|
37
37
|
}
|
|
38
38
|
|
|
39
|
-
// src/encryption/
|
|
39
|
+
// src/encryption/operations/batch-encrypt-query.ts
|
|
40
40
|
import { withResult } from "@byteslice/result";
|
|
41
41
|
import {
|
|
42
42
|
encryptQueryBulk as ffiEncryptQueryBulk
|
|
43
43
|
} from "@cipherstash/protect-ffi";
|
|
44
44
|
|
|
45
|
-
// src/encryption/
|
|
45
|
+
// src/encryption/helpers/infer-index-type.ts
|
|
46
46
|
function inferIndexType(column) {
|
|
47
47
|
const config = column.build();
|
|
48
48
|
const indexes = config.indexes;
|
|
@@ -102,7 +102,7 @@ function resolveIndexType(column, queryType, plaintext) {
|
|
|
102
102
|
return { indexType };
|
|
103
103
|
}
|
|
104
104
|
|
|
105
|
-
// src/encryption/
|
|
105
|
+
// src/encryption/helpers/validation.ts
|
|
106
106
|
function validateNumericValue(value) {
|
|
107
107
|
if (typeof value === "number" && Number.isNaN(value)) {
|
|
108
108
|
return {
|
|
@@ -138,7 +138,7 @@ function assertValueIndexCompatibility(value, indexType, columnName) {
|
|
|
138
138
|
}
|
|
139
139
|
}
|
|
140
140
|
|
|
141
|
-
// src/encryption/
|
|
141
|
+
// src/encryption/operations/base-operation.ts
|
|
142
142
|
var EncryptionOperation = class {
|
|
143
143
|
auditMetadata;
|
|
144
144
|
/**
|
|
@@ -166,7 +166,7 @@ var EncryptionOperation = class {
|
|
|
166
166
|
}
|
|
167
167
|
};
|
|
168
168
|
|
|
169
|
-
// src/encryption/
|
|
169
|
+
// src/encryption/operations/batch-encrypt-query.ts
|
|
170
170
|
function filterNullTerms(terms) {
|
|
171
171
|
const nullIndices = /* @__PURE__ */ new Set();
|
|
172
172
|
const nonNullTerms = [];
|
|
@@ -321,7 +321,7 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
|
|
|
321
321
|
}
|
|
322
322
|
};
|
|
323
323
|
|
|
324
|
-
// src/encryption/
|
|
324
|
+
// src/encryption/operations/bulk-decrypt.ts
|
|
325
325
|
import { withResult as withResult2 } from "@byteslice/result";
|
|
326
326
|
import {
|
|
327
327
|
decryptBulkFallible
|
|
@@ -474,10 +474,10 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
|
|
|
474
474
|
}
|
|
475
475
|
};
|
|
476
476
|
|
|
477
|
-
// src/encryption/
|
|
477
|
+
// src/encryption/operations/bulk-decrypt-models.ts
|
|
478
478
|
import { withResult as withResult3 } from "@byteslice/result";
|
|
479
479
|
|
|
480
|
-
// src/encryption/
|
|
480
|
+
// src/encryption/helpers/model-helpers.ts
|
|
481
481
|
import {
|
|
482
482
|
decryptBulk,
|
|
483
483
|
encryptBulk
|
|
@@ -995,7 +995,7 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
|
|
|
995
995
|
});
|
|
996
996
|
}
|
|
997
997
|
|
|
998
|
-
// src/encryption/
|
|
998
|
+
// src/encryption/operations/bulk-decrypt-models.ts
|
|
999
999
|
var BulkDecryptModelsOperation = class extends EncryptionOperation {
|
|
1000
1000
|
client;
|
|
1001
1001
|
models;
|
|
@@ -1092,7 +1092,7 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
|
|
|
1092
1092
|
}
|
|
1093
1093
|
};
|
|
1094
1094
|
|
|
1095
|
-
// src/encryption/
|
|
1095
|
+
// src/encryption/operations/bulk-encrypt.ts
|
|
1096
1096
|
import { withResult as withResult4 } from "@byteslice/result";
|
|
1097
1097
|
import { encryptBulk as encryptBulk2 } from "@cipherstash/protect-ffi";
|
|
1098
1098
|
var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
|
|
@@ -1257,7 +1257,7 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
|
|
|
1257
1257
|
}
|
|
1258
1258
|
};
|
|
1259
1259
|
|
|
1260
|
-
// src/encryption/
|
|
1260
|
+
// src/encryption/operations/bulk-encrypt-models.ts
|
|
1261
1261
|
import { withResult as withResult5 } from "@byteslice/result";
|
|
1262
1262
|
var BulkEncryptModelsOperation = class extends EncryptionOperation {
|
|
1263
1263
|
client;
|
|
@@ -1366,7 +1366,7 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
|
|
|
1366
1366
|
}
|
|
1367
1367
|
};
|
|
1368
1368
|
|
|
1369
|
-
// src/encryption/
|
|
1369
|
+
// src/encryption/operations/decrypt.ts
|
|
1370
1370
|
import { withResult as withResult6 } from "@byteslice/result";
|
|
1371
1371
|
import {
|
|
1372
1372
|
decrypt as ffiDecrypt
|
|
@@ -1475,7 +1475,7 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
|
|
|
1475
1475
|
}
|
|
1476
1476
|
};
|
|
1477
1477
|
|
|
1478
|
-
// src/encryption/
|
|
1478
|
+
// src/encryption/operations/decrypt-model.ts
|
|
1479
1479
|
import { withResult as withResult7 } from "@byteslice/result";
|
|
1480
1480
|
var DecryptModelOperation = class extends EncryptionOperation {
|
|
1481
1481
|
client;
|
|
@@ -1571,7 +1571,7 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
|
|
|
1571
1571
|
}
|
|
1572
1572
|
};
|
|
1573
1573
|
|
|
1574
|
-
// src/encryption/
|
|
1574
|
+
// src/encryption/operations/encrypt.ts
|
|
1575
1575
|
import { withResult as withResult8 } from "@byteslice/result";
|
|
1576
1576
|
import {
|
|
1577
1577
|
encrypt as ffiEncrypt
|
|
@@ -1699,7 +1699,7 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
|
|
|
1699
1699
|
}
|
|
1700
1700
|
};
|
|
1701
1701
|
|
|
1702
|
-
// src/encryption/
|
|
1702
|
+
// src/encryption/operations/encrypt-model.ts
|
|
1703
1703
|
import { withResult as withResult9 } from "@byteslice/result";
|
|
1704
1704
|
var EncryptModelOperation = class extends EncryptionOperation {
|
|
1705
1705
|
client;
|
|
@@ -1806,7 +1806,7 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
|
|
|
1806
1806
|
}
|
|
1807
1807
|
};
|
|
1808
1808
|
|
|
1809
|
-
// src/encryption/
|
|
1809
|
+
// src/encryption/operations/encrypt-query.ts
|
|
1810
1810
|
import { withResult as withResult10 } from "@byteslice/result";
|
|
1811
1811
|
import {
|
|
1812
1812
|
encryptQuery as ffiEncryptQuery
|
|
@@ -1958,9 +1958,9 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
|
|
|
1958
1958
|
}
|
|
1959
1959
|
};
|
|
1960
1960
|
|
|
1961
|
-
// src/encryption/
|
|
1961
|
+
// src/encryption/index.ts
|
|
1962
1962
|
var noClientError = () => new Error(
|
|
1963
|
-
"The
|
|
1963
|
+
"The Encryption client has not been initialized. Please call init() before using the client."
|
|
1964
1964
|
);
|
|
1965
1965
|
var EncryptionClient = class {
|
|
1966
1966
|
client;
|
|
@@ -1983,7 +1983,7 @@ var EncryptionClient = class {
|
|
|
1983
1983
|
config.encryptConfig
|
|
1984
1984
|
);
|
|
1985
1985
|
logger.debug(
|
|
1986
|
-
"Initializing the
|
|
1986
|
+
"Initializing the Encryption client with the following config:",
|
|
1987
1987
|
{
|
|
1988
1988
|
encryptConfig: validated
|
|
1989
1989
|
}
|
|
@@ -1991,15 +1991,15 @@ var EncryptionClient = class {
|
|
|
1991
1991
|
this.client = await newClient({
|
|
1992
1992
|
encryptConfig: validated,
|
|
1993
1993
|
clientOpts: {
|
|
1994
|
-
workspaceCrn: config.workspaceCrn,
|
|
1995
|
-
accessKey: config.accessKey,
|
|
1996
|
-
clientId: config.clientId,
|
|
1997
|
-
clientKey: config.clientKey,
|
|
1994
|
+
workspaceCrn: config.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
|
|
1995
|
+
accessKey: config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
|
|
1996
|
+
clientId: config.clientId ?? process.env.CS_CLIENT_ID,
|
|
1997
|
+
clientKey: config.clientKey ?? process.env.CS_CLIENT_KEY,
|
|
1998
1998
|
keyset: toFfiKeysetIdentifier(config.keyset)
|
|
1999
1999
|
}
|
|
2000
2000
|
});
|
|
2001
2001
|
this.encryptConfig = validated;
|
|
2002
|
-
logger.debug("Successfully initialized the
|
|
2002
|
+
logger.debug("Successfully initialized the Encryption client.");
|
|
2003
2003
|
return this;
|
|
2004
2004
|
},
|
|
2005
2005
|
(error) => ({
|
|
@@ -2012,7 +2012,7 @@ var EncryptionClient = class {
|
|
|
2012
2012
|
* Encrypt a value - returns a promise which resolves to an encrypted value.
|
|
2013
2013
|
*
|
|
2014
2014
|
* @param plaintext - The plaintext value to be encrypted. Can be null.
|
|
2015
|
-
* @param opts - Options specifying the column and table for encryption.
|
|
2015
|
+
* @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
|
|
2016
2016
|
* @returns An EncryptOperation that can be awaited or chained with additional methods.
|
|
2017
2017
|
*
|
|
2018
2018
|
* @example
|
|
@@ -2075,8 +2075,11 @@ var EncryptionClient = class {
|
|
|
2075
2075
|
* .withLockContext(lockContext)
|
|
2076
2076
|
* ```
|
|
2077
2077
|
*
|
|
2078
|
+
* @see {@link EncryptOptions}
|
|
2078
2079
|
* @see {@link Result}
|
|
2079
2080
|
* @see {@link encryptedTable}
|
|
2081
|
+
* @see {@link encryptedColumn}
|
|
2082
|
+
* @see {@link encryptedField}
|
|
2080
2083
|
* @see {@link LockContext}
|
|
2081
2084
|
* @see {@link EncryptOperation}
|
|
2082
2085
|
*/
|
|
@@ -2144,10 +2147,16 @@ var EncryptionClient = class {
|
|
|
2144
2147
|
* All other fields are passed through unchanged. Returns a thenable operation
|
|
2145
2148
|
* that supports `.withLockContext()` for identity-aware encryption.
|
|
2146
2149
|
*
|
|
2150
|
+
* The return type is **schema-aware**: fields matching the table schema are
|
|
2151
|
+
* typed as `Encrypted`, while other fields retain their original types. For
|
|
2152
|
+
* best results, let TypeScript infer the type parameters from the arguments
|
|
2153
|
+
* rather than providing an explicit type argument.
|
|
2154
|
+
*
|
|
2147
2155
|
* @param input - The model object with plaintext values to encrypt.
|
|
2148
2156
|
* @param table - The table schema defining which fields to encrypt.
|
|
2149
|
-
* @returns An `EncryptModelOperation
|
|
2150
|
-
* containing the model with
|
|
2157
|
+
* @returns An `EncryptModelOperation` that can be awaited to get a `Result`
|
|
2158
|
+
* containing the model with schema-defined fields typed as `Encrypted`,
|
|
2159
|
+
* or an `EncryptionError`.
|
|
2151
2160
|
*
|
|
2152
2161
|
* @example
|
|
2153
2162
|
* ```typescript
|
|
@@ -2162,7 +2171,9 @@ var EncryptionClient = class {
|
|
|
2162
2171
|
*
|
|
2163
2172
|
* const client = await Encryption({ schemas: [usersSchema] })
|
|
2164
2173
|
*
|
|
2165
|
-
*
|
|
2174
|
+
* // Let TypeScript infer the return type from the schema.
|
|
2175
|
+
* // result.data.email is typed as `Encrypted`, result.data.id stays `string`.
|
|
2176
|
+
* const result = await client.encryptModel(
|
|
2166
2177
|
* { id: "user_123", email: "alice@example.com", createdAt: new Date() },
|
|
2167
2178
|
* usersSchema,
|
|
2168
2179
|
* )
|
|
@@ -2170,13 +2181,17 @@ var EncryptionClient = class {
|
|
|
2170
2181
|
* if (result.failure) {
|
|
2171
2182
|
* console.error(result.failure.message)
|
|
2172
2183
|
* } else {
|
|
2173
|
-
*
|
|
2174
|
-
* console.log(result.data)
|
|
2184
|
+
* console.log(result.data.id) // string
|
|
2185
|
+
* console.log(result.data.email) // Encrypted
|
|
2175
2186
|
* }
|
|
2176
2187
|
* ```
|
|
2177
2188
|
*/
|
|
2178
2189
|
encryptModel(input, table) {
|
|
2179
|
-
return new EncryptModelOperation(
|
|
2190
|
+
return new EncryptModelOperation(
|
|
2191
|
+
this.client,
|
|
2192
|
+
input,
|
|
2193
|
+
table
|
|
2194
|
+
);
|
|
2180
2195
|
}
|
|
2181
2196
|
/**
|
|
2182
2197
|
* Decrypt a model (object) whose fields contain encrypted values.
|
|
@@ -2216,10 +2231,15 @@ var EncryptionClient = class {
|
|
|
2216
2231
|
* while still using a unique key for each encrypted value. Only fields
|
|
2217
2232
|
* matching the table schema are encrypted; other fields pass through unchanged.
|
|
2218
2233
|
*
|
|
2234
|
+
* The return type is **schema-aware**: fields matching the table schema are
|
|
2235
|
+
* typed as `Encrypted`, while other fields retain their original types. For
|
|
2236
|
+
* best results, let TypeScript infer the type parameters from the arguments.
|
|
2237
|
+
*
|
|
2219
2238
|
* @param input - An array of model objects with plaintext values to encrypt.
|
|
2220
2239
|
* @param table - The table schema defining which fields to encrypt.
|
|
2221
|
-
* @returns A `BulkEncryptModelsOperation
|
|
2222
|
-
* containing an array of models with
|
|
2240
|
+
* @returns A `BulkEncryptModelsOperation` that can be awaited to get a `Result`
|
|
2241
|
+
* containing an array of models with schema-defined fields typed as `Encrypted`,
|
|
2242
|
+
* or an `EncryptionError`.
|
|
2223
2243
|
*
|
|
2224
2244
|
* @example
|
|
2225
2245
|
* ```typescript
|
|
@@ -2234,7 +2254,9 @@ var EncryptionClient = class {
|
|
|
2234
2254
|
*
|
|
2235
2255
|
* const client = await Encryption({ schemas: [usersSchema] })
|
|
2236
2256
|
*
|
|
2237
|
-
*
|
|
2257
|
+
* // Let TypeScript infer the return type from the schema.
|
|
2258
|
+
* // Each item's email is typed as `Encrypted`, id stays `string`.
|
|
2259
|
+
* const result = await client.bulkEncryptModels(
|
|
2238
2260
|
* [
|
|
2239
2261
|
* { id: "1", email: "alice@example.com" },
|
|
2240
2262
|
* { id: "2", email: "bob@example.com" },
|
|
@@ -2248,7 +2270,11 @@ var EncryptionClient = class {
|
|
|
2248
2270
|
* ```
|
|
2249
2271
|
*/
|
|
2250
2272
|
bulkEncryptModels(input, table) {
|
|
2251
|
-
return new BulkEncryptModelsOperation(
|
|
2273
|
+
return new BulkEncryptModelsOperation(
|
|
2274
|
+
this.client,
|
|
2275
|
+
input,
|
|
2276
|
+
table
|
|
2277
|
+
);
|
|
2252
2278
|
}
|
|
2253
2279
|
/**
|
|
2254
2280
|
* Decrypt multiple models (objects) in a single bulk operation.
|
|
@@ -2289,7 +2315,7 @@ var EncryptionClient = class {
|
|
|
2289
2315
|
* your application data. Null plaintext values are preserved as null.
|
|
2290
2316
|
*
|
|
2291
2317
|
* @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
|
|
2292
|
-
* @param opts - Options specifying the target column and table
|
|
2318
|
+
* @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
|
|
2293
2319
|
* @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
|
|
2294
2320
|
* containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
|
|
2295
2321
|
*
|
|
@@ -2397,4 +2423,4 @@ var Encryption = async (config) => {
|
|
|
2397
2423
|
export {
|
|
2398
2424
|
Encryption
|
|
2399
2425
|
};
|
|
2400
|
-
//# sourceMappingURL=chunk-
|
|
2426
|
+
//# sourceMappingURL=chunk-MW6D52V2.js.map
|