@cipherstash/stack 0.1.0

package/dist/chunk-7XRPN2KX.js

@@ -0,0 +1,336 @@
+// src/schema/index.ts
+import { z } from "zod";
+var castAsEnum = z.enum(["bigint", "boolean", "date", "number", "string", "json"]).default("string");
+var tokenFilterSchema = z.object({
+  kind: z.literal("downcase")
+});
+var tokenizerSchema = z.union([
+  z.object({
+    kind: z.literal("standard")
+  }),
+  z.object({
+    kind: z.literal("ngram"),
+    token_length: z.number()
+  })
+]).default({ kind: "ngram", token_length: 3 }).optional();
+var oreIndexOptsSchema = z.object({});
+var uniqueIndexOptsSchema = z.object({
+  token_filters: z.array(tokenFilterSchema).default([]).optional()
+});
+var matchIndexOptsSchema = z.object({
+  tokenizer: tokenizerSchema,
+  token_filters: z.array(tokenFilterSchema).default([]).optional(),
+  k: z.number().default(6).optional(),
+  m: z.number().default(2048).optional(),
+  include_original: z.boolean().default(false).optional()
+});
+var steVecIndexOptsSchema = z.object({
+  prefix: z.string()
+});
+var indexesSchema = z.object({
+  ore: oreIndexOptsSchema.optional(),
+  unique: uniqueIndexOptsSchema.optional(),
+  match: matchIndexOptsSchema.optional(),
+  ste_vec: steVecIndexOptsSchema.optional()
+}).default({});
+var columnSchema = z.object({
+  cast_as: castAsEnum,
+  indexes: indexesSchema
+}).default({});
+var tableSchema = z.record(columnSchema).default({});
+var tablesSchema = z.record(tableSchema).default({});
+var encryptConfigSchema = z.object({
+  v: z.number(),
+  tables: tablesSchema
+});
+var ProtectValue = class {
+  valueName;
+  castAsValue;
+  constructor(valueName) {
+    this.valueName = valueName;
+    this.castAsValue = "string";
+  }
+  /**
+   * Set or override the plaintext data type for this value.
+   *
+   * By default all values are treated as `'string'`. Use this method to specify
+   * a different type so the encryption layer knows how to encode the plaintext
+   * before encrypting.
+   *
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+   * @returns This `ProtectValue` instance for method chaining.
+   *
+   * @example
+   * ```typescript
+   * import { encryptedValue } from "@cipherstash/stack/schema"
+   *
+   * const age = encryptedValue("age").dataType("number")
+   * ```
+   */
+  dataType(castAs) {
+    this.castAsValue = castAs;
+    return this;
+  }
+  build() {
+    return {
+      cast_as: this.castAsValue,
+      indexes: {}
+    };
+  }
+  getName() {
+    return this.valueName;
+  }
+};
+var ProtectColumn = class {
+  columnName;
+  castAsValue;
+  indexesValue = {};
+  constructor(columnName) {
+    this.columnName = columnName;
+    this.castAsValue = "string";
+  }
+  /**
+   * Set or override the plaintext data type for this column.
+   *
+   * By default all columns are treated as `'string'`. Use this method to specify
+   * a different type so the encryption layer knows how to encode the plaintext
+   * before encrypting.
+   *
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+   * @returns This `ProtectColumn` instance for method chaining.
+   *
+   * @example
+   * ```typescript
+   * import { encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * const dateOfBirth = encryptedColumn("date_of_birth").dataType("date")
+   * ```
+   */
+  dataType(castAs) {
+    this.castAsValue = castAs;
+    return this;
+  }
+  /**
+   * Enable Order-Revealing Encryption (ORE) indexing on this column.
+   *
+   * ORE allows sorting, comparison, and range queries on encrypted data.
+   * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
+   *
+   * @returns This `ProtectColumn` instance for method chaining.
+   *
+   * @example
+   * ```typescript
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * const users = encryptedTable("users", {
+   *   email: encryptedColumn("email").orderAndRange(),
+   * })
+   * ```
+   */
+  orderAndRange() {
+    this.indexesValue.ore = {};
+    return this;
+  }
+  /**
+   * Enable an exact-match (unique) index on this column.
+   *
+   * Allows equality queries on encrypted data. Use with `encryptQuery`
+   * and `queryType: 'equality'`.
+   *
+   * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
+   *   When omitted, no token filters are applied.
+   * @returns This `ProtectColumn` instance for method chaining.
+   *
+   * @example
+   * ```typescript
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * const users = encryptedTable("users", {
+   *   email: encryptedColumn("email").equality(),
+   * })
+   * ```
+   */
+  equality(tokenFilters) {
+    this.indexesValue.unique = {
+      token_filters: tokenFilters ?? []
+    };
+    return this;
+  }
+  /**
+   * Enable a full-text / fuzzy search (match) index on this column.
+   *
+   * Uses n-gram tokenization by default for substring and fuzzy matching.
+   * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.
+   *
+   * @param opts - Optional match index configuration. Defaults to 3-character ngram
+   *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
+   * @returns This `ProtectColumn` instance for method chaining.
+   *
+   * @example
+   * ```typescript
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * const users = encryptedTable("users", {
+   *   email: encryptedColumn("email").freeTextSearch(),
+   * })
+   *
+   * // With custom options
+   * const posts = encryptedTable("posts", {
+   *   body: encryptedColumn("body").freeTextSearch({
+   *     tokenizer: { kind: "ngram", token_length: 4 },
+   *     k: 8,
+   *     m: 4096,
+   *   }),
+   * })
+   * ```
+   */
+  freeTextSearch(opts) {
+    this.indexesValue.match = {
+      tokenizer: opts?.tokenizer ?? { kind: "ngram", token_length: 3 },
+      token_filters: opts?.token_filters ?? [
+        {
+          kind: "downcase"
+        }
+      ],
+      k: opts?.k ?? 6,
+      m: opts?.m ?? 2048,
+      include_original: opts?.include_original ?? true
+    };
+    return this;
+  }
+  /**
+   * Configure this column for searchable encrypted JSON (STE-Vec).
+   *
+   * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and
+   * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the
+   * data type to `'json'`.
+   *
+   * When used with `encryptQuery`, the query operation is auto-inferred from
+   * the plaintext type: strings become selector queries, objects/arrays become
+   * containment queries.
+   *
+   * @returns This `ProtectColumn` instance for method chaining.
+   *
+   * @example
+   * ```typescript
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * const documents = encryptedTable("documents", {
+   *   metadata: encryptedColumn("metadata").searchableJson(),
+   * })
+   * ```
+   */
+  searchableJson() {
+    this.castAsValue = "json";
+    this.indexesValue.ste_vec = { prefix: "enabled" };
+    return this;
+  }
+  build() {
+    return {
+      cast_as: this.castAsValue,
+      indexes: this.indexesValue
+    };
+  }
+  getName() {
+    return this.columnName;
+  }
+};
+var ProtectTable = class {
+  constructor(tableName, columnBuilders) {
+    this.tableName = tableName;
+    this.columnBuilders = columnBuilders;
+  }
+  /**
+   * Compile this table schema into a `TableDefinition` used internally by the encryption client.
+   *
+   * Iterates over all column builders, calls `.build()` on each, and assembles
+   * the final `{ tableName, columns }` structure. For `searchableJson()` columns,
+   * the STE-Vec prefix is automatically set to `"<tableName>/<columnName>"`.
+   *
+   * @returns A `TableDefinition` containing the table name and built column configs.
+   *
+   * @example
+   * ```typescript
+   * const users = encryptedTable("users", {
+   *   email: encryptedColumn("email").equality(),
+   * })
+   *
+   * const definition = users.build()
+   * // { tableName: "users", columns: { email: { cast_as: "string", indexes: { unique: ... } } } }
+   * ```
+   */
+  build() {
+    const builtColumns = {};
+    const processColumn = (builder, colName) => {
+      if (builder instanceof ProtectColumn) {
+        const builtColumn = builder.build();
+        if (builtColumn.cast_as === "json" && builtColumn.indexes.ste_vec?.prefix === "enabled") {
+          builtColumns[colName] = {
+            ...builtColumn,
+            indexes: {
+              ...builtColumn.indexes,
+              ste_vec: {
+                prefix: `${this.tableName}/${colName}`
+              }
+            }
+          };
+        } else {
+          builtColumns[colName] = builtColumn;
+        }
+      } else {
+        for (const [key, value] of Object.entries(builder)) {
+          if (value instanceof ProtectValue) {
+            builtColumns[value.getName()] = value.build();
+          } else {
+            processColumn(value, key);
+          }
+        }
+      }
+    };
+    for (const [colName, builder] of Object.entries(this.columnBuilders)) {
+      processColumn(builder, colName);
+    }
+    return {
+      tableName: this.tableName,
+      columns: builtColumns
+    };
+  }
+};
+function encryptedTable(tableName, columns) {
+  const tableBuilder = new ProtectTable(tableName, columns);
+  for (const [colName, colBuilder] of Object.entries(columns)) {
+    ;
+    tableBuilder[colName] = colBuilder;
+  }
+  return tableBuilder;
+}
+function encryptedColumn(columnName) {
+  return new ProtectColumn(columnName);
+}
+function encryptedValue(valueName) {
+  return new ProtectValue(valueName);
+}
+function buildEncryptConfig(...protectTables) {
+  const config = {
+    v: 2,
+    tables: {}
+  };
+  for (const tb of protectTables) {
+    const tableDef = tb.build();
+    config.tables[tableDef.tableName] = tableDef.columns;
+  }
+  return config;
+}
+
+export {
+  castAsEnum,
+  encryptConfigSchema,
+  ProtectValue,
+  ProtectColumn,
+  ProtectTable,
+  encryptedTable,
+  encryptedColumn,
+  encryptedValue,
+  buildEncryptConfig
+};
+//# sourceMappingURL=chunk-7XRPN2KX.js.map

package/dist/chunk-7XRPN2KX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema/index.ts"],"sourcesContent":["import type { Encrypted } from '@/types'\nimport { z } from 'zod'\n\n// ------------------------\n// Zod schemas\n// ------------------------\n\n/**\n * Allowed cast types for CipherStash schema fields.\n *\n * **Possible values:**\n * - `\"bigint\"`\n * - `\"boolean\"`\n * - `\"date\"`\n * - `\"number\"`\n * - `\"string\"`\n * - `\"json\"`\n *\n * @remarks\n * This is a Zod enum used at runtime to validate schema definitions.\n * Use {@link CastAs} when typing your own code.\n *\n * @internal\n */\nexport const castAsEnum = z\n  .enum(['bigint', 'boolean', 'date', 'number', 'string', 'json'])\n  .default('string')\n\nconst tokenFilterSchema = z.object({\n  kind: z.literal('downcase'),\n})\n\nconst tokenizerSchema = z\n  .union([\n    z.object({\n      kind: z.literal('standard'),\n    }),\n    z.object({\n      kind: z.literal('ngram'),\n      token_length: z.number(),\n    }),\n  ])\n  .default({ kind: 'ngram', token_length: 3 })\n  .optional()\n\nconst oreIndexOptsSchema = z.object({})\n\nconst uniqueIndexOptsSchema = z.object({\n  token_filters: z.array(tokenFilterSchema).default([]).optional(),\n})\n\nconst matchIndexOptsSchema = z.object({\n  tokenizer: tokenizerSchema,\n  token_filters: z.array(tokenFilterSchema).default([]).optional(),\n  k: z.number().default(6).optional(),\n  m: z.number().default(2048).optional(),\n  include_original: z.boolean().default(false).optional(),\n})\n\nconst steVecIndexOptsSchema = z.object({\n  prefix: z.string(),\n})\n\nconst indexesSchema = z\n  .object({\n    ore: oreIndexOptsSchema.optional(),\n    unique: uniqueIndexOptsSchema.optional(),\n    match: matchIndexOptsSchema.optional(),\n    ste_vec: steVecIndexOptsSchema.optional(),\n  })\n  .default({})\n\nconst columnSchema = z\n  .object({\n    cast_as: castAsEnum,\n    indexes: indexesSchema,\n  })\n  .default({})\n\nconst tableSchema = z.record(columnSchema).default({})\n\nconst tablesSchema = z.record(tableSchema).default({})\n\n/** @internal */\nexport const encryptConfigSchema = z.object({\n  v: z.number(),\n  tables: tablesSchema,\n})\n\n// ------------------------\n// Type definitions\n// ------------------------\n\n/**\n * Type-safe alias for {@link castAsEnum} used to specify the *unencrypted* data type of a column or value.\n * This is important because once encrypted, all data is stored as binary blobs.\n *\n * @see {@link castAsEnum} for possible values.\n */\nexport type CastAs = z.infer<typeof castAsEnum>\nexport type TokenFilter = z.infer<typeof tokenFilterSchema>\nexport type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>\nexport type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>\nexport type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>\nexport type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>\nexport type ColumnSchema = z.infer<typeof columnSchema>\n\nexport type ProtectTableColumn = {\n  [key: string]:\n    | ProtectColumn\n    | {\n        [key: string]:\n          | ProtectValue\n          | {\n              [key: string]:\n                | ProtectValue\n                | {\n                    [key: string]: ProtectValue\n                  }\n            }\n      }\n}\nexport type EncryptConfig = z.infer<typeof encryptConfigSchema>\n\n// ------------------------\n// Interface definitions\n// ------------------------\nexport class ProtectValue {\n  private valueName: string\n  private castAsValue: CastAs\n\n  constructor(valueName: string) {\n    this.valueName = valueName\n    this.castAsValue = 'string'\n  }\n\n  /**\n   * Set or override the plaintext data type for this value.\n   *\n   * By default all values are treated as `'string'`. Use this method to specify\n   * a different type so the encryption layer knows how to encode the plaintext\n   * before encrypting.\n   *\n   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.\n   * @returns This `ProtectValue` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedValue } from \"@cipherstash/stack/schema\"\n   *\n   * const age = encryptedValue(\"age\").dataType(\"number\")\n   * ```\n   */\n  dataType(castAs: CastAs) {\n    this.castAsValue = castAs\n    return this\n  }\n\n  build() {\n    return {\n      cast_as: this.castAsValue,\n      indexes: {},\n    }\n  }\n\n  getName() {\n    return this.valueName\n  }\n}\n\nexport class ProtectColumn {\n  private columnName: string\n  private castAsValue: CastAs\n  private indexesValue: {\n    ore?: OreIndexOpts\n    unique?: UniqueIndexOpts\n    match?: Required<MatchIndexOpts>\n    ste_vec?: SteVecIndexOpts\n  } = {}\n\n  constructor(columnName: string) {\n    this.columnName = columnName\n    this.castAsValue = 'string'\n  }\n\n  /**\n   * Set or override the plaintext data type for this column.\n   *\n   * By default all columns are treated as `'string'`. Use this method to specify\n   * a different type so the encryption layer knows how to encode the plaintext\n   * before encrypting.\n   *\n   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.\n   * @returns This `ProtectColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const dateOfBirth = encryptedColumn(\"date_of_birth\").dataType(\"date\")\n   * ```\n   */\n  dataType(castAs: CastAs) {\n    this.castAsValue = castAs\n    return this\n  }\n\n  /**\n   * Enable Order-Revealing Encryption (ORE) indexing on this column.\n   *\n   * ORE allows sorting, comparison, and range queries on encrypted data.\n   * Use with `encryptQuery` and `queryType: 'orderAndRange'`.\n   *\n   * @returns This `ProtectColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").orderAndRange(),\n   * })\n   * ```\n   */\n  orderAndRange() {\n    this.indexesValue.ore = {}\n    return this\n  }\n\n  /**\n   * Enable an exact-match (unique) index on this column.\n   *\n   * Allows equality queries on encrypted data. Use with `encryptQuery`\n   * and `queryType: 'equality'`.\n   *\n   * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).\n   *   When omitted, no token filters are applied.\n   * @returns This `ProtectColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").equality(),\n   * })\n   * ```\n   */\n  equality(tokenFilters?: TokenFilter[]) {\n    this.indexesValue.unique = {\n      token_filters: tokenFilters ?? [],\n    }\n    return this\n  }\n\n  /**\n   * Enable a full-text / fuzzy search (match) index on this column.\n   *\n   * Uses n-gram tokenization by default for substring and fuzzy matching.\n   * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.\n   *\n   * @param opts - Optional match index configuration. Defaults to 3-character ngram\n   *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.\n   * @returns This `ProtectColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").freeTextSearch(),\n   * })\n   *\n   * // With custom options\n   * const posts = encryptedTable(\"posts\", {\n   *   body: encryptedColumn(\"body\").freeTextSearch({\n   *     tokenizer: { kind: \"ngram\", token_length: 4 },\n   *     k: 8,\n   *     m: 4096,\n   *   }),\n   * })\n   * ```\n   */\n  freeTextSearch(opts?: MatchIndexOpts) {\n    // Provide defaults\n    this.indexesValue.match = {\n      tokenizer: opts?.tokenizer ?? { kind: 'ngram', token_length: 3 },\n      token_filters: opts?.token_filters ?? [\n        {\n          kind: 'downcase',\n        },\n      ],\n      k: opts?.k ?? 6,\n      m: opts?.m ?? 2048,\n      include_original: opts?.include_original ?? true,\n    }\n    return this\n  }\n\n  /**\n   * Configure this column for searchable encrypted JSON (STE-Vec).\n   *\n   * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and\n   * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the\n   * data type to `'json'`.\n   *\n   * When used with `encryptQuery`, the query operation is auto-inferred from\n   * the plaintext type: strings become selector queries, objects/arrays become\n   * containment queries.\n   *\n   * @returns This `ProtectColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const documents = encryptedTable(\"documents\", {\n   *   metadata: encryptedColumn(\"metadata\").searchableJson(),\n   * })\n   * ```\n   */\n  searchableJson() {\n    this.castAsValue = 'json'\n    this.indexesValue.ste_vec = { prefix: 'enabled' }\n    return this\n  }\n\n  build() {\n    return {\n      cast_as: this.castAsValue,\n      indexes: this.indexesValue,\n    }\n  }\n\n  getName() {\n    return this.columnName\n  }\n}\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\nexport class ProtectTable<T extends ProtectTableColumn> {\n  constructor(\n    public readonly tableName: string,\n    private readonly columnBuilders: T,\n  ) {}\n\n  /**\n   * Compile this table schema into a `TableDefinition` used internally by the encryption client.\n   *\n   * Iterates over all column builders, calls `.build()` on each, and assembles\n   * the final `{ tableName, columns }` structure. For `searchableJson()` columns,\n   * the STE-Vec prefix is automatically set to `\"<tableName>/<columnName>\"`.\n   *\n   * @returns A `TableDefinition` containing the table name and built column configs.\n   *\n   * @example\n   * ```typescript\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").equality(),\n   * })\n   *\n   * const definition = users.build()\n   * // { tableName: \"users\", columns: { email: { cast_as: \"string\", indexes: { unique: ... } } } }\n   * ```\n   */\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n\n    const processColumn = (\n      builder:\n        | ProtectColumn\n        | Record<\n            string,\n            | ProtectValue\n            | Record<\n                string,\n                | ProtectValue\n                | Record<string, ProtectValue | Record<string, ProtectValue>>\n              >\n          >,\n      colName: string,\n    ) => {\n      if (builder instanceof ProtectColumn) {\n        const builtColumn = builder.build()\n\n        // Hanlde building the ste_vec index for JSON columns so users don't have to pass the prefix.\n        if (\n          builtColumn.cast_as === 'json' &&\n          builtColumn.indexes.ste_vec?.prefix === 'enabled'\n        ) {\n          builtColumns[colName] = {\n            ...builtColumn,\n            indexes: {\n              ...builtColumn.indexes,\n              ste_vec: {\n                prefix: `${this.tableName}/${colName}`,\n              },\n            },\n          }\n        } else {\n          builtColumns[colName] = builtColumn\n        }\n      } else {\n        for (const [key, value] of Object.entries(builder)) {\n          if (value instanceof ProtectValue) {\n            builtColumns[value.getName()] = value.build()\n          } else {\n            processColumn(value, key)\n          }\n        }\n      }\n    }\n\n    for (const [colName, builder] of Object.entries(this.columnBuilders)) {\n      processColumn(builder, colName)\n    }\n\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n}\n\n// ------------------------\n// Schema type inference helpers\n// ------------------------\n\n/**\n * Infer the plaintext (decrypted) type from a ProtectTable schema.\n *\n * @example\n * ```typescript\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n *   name: encryptedColumn(\"name\"),\n * })\n *\n * type UserPlaintext = InferPlaintext<typeof users>\n * // => { email: string; name: string }\n * ```\n */\nexport type InferPlaintext<T extends ProtectTable<any>> =\n  T extends ProtectTable<infer C>\n    ? {\n        [K in keyof C as C[K] extends ProtectColumn | ProtectValue\n          ? K\n          : never]: string\n      }\n    : never\n\n/**\n * Infer the encrypted type from a ProtectTable schema.\n *\n * @example\n * ```typescript\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * type UserEncrypted = InferEncrypted<typeof users>\n * // => { email: Encrypted }\n * ```\n */\nexport type InferEncrypted<T extends ProtectTable<any>> =\n  T extends ProtectTable<infer C>\n    ? {\n        [K in keyof C as C[K] extends ProtectColumn | ProtectValue\n          ? K\n          : never]: Encrypted\n      }\n    : never\n\n// ------------------------\n// User facing functions\n// ------------------------\n\n/**\n * Define an encrypted table schema.\n *\n * Creates a `ProtectTable` that maps a database table name to a set of encrypted\n * column definitions. Pass the resulting object to `Encryption({ schemas: [...] })`\n * when initializing the client.\n *\n * The returned object is also a proxy that exposes each column builder directly,\n * so you can reference columns as `users.email` when calling `encrypt`, `decrypt`,\n * and `encryptQuery`.\n *\n * @param tableName - The name of the database table this schema represents.\n * @param columns - An object whose keys are logical column names and values are\n *   `ProtectColumn` instances created with {@link encryptedColumn}.\n * @returns A `ProtectTable<T> & T` that can be used as both a schema definition\n *   and a column accessor.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality().freeTextSearch(),\n *   address: encryptedColumn(\"address\"),\n * })\n *\n * // Use as schema\n * const client = await Encryption({ schemas: [users] })\n *\n * // Use as column accessor\n * await client.encrypt(\"hello@example.com\", { column: users.email, table: users })\n * ```\n */\nexport function encryptedTable<T extends ProtectTableColumn>(\n  tableName: string,\n  columns: T,\n): ProtectTable<T> & T {\n  const tableBuilder = new ProtectTable(tableName, columns) as ProtectTable<T> &\n    T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    ;(tableBuilder as ProtectTableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Define an encrypted column within a table schema.\n *\n * Creates a `ProtectColumn` builder for the given column name. Chain index\n * methods (`.equality()`, `.freeTextSearch()`, `.orderAndRange()`,\n * `.searchableJson()`) and/or `.dataType()` to configure searchable encryption\n * and the plaintext data type.\n *\n * @param columnName - The name of the database column to encrypt.\n * @returns A new `ProtectColumn` builder.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality().freeTextSearch().orderAndRange(),\n * })\n * ```\n */\nexport function encryptedColumn(columnName: string) {\n  return new ProtectColumn(columnName)\n}\n\n/**\n * Define an encrypted value for use in nested or structured schemas.\n *\n * `encryptedValue` is similar to {@link encryptedColumn} but creates a `ProtectValue`\n * intended for nested fields within a table schema. It supports `.dataType()`\n * for specifying the plaintext type.\n *\n * @param valueName - The name of the value field.\n * @returns A new `ProtectValue` builder.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedValue } from \"@cipherstash/stack/schema\"\n *\n * const orders = encryptedTable(\"orders\", {\n *   details: {\n *     amount: encryptedValue(\"amount\").dataType(\"number\"),\n *     currency: encryptedValue(\"currency\"),\n *   },\n * })\n * ```\n */\nexport function encryptedValue(valueName: string) {\n  return new ProtectValue(valueName)\n}\n\n// ------------------------\n// Internal functions\n// ------------------------\n\n/** @internal */\nexport function buildEncryptConfig(\n  ...protectTables: Array<ProtectTable<ProtectTableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 2,\n    tables: {},\n  }\n\n  for (const tb of protectTables) {\n    const tableDef = tb.build()\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n"],"mappings":";AACA,SAAS,SAAS;AAuBX,IAAM,aAAa,EACvB,KAAK,CAAC,UAAU,WAAW,QAAQ,UAAU,UAAU,MAAM,CAAC,EAC9D,QAAQ,QAAQ;AAEnB,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,MAAM,EAAE,QAAQ,UAAU;AAC5B,CAAC;AAED,IAAM,kBAAkB,EACrB,MAAM;AAAA,EACL,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,EAC5B,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,cAAc,EAAE,OAAO;AAAA,EACzB,CAAC;AACH,CAAC,EACA,QAAQ,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC,EAC1C,SAAS;AAEZ,IAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAEtC,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,eAAe,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AACjE,CAAC;AAED,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,WAAW;AAAA,EACX,eAAe,EAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,EAC/D,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,SAAS;AACxD,CAAC;AAED,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,IAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,KAAK,mBAAmB,SAAS;AAAA,EACjC,QAAQ,sBAAsB,SAAS;AAAA,EACvC,OAAO,qBAAqB,SAAS;AAAA,EACrC,SAAS,sBAAsB,SAAS;AAC1C,CAAC,EACA,QAAQ,CAAC,CAAC;AAEb,IAAM,eAAe,EAClB,OAAO;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AACX,CAAC,EACA,QAAQ,CAAC,CAAC;AAEb,IAAM,cAAc,EAAE,OAAO,YAAY,EAAE,QAAQ,CAAC,CAAC;AAErD,IAAM,eAAe,EAAE,OAAO,WAAW,EAAE,QAAQ,CAAC,CAAC;AAG9C,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,GAAG,EAAE,OAAO;AAAA,EACZ,QAAQ;AACV,CAAC;AAwCM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACA;AAAA,EAER,YAAY,WAAmB;AAC7B,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,QAAgB;AACvB,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,SAAS,CAAC;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,UAAU;AACR,WAAO,KAAK;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACjB;AAAA,EACA;AAAA,EACA,eAKJ,CAAC;AAAA,EAEL,YAAY,YAAoB;AAC9B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,QAAgB;AACvB,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,gBAAgB;AACd,SAAK,aAAa,MAAM,CAAC;AACzB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,SAAS,cAA8B;AACrC,SAAK,aAAa,SAAS;AAAA,MACzB,eAAe,gBAAgB,CAAC;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,eAAe,MAAuB;AAEpC,SAAK,aAAa,QAAQ;AAAA,MACxB,WAAW,MAAM,aAAa,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,MAC/D,eAAe,MAAM,iBAAiB;AAAA,QACpC;AAAA,UACE,MAAM;AAAA,QACR;AAAA,MACF;AAAA,MACA,GAAG,MAAM,KAAK;AAAA,MACd,GAAG,MAAM,KAAK;AAAA,MACd,kBAAkB,MAAM,oBAAoB;AAAA,IAC9C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,iBAAiB;AACf,SAAK,cAAc;AACnB,SAAK,aAAa,UAAU,EAAE,QAAQ,UAAU;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,UAAU;AACR,WAAO,KAAK;AAAA,EACd;AACF;AAOO,IAAM,eAAN,MAAiD;AAAA,EACtD,YACkB,WACC,gBACjB;AAFgB;AACC;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBH,QAAyB;AACvB,UAAM,eAA6C,CAAC;AAEpD,UAAM,gBAAgB,CACpB,SAWA,YACG;AACH,UAAI,mBAAmB,eAAe;AACpC,cAAM,cAAc,QAAQ,MAAM;AAGlC,YACE,YAAY,YAAY,UACxB,YAAY,QAAQ,SAAS,WAAW,WACxC;AACA,uBAAa,OAAO,IAAI;AAAA,YACtB,GAAG;AAAA,YACH,SAAS;AAAA,cACP,GAAG,YAAY;AAAA,cACf,SAAS;AAAA,gBACP,QAAQ,GAAG,KAAK,SAAS,IAAI,OAAO;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AACL,uBAAa,OAAO,IAAI;AAAA,QAC1B;AAAA,MACF,OAAO;AACL,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,cAAI,iBAAiB,cAAc;AACjC,yBAAa,MAAM,QAAQ,CAAC,IAAI,MAAM,MAAM;AAAA,UAC9C,OAAO;AACL,0BAAc,OAAO,GAAG;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACpE,oBAAc,SAAS,OAAO;AAAA,IAChC;AAEA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAwFO,SAAS,eACd,WACA,SACqB;AACrB,QAAM,eAAe,IAAI,aAAa,WAAW,OAAO;AAGxD,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D;AAAC,IAAC,aAAoC,OAAO,IAAI;AAAA,EACnD;AAEA,SAAO;AACT;AAsBO,SAAS,gBAAgB,YAAoB;AAClD,SAAO,IAAI,cAAc,UAAU;AACrC;AAwBO,SAAS,eAAe,WAAmB;AAChD,SAAO,IAAI,aAAa,SAAS;AACnC;AAOO,SAAS,sBACX,eACY;AACf,QAAM,SAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,QAAQ,CAAC;AAAA,EACX;AAEA,aAAW,MAAM,eAAe;AAC9B,UAAM,WAAW,GAAG,MAAM;AAC1B,WAAO,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,EAC/C;AAEA,SAAO;AACT;","names":[]}

package/dist/chunk-SJ7JO4ME.js

@@ -0,0 +1,28 @@
+// src/types.ts
+var queryTypes = {
+  orderAndRange: "orderAndRange",
+  freeTextSearch: "freeTextSearch",
+  equality: "equality",
+  steVecSelector: "steVecSelector",
+  steVecTerm: "steVecTerm",
+  searchableJson: "searchableJson"
+};
+var queryTypeToFfi = {
+  orderAndRange: "ore",
+  freeTextSearch: "match",
+  equality: "unique",
+  steVecSelector: "ste_vec",
+  steVecTerm: "ste_vec",
+  searchableJson: "ste_vec"
+};
+var queryTypeToQueryOp = {
+  steVecSelector: "ste_vec_selector",
+  steVecTerm: "ste_vec_term"
+};
+
+export {
+  queryTypes,
+  queryTypeToFfi,
+  queryTypeToQueryOp
+};
+//# sourceMappingURL=chunk-SJ7JO4ME.js.map

package/dist/chunk-SJ7JO4ME.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  ProtectColumn,\n  ProtectTable,\n  ProtectTableColumn,\n  ProtectValue,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'> | null\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted | null\n\nexport type EncryptPayload = JsPlaintext | null\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<ProtectTable<ProtectTableColumn>>\n  config?: ClientConfig\n  logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\nexport type EncryptOptions = {\n  column: ProtectColumn | ProtectValue\n  table: ProtectTable<ProtectTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: ProtectColumn\n  table: ProtectTable<ProtectTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL, composite literal string, or null */\nexport type EncryptedQueryResult = Encrypted | string | null\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? K : never]: string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext | null\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: ProtectColumn\n  table: ProtectTable<ProtectTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext | null\n}\n"],"mappings":";AA0LO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}

package/dist/chunk-SUYMGQBY.js

@@ -0,0 +1,67 @@
+// src/encryption/helpers/index.ts
+function encryptedToPgComposite(obj) {
+  return {
+    data: obj
+  };
+}
+function encryptedToCompositeLiteral(obj) {
+  if (obj === null) {
+    throw new Error("encryptedToCompositeLiteral: obj cannot be null");
+  }
+  return `(${JSON.stringify(JSON.stringify(obj))})`;
+}
+function encryptedToEscapedCompositeLiteral(obj) {
+  if (obj === null) {
+    throw new Error("encryptedToEscapedCompositeLiteral: obj cannot be null");
+  }
+  return JSON.stringify(encryptedToCompositeLiteral(obj));
+}
+function formatEncryptedResult(encrypted, returnType) {
+  if (returnType === "composite-literal") {
+    return encryptedToCompositeLiteral(encrypted);
+  }
+  if (returnType === "escaped-composite-literal") {
+    return encryptedToEscapedCompositeLiteral(encrypted);
+  }
+  return encrypted;
+}
+function modelToEncryptedPgComposites(model) {
+  const result = {};
+  for (const [key, value] of Object.entries(model)) {
+    if (isEncryptedPayload(value)) {
+      result[key] = encryptedToPgComposite(value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function bulkModelsToEncryptedPgComposites(models) {
+  return models.map((model) => modelToEncryptedPgComposites(model));
+}
+function toFfiKeysetIdentifier(keyset) {
+  if (!keyset) return void 0;
+  if ("name" in keyset) {
+    return { Name: keyset.name };
+  }
+  return { Uuid: keyset.id };
+}
+function isEncryptedPayload(value) {
+  if (value === null) return false;
+  if (typeof value !== "object") return false;
+  const obj = value;
+  if (!("v" in obj) || typeof obj.v !== "number") return false;
+  if (!("i" in obj) || typeof obj.i !== "object") return false;
+  if (!("c" in obj) && !("sv" in obj)) return false;
+  return true;
+}
+
+export {
+  encryptedToPgComposite,
+  formatEncryptedResult,
+  modelToEncryptedPgComposites,
+  bulkModelsToEncryptedPgComposites,
+  toFfiKeysetIdentifier,
+  isEncryptedPayload
+};
+//# sourceMappingURL=chunk-SUYMGQBY.js.map

package/dist/chunk-SUYMGQBY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encryption/helpers/index.ts"],"sourcesContent":["import type { Encrypted, EncryptedQueryResult, KeysetIdentifier } from '@/types'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  KeysetIdentifier as KeysetIdentifierFfi,\n} from '@cipherstash/protect-ffi'\n\nexport type EncryptedPgComposite = {\n  data: Encrypted\n}\n\n/**\n * Helper function to transform an encrypted payload into a PostgreSQL composite type.\n * Use this when inserting data via Supabase or similar clients.\n */\nexport function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite {\n  return {\n    data: obj,\n  }\n}\n\n/**\n * Helper function to transform an encrypted payload into a PostgreSQL composite literal string.\n * Use this when querying with `.eq()` or similar equality operations in Supabase.\n *\n * @example\n * ```typescript\n * const literal = encryptedToCompositeLiteral(encrypted)\n * await supabase.from('table').select().eq('column', literal)\n * ```\n */\nexport function encryptedToCompositeLiteral(obj: CipherStashEncrypted): string {\n  if (obj === null) {\n    throw new Error('encryptedToCompositeLiteral: obj cannot be null')\n  }\n  return `(${JSON.stringify(JSON.stringify(obj))})`\n}\n\n/**\n * Helper function to transform an encrypted payload into an escaped PostgreSQL composite literal string.\n * Use this when you need the composite literal format to be escaped as a string value.\n *\n * @example\n * ```typescript\n * const escapedLiteral = encryptedToEscapedCompositeLiteral(encrypted)\n * ```\n */\nexport function encryptedToEscapedCompositeLiteral(\n  obj: CipherStashEncrypted,\n): string {\n  if (obj === null) {\n    throw new Error('encryptedToEscapedCompositeLiteral: obj cannot be null')\n  }\n  return JSON.stringify(encryptedToCompositeLiteral(obj))\n}\n\n/**\n * Format an encrypted result based on the requested return type.\n *\n * - `'composite-literal'` → PostgreSQL composite literal string `(\"json\")`\n * - `'escaped-composite-literal'` → escaped variant `\"(\\\"json\\\")\"`\n * - default (`'eql'` or omitted) → raw encrypted object\n */\nexport function formatEncryptedResult(\n  encrypted: CipherStashEncrypted,\n  returnType?: string,\n): EncryptedQueryResult {\n  if (returnType === 'composite-literal') {\n    return encryptedToCompositeLiteral(encrypted)\n  }\n  if (returnType === 'escaped-composite-literal') {\n    return encryptedToEscapedCompositeLiteral(encrypted)\n  }\n  return encrypted\n}\n\n/**\n * Helper function to transform a model's encrypted fields into PostgreSQL composite types\n */\nexport function modelToEncryptedPgComposites<T extends Record<string, unknown>>(\n  model: T,\n): T {\n  const result: Record<string, unknown> = {}\n\n  for (const [key, value] of Object.entries(model)) {\n    if (isEncryptedPayload(value)) {\n      result[key] = encryptedToPgComposite(value)\n    } else {\n      result[key] = value\n    }\n  }\n\n  return result as T\n}\n\n/**\n * Helper function to transform multiple models' encrypted fields into PostgreSQL composite types\n */\nexport function bulkModelsToEncryptedPgComposites<\n  T extends Record<string, unknown>,\n>(models: T[]): T[] {\n  return models.map((model) => modelToEncryptedPgComposites(model))\n}\n\nexport function toFfiKeysetIdentifier(\n  keyset: KeysetIdentifier | undefined,\n): KeysetIdentifierFfi | undefined {\n  if (!keyset) return undefined\n\n  if ('name' in keyset) {\n    return { Name: keyset.name }\n  }\n\n  return { Uuid: keyset.id }\n}\n\n/**\n * Helper function to check if a value is an encrypted payload\n */\nexport function isEncryptedPayload(value: unknown): value is Encrypted {\n  if (value === null) return false\n  if (typeof value !== 'object') return false\n\n  const obj = value as Record<string, unknown>\n\n  // Must have version field (number)\n  if (!('v' in obj) || typeof obj.v !== 'number') return false\n\n  // Must have index field (object)\n  if (!('i' in obj) || typeof obj.i !== 'object') return false\n\n  // Must have either ciphertext (c) or searchable vector (sv)\n  if (!('c' in obj) && !('sv' in obj)) return false\n\n  return true\n}\n\nexport {\n  toJsonPath,\n  buildNestedObject,\n  parseJsonbPath,\n} from './jsonb'\n"],"mappings":";AAcO,SAAS,uBAAuB,KAAsC;AAC3E,SAAO;AAAA,IACL,MAAM;AAAA,EACR;AACF;AAYO,SAAS,4BAA4B,KAAmC;AAC7E,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,IAAI,KAAK,UAAU,KAAK,UAAU,GAAG,CAAC,CAAC;AAChD;AAWO,SAAS,mCACd,KACQ;AACR,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,KAAK,UAAU,4BAA4B,GAAG,CAAC;AACxD;AASO,SAAS,sBACd,WACA,YACsB;AACtB,MAAI,eAAe,qBAAqB;AACtC,WAAO,4BAA4B,SAAS;AAAA,EAC9C;AACA,MAAI,eAAe,6BAA6B;AAC9C,WAAO,mCAAmC,SAAS;AAAA,EACrD;AACA,SAAO;AACT;AAKO,SAAS,6BACd,OACG;AACH,QAAM,SAAkC,CAAC;AAEzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,mBAAmB,KAAK,GAAG;AAC7B,aAAO,GAAG,IAAI,uBAAuB,KAAK;AAAA,IAC5C,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,kCAEd,QAAkB;AAClB,SAAO,OAAO,IAAI,CAAC,UAAU,6BAA6B,KAAK,CAAC;AAClE;AAEO,SAAS,sBACd,QACiC;AACjC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,UAAU,QAAQ;AACpB,WAAO,EAAE,MAAM,OAAO,KAAK;AAAA,EAC7B;AAEA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAKO,SAAS,mBAAmB,OAAoC;AACrE,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,MAAM;AAGZ,MAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,MAAM,SAAU,QAAO;AAGvD,MAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,MAAM,SAAU,QAAO;AAGvD,MAAI,EAAE,OAAO,QAAQ,EAAE,QAAQ,KAAM,QAAO;AAE5C,SAAO;AACT;","names":[]}