@cipherstash/stack 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cipherstash/stack
 
+## 0.11.0
+
+### Minor Changes
+
+- b0e56b8: Upgrade protect-ffi to 0.21.0 and enable array_index_mode for searchable JSON
+
+  - Upgrade `@cipherstash/protect-ffi` to 0.21.0 across all packages
+  - Enable `array_index_mode: 'all'` on STE vec indexes so JSON array operations
+    (jsonb_array_elements, jsonb_array_length, array containment) work correctly
+  - Delegate credential resolution entirely to protect-ffi's `withEnvCredentials`
+  - Download latest EQL at build/runtime instead of bundling hardcoded SQL files
+
 ## 0.10.0
 
 ### Minor Changes

package/dist/bin/stash.js

@@ -104,8 +104,8 @@ var require_package = __commonJS({
 var require_main = __commonJS({
   "../../node_modules/.pnpm/dotenv@16.4.7/node_modules/dotenv/lib/main.js"(exports, module) {
     "use strict";
-    var fs2 = __require("fs");
-    var path2 = __require("path");
+    var fs = __require("fs");
+    var path = __require("path");
     var os = __require("os");
     var crypto = __require("crypto");
     var packageJson = require_package();
@@ -211,7 +211,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs2.existsSync(filepath)) {
+            if (fs.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -219,15 +219,15 @@ var require_main = __commonJS({
           possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
         }
       } else {
-        possibleVaultPath = path2.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
       }
-      if (fs2.existsSync(possibleVaultPath)) {
+      if (fs.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path2.join(os.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       _log("Loading env from encrypted .env.vault");
@@ -240,7 +240,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options) {
-      const dotenvPath = path2.resolve(process.cwd(), ".env");
+      const dotenvPath = path.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options && options.debug);
       if (options && options.encoding) {
@@ -263,13 +263,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path3 of optionPaths) {
+      for (const path2 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs2.readFileSync(path3, { encoding }));
+          const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e2) {
           if (debug) {
-            _debug(`Failed to load ${path3} ${e2.message}`);
+            _debug(`Failed to load ${path2} ${e2.message}`);
           }
           lastError = e2;
         }
@@ -1768,8 +1768,18 @@ var matchIndexOptsSchema = z2.object({
   m: z2.number().default(2048).optional(),
   include_original: z2.boolean().default(false).optional()
 });
+var arrayIndexModeSchema = z2.union([
+  z2.literal("all"),
+  z2.literal("none"),
+  z2.object({
+    item: z2.boolean().optional(),
+    wildcard: z2.boolean().optional(),
+    position: z2.boolean().optional()
+  })
+]);
 var steVecIndexOptsSchema = z2.object({
-  prefix: z2.string()
+  prefix: z2.string(),
+  array_index_mode: arrayIndexModeSchema.optional()
 });
 var indexesSchema = z2.object({
   ore: oreIndexOptsSchema.optional(),
@@ -1966,7 +1976,7 @@ var EncryptedColumn = class {
    */
   searchableJson() {
     this.castAsValue = "json";
-    this.indexesValue.ste_vec = { prefix: "enabled" };
+    this.indexesValue.ste_vec = { prefix: "enabled", array_index_mode: "all" };
     return this;
   }
   build() {
@@ -2014,6 +2024,7 @@ var EncryptedTable = class {
             indexes: {
               ...builtColumn.indexes,
               ste_vec: {
+                ...builtColumn.indexes.ste_vec,
                 prefix: `${this.tableName}/${colName}`
               }
             }
@@ -2075,69 +2086,6 @@ var EncryptionErrorTypes = {
   CtsTokenError: "CtsTokenError"
 };
 
-// src/utils/config/index.ts
-import fs from "node:fs";
-import path from "node:path";
-function getWorkspaceCrn(tomlString) {
-  let currentSection = "";
-  let workspaceCrn;
-  const lines = tomlString.split(/\r?\n/);
-  for (const line of lines) {
-    const trimmedLine = line.trim();
-    if (!trimmedLine || trimmedLine.startsWith("#")) {
-      continue;
-    }
-    const sectionMatch = trimmedLine.match(/^\[([^\]]+)\]$/);
-    if (sectionMatch) {
-      currentSection = sectionMatch[1];
-      continue;
-    }
-    const kvMatch = trimmedLine.match(/^(\w+)\s*=\s*"([^"]+)"$/);
-    if (kvMatch) {
-      const [_3, key, value] = kvMatch;
-      if (currentSection === "auth" && key === "workspace_crn") {
-        workspaceCrn = value;
-        break;
-      }
-    }
-  }
-  return workspaceCrn;
-}
-function extractWorkspaceIdFromCrn(crn) {
-  const match = crn.match(/crn:[^:]+:([^:]+)$/);
-  if (!match) {
-    throw new Error("Invalid CRN format");
-  }
-  return match[1];
-}
-function loadWorkSpaceId(suppliedCrn) {
-  const configPath = path.join(process.cwd(), "cipherstash.toml");
-  if (suppliedCrn) {
-    return extractWorkspaceIdFromCrn(suppliedCrn);
-  }
-  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  if (process.env.CS_WORKSPACE_CRN) {
-    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN);
-  }
-  if (!fs.existsSync(configPath)) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  const tomlString = fs.readFileSync(configPath, "utf8");
-  const workspaceCrn = getWorkspaceCrn(tomlString);
-  if (!workspaceCrn) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  return extractWorkspaceIdFromCrn(workspaceCrn);
-}
-
 // src/utils/logger/index.ts
 import { createRequestLogger, initLogger } from "evlog";
 var validLevels = ["debug", "info", "error"];
@@ -2631,11 +2579,11 @@ import {
   decryptBulk,
   encryptBulk
 } from "@cipherstash/protect-ffi";
-function setNestedValue(obj, path2, value) {
+function setNestedValue(obj, path, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
   let current = obj;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const part = path2[i];
+  for (let i = 0; i < path.length - 1; i++) {
+    const part = path[i];
     if (FORBIDDEN_KEYS.includes(part)) {
       throw new Error(`[encryption]: Forbidden key "${part}" in field path`);
     }
@@ -2644,7 +2592,7 @@ function setNestedValue(obj, path2, value) {
     }
     current = current[part];
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path[path.length - 1];
   if (FORBIDDEN_KEYS.includes(lastKey)) {
     throw new Error(`[encryption]: Forbidden key "${lastKey}" in field path`);
   }
@@ -2721,7 +2669,7 @@ function prepareFieldsForEncryption(model, table) {
         continue;
       }
       if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths2.includes(fullKey)) {
-        if (columnPaths2.some((path2) => path2.startsWith(fullKey))) {
+        if (columnPaths2.some((path) => path.startsWith(fullKey))) {
           processNestedFields(
             value,
             fullKey,
@@ -2899,7 +2847,7 @@ function prepareBulkModelsForOperation(models, table) {
           continue;
         }
         if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths.includes(fullKey)) {
-          if (columnPaths.some((path2) => path2.startsWith(fullKey))) {
+          if (columnPaths.some((path) => path.startsWith(fullKey))) {
             processNestedFields(
               value,
               fullKey,
@@ -4074,11 +4022,6 @@ var noClientError = () => new Error(
 var EncryptionClient = class {
   client;
   encryptConfig;
-  workspaceId;
-  constructor(workspaceCrn) {
-    const workspaceId = loadWorkSpaceId(workspaceCrn);
-    this.workspaceId = workspaceId;
-  }
   /**
    * Initializes the EncryptionClient with the provided configuration.
    * @internal
@@ -4100,10 +4043,10 @@ var EncryptionClient = class {
         this.client = await newClient({
           encryptConfig: validated,
           clientOpts: {
-            workspaceCrn: config3.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
-            accessKey: config3.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
-            clientId: config3.clientId ?? process.env.CS_CLIENT_ID,
-            clientKey: config3.clientKey ?? process.env.CS_CLIENT_KEY,
+            workspaceCrn: config3.workspaceCrn,
+            accessKey: config3.accessKey,
+            clientId: config3.clientId,
+            clientKey: config3.clientKey,
             keyset: toFfiKeysetIdentifier(config3.keyset)
           }
         });
@@ -4488,12 +4431,6 @@ var EncryptionClient = class {
   bulkDecrypt(encryptedPayloads) {
     return new BulkDecryptOperation(this.client, encryptedPayloads);
   }
-  /** e.g., debugging or environment info */
-  clientInfo() {
-    return {
-      workspaceId: this.workspaceId
-    };
-  }
   /**
    * Get the encrypt config object.
    *
@@ -4515,7 +4452,7 @@ var Encryption = async (config3) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
-  const client = new EncryptionClient(clientConfig?.workspaceCrn);
+  const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
   const result = await client.init({
     encryptConfig,
@@ -4527,6 +4464,15 @@ var Encryption = async (config3) => {
   return result.data;
 };
 
+// src/utils/config/index.ts
+function extractWorkspaceIdFromCrn(crn) {
+  const match = crn.match(/crn:[^:]+:([^:]+)$/);
+  if (!match) {
+    throw new Error("Invalid CRN format");
+  }
+  return match[1];
+}
+
 // src/secrets/index.ts
 var Secrets = class {
   encryptionClient = null;
@@ -4589,14 +4535,14 @@ var Secrets = class {
    * For GET requests, `params` are appended as URL query parameters.
    * For POST requests, `body` is sent as JSON in the request body.
    */
-  async apiRequest(method, path2, options) {
+  async apiRequest(method, path, options) {
     try {
-      let url = `${this.apiBaseUrl}${path2}`;
+      let url = `${this.apiBaseUrl}${path}`;
       if (options?.params) {
         const searchParams = new URLSearchParams(options.params);
         url = `${url}?${searchParams.toString()}`;
       }
-      logger.debug(`Secrets API request: ${method} ${path2}`);
+      logger.debug(`Secrets API request: ${method} ${path}`);
       const headers = {
         "Content-Type": "application/json",
         Authorization: this.getAuthHeader()
@@ -4615,7 +4561,7 @@ var Secrets = class {
         } catch {
           errorMessage = errorText || errorMessage;
         }
-        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
+        logger.error(`Secrets API error on ${method} ${path}: ${errorMessage}`);
         return {
           failure: {
             type: "ApiError",
@@ -4623,12 +4569,12 @@ var Secrets = class {
           }
         };
       }
-      logger.debug(`Secrets API request successful: ${method} ${path2}`);
+      logger.debug(`Secrets API request successful: ${method} ${path}`);
       const data = await response.json();
       return { data };
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown network error occurred";
-      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
+      logger.error(`Secrets network error on ${method} ${path}: ${message}`);
       return {
         failure: {
           type: "NetworkError",