@cipherstash/stack 0.10.0 → 0.11.0

package/dist/drizzle/index.d.cts

@@ -1,7 +1,7 @@
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { PgTable, PgCustomColumn } from 'drizzle-orm/pg-core';
-import { c as EncryptedTable, f as EncryptedColumn, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-B5YxQhR6.cjs';
-import { a as EncryptionClient } from '../client-CV7X5Hrt.cjs';
+import { c as EncryptedTable, f as EncryptedColumn, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-WADaA-TW.cjs';
+import { a as EncryptionClient } from '../client-bW-5wG9Y.cjs';
 import { SQLWrapper, SQL, exists, notExists, isNull, isNotNull, not, arrayContains, arrayContained, arrayOverlaps } from 'drizzle-orm';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { PgTable, PgCustomColumn } from 'drizzle-orm/pg-core';
-import { c as EncryptedTable, f as EncryptedColumn, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-B5YxQhR6.js';
-import { a as EncryptionClient } from '../client-_63nbmO7.js';
+import { c as EncryptedTable, f as EncryptedColumn, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-WADaA-TW.js';
+import { a as EncryptionClient } from '../client-CZLBiToT.js';
 import { SQLWrapper, SQL, exists, notExists, isNull, isNotNull, not, arrayContains, arrayContained, arrayOverlaps } from 'drizzle-orm';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/drizzle/index.js

@@ -1,10 +1,10 @@
 import {
   encryptedColumn,
   encryptedTable
-} from "../chunk-Y3KSTOVR.js";
+} from "../chunk-GNLU3I27.js";
 import {
   queryTypes
-} from "../chunk-HCL75LXQ.js";
+} from "../chunk-46PDK2Z6.js";
 
 // src/drizzle/index.ts
 import { customType } from "drizzle-orm/pg-core";

package/dist/dynamodb/index.d.cts

@@ -1,5 +1,5 @@
-import { a as EncryptionClient } from '../client-CV7X5Hrt.cjs';
-import { D as Decrypted, g as EncryptedValue, c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-B5YxQhR6.cjs';
+import { a as EncryptionClient } from '../client-bW-5wG9Y.cjs';
+import { D as Decrypted, g as EncryptedValue, c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-WADaA-TW.cjs';
 import { ProtectErrorCode } from '@cipherstash/protect-ffi';
 import { Result } from '@byteslice/result';
 import '../errors/index.cjs';

package/dist/dynamodb/index.d.ts

@@ -1,5 +1,5 @@
-import { a as EncryptionClient } from '../client-_63nbmO7.js';
-import { D as Decrypted, g as EncryptedValue, c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-B5YxQhR6.js';
+import { a as EncryptionClient } from '../client-CZLBiToT.js';
+import { D as Decrypted, g as EncryptedValue, c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-WADaA-TW.js';
 import { ProtectErrorCode } from '@cipherstash/protect-ffi';
 import { Result } from '@byteslice/result';
 import '../errors/index.js';

package/dist/encryption/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/encryption/index.ts
@@ -82,8 +72,18 @@ var matchIndexOptsSchema = import_zod.z.object({
   m: import_zod.z.number().default(2048).optional(),
   include_original: import_zod.z.boolean().default(false).optional()
 });
+var arrayIndexModeSchema = import_zod.z.union([
+  import_zod.z.literal("all"),
+  import_zod.z.literal("none"),
+  import_zod.z.object({
+    item: import_zod.z.boolean().optional(),
+    wildcard: import_zod.z.boolean().optional(),
+    position: import_zod.z.boolean().optional()
+  })
+]);
 var steVecIndexOptsSchema = import_zod.z.object({
-  prefix: import_zod.z.string()
+  prefix: import_zod.z.string(),
+  array_index_mode: arrayIndexModeSchema.optional()
 });
 var indexesSchema = import_zod.z.object({
   ore: oreIndexOptsSchema.optional(),
@@ -113,69 +113,6 @@ function buildEncryptConfig(...protectTables) {
   return config;
 }
 
-// src/utils/config/index.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path = __toESM(require("path"), 1);
-function getWorkspaceCrn(tomlString) {
-  let currentSection = "";
-  let workspaceCrn;
-  const lines = tomlString.split(/\r?\n/);
-  for (const line of lines) {
-    const trimmedLine = line.trim();
-    if (!trimmedLine || trimmedLine.startsWith("#")) {
-      continue;
-    }
-    const sectionMatch = trimmedLine.match(/^\[([^\]]+)\]$/);
-    if (sectionMatch) {
-      currentSection = sectionMatch[1];
-      continue;
-    }
-    const kvMatch = trimmedLine.match(/^(\w+)\s*=\s*"([^"]+)"$/);
-    if (kvMatch) {
-      const [_, key, value] = kvMatch;
-      if (currentSection === "auth" && key === "workspace_crn") {
-        workspaceCrn = value;
-        break;
-      }
-    }
-  }
-  return workspaceCrn;
-}
-function extractWorkspaceIdFromCrn(crn) {
-  const match = crn.match(/crn:[^:]+:([^:]+)$/);
-  if (!match) {
-    throw new Error("Invalid CRN format");
-  }
-  return match[1];
-}
-function loadWorkSpaceId(suppliedCrn) {
-  const configPath = import_node_path.default.join(process.cwd(), "cipherstash.toml");
-  if (suppliedCrn) {
-    return extractWorkspaceIdFromCrn(suppliedCrn);
-  }
-  if (!import_node_fs.default.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  if (process.env.CS_WORKSPACE_CRN) {
-    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN);
-  }
-  if (!import_node_fs.default.existsSync(configPath)) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  const tomlString = import_node_fs.default.readFileSync(configPath, "utf8");
-  const workspaceCrn = getWorkspaceCrn(tomlString);
-  if (!workspaceCrn) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  return extractWorkspaceIdFromCrn(workspaceCrn);
-}
-
 // src/utils/logger/index.ts
 var import_evlog = require("evlog");
 var validLevels = ["debug", "info", "error"];
@@ -693,11 +630,11 @@ var import_result3 = require("@byteslice/result");
 
 // src/encryption/helpers/model-helpers.ts
 var import_protect_ffi4 = require("@cipherstash/protect-ffi");
-function setNestedValue(obj, path2, value) {
+function setNestedValue(obj, path, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
   let current = obj;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const part = path2[i];
+  for (let i = 0; i < path.length - 1; i++) {
+    const part = path[i];
     if (FORBIDDEN_KEYS.includes(part)) {
       throw new Error(`[encryption]: Forbidden key "${part}" in field path`);
     }
@@ -706,7 +643,7 @@ function setNestedValue(obj, path2, value) {
     }
     current = current[part];
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path[path.length - 1];
   if (FORBIDDEN_KEYS.includes(lastKey)) {
     throw new Error(`[encryption]: Forbidden key "${lastKey}" in field path`);
   }
@@ -783,7 +720,7 @@ function prepareFieldsForEncryption(model, table) {
         continue;
       }
       if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths2.includes(fullKey)) {
-        if (columnPaths2.some((path2) => path2.startsWith(fullKey))) {
+        if (columnPaths2.some((path) => path.startsWith(fullKey))) {
           processNestedFields(
             value,
             fullKey,
@@ -961,7 +898,7 @@ function prepareBulkModelsForOperation(models, table) {
           continue;
         }
         if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths.includes(fullKey)) {
-          if (columnPaths.some((path2) => path2.startsWith(fullKey))) {
+          if (columnPaths.some((path) => path.startsWith(fullKey))) {
             processNestedFields(
               value,
               fullKey,
@@ -2130,11 +2067,6 @@ var noClientError = () => new Error(
 var EncryptionClient = class {
   client;
   encryptConfig;
-  workspaceId;
-  constructor(workspaceCrn) {
-    const workspaceId = loadWorkSpaceId(workspaceCrn);
-    this.workspaceId = workspaceId;
-  }
   /**
    * Initializes the EncryptionClient with the provided configuration.
    * @internal
@@ -2156,10 +2088,10 @@ var EncryptionClient = class {
         this.client = await (0, import_protect_ffi9.newClient)({
           encryptConfig: validated,
           clientOpts: {
-            workspaceCrn: config.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
-            accessKey: config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
-            clientId: config.clientId ?? process.env.CS_CLIENT_ID,
-            clientKey: config.clientKey ?? process.env.CS_CLIENT_KEY,
+            workspaceCrn: config.workspaceCrn,
+            accessKey: config.accessKey,
+            clientId: config.clientId,
+            clientKey: config.clientKey,
             keyset: toFfiKeysetIdentifier(config.keyset)
           }
         });
@@ -2544,12 +2476,6 @@ var EncryptionClient = class {
   bulkDecrypt(encryptedPayloads) {
     return new BulkDecryptOperation(this.client, encryptedPayloads);
   }
-  /** e.g., debugging or environment info */
-  clientInfo() {
-    return {
-      workspaceId: this.workspaceId
-    };
-  }
   /**
    * Get the encrypt config object.
    *
@@ -2571,7 +2497,7 @@ var Encryption = async (config) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
-  const client = new EncryptionClient(clientConfig?.workspaceCrn);
+  const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
   const result = await client.init({
     encryptConfig,