@cipherstash/stack 0.13.0 → 0.15.0

package/dist/encryption/index.d.cts

@@ -1,7 +1,7 @@
 import '../errors/index.cjs';
-import '../types-public-WADaA-TW.cjs';
+import '../types-public-DX3mGqoi.cjs';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
-export { E as Encryption, a as EncryptionClient, n as noClientError } from '../client-bW-5wG9Y.cjs';
+export { E as Encryption, a as EncryptionClient, n as noClientError } from '../client-DQyqn0oT.cjs';
 import 'zod';
 import '../identity/index.cjs';

package/dist/encryption/index.d.ts

@@ -1,7 +1,7 @@
 import '../errors/index.js';
-import '../types-public-WADaA-TW.js';
+import '../types-public-DX3mGqoi.js';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
-export { E as Encryption, a as EncryptionClient, n as noClientError } from '../client-CZLBiToT.js';
+export { E as Encryption, a as EncryptionClient, n as noClientError } from '../client-Dv60lAyy.js';
 import 'zod';
 import '../identity/index.js';

package/dist/encryption/index.js

@@ -2,10 +2,10 @@ import {
   Encryption,
   EncryptionClient,
   noClientError
-} from "../chunk-O4MBO4DJ.js";
+} from "../chunk-YPAPL3IC.js";
 import "../chunk-4RNBI3UH.js";
 import "../chunk-GNLU3I27.js";
-import "../chunk-46PDK2Z6.js";
+import "../chunk-MD6742R6.js";
 import "../chunk-Q5FTQLYG.js";
 import "../chunk-LBMC4D6D.js";
 export {

package/dist/identity/index.js

@@ -1,6 +1,3 @@
-import {
-  loadWorkSpaceId
-} from "../chunk-GXGEW6T4.js";
 import {
   logger
 } from "../chunk-Q5FTQLYG.js";
@@ -8,6 +5,69 @@ import {
   EncryptionErrorTypes
 } from "../chunk-LBMC4D6D.js";
 
+// src/utils/config/index.ts
+import fs from "node:fs";
+import path from "node:path";
+function getWorkspaceCrn(tomlString) {
+  let currentSection = "";
+  let workspaceCrn;
+  const lines = tomlString.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmedLine = line.trim();
+    if (!trimmedLine || trimmedLine.startsWith("#")) {
+      continue;
+    }
+    const sectionMatch = trimmedLine.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      currentSection = sectionMatch[1];
+      continue;
+    }
+    const kvMatch = trimmedLine.match(/^(\w+)\s*=\s*"([^"]+)"$/);
+    if (kvMatch) {
+      const [_, key, value] = kvMatch;
+      if (currentSection === "auth" && key === "workspace_crn") {
+        workspaceCrn = value;
+        break;
+      }
+    }
+  }
+  return workspaceCrn;
+}
+function extractWorkspaceIdFromCrn(crn) {
+  const match = crn.match(/crn:[^:]+:([^:]+)$/);
+  if (!match) {
+    throw new Error("Invalid CRN format");
+  }
+  return match[1];
+}
+function loadWorkSpaceId(suppliedCrn) {
+  const configPath = path.join(process.cwd(), "cipherstash.toml");
+  if (suppliedCrn) {
+    return extractWorkspaceIdFromCrn(suppliedCrn);
+  }
+  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {
+    throw new Error(
+      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
+    );
+  }
+  if (process.env.CS_WORKSPACE_CRN) {
+    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN);
+  }
+  if (!fs.existsSync(configPath)) {
+    throw new Error(
+      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
+    );
+  }
+  const tomlString = fs.readFileSync(configPath, "utf8");
+  const workspaceCrn = getWorkspaceCrn(tomlString);
+  if (!workspaceCrn) {
+    throw new Error(
+      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
+    );
+  }
+  return extractWorkspaceIdFromCrn(workspaceCrn);
+}
+
 // src/identity/index.ts
 import { withResult } from "@byteslice/result";
 var LockContext = class {

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/identity/index.ts"],"sourcesContent":["import { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken: CtsToken\n  context: Context\n}\n\n/**\n * Manages CipherStash lock contexts for row-level access control.\n *\n * A `LockContext` ties encryption/decryption operations to an authenticated\n * user identity via CTS (CipherStash Token Service). Call {@link identify}\n * with a user's JWT to obtain a CTS token, then pass the `LockContext`\n * to `.withLockContext()` on any encrypt/decrypt operation.\n *\n * @example\n * ```typescript\n * import { LockContext } from \"@cipherstash/stack/identity\"\n *\n * const lc = new LockContext()\n * const identified = await lc.identify(userJwt)\n *\n * if (identified.failure) throw new Error(identified.failure.message)\n *\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext(identified.data)\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.\n   *\n   * @example\n   * ```typescript\n   * const lc = new LockContext()\n   * const result = await lc.identify(userJwt)\n   * if (result.failure) {\n   *   console.error(\"Auth failed:\", result.failure.message)\n   * }\n   * ```\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the current CTS token and context for use with encryption operations.\n   *\n   * Must be called after {@link identify}. Returns the token/context pair that\n   * `.withLockContext()` expects.\n   *\n   * @returns A `Result` containing the CTS token and identity context, or an error\n   *   if {@link identify} has not been called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => {\n        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {\n          throw new Error(\n            'The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext().',\n          )\n        }\n\n        return {\n          context: this.context,\n          ctsToken: this.ctsToken,\n        }\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;AAGA,SAAsB,kBAAkB;AAiDjC,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,MAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,iBAA2E;AACzE,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,UAAU,QAAQ;AACzD,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,SAAS,KAAK;AAAA,UACd,UAAU,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/utils/config/index.ts","../../src/identity/index.ts"],"sourcesContent":["import fs from 'node:fs'\nimport path from 'node:path'\n\n/**\n * A lightweight function that parses a TOML-like string\n * and returns the `workspace_crn` value found under `[auth]`.\n *\n * @param tomlString The contents of the TOML file as a string.\n * @returns The workspace_crn if found, otherwise undefined.\n */\nfunction getWorkspaceCrn(tomlString: string): string | undefined {\n  let currentSection = ''\n  let workspaceCrn: string | undefined\n\n  const lines = tomlString.split(/\\r?\\n/)\n\n  for (const line of lines) {\n    const trimmedLine = line.trim()\n\n    if (!trimmedLine || trimmedLine.startsWith('#')) {\n      continue\n    }\n\n    const sectionMatch = trimmedLine.match(/^\\[([^\\]]+)\\]$/)\n    if (sectionMatch) {\n      currentSection = sectionMatch[1]\n      continue\n    }\n\n    const kvMatch = trimmedLine.match(/^(\\w+)\\s*=\\s*\"([^\"]+)\"$/)\n    if (kvMatch) {\n      const [_, key, value] = kvMatch\n\n      if (currentSection === 'auth' && key === 'workspace_crn') {\n        workspaceCrn = value\n        break\n      }\n    }\n  }\n\n  return workspaceCrn\n}\n\n/**\n * Extracts the workspace ID from a CRN string.\n * CRN format: crn:region.aws:ID\n *\n * @param crn The CRN string to extract from\n * @returns The workspace ID portion of the CRN\n */\nexport function extractWorkspaceIdFromCrn(crn: string): string {\n  const match = crn.match(/crn:[^:]+:([^:]+)$/)\n  if (!match) {\n    throw new Error('Invalid CRN format')\n  }\n  return match[1]\n}\n\nexport function loadWorkSpaceId(suppliedCrn?: string): string {\n  const configPath = path.join(process.cwd(), 'cipherstash.toml')\n\n  if (suppliedCrn) {\n    return extractWorkspaceIdFromCrn(suppliedCrn)\n  }\n\n  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  // Environment variables take precedence over config files\n  if (process.env.CS_WORKSPACE_CRN) {\n    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN)\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  const tomlString = fs.readFileSync(configPath, 'utf8')\n  const workspaceCrn = getWorkspaceCrn(tomlString)\n\n  if (!workspaceCrn) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  return extractWorkspaceIdFromCrn(workspaceCrn)\n}\n","import { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken: CtsToken\n  context: Context\n}\n\n/**\n * Manages CipherStash lock contexts for row-level access control.\n *\n * A `LockContext` ties encryption/decryption operations to an authenticated\n * user identity via CTS (CipherStash Token Service). Call {@link identify}\n * with a user's JWT to obtain a CTS token, then pass the `LockContext`\n * to `.withLockContext()` on any encrypt/decrypt operation.\n *\n * @example\n * ```typescript\n * import { LockContext } from \"@cipherstash/stack/identity\"\n *\n * const lc = new LockContext()\n * const identified = await lc.identify(userJwt)\n *\n * if (identified.failure) throw new Error(identified.failure.message)\n *\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext(identified.data)\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.\n   *\n   * @example\n   * ```typescript\n   * const lc = new LockContext()\n   * const result = await lc.identify(userJwt)\n   * if (result.failure) {\n   *   console.error(\"Auth failed:\", result.failure.message)\n   * }\n   * ```\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the current CTS token and context for use with encryption operations.\n   *\n   * Must be called after {@link identify}. Returns the token/context pair that\n   * `.withLockContext()` expects.\n   *\n   * @returns A `Result` containing the CTS token and identity context, or an error\n   *   if {@link identify} has not been called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => {\n        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {\n          throw new Error(\n            'The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext().',\n          )\n        }\n\n        return {\n          context: this.context,\n          ctsToken: this.ctsToken,\n        }\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AASjB,SAAS,gBAAgB,YAAwC;AAC/D,MAAI,iBAAiB;AACrB,MAAI;AAEJ,QAAM,QAAQ,WAAW,MAAM,OAAO;AAEtC,aAAW,QAAQ,OAAO;AACxB,UAAM,cAAc,KAAK,KAAK;AAE9B,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG,GAAG;AAC/C;AAAA,IACF;AAEA,UAAM,eAAe,YAAY,MAAM,gBAAgB;AACvD,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,MAAM,yBAAyB;AAC3D,QAAI,SAAS;AACX,YAAM,CAAC,GAAG,KAAK,KAAK,IAAI;AAExB,UAAI,mBAAmB,UAAU,QAAQ,iBAAiB;AACxD,uBAAe;AACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,0BAA0B,KAAqB;AAC7D,QAAM,QAAQ,IAAI,MAAM,oBAAoB;AAC5C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,SAAO,MAAM,CAAC;AAChB;AAEO,SAAS,gBAAgB,aAA8B;AAC5D,QAAM,aAAa,KAAK,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAE9D,MAAI,aAAa;AACf,WAAO,0BAA0B,WAAW;AAAA,EAC9C;AAEA,MAAI,CAAC,GAAG,WAAW,UAAU,KAAK,CAAC,QAAQ,IAAI,kBAAkB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,IAAI,kBAAkB;AAChC,WAAO,0BAA0B,QAAQ,IAAI,gBAAgB;AAAA,EAC/D;AAEA,MAAI,CAAC,GAAG,WAAW,UAAU,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,GAAG,aAAa,YAAY,MAAM;AACrD,QAAM,eAAe,gBAAgB,UAAU;AAE/C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,0BAA0B,YAAY;AAC/C;;;ACzFA,SAAsB,kBAAkB;AAiDjC,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,MAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,iBAA2E;AACzE,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,UAAU,QAAQ;AACzD,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,SAAS,KAAK;AAAA,UACd,UAAU,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,21 +15,12 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   Encryption: () => Encryption,
-  Secrets: () => Secrets,
   encryptedColumn: () => encryptedColumn,
   encryptedField: () => encryptedField,
   encryptedTable: () => encryptedTable,
@@ -920,11 +909,11 @@ var import_result3 = require("@byteslice/result");
 
 // src/encryption/helpers/model-helpers.ts
 var import_protect_ffi4 = require("@cipherstash/protect-ffi");
-function setNestedValue(obj, path2, value) {
+function setNestedValue(obj, path, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
   let current = obj;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const part = path2[i];
+  for (let i = 0; i < path.length - 1; i++) {
+    const part = path[i];
     if (FORBIDDEN_KEYS.includes(part)) {
       throw new Error(`[encryption]: Forbidden key "${part}" in field path`);
     }
@@ -933,7 +922,7 @@ function setNestedValue(obj, path2, value) {
     }
     current = current[part];
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path[path.length - 1];
   if (FORBIDDEN_KEYS.includes(lastKey)) {
     throw new Error(`[encryption]: Forbidden key "${lastKey}" in field path`);
   }
@@ -1010,7 +999,7 @@ function prepareFieldsForEncryption(model, table) {
         continue;
       }
       if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths2.includes(fullKey)) {
-        if (columnPaths2.some((path2) => path2.startsWith(fullKey))) {
+        if (columnPaths2.some((path) => path.startsWith(fullKey))) {
           processNestedFields(
             value,
             fullKey,
@@ -1188,7 +1177,7 @@ function prepareBulkModelsForOperation(models, table) {
           continue;
         }
         if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths.includes(fullKey)) {
-          if (columnPaths.some((path2) => path2.startsWith(fullKey))) {
+          if (columnPaths.some((path) => path.startsWith(fullKey))) {
             processNestedFields(
               value,
               fullKey,
@@ -2798,357 +2787,9 @@ var Encryption = async (config) => {
   }
   return result.data;
 };
-
-// src/utils/config/index.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path = __toESM(require("path"), 1);
-function extractWorkspaceIdFromCrn(crn) {
-  const match = crn.match(/crn:[^:]+:([^:]+)$/);
-  if (!match) {
-    throw new Error("Invalid CRN format");
-  }
-  return match[1];
-}
-
-// src/secrets/index.ts
-var Secrets = class {
-  encryptionClient = null;
-  config;
-  apiBaseUrl = process.env.STASH_API_URL || "https://dashboard.cipherstash.com/api/secrets";
-  secretsSchema = encryptedTable("secrets", {
-    value: encryptedColumn("value")
-  });
-  constructor(config) {
-    const workspaceCRN = config.workspaceCRN ?? process.env.CS_WORKSPACE_CRN;
-    const clientId = config.clientId ?? process.env.CS_CLIENT_ID;
-    const clientKey = config.clientKey ?? process.env.CS_CLIENT_KEY;
-    const accessKey = config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY;
-    if (!workspaceCRN || !clientId || !clientKey || !accessKey) {
-      throw new Error(
-        "Missing required configuration or environment variables."
-      );
-    }
-    this.config = {
-      environment: config.environment,
-      workspaceCRN,
-      clientId,
-      clientKey,
-      accessKey
-    };
-  }
-  initPromise = null;
-  /**
-   * Initialize the Secrets client and underlying Encryption client
-   */
-  async ensureInitialized() {
-    if (!this.initPromise) {
-      this.initPromise = this._doInit();
-    }
-    return this.initPromise;
-  }
-  async _doInit() {
-    logger.debug("Initializing the Secrets client.");
-    this.encryptionClient = await Encryption({
-      schemas: [this.secretsSchema],
-      config: {
-        workspaceCrn: this.config.workspaceCRN,
-        clientId: this.config.clientId,
-        clientKey: this.config.clientKey,
-        accessKey: this.config.accessKey,
-        keyset: { name: this.config.environment }
-      }
-    });
-    logger.debug("Successfully initialized the Secrets client.");
-  }
-  /**
-   * Get the authorization header for API requests
-   */
-  getAuthHeader() {
-    return `Bearer ${this.config.accessKey}`;
-  }
-  /**
-   * Make an API request with error handling.
-   *
-   * For GET requests, `params` are appended as URL query parameters.
-   * For POST requests, `body` is sent as JSON in the request body.
-   */
-  async apiRequest(method, path2, options) {
-    try {
-      let url = `${this.apiBaseUrl}${path2}`;
-      if (options?.params) {
-        const searchParams = new URLSearchParams(options.params);
-        url = `${url}?${searchParams.toString()}`;
-      }
-      logger.debug(`Secrets API request: ${method} ${path2}`);
-      const headers = {
-        "Content-Type": "application/json",
-        Authorization: this.getAuthHeader()
-      };
-      const response = await fetch(url, {
-        method,
-        headers,
-        body: options?.body ? JSON.stringify(options.body) : void 0
-      });
-      if (!response.ok) {
-        const errorText = await response.text();
-        let errorMessage = `API request failed with status ${response.status}`;
-        try {
-          const errorJson = JSON.parse(errorText);
-          errorMessage = errorJson.message || errorJson.error || errorMessage;
-        } catch {
-          errorMessage = errorText || errorMessage;
-        }
-        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
-        return {
-          failure: {
-            type: "ApiError",
-            message: errorMessage
-          }
-        };
-      }
-      logger.debug(`Secrets API request successful: ${method} ${path2}`);
-      const data = await response.json();
-      return { data };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown network error occurred";
-      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
-      return {
-        failure: {
-          type: "NetworkError",
-          message
-        }
-      };
-    }
-  }
-  /**
-   * Store an encrypted secret in the vault.
-   * The value is encrypted locally before being sent to the API.
-   *
-   * API: POST /api/secrets/set
-   *
-   * @param name - The name of the secret
-   * @param value - The plaintext value to encrypt and store
-   * @returns A Result containing the API response or an error
-   */
-  async set(name, value) {
-    logger.debug("Setting secret");
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    const encryptResult = await this.encryptionClient.encrypt(value, {
-      column: this.secretsSchema.value,
-      table: this.secretsSchema
-    });
-    if (encryptResult.failure) {
-      logger.error("Failed to encrypt secret");
-      return {
-        failure: {
-          type: "EncryptionError",
-          message: encryptResult.failure.message
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    return await this.apiRequest("POST", "/set", {
-      body: {
-        workspaceId,
-        environment: this.config.environment,
-        name,
-        encryptedValue: encryptedToPgComposite(encryptResult.data)
-      }
-    });
-  }
-  /**
-   * Retrieve and decrypt a secret from the vault.
-   * The secret is decrypted locally after retrieval.
-   *
-   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...
-   *
-   * @param name - The name of the secret to retrieve
-   * @returns A Result containing the decrypted value or an error
-   */
-  async get(name) {
-    logger.debug("Getting secret");
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest("GET", "/get", {
-      params: {
-        workspaceId,
-        environment: this.config.environment,
-        name
-      }
-    });
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    const decryptResult = await this.encryptionClient.decrypt(
-      apiResult.data.encryptedValue.data
-    );
-    if (decryptResult.failure) {
-      logger.error("Failed to decrypt secret");
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: decryptResult.failure.message
-        }
-      };
-    }
-    if (typeof decryptResult.data !== "string") {
-      logger.error("Decrypted secret value is not a string");
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: "Decrypted value is not a string"
-        }
-      };
-    }
-    return { data: decryptResult.data };
-  }
-  /**
-   * Retrieve and decrypt many secrets from the vault.
-   * The secrets are decrypted locally after retrieval.
-   * This method only triggers a single network request to the ZeroKMS.
-   *
-   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...
-   *
-   * Constraints:
-   *   - Minimum 2 secret names required
-   *   - Maximum 100 secret names per request
-   *
-   * @param names - The names of the secrets to retrieve (min 2, max 100)
-   * @returns A Result containing an object mapping secret names to their decrypted values
-   */
-  async getMany(names) {
-    logger.debug(`Getting ${names.length} secrets.`);
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    if (names.length < 2) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "At least 2 secret names are required for getMany"
-        }
-      };
-    }
-    if (names.length > 100) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Maximum 100 secret names per request"
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest(
-      "GET",
-      "/get-many",
-      {
-        params: {
-          workspaceId,
-          environment: this.config.environment,
-          names: names.join(",")
-        }
-      }
-    );
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    const dataToDecrypt = apiResult.data.map((item) => ({
-      name: item.name,
-      value: item.encryptedValue.data
-    }));
-    const decryptResult = await this.encryptionClient.bulkDecryptModels(dataToDecrypt);
-    if (decryptResult.failure) {
-      logger.error(
-        `Failed to decrypt secrets: ${decryptResult.failure.message}`
-      );
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: decryptResult.failure.message
-        }
-      };
-    }
-    const decryptedSecrets = decryptResult.data;
-    const secretsMap = {};
-    for (const secret of decryptedSecrets) {
-      if (secret.name && secret.value) {
-        secretsMap[secret.name] = secret.value;
-      }
-    }
-    return { data: secretsMap };
-  }
-  /**
-   * List all secrets in the environment.
-   * Only names and metadata are returned; values remain encrypted.
-   *
-   * API: GET /api/secrets/list?workspaceId=...&environment=...
-   *
-   * @returns A Result containing the list of secrets or an error
-   */
-  async list() {
-    logger.debug("Listing secrets.");
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest(
-      "GET",
-      "/list",
-      {
-        params: {
-          workspaceId,
-          environment: this.config.environment
-        }
-      }
-    );
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    return { data: apiResult.data.secrets };
-  }
-  /**
-   * Delete a secret from the vault.
-   *
-   * API: POST /api/secrets/delete
-   *
-   * @param name - The name of the secret to delete
-   * @returns A Result containing the API response or an error
-   */
-  async delete(name) {
-    logger.debug("Deleting secret");
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    return await this.apiRequest("POST", "/delete", {
-      body: {
-        workspaceId,
-        environment: this.config.environment,
-        name
-      }
-    });
-  }
-};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Encryption,
-  Secrets,
   encryptedColumn,
   encryptedField,
   encryptedTable,