@cipherstash/stack 0.13.0 → 0.15.0

package/dist/index.d.cts

@@ -1,7 +1,6 @@
-import { E as Encrypted } from './types-public-WADaA-TW.cjs';
-export { e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-WADaA-TW.cjs';
-export { E as Encryption } from './client-bW-5wG9Y.cjs';
-export { Secrets } from './secrets/index.cjs';
+import { E as Encrypted } from './types-public-DX3mGqoi.cjs';
+export { e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-DX3mGqoi.cjs';
+export { E as Encryption } from './client-DQyqn0oT.cjs';
 import 'zod';
 import '@cipherstash/protect-ffi';
 import './errors/index.cjs';

package/dist/index.d.ts

@@ -1,7 +1,6 @@
-import { E as Encrypted } from './types-public-WADaA-TW.js';
-export { e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-WADaA-TW.js';
-export { E as Encryption } from './client-CZLBiToT.js';
-export { Secrets } from './secrets/index.js';
+import { E as Encrypted } from './types-public-DX3mGqoi.js';
+export { e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-DX3mGqoi.js';
+export { E as Encryption } from './client-Dv60lAyy.js';
 import 'zod';
 import '@cipherstash/protect-ffi';
 import './errors/index.js';

package/dist/index.js

@@ -1,9 +1,6 @@
-import {
-  Secrets
-} from "./chunk-EHDOOLWU.js";
 import {
   Encryption
-} from "./chunk-O4MBO4DJ.js";
+} from "./chunk-YPAPL3IC.js";
 import {
   encryptedToPgComposite,
   isEncryptedPayload
@@ -13,13 +10,11 @@ import {
   encryptedField,
   encryptedTable
 } from "./chunk-GNLU3I27.js";
-import "./chunk-46PDK2Z6.js";
-import "./chunk-GXGEW6T4.js";
+import "./chunk-MD6742R6.js";
 import "./chunk-Q5FTQLYG.js";
 import "./chunk-LBMC4D6D.js";
 export {
   Encryption,
-  Secrets,
   encryptedColumn,
   encryptedField,
   encryptedTable,

package/dist/schema/index.d.cts

@@ -1,3 +1,3 @@
-export { C as CastAs, u as ColumnSchema, q as EncryptConfig, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, v as EqlCastAs, I as InferEncrypted, t as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, w as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, x as buildEncryptConfig, y as castAsEnum, z as encryptConfigSchema, e as encryptedColumn, a as encryptedField, b as encryptedTable, A as eqlCastAsEnum, F as toEqlCastAs } from '../types-public-WADaA-TW.cjs';
+export { C as CastAs, u as ColumnSchema, q as EncryptConfig, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, v as EqlCastAs, I as InferEncrypted, t as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, w as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, x as buildEncryptConfig, y as castAsEnum, z as encryptConfigSchema, e as encryptedColumn, a as encryptedField, b as encryptedTable, A as eqlCastAsEnum, F as toEqlCastAs } from '../types-public-DX3mGqoi.cjs';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/schema/index.d.ts

@@ -1,3 +1,3 @@
-export { C as CastAs, u as ColumnSchema, q as EncryptConfig, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, v as EqlCastAs, I as InferEncrypted, t as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, w as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, x as buildEncryptConfig, y as castAsEnum, z as encryptConfigSchema, e as encryptedColumn, a as encryptedField, b as encryptedTable, A as eqlCastAsEnum, F as toEqlCastAs } from '../types-public-WADaA-TW.js';
+export { C as CastAs, u as ColumnSchema, q as EncryptConfig, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, v as EqlCastAs, I as InferEncrypted, t as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, w as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, x as buildEncryptConfig, y as castAsEnum, z as encryptConfigSchema, e as encryptedColumn, a as encryptedField, b as encryptedTable, A as eqlCastAsEnum, F as toEqlCastAs } from '../types-public-DX3mGqoi.js';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/supabase/index.d.cts

@@ -1,7 +1,7 @@
-import { A as AuditConfig, a as EncryptionClient } from '../client-bW-5wG9Y.cjs';
+import { A as AuditConfig, a as EncryptionClient } from '../client-DQyqn0oT.cjs';
 import { EncryptionError } from '../errors/index.cjs';
 import { LockContext } from '../identity/index.cjs';
-import { c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-WADaA-TW.cjs';
+import { c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-DX3mGqoi.cjs';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
 import 'zod';

package/dist/supabase/index.d.ts

@@ -1,7 +1,7 @@
-import { A as AuditConfig, a as EncryptionClient } from '../client-CZLBiToT.js';
+import { A as AuditConfig, a as EncryptionClient } from '../client-Dv60lAyy.js';
 import { EncryptionError } from '../errors/index.js';
 import { LockContext } from '../identity/index.js';
-import { c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-WADaA-TW.js';
+import { c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-DX3mGqoi.js';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
 import 'zod';

package/dist/{types-public-WADaA-TW.d.ts → types-public-DX3mGqoi.d.cts}

@@ -144,9 +144,9 @@ type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>;
 /**
  * User-facing query type names for encrypting query values.
  *
- * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)
- * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)
- * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)
+ * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
  * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)
  * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)
  * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)

package/dist/{types-public-WADaA-TW.d.cts → types-public-DX3mGqoi.d.ts}

@@ -144,9 +144,9 @@ type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>;
 /**
  * User-facing query type names for encrypting query values.
  *
- * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)
- * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)
- * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)
+ * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
  * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)
  * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)
  * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)

package/dist/types-public.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}
+{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}

package/dist/types-public.d.cts

@@ -1,3 +1,3 @@
-export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-WADaA-TW.cjs';
+export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-DX3mGqoi.cjs';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/types-public.d.ts

@@ -1,3 +1,3 @@
-export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-WADaA-TW.js';
+export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-DX3mGqoi.js';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/types-public.js

@@ -1,6 +1,6 @@
 import {
   queryTypes
-} from "./chunk-46PDK2Z6.js";
+} from "./chunk-MD6742R6.js";
 export {
   queryTypes
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/stack",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "CipherStash Stack for TypeScript and JavaScript",
   "keywords": [
     "encrypted",

package/dist/chunk-EHDOOLWU.js

@@ -1,357 +0,0 @@
-import {
-  Encryption
-} from "./chunk-O4MBO4DJ.js";
-import {
-  encryptedToPgComposite
-} from "./chunk-4RNBI3UH.js";
-import {
-  encryptedColumn,
-  encryptedTable
-} from "./chunk-GNLU3I27.js";
-import {
-  extractWorkspaceIdFromCrn
-} from "./chunk-GXGEW6T4.js";
-import {
-  logger
-} from "./chunk-Q5FTQLYG.js";
-
-// src/secrets/index.ts
-var Secrets = class {
-  encryptionClient = null;
-  config;
-  apiBaseUrl = process.env.STASH_API_URL || "https://dashboard.cipherstash.com/api/secrets";
-  secretsSchema = encryptedTable("secrets", {
-    value: encryptedColumn("value")
-  });
-  constructor(config) {
-    const workspaceCRN = config.workspaceCRN ?? process.env.CS_WORKSPACE_CRN;
-    const clientId = config.clientId ?? process.env.CS_CLIENT_ID;
-    const clientKey = config.clientKey ?? process.env.CS_CLIENT_KEY;
-    const accessKey = config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY;
-    if (!workspaceCRN || !clientId || !clientKey || !accessKey) {
-      throw new Error(
-        "Missing required configuration or environment variables."
-      );
-    }
-    this.config = {
-      environment: config.environment,
-      workspaceCRN,
-      clientId,
-      clientKey,
-      accessKey
-    };
-  }
-  initPromise = null;
-  /**
-   * Initialize the Secrets client and underlying Encryption client
-   */
-  async ensureInitialized() {
-    if (!this.initPromise) {
-      this.initPromise = this._doInit();
-    }
-    return this.initPromise;
-  }
-  async _doInit() {
-    logger.debug("Initializing the Secrets client.");
-    this.encryptionClient = await Encryption({
-      schemas: [this.secretsSchema],
-      config: {
-        workspaceCrn: this.config.workspaceCRN,
-        clientId: this.config.clientId,
-        clientKey: this.config.clientKey,
-        accessKey: this.config.accessKey,
-        keyset: { name: this.config.environment }
-      }
-    });
-    logger.debug("Successfully initialized the Secrets client.");
-  }
-  /**
-   * Get the authorization header for API requests
-   */
-  getAuthHeader() {
-    return `Bearer ${this.config.accessKey}`;
-  }
-  /**
-   * Make an API request with error handling.
-   *
-   * For GET requests, `params` are appended as URL query parameters.
-   * For POST requests, `body` is sent as JSON in the request body.
-   */
-  async apiRequest(method, path, options) {
-    try {
-      let url = `${this.apiBaseUrl}${path}`;
-      if (options?.params) {
-        const searchParams = new URLSearchParams(options.params);
-        url = `${url}?${searchParams.toString()}`;
-      }
-      logger.debug(`Secrets API request: ${method} ${path}`);
-      const headers = {
-        "Content-Type": "application/json",
-        Authorization: this.getAuthHeader()
-      };
-      const response = await fetch(url, {
-        method,
-        headers,
-        body: options?.body ? JSON.stringify(options.body) : void 0
-      });
-      if (!response.ok) {
-        const errorText = await response.text();
-        let errorMessage = `API request failed with status ${response.status}`;
-        try {
-          const errorJson = JSON.parse(errorText);
-          errorMessage = errorJson.message || errorJson.error || errorMessage;
-        } catch {
-          errorMessage = errorText || errorMessage;
-        }
-        logger.error(`Secrets API error on ${method} ${path}: ${errorMessage}`);
-        return {
-          failure: {
-            type: "ApiError",
-            message: errorMessage
-          }
-        };
-      }
-      logger.debug(`Secrets API request successful: ${method} ${path}`);
-      const data = await response.json();
-      return { data };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown network error occurred";
-      logger.error(`Secrets network error on ${method} ${path}: ${message}`);
-      return {
-        failure: {
-          type: "NetworkError",
-          message
-        }
-      };
-    }
-  }
-  /**
-   * Store an encrypted secret in the vault.
-   * The value is encrypted locally before being sent to the API.
-   *
-   * API: POST /api/secrets/set
-   *
-   * @param name - The name of the secret
-   * @param value - The plaintext value to encrypt and store
-   * @returns A Result containing the API response or an error
-   */
-  async set(name, value) {
-    logger.debug("Setting secret");
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    const encryptResult = await this.encryptionClient.encrypt(value, {
-      column: this.secretsSchema.value,
-      table: this.secretsSchema
-    });
-    if (encryptResult.failure) {
-      logger.error("Failed to encrypt secret");
-      return {
-        failure: {
-          type: "EncryptionError",
-          message: encryptResult.failure.message
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    return await this.apiRequest("POST", "/set", {
-      body: {
-        workspaceId,
-        environment: this.config.environment,
-        name,
-        encryptedValue: encryptedToPgComposite(encryptResult.data)
-      }
-    });
-  }
-  /**
-   * Retrieve and decrypt a secret from the vault.
-   * The secret is decrypted locally after retrieval.
-   *
-   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...
-   *
-   * @param name - The name of the secret to retrieve
-   * @returns A Result containing the decrypted value or an error
-   */
-  async get(name) {
-    logger.debug("Getting secret");
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest("GET", "/get", {
-      params: {
-        workspaceId,
-        environment: this.config.environment,
-        name
-      }
-    });
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    const decryptResult = await this.encryptionClient.decrypt(
-      apiResult.data.encryptedValue.data
-    );
-    if (decryptResult.failure) {
-      logger.error("Failed to decrypt secret");
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: decryptResult.failure.message
-        }
-      };
-    }
-    if (typeof decryptResult.data !== "string") {
-      logger.error("Decrypted secret value is not a string");
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: "Decrypted value is not a string"
-        }
-      };
-    }
-    return { data: decryptResult.data };
-  }
-  /**
-   * Retrieve and decrypt many secrets from the vault.
-   * The secrets are decrypted locally after retrieval.
-   * This method only triggers a single network request to the ZeroKMS.
-   *
-   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...
-   *
-   * Constraints:
-   *   - Minimum 2 secret names required
-   *   - Maximum 100 secret names per request
-   *
-   * @param names - The names of the secrets to retrieve (min 2, max 100)
-   * @returns A Result containing an object mapping secret names to their decrypted values
-   */
-  async getMany(names) {
-    logger.debug(`Getting ${names.length} secrets.`);
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    if (names.length < 2) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "At least 2 secret names are required for getMany"
-        }
-      };
-    }
-    if (names.length > 100) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Maximum 100 secret names per request"
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest(
-      "GET",
-      "/get-many",
-      {
-        params: {
-          workspaceId,
-          environment: this.config.environment,
-          names: names.join(",")
-        }
-      }
-    );
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    const dataToDecrypt = apiResult.data.map((item) => ({
-      name: item.name,
-      value: item.encryptedValue.data
-    }));
-    const decryptResult = await this.encryptionClient.bulkDecryptModels(dataToDecrypt);
-    if (decryptResult.failure) {
-      logger.error(
-        `Failed to decrypt secrets: ${decryptResult.failure.message}`
-      );
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: decryptResult.failure.message
-        }
-      };
-    }
-    const decryptedSecrets = decryptResult.data;
-    const secretsMap = {};
-    for (const secret of decryptedSecrets) {
-      if (secret.name && secret.value) {
-        secretsMap[secret.name] = secret.value;
-      }
-    }
-    return { data: secretsMap };
-  }
-  /**
-   * List all secrets in the environment.
-   * Only names and metadata are returned; values remain encrypted.
-   *
-   * API: GET /api/secrets/list?workspaceId=...&environment=...
-   *
-   * @returns A Result containing the list of secrets or an error
-   */
-  async list() {
-    logger.debug("Listing secrets.");
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest(
-      "GET",
-      "/list",
-      {
-        params: {
-          workspaceId,
-          environment: this.config.environment
-        }
-      }
-    );
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    return { data: apiResult.data.secrets };
-  }
-  /**
-   * Delete a secret from the vault.
-   *
-   * API: POST /api/secrets/delete
-   *
-   * @param name - The name of the secret to delete
-   * @returns A Result containing the API response or an error
-   */
-  async delete(name) {
-    logger.debug("Deleting secret");
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    return await this.apiRequest("POST", "/delete", {
-      body: {
-        workspaceId,
-        environment: this.config.environment,
-        name
-      }
-    });
-  }
-};
-
-export {
-  Secrets
-};
-//# sourceMappingURL=chunk-EHDOOLWU.js.map

package/dist/chunk-EHDOOLWU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/secrets/index.ts"],"sourcesContent":["/**\n * Placeholder: Corrected Secrets client interface\n *\n * This file reflects the actual dashboard API endpoints as implemented in:\n *   apps/dashboard/src/app/api/secrets/{get,set,list,get-many,delete}/route.ts\n *\n * Key corrections from the original interface:\n *   1. get, list, get-many are GET endpoints (not POST) with query params\n *   2. get-many takes a comma-separated `names` string (not a JSON array)\n *   3. set and delete return { success, message } (not void)\n *   4. SecretMetadata fields (id, createdAt, updatedAt) are non-optional\n *   5. GetSecretResponse fields (createdAt, updatedAt) are non-optional\n *   6. get-many enforces min 2 names (comma required) and max 100 names\n */\n\nimport { encryptedToPgComposite } from '@/encryption/helpers'\nimport type { EncryptionClient } from '@/encryption/index.js'\nimport { Encryption } from '@/index'\nimport { encryptedColumn, encryptedTable } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport { logger } from '@/utils/logger'\nimport type { Result } from '@byteslice/result'\nimport { extractWorkspaceIdFromCrn } from '../utils/config/index.js'\n\nexport type SecretName = string\nexport type SecretValue = string\n\n/**\n * Discriminated error type for secrets operations.\n */\nexport type SecretsErrorType =\n  | 'ApiError'\n  | 'NetworkError'\n  | 'ClientError'\n  | 'EncryptionError'\n  | 'DecryptionError'\n\n/**\n * Error returned by secrets operations.\n */\nexport interface SecretsError {\n  type: SecretsErrorType\n  message: string\n}\n\n/**\n * Configuration options for initializing the Stash client\n */\nexport interface SecretsConfig {\n  environment: string\n  workspaceCRN?: string\n  clientId?: string\n  clientKey?: string\n  accessKey?: string\n}\n\n/**\n * Secret metadata returned from the API (list endpoint).\n * All fields are always present in API responses.\n */\nexport interface SecretMetadata {\n  id: string\n  name: string\n  environment: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * API response for listing secrets.\n * GET /api/secrets/list?workspaceId=...&environment=...\n */\nexport interface ListSecretsResponse {\n  environment: string\n  secrets: SecretMetadata[]\n}\n\n/**\n * API response for getting a single secret.\n * GET /api/secrets/get?workspaceId=...&environment=...&name=...\n *\n * The `encryptedValue` is the raw value stored in the vault's `value` column,\n * which is the `{ data: Encrypted }` object that was passed to the set endpoint.\n */\nexport interface GetSecretResponse {\n  name: string\n  environment: string\n  encryptedValue: {\n    data: Encrypted\n  }\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * API response for getting multiple secrets.\n * GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...\n *\n * Returns an array of GetSecretResponse objects.\n * Constraints:\n *   - `names` must be comma-separated (minimum 2 names)\n *   - Maximum 100 names per request\n */\nexport type GetManySecretsResponse = GetSecretResponse[]\n\n/**\n * API response for setting a secret.\n * POST /api/secrets/set\n */\nexport interface SetSecretResponse {\n  success: true\n  message: string\n}\n\n/**\n * API request body for setting a secret.\n * POST /api/secrets/set\n */\nexport interface SetSecretRequest {\n  workspaceId: string\n  environment: string\n  name: string\n  encryptedValue: {\n    data: Encrypted\n  }\n}\n\n/**\n * API response for deleting a secret.\n * POST /api/secrets/delete\n */\nexport interface DeleteSecretResponse {\n  success: true\n  message: string\n}\n\n/**\n * API request body for deleting a secret.\n * POST /api/secrets/delete\n */\nexport interface DeleteSecretRequest {\n  workspaceId: string\n  environment: string\n  name: string\n}\n\n/**\n * API error response for plan limit violations (403).\n * Returned by POST /api/secrets/set when the workspace has reached its secret limit.\n */\nexport interface PlanLimitError {\n  error: string\n  code: 'PLAN_LIMIT_REACHED'\n}\n\nexport interface DecryptedSecretResponse {\n  name: string\n  environment: string\n  value: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * The Secrets client provides a high-level API for managing encrypted secrets\n * stored in CipherStash. Secrets are encrypted locally before being sent to\n * the API, ensuring end-to-end encryption.\n */\nexport class Secrets {\n  private encryptionClient: EncryptionClient | null = null\n  private config: Required<SecretsConfig>\n  private readonly apiBaseUrl =\n    process.env.STASH_API_URL || 'https://dashboard.cipherstash.com/api/secrets'\n  private readonly secretsSchema = encryptedTable('secrets', {\n    value: encryptedColumn('value'),\n  })\n\n  constructor(config: SecretsConfig) {\n    const workspaceCRN = config.workspaceCRN ?? process.env.CS_WORKSPACE_CRN\n    const clientId = config.clientId ?? process.env.CS_CLIENT_ID\n    const clientKey = config.clientKey ?? process.env.CS_CLIENT_KEY\n    const accessKey = config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY\n\n    if (!workspaceCRN || !clientId || !clientKey || !accessKey) {\n      throw new Error(\n        'Missing required configuration or environment variables.',\n      )\n    }\n\n    this.config = {\n      environment: config.environment,\n      workspaceCRN,\n      clientId,\n      clientKey,\n      accessKey,\n    }\n  }\n\n  private initPromise: Promise<void> | null = null\n\n  /**\n   * Initialize the Secrets client and underlying Encryption client\n   */\n  private async ensureInitialized(): Promise<void> {\n    if (!this.initPromise) {\n      this.initPromise = this._doInit()\n    }\n    return this.initPromise\n  }\n\n  private async _doInit(): Promise<void> {\n    logger.debug('Initializing the Secrets client.')\n\n    this.encryptionClient = await Encryption({\n      schemas: [this.secretsSchema],\n      config: {\n        workspaceCrn: this.config.workspaceCRN,\n        clientId: this.config.clientId,\n        clientKey: this.config.clientKey,\n        accessKey: this.config.accessKey,\n        keyset: { name: this.config.environment },\n      },\n    })\n\n    logger.debug('Successfully initialized the Secrets client.')\n  }\n\n  /**\n   * Get the authorization header for API requests\n   */\n  private getAuthHeader(): string {\n    return `Bearer ${this.config.accessKey}`\n  }\n\n  /**\n   * Make an API request with error handling.\n   *\n   * For GET requests, `params` are appended as URL query parameters.\n   * For POST requests, `body` is sent as JSON in the request body.\n   */\n  private async apiRequest<T>(\n    method: 'GET' | 'POST',\n    path: string,\n    options?: {\n      body?: unknown\n      params?: Record<string, string>\n    },\n  ): Promise<Result<T, SecretsError>> {\n    try {\n      let url = `${this.apiBaseUrl}${path}`\n\n      if (options?.params) {\n        const searchParams = new URLSearchParams(options.params)\n        url = `${url}?${searchParams.toString()}`\n      }\n\n      logger.debug(`Secrets API request: ${method} ${path}`)\n\n      const headers: Record<string, string> = {\n        'Content-Type': 'application/json',\n        Authorization: this.getAuthHeader(),\n      }\n\n      const response = await fetch(url, {\n        method,\n        headers,\n        body: options?.body ? JSON.stringify(options.body) : undefined,\n      })\n\n      if (!response.ok) {\n        const errorText = await response.text()\n        let errorMessage = `API request failed with status ${response.status}`\n        try {\n          const errorJson = JSON.parse(errorText)\n          errorMessage = errorJson.message || errorJson.error || errorMessage\n        } catch {\n          errorMessage = errorText || errorMessage\n        }\n\n        logger.error(`Secrets API error on ${method} ${path}: ${errorMessage}`)\n\n        return {\n          failure: {\n            type: 'ApiError',\n            message: errorMessage,\n          },\n        }\n      }\n\n      logger.debug(`Secrets API request successful: ${method} ${path}`)\n\n      const data = await response.json()\n      return { data }\n    } catch (error) {\n      const message =\n        error instanceof Error\n          ? error.message\n          : 'Unknown network error occurred'\n\n      logger.error(`Secrets network error on ${method} ${path}: ${message}`)\n\n      return {\n        failure: {\n          type: 'NetworkError',\n          message,\n        },\n      }\n    }\n  }\n\n  /**\n   * Store an encrypted secret in the vault.\n   * The value is encrypted locally before being sent to the API.\n   *\n   * API: POST /api/secrets/set\n   *\n   * @param name - The name of the secret\n   * @param value - The plaintext value to encrypt and store\n   * @returns A Result containing the API response or an error\n   */\n  async set(\n    name: SecretName,\n    value: SecretValue,\n  ): Promise<Result<SetSecretResponse, SecretsError>> {\n    logger.debug('Setting secret')\n\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    // Encrypt the value locally\n    const encryptResult = await this.encryptionClient.encrypt(value, {\n      column: this.secretsSchema.value,\n      table: this.secretsSchema,\n    })\n\n    if (encryptResult.failure) {\n      logger.error('Failed to encrypt secret')\n      return {\n        failure: {\n          type: 'EncryptionError',\n          message: encryptResult.failure.message,\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Send encrypted value to API\n    return await this.apiRequest<SetSecretResponse>('POST', '/set', {\n      body: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n        encryptedValue: encryptedToPgComposite(encryptResult.data),\n      },\n    })\n  }\n\n  /**\n   * Retrieve and decrypt a secret from the vault.\n   * The secret is decrypted locally after retrieval.\n   *\n   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...\n   *\n   * @param name - The name of the secret to retrieve\n   * @returns A Result containing the decrypted value or an error\n   */\n  async get(name: SecretName): Promise<Result<SecretValue, SecretsError>> {\n    logger.debug('Getting secret')\n\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Fetch encrypted value from API via GET with query params\n    const apiResult = await this.apiRequest<GetSecretResponse>('GET', '/get', {\n      params: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n      },\n    })\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    // Decrypt the value locally\n    const decryptResult = await this.encryptionClient.decrypt(\n      apiResult.data.encryptedValue.data,\n    )\n\n    if (decryptResult.failure) {\n      logger.error('Failed to decrypt secret')\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: decryptResult.failure.message,\n        },\n      }\n    }\n\n    if (typeof decryptResult.data !== 'string') {\n      logger.error('Decrypted secret value is not a string')\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: 'Decrypted value is not a string',\n        },\n      }\n    }\n\n    return { data: decryptResult.data }\n  }\n\n  /**\n   * Retrieve and decrypt many secrets from the vault.\n   * The secrets are decrypted locally after retrieval.\n   * This method only triggers a single network request to the ZeroKMS.\n   *\n   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...\n   *\n   * Constraints:\n   *   - Minimum 2 secret names required\n   *   - Maximum 100 secret names per request\n   *\n   * @param names - The names of the secrets to retrieve (min 2, max 100)\n   * @returns A Result containing an object mapping secret names to their decrypted values\n   */\n  async getMany(\n    names: SecretName[],\n  ): Promise<Result<Record<SecretName, SecretValue>, SecretsError>> {\n    logger.debug(`Getting ${names.length} secrets.`)\n\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    if (names.length < 2) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'At least 2 secret names are required for getMany',\n        },\n      }\n    }\n\n    if (names.length > 100) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Maximum 100 secret names per request',\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Fetch encrypted values from API via GET with comma-separated names\n    const apiResult = await this.apiRequest<GetManySecretsResponse>(\n      'GET',\n      '/get-many',\n      {\n        params: {\n          workspaceId,\n          environment: this.config.environment,\n          names: names.join(','),\n        },\n      },\n    )\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    const dataToDecrypt = apiResult.data.map((item) => ({\n      name: item.name,\n      value: item.encryptedValue.data,\n    }))\n\n    const decryptResult =\n      await this.encryptionClient.bulkDecryptModels(dataToDecrypt)\n\n    if (decryptResult.failure) {\n      logger.error(\n        `Failed to decrypt secrets: ${decryptResult.failure.message}`,\n      )\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: decryptResult.failure.message,\n        },\n      }\n    }\n\n    // Transform array of decrypted secrets into an object keyed by secret name\n    const decryptedSecrets =\n      decryptResult.data as unknown as DecryptedSecretResponse[]\n    const secretsMap: Record<SecretName, SecretValue> = {}\n\n    for (const secret of decryptedSecrets) {\n      if (secret.name && secret.value) {\n        secretsMap[secret.name] = secret.value\n      }\n    }\n\n    return { data: secretsMap }\n  }\n\n  /**\n   * List all secrets in the environment.\n   * Only names and metadata are returned; values remain encrypted.\n   *\n   * API: GET /api/secrets/list?workspaceId=...&environment=...\n   *\n   * @returns A Result containing the list of secrets or an error\n   */\n  async list(): Promise<Result<SecretMetadata[], SecretsError>> {\n    logger.debug('Listing secrets.')\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    const apiResult = await this.apiRequest<ListSecretsResponse>(\n      'GET',\n      '/list',\n      {\n        params: {\n          workspaceId,\n          environment: this.config.environment,\n        },\n      },\n    )\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    return { data: apiResult.data.secrets }\n  }\n\n  /**\n   * Delete a secret from the vault.\n   *\n   * API: POST /api/secrets/delete\n   *\n   * @param name - The name of the secret to delete\n   * @returns A Result containing the API response or an error\n   */\n  async delete(\n    name: SecretName,\n  ): Promise<Result<DeleteSecretResponse, SecretsError>> {\n    logger.debug('Deleting secret')\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    return await this.apiRequest<DeleteSecretResponse>('POST', '/delete', {\n      body: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n      },\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAwKO,IAAM,UAAN,MAAc;AAAA,EACX,mBAA4C;AAAA,EAC5C;AAAA,EACS,aACf,QAAQ,IAAI,iBAAiB;AAAA,EACd,gBAAgB,eAAe,WAAW;AAAA,IACzD,OAAO,gBAAgB,OAAO;AAAA,EAChC,CAAC;AAAA,EAED,YAAY,QAAuB;AACjC,UAAM,eAAe,OAAO,gBAAgB,QAAQ,IAAI;AACxD,UAAM,WAAW,OAAO,YAAY,QAAQ,IAAI;AAChD,UAAM,YAAY,OAAO,aAAa,QAAQ,IAAI;AAClD,UAAM,YAAY,OAAO,aAAa,QAAQ,IAAI;AAElD,QAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,aAAa,CAAC,WAAW;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,SAAK,SAAS;AAAA,MACZ,aAAa,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,cAAoC;AAAA;AAAA;AAAA;AAAA,EAK5C,MAAc,oBAAmC;AAC/C,QAAI,CAAC,KAAK,aAAa;AACrB,WAAK,cAAc,KAAK,QAAQ;AAAA,IAClC;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAyB;AACrC,WAAO,MAAM,kCAAkC;AAE/C,SAAK,mBAAmB,MAAM,WAAW;AAAA,MACvC,SAAS,CAAC,KAAK,aAAa;AAAA,MAC5B,QAAQ;AAAA,QACN,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,OAAO;AAAA,QACtB,WAAW,KAAK,OAAO;AAAA,QACvB,WAAW,KAAK,OAAO;AAAA,QACvB,QAAQ,EAAE,MAAM,KAAK,OAAO,YAAY;AAAA,MAC1C;AAAA,IACF,CAAC;AAED,WAAO,MAAM,8CAA8C;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAwB;AAC9B,WAAO,UAAU,KAAK,OAAO,SAAS;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,WACZ,QACA,MACA,SAIkC;AAClC,QAAI;AACF,UAAI,MAAM,GAAG,KAAK,UAAU,GAAG,IAAI;AAEnC,UAAI,SAAS,QAAQ;AACnB,cAAM,eAAe,IAAI,gBAAgB,QAAQ,MAAM;AACvD,cAAM,GAAG,GAAG,IAAI,aAAa,SAAS,CAAC;AAAA,MACzC;AAEA,aAAO,MAAM,wBAAwB,MAAM,IAAI,IAAI,EAAE;AAErD,YAAM,UAAkC;AAAA,QACtC,gBAAgB;AAAA,QAChB,eAAe,KAAK,cAAc;AAAA,MACpC;AAEA,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC;AAAA,QACA;AAAA,QACA,MAAM,SAAS,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,MACvD,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,YAAI,eAAe,kCAAkC,SAAS,MAAM;AACpE,YAAI;AACF,gBAAM,YAAY,KAAK,MAAM,SAAS;AACtC,yBAAe,UAAU,WAAW,UAAU,SAAS;AAAA,QACzD,QAAQ;AACN,yBAAe,aAAa;AAAA,QAC9B;AAEA,eAAO,MAAM,wBAAwB,MAAM,IAAI,IAAI,KAAK,YAAY,EAAE;AAEtE,eAAO;AAAA,UACL,SAAS;AAAA,YACP,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAEA,aAAO,MAAM,mCAAmC,MAAM,IAAI,IAAI,EAAE;AAEhE,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,EAAE,KAAK;AAAA,IAChB,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QACb,MAAM,UACN;AAEN,aAAO,MAAM,4BAA4B,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE;AAErE,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,IACJ,MACA,OACkD;AAClD,WAAO,MAAM,gBAAgB;AAE7B,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,QAAQ,OAAO;AAAA,MAC/D,QAAQ,KAAK,cAAc;AAAA,MAC3B,OAAO,KAAK;AAAA,IACd,CAAC;AAED,QAAI,cAAc,SAAS;AACzB,aAAO,MAAM,0BAA0B;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,WAAO,MAAM,KAAK,WAA8B,QAAQ,QAAQ;AAAA,MAC9D,MAAM;AAAA,QACJ;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,QACA,gBAAgB,uBAAuB,cAAc,IAAI;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,IAAI,MAA8D;AACtE,WAAO,MAAM,gBAAgB;AAE7B,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,UAAM,YAAY,MAAM,KAAK,WAA8B,OAAO,QAAQ;AAAA,MACxE,QAAQ;AAAA,QACN;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,MAAM,KAAK,iBAAiB;AAAA,MAChD,UAAU,KAAK,eAAe;AAAA,IAChC;AAEA,QAAI,cAAc,SAAS;AACzB,aAAO,MAAM,0BAA0B;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,cAAc,SAAS,UAAU;AAC1C,aAAO,MAAM,wCAAwC;AACrD,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,cAAc,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,QACJ,OACgE;AAChE,WAAO,MAAM,WAAW,MAAM,MAAM,WAAW;AAE/C,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,KAAK;AACtB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,UACN;AAAA,UACA,aAAa,KAAK,OAAO;AAAA,UACzB,OAAO,MAAM,KAAK,GAAG;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,UAAU,KAAK,IAAI,CAAC,UAAU;AAAA,MAClD,MAAM,KAAK;AAAA,MACX,OAAO,KAAK,eAAe;AAAA,IAC7B,EAAE;AAEF,UAAM,gBACJ,MAAM,KAAK,iBAAiB,kBAAkB,aAAa;AAE7D,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,8BAA8B,cAAc,QAAQ,OAAO;AAAA,MAC7D;AACA,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,mBACJ,cAAc;AAChB,UAAM,aAA8C,CAAC;AAErD,eAAW,UAAU,kBAAkB;AACrC,UAAI,OAAO,QAAQ,OAAO,OAAO;AAC/B,mBAAW,OAAO,IAAI,IAAI,OAAO;AAAA,MACnC;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAwD;AAC5D,WAAO,MAAM,kBAAkB;AAG/B,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAEtE,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,UACN;AAAA,UACA,aAAa,KAAK,OAAO;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,EAAE,MAAM,UAAU,KAAK,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OACJ,MACqD;AACrD,WAAO,MAAM,iBAAiB;AAG9B,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAEtE,WAAO,MAAM,KAAK,WAAiC,QAAQ,WAAW;AAAA,MACpE,MAAM;AAAA,QACJ;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}