@cipherstash/stack 0.14.0 → 0.15.0

package/dist/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,21 +15,12 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   Encryption: () => Encryption,
-  Secrets: () => Secrets,
   encryptedColumn: () => encryptedColumn,
   encryptedField: () => encryptedField,
   encryptedTable: () => encryptedTable,
@@ -920,11 +909,11 @@ var import_result3 = require("@byteslice/result");
 
 // src/encryption/helpers/model-helpers.ts
 var import_protect_ffi4 = require("@cipherstash/protect-ffi");
-function setNestedValue(obj, path2, value) {
+function setNestedValue(obj, path, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
   let current = obj;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const part = path2[i];
+  for (let i = 0; i < path.length - 1; i++) {
+    const part = path[i];
     if (FORBIDDEN_KEYS.includes(part)) {
       throw new Error(`[encryption]: Forbidden key "${part}" in field path`);
     }
@@ -933,7 +922,7 @@ function setNestedValue(obj, path2, value) {
     }
     current = current[part];
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path[path.length - 1];
   if (FORBIDDEN_KEYS.includes(lastKey)) {
     throw new Error(`[encryption]: Forbidden key "${lastKey}" in field path`);
   }
@@ -1010,7 +999,7 @@ function prepareFieldsForEncryption(model, table) {
         continue;
       }
       if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths2.includes(fullKey)) {
-        if (columnPaths2.some((path2) => path2.startsWith(fullKey))) {
+        if (columnPaths2.some((path) => path.startsWith(fullKey))) {
           processNestedFields(
             value,
             fullKey,
@@ -1188,7 +1177,7 @@ function prepareBulkModelsForOperation(models, table) {
           continue;
         }
         if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths.includes(fullKey)) {
-          if (columnPaths.some((path2) => path2.startsWith(fullKey))) {
+          if (columnPaths.some((path) => path.startsWith(fullKey))) {
             processNestedFields(
               value,
               fullKey,
@@ -2798,357 +2787,9 @@ var Encryption = async (config) => {
   }
   return result.data;
 };
-
-// src/utils/config/index.ts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path = __toESM(require("path"), 1);
-function extractWorkspaceIdFromCrn(crn) {
-  const match = crn.match(/crn:[^:]+:([^:]+)$/);
-  if (!match) {
-    throw new Error("Invalid CRN format");
-  }
-  return match[1];
-}
-
-// src/secrets/index.ts
-var Secrets = class {
-  encryptionClient = null;
-  config;
-  apiBaseUrl = process.env.STASH_API_URL || "https://dashboard.cipherstash.com/api/secrets";
-  secretsSchema = encryptedTable("secrets", {
-    value: encryptedColumn("value")
-  });
-  constructor(config) {
-    const workspaceCRN = config.workspaceCRN ?? process.env.CS_WORKSPACE_CRN;
-    const clientId = config.clientId ?? process.env.CS_CLIENT_ID;
-    const clientKey = config.clientKey ?? process.env.CS_CLIENT_KEY;
-    const accessKey = config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY;
-    if (!workspaceCRN || !clientId || !clientKey || !accessKey) {
-      throw new Error(
-        "Missing required configuration or environment variables."
-      );
-    }
-    this.config = {
-      environment: config.environment,
-      workspaceCRN,
-      clientId,
-      clientKey,
-      accessKey
-    };
-  }
-  initPromise = null;
-  /**
-   * Initialize the Secrets client and underlying Encryption client
-   */
-  async ensureInitialized() {
-    if (!this.initPromise) {
-      this.initPromise = this._doInit();
-    }
-    return this.initPromise;
-  }
-  async _doInit() {
-    logger.debug("Initializing the Secrets client.");
-    this.encryptionClient = await Encryption({
-      schemas: [this.secretsSchema],
-      config: {
-        workspaceCrn: this.config.workspaceCRN,
-        clientId: this.config.clientId,
-        clientKey: this.config.clientKey,
-        accessKey: this.config.accessKey,
-        keyset: { name: this.config.environment }
-      }
-    });
-    logger.debug("Successfully initialized the Secrets client.");
-  }
-  /**
-   * Get the authorization header for API requests
-   */
-  getAuthHeader() {
-    return `Bearer ${this.config.accessKey}`;
-  }
-  /**
-   * Make an API request with error handling.
-   *
-   * For GET requests, `params` are appended as URL query parameters.
-   * For POST requests, `body` is sent as JSON in the request body.
-   */
-  async apiRequest(method, path2, options) {
-    try {
-      let url = `${this.apiBaseUrl}${path2}`;
-      if (options?.params) {
-        const searchParams = new URLSearchParams(options.params);
-        url = `${url}?${searchParams.toString()}`;
-      }
-      logger.debug(`Secrets API request: ${method} ${path2}`);
-      const headers = {
-        "Content-Type": "application/json",
-        Authorization: this.getAuthHeader()
-      };
-      const response = await fetch(url, {
-        method,
-        headers,
-        body: options?.body ? JSON.stringify(options.body) : void 0
-      });
-      if (!response.ok) {
-        const errorText = await response.text();
-        let errorMessage = `API request failed with status ${response.status}`;
-        try {
-          const errorJson = JSON.parse(errorText);
-          errorMessage = errorJson.message || errorJson.error || errorMessage;
-        } catch {
-          errorMessage = errorText || errorMessage;
-        }
-        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
-        return {
-          failure: {
-            type: "ApiError",
-            message: errorMessage
-          }
-        };
-      }
-      logger.debug(`Secrets API request successful: ${method} ${path2}`);
-      const data = await response.json();
-      return { data };
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown network error occurred";
-      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
-      return {
-        failure: {
-          type: "NetworkError",
-          message
-        }
-      };
-    }
-  }
-  /**
-   * Store an encrypted secret in the vault.
-   * The value is encrypted locally before being sent to the API.
-   *
-   * API: POST /api/secrets/set
-   *
-   * @param name - The name of the secret
-   * @param value - The plaintext value to encrypt and store
-   * @returns A Result containing the API response or an error
-   */
-  async set(name, value) {
-    logger.debug("Setting secret");
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    const encryptResult = await this.encryptionClient.encrypt(value, {
-      column: this.secretsSchema.value,
-      table: this.secretsSchema
-    });
-    if (encryptResult.failure) {
-      logger.error("Failed to encrypt secret");
-      return {
-        failure: {
-          type: "EncryptionError",
-          message: encryptResult.failure.message
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    return await this.apiRequest("POST", "/set", {
-      body: {
-        workspaceId,
-        environment: this.config.environment,
-        name,
-        encryptedValue: encryptedToPgComposite(encryptResult.data)
-      }
-    });
-  }
-  /**
-   * Retrieve and decrypt a secret from the vault.
-   * The secret is decrypted locally after retrieval.
-   *
-   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...
-   *
-   * @param name - The name of the secret to retrieve
-   * @returns A Result containing the decrypted value or an error
-   */
-  async get(name) {
-    logger.debug("Getting secret");
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest("GET", "/get", {
-      params: {
-        workspaceId,
-        environment: this.config.environment,
-        name
-      }
-    });
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    const decryptResult = await this.encryptionClient.decrypt(
-      apiResult.data.encryptedValue.data
-    );
-    if (decryptResult.failure) {
-      logger.error("Failed to decrypt secret");
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: decryptResult.failure.message
-        }
-      };
-    }
-    if (typeof decryptResult.data !== "string") {
-      logger.error("Decrypted secret value is not a string");
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: "Decrypted value is not a string"
-        }
-      };
-    }
-    return { data: decryptResult.data };
-  }
-  /**
-   * Retrieve and decrypt many secrets from the vault.
-   * The secrets are decrypted locally after retrieval.
-   * This method only triggers a single network request to the ZeroKMS.
-   *
-   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...
-   *
-   * Constraints:
-   *   - Minimum 2 secret names required
-   *   - Maximum 100 secret names per request
-   *
-   * @param names - The names of the secrets to retrieve (min 2, max 100)
-   * @returns A Result containing an object mapping secret names to their decrypted values
-   */
-  async getMany(names) {
-    logger.debug(`Getting ${names.length} secrets.`);
-    await this.ensureInitialized();
-    if (!this.encryptionClient) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Failed to initialize Encryption client"
-        }
-      };
-    }
-    if (names.length < 2) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "At least 2 secret names are required for getMany"
-        }
-      };
-    }
-    if (names.length > 100) {
-      return {
-        failure: {
-          type: "ClientError",
-          message: "Maximum 100 secret names per request"
-        }
-      };
-    }
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest(
-      "GET",
-      "/get-many",
-      {
-        params: {
-          workspaceId,
-          environment: this.config.environment,
-          names: names.join(",")
-        }
-      }
-    );
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    const dataToDecrypt = apiResult.data.map((item) => ({
-      name: item.name,
-      value: item.encryptedValue.data
-    }));
-    const decryptResult = await this.encryptionClient.bulkDecryptModels(dataToDecrypt);
-    if (decryptResult.failure) {
-      logger.error(
-        `Failed to decrypt secrets: ${decryptResult.failure.message}`
-      );
-      return {
-        failure: {
-          type: "DecryptionError",
-          message: decryptResult.failure.message
-        }
-      };
-    }
-    const decryptedSecrets = decryptResult.data;
-    const secretsMap = {};
-    for (const secret of decryptedSecrets) {
-      if (secret.name && secret.value) {
-        secretsMap[secret.name] = secret.value;
-      }
-    }
-    return { data: secretsMap };
-  }
-  /**
-   * List all secrets in the environment.
-   * Only names and metadata are returned; values remain encrypted.
-   *
-   * API: GET /api/secrets/list?workspaceId=...&environment=...
-   *
-   * @returns A Result containing the list of secrets or an error
-   */
-  async list() {
-    logger.debug("Listing secrets.");
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    const apiResult = await this.apiRequest(
-      "GET",
-      "/list",
-      {
-        params: {
-          workspaceId,
-          environment: this.config.environment
-        }
-      }
-    );
-    if (apiResult.failure) {
-      return apiResult;
-    }
-    return { data: apiResult.data.secrets };
-  }
-  /**
-   * Delete a secret from the vault.
-   *
-   * API: POST /api/secrets/delete
-   *
-   * @param name - The name of the secret to delete
-   * @returns A Result containing the API response or an error
-   */
-  async delete(name) {
-    logger.debug("Deleting secret");
-    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
-    return await this.apiRequest("POST", "/delete", {
-      body: {
-        workspaceId,
-        environment: this.config.environment,
-        name
-      }
-    });
-  }
-};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Encryption,
-  Secrets,
   encryptedColumn,
   encryptedField,
   encryptedTable,