@cipherstash/stack 0.16.0 → 0.18.0

package/dist/{chunk-CY5B4LIF.js → chunk-ZYOZHZMJ.js}

@@ -2,19 +2,19 @@ import {
   formatEncryptedResult,
   isEncryptedPayload,
   toFfiKeysetIdentifier
-} from "./chunk-4RNBI3UH.js";
+} from "./chunk-XWPGAHBZ.js";
 import {
   buildEncryptConfig,
   encryptConfigSchema
-} from "./chunk-JDZ2QUUF.js";
+} from "./chunk-YWQXTZ5M.js";
 import {
   queryTypeToFfi,
   queryTypeToQueryOp
-} from "./chunk-MD6742R6.js";
+} from "./chunk-VPOTNP4K.js";
 import {
   createRequestLogger,
   logger
-} from "./chunk-6FD7OBGM.js";
+} from "./chunk-LLCCNKDL.js";
 import {
   EncryptionErrorTypes
 } from "./chunk-LBMC4D6D.js";
@@ -176,6 +176,15 @@ var EncryptionOperation = class {
 };
 
 // src/encryption/operations/batch-encrypt-query.ts
+function filterNullTerms(terms) {
+  const nonNullTerms = [];
+  terms.forEach((term, index) => {
+    if (term.value !== null && term.value !== void 0) {
+      nonNullTerms.push({ term, originalIndex: index });
+    }
+  });
+  return { nonNullTerms };
+}
 function buildQueryPayload(term, lockContext) {
   assertValidNumericValue(term.value);
   const { indexType, queryOp } = resolveIndexType(
@@ -196,10 +205,15 @@ function buildQueryPayload(term, lockContext) {
   }
   return payload;
 }
-function assembleResults(terms, encryptedValues) {
-  return terms.map(
-    (term, i) => formatEncryptedResult(encryptedValues[i], term.returnType)
-  );
+function assembleResults(totalLength, encryptedValues, nonNullTerms) {
+  const results = new Array(totalLength).fill(null);
+  nonNullTerms.forEach(({ term, originalIndex }, i) => {
+    results[originalIndex] = formatEncryptedResult(
+      encryptedValues[i],
+      term.returnType
+    );
+  });
+  return results;
 }
 var BatchEncryptQueryOperation = class extends EncryptionOperation {
   constructor(client, terms) {
@@ -207,6 +221,8 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
     this.client = client;
     this.terms = terms;
   }
+  client;
+  terms;
   withLockContext(lockContext) {
     return new BatchEncryptQueryOperationWithLockContext(
       this.client,
@@ -226,18 +242,23 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { data: [] };
     }
+    const { nonNullTerms } = filterNullTerms(this.terms);
+    if (nonNullTerms.length === 0) {
+      log.emit();
+      return { data: this.terms.map(() => null) };
+    }
     const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = this.terms.map(
-          (term) => buildQueryPayload(term)
+        const queries = nonNullTerms.map(
+          ({ term }) => buildQueryPayload(term)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms, encrypted);
+        return assembleResults(this.terms.length, encrypted, nonNullTerms);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -260,6 +281,9 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
     this.lockContext = lockContext;
     this.auditMetadata = auditMetadata;
   }
+  client;
+  terms;
+  lockContext;
   async execute() {
     const log = createRequestLogger();
     log.set({
@@ -271,6 +295,11 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: [] };
     }
+    const { nonNullTerms } = filterNullTerms(this.terms);
+    if (nonNullTerms.length === 0) {
+      log.emit();
+      return { data: this.terms.map(() => null) };
+    }
     const lockContextResult = await this.lockContext.getLockContext();
     if (lockContextResult.failure) {
       log.emit();
@@ -281,15 +310,15 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = this.terms.map(
-          (term) => buildQueryPayload(term, context)
+        const queries = nonNullTerms.map(
+          ({ term }) => buildQueryPayload(term, context)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
           serviceToken: ctsToken,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms, encrypted);
+        return assembleResults(this.terms.length, encrypted, nonNullTerms);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -311,25 +340,30 @@ import {
   decryptBulkFallible
 } from "@cipherstash/protect-ffi";
 var createDecryptPayloads = (encryptedPayloads, lockContext) => {
-  return encryptedPayloads.map(({ id, data }) => ({
+  return encryptedPayloads.filter(({ data }) => data !== null).map(({ id, data }) => ({
     id,
     ciphertext: data,
     ...lockContext && { lockContext }
   }));
 };
+var createNullResult = (encryptedPayloads) => encryptedPayloads.map(({ id }) => ({ id, data: null }));
 var mapDecryptedDataToResult = (encryptedPayloads, decryptedData) => {
-  return decryptedData.map((decryptResult, i) => {
-    if ("error" in decryptResult) {
-      return {
-        id: encryptedPayloads[i].id,
-        error: decryptResult.error
-      };
+  const result = new Array(encryptedPayloads.length);
+  let decryptedIndex = 0;
+  for (let i = 0; i < encryptedPayloads.length; i++) {
+    if (encryptedPayloads[i].data === null) {
+      result[i] = { id: encryptedPayloads[i].id, data: null };
+    } else {
+      const decryptResult = decryptedData[decryptedIndex];
+      if ("error" in decryptResult) {
+        result[i] = { id: encryptedPayloads[i].id, error: decryptResult.error };
+      } else {
+        result[i] = { id: encryptedPayloads[i].id, data: decryptResult.data };
+      }
+      decryptedIndex++;
     }
-    return {
-      id: encryptedPayloads[i].id,
-      data: decryptResult.data
-    };
-  });
+  }
+  return result;
 };
 var BulkDecryptOperation = class extends EncryptionOperation {
   client;
@@ -354,10 +388,13 @@ var BulkDecryptOperation = class extends EncryptionOperation {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
           return [];
-        const payloads = createDecryptPayloads(this.encryptedPayloads);
+        const nonNullPayloads = createDecryptPayloads(this.encryptedPayloads);
+        if (nonNullPayloads.length === 0) {
+          return createNullResult(this.encryptedPayloads);
+        }
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(this.client, {
-          ciphertexts: payloads,
+          ciphertexts: nonNullPayloads,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(this.encryptedPayloads, decryptedData);
@@ -409,13 +446,16 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const payloads = createDecryptPayloads(
+        const nonNullPayloads = createDecryptPayloads(
           encryptedPayloads,
           context.data.context
         );
+        if (nonNullPayloads.length === 0) {
+          return createNullResult(encryptedPayloads);
+        }
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(client, {
-          ciphertexts: payloads,
+          ciphertexts: nonNullPayloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
@@ -1057,7 +1097,7 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 import { withResult as withResult4 } from "@byteslice/result";
 import { encryptBulk as encryptBulk2 } from "@cipherstash/protect-ffi";
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.map(({ id, plaintext }) => ({
+  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
     id,
     plaintext,
     column: column.getName(),
@@ -1065,6 +1105,20 @@ var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
     ...lockContext && { lockContext }
   }));
 };
+var createNullResult2 = (plaintexts) => plaintexts.map(({ id }) => ({ id, data: null }));
+var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
+  const result = new Array(plaintexts.length);
+  let encryptedIndex = 0;
+  for (let i = 0; i < plaintexts.length; i++) {
+    if (plaintexts[i].plaintext === null) {
+      result[i] = { id: plaintexts[i].id, data: null };
+    } else {
+      result[i] = { id: plaintexts[i].id, data: encryptedData[encryptedIndex] };
+      encryptedIndex++;
+    }
+  }
+  return result;
+};
 var BulkEncryptOperation = class extends EncryptionOperation {
   client;
   plaintexts;
@@ -1097,20 +1151,20 @@ var BulkEncryptOperation = class extends EncryptionOperation {
         if (!this.plaintexts || this.plaintexts.length === 0) {
           return [];
         }
-        const payloads = createEncryptPayloads(
+        const nonNullPayloads = createEncryptPayloads(
           this.plaintexts,
           this.column,
           this.table
         );
+        if (nonNullPayloads.length === 0) {
+          return createNullResult2(this.plaintexts);
+        }
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(this.client, {
-          plaintexts: payloads,
+          plaintexts: nonNullPayloads,
           unverifiedContext: metadata
         });
-        return encryptedData.map((data, i) => ({
-          id: this.plaintexts[i].id,
-          data
-        }));
+        return mapEncryptedDataToResult(this.plaintexts, encryptedData);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1167,22 +1221,22 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const payloads = createEncryptPayloads(
+        const nonNullPayloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
           context.data.context
         );
+        if (nonNullPayloads.length === 0) {
+          return createNullResult2(plaintexts);
+        }
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(client, {
-          plaintexts: payloads,
+          plaintexts: nonNullPayloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
-        return encryptedData.map((data, i) => ({
-          id: plaintexts[i].id,
-          data
-        }));
+        return mapEncryptedDataToResult(plaintexts, encryptedData);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1314,6 +1368,10 @@ import {
 } from "@cipherstash/protect-ffi";
 var DecryptOperation = class extends EncryptionOperation {
   client;
+  // Internally widened to allow null so the runtime guard below can
+  // short-circuit on legacy / manually-NULLed rows. The public
+  // `Encryption.decrypt()` signature still rejects null at the type
+  // layer; this is defense in depth for direct construction.
   encryptedData;
   constructor(client, encryptedData) {
     super();
@@ -1334,6 +1392,9 @@ var DecryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
+        if (this.encryptedData === null) {
+          return null;
+        }
         const { metadata } = this.getAuditData();
         return await ffiDecrypt(this.client, {
           ciphertext: this.encryptedData,
@@ -1384,6 +1445,9 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
+        if (encryptedData === null) {
+          return null;
+        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -1513,6 +1577,10 @@ import {
 } from "@cipherstash/protect-ffi";
 var EncryptOperation = class extends EncryptionOperation {
   client;
+  // Internally widened to allow null so the runtime guard below can
+  // short-circuit. The public `Encryption.encrypt()` signature still
+  // rejects null at the type layer; this is defense in depth for callers
+  // that reach this class through casts or dynamic field walking.
   plaintext;
   column;
   table;
@@ -1539,6 +1607,9 @@ var EncryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
+        if (this.plaintext === null) {
+          return null;
+        }
         if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
           throw new Error("[encryption]: Cannot encrypt NaN value");
         }
@@ -1600,6 +1671,9 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
+        if (plaintext === null) {
+          return null;
+        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -1747,6 +1821,9 @@ var EncryptQueryOperation = class extends EncryptionOperation {
     this.plaintext = plaintext;
     this.opts = opts;
   }
+  client;
+  plaintext;
+  opts;
   withLockContext(lockContext) {
     return new EncryptQueryOperationWithLockContext(
       this.client,
@@ -1765,7 +1842,12 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: false
     });
-    const validationError = validateNumericValue(this.plaintext);
+    if (this.plaintext === null || this.plaintext === void 0) {
+      log.emit();
+      return { data: null };
+    }
+    const plaintext = this.plaintext;
+    const validationError = validateNumericValue(plaintext);
     if (validationError?.failure) {
       log.emit();
       return { failure: validationError.failure };
@@ -1777,15 +1859,15 @@ var EncryptQueryOperation = class extends EncryptionOperation {
         const { indexType, queryOp } = resolveIndexType(
           this.opts.column,
           this.opts.queryType,
-          this.plaintext
+          plaintext
         );
         assertValueIndexCompatibility(
-          this.plaintext,
+          plaintext,
           indexType,
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
-          plaintext: this.plaintext,
+          plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
           indexType,
@@ -1819,6 +1901,10 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
     this.lockContext = lockContext;
     this.auditMetadata = auditMetadata;
   }
+  client;
+  plaintext;
+  opts;
+  lockContext;
   async execute() {
     const log = createRequestLogger();
     log.set({
@@ -1828,7 +1914,12 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: true
     });
-    const validationError = validateNumericValue(this.plaintext);
+    if (this.plaintext === null || this.plaintext === void 0) {
+      log.emit();
+      return { data: null };
+    }
+    const plaintext = this.plaintext;
+    const validationError = validateNumericValue(plaintext);
     if (validationError?.failure) {
       log.emit();
       return { failure: validationError.failure };
@@ -1846,15 +1937,15 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
         const { indexType, queryOp } = resolveIndexType(
           this.opts.column,
           this.opts.queryType,
-          this.plaintext
+          plaintext
         );
         assertValueIndexCompatibility(
-          this.plaintext,
+          plaintext,
           indexType,
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
-          plaintext: this.plaintext,
+          plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
           indexType,
@@ -2050,6 +2141,13 @@ var EncryptionClient = class {
    *      .withLockContext(lockContext)
    * ```
    *
+   * @remarks
+   * The public input type rejects null, but at runtime `decrypt` will
+   * short-circuit and return null when given a null ciphertext
+   * (defense in depth for legacy / manually-NULLed DB rows reached via
+   * casts or dynamic field walking). The narrow return type holds for
+   * any caller that respects the input contract.
+   *
    * @see {@link LockContext}
    * @see {@link DecryptOperation}
    */
@@ -2329,8 +2427,18 @@ var Encryption = async (config) => {
 };
 
 export {
+  BatchEncryptQueryOperation,
+  BulkDecryptOperation,
+  BulkDecryptModelsOperation,
+  BulkEncryptOperation,
+  BulkEncryptModelsOperation,
+  DecryptOperation,
+  DecryptModelOperation,
+  EncryptOperation,
+  EncryptModelOperation,
+  EncryptQueryOperation,
   noClientError,
   EncryptionClient,
   Encryption
 };
-//# sourceMappingURL=chunk-CY5B4LIF.js.map
+//# sourceMappingURL=chunk-ZYOZHZMJ.js.map