@cipherstash/stack 0.2.0 → 0.3.0

package/dist/secrets/index.d.cts

@@ -1,4 +1,4 @@
-import { i as Encrypted } from '../types-public-Dfg-hkuQ.cjs';
+import { j as Encrypted } from '../types-public-0CzBV45X.cjs';
 import { Result } from '@byteslice/result';
 import 'zod';
 import 'evlog';

package/dist/secrets/index.d.ts

@@ -1,4 +1,4 @@
-import { i as Encrypted } from '../types-public-Dfg-hkuQ.js';
+import { j as Encrypted } from '../types-public-0CzBV45X.js';
 import { Result } from '@byteslice/result';
 import 'zod';
 import 'evlog';

package/dist/secrets/index.js

@@ -1,17 +1,17 @@
 import {
   Encryption
-} from "../chunk-LHZ6KZIG.js";
+} from "../chunk-MW6D52V2.js";
 import {
   encryptedToPgComposite
 } from "../chunk-SUYMGQBY.js";
-import "../chunk-5G4F4JJG.js";
+import "../chunk-JLI27P46.js";
 import {
   extractWorkspaceIdFromCrn
-} from "../chunk-5DCT6YU2.js";
+} from "../chunk-OAPLZLR5.js";
 import {
   encryptedColumn,
   encryptedTable
-} from "../chunk-7XRPN2KX.js";
+} from "../chunk-TBAIVO6T.js";
 
 // src/secrets/index.ts
 var Secrets = class {

package/dist/secrets/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/secrets/index.ts"],"sourcesContent":["/**\n * Placeholder: Corrected Secrets client interface\n *\n * This file reflects the actual dashboard API endpoints as implemented in:\n *   apps/dashboard/src/app/api/secrets/{get,set,list,get-many,delete}/route.ts\n *\n * Key corrections from the original interface:\n *   1. get, list, get-many are GET endpoints (not POST) with query params\n *   2. get-many takes a comma-separated `names` string (not a JSON array)\n *   3. set and delete return { success, message } (not void)\n *   4. SecretMetadata fields (id, createdAt, updatedAt) are non-optional\n *   5. GetSecretResponse fields (createdAt, updatedAt) are non-optional\n *   6. get-many enforces min 2 names (comma required) and max 100 names\n */\n\nimport type { EncryptionClient } from '@/encryption/ffi'\nimport { encryptedToPgComposite } from '@/encryption/helpers'\nimport { Encryption } from '@/index'\nimport { encryptedColumn, encryptedTable } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type { Result } from '@byteslice/result'\nimport { extractWorkspaceIdFromCrn } from '../utils/config/index.js'\n\nexport type SecretName = string\nexport type SecretValue = string\n\n/**\n * Discriminated error type for secrets operations.\n */\nexport type SecretsErrorType =\n  | 'ApiError'\n  | 'NetworkError'\n  | 'ClientError'\n  | 'EncryptionError'\n  | 'DecryptionError'\n\n/**\n * Error returned by secrets operations.\n */\nexport interface SecretsError {\n  type: SecretsErrorType\n  message: string\n}\n\n/**\n * Configuration options for initializing the Stash client\n */\nexport interface SecretsConfig {\n  workspaceCRN: string\n  clientId: string\n  clientKey: string\n  environment: string\n  apiKey: string\n  accessKey?: string\n}\n\n/**\n * Secret metadata returned from the API (list endpoint).\n * All fields are always present in API responses.\n */\nexport interface SecretMetadata {\n  id: string\n  name: string\n  environment: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * API response for listing secrets.\n * GET /api/secrets/list?workspaceId=...&environment=...\n */\nexport interface ListSecretsResponse {\n  environment: string\n  secrets: SecretMetadata[]\n}\n\n/**\n * API response for getting a single secret.\n * GET /api/secrets/get?workspaceId=...&environment=...&name=...\n *\n * The `encryptedValue` is the raw value stored in the vault's `value` column,\n * which is the `{ data: Encrypted }` object that was passed to the set endpoint.\n */\nexport interface GetSecretResponse {\n  name: string\n  environment: string\n  encryptedValue: {\n    data: Encrypted\n  }\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * API response for getting multiple secrets.\n * GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...\n *\n * Returns an array of GetSecretResponse objects.\n * Constraints:\n *   - `names` must be comma-separated (minimum 2 names)\n *   - Maximum 100 names per request\n */\nexport type GetManySecretsResponse = GetSecretResponse[]\n\n/**\n * API response for setting a secret.\n * POST /api/secrets/set\n */\nexport interface SetSecretResponse {\n  success: true\n  message: string\n}\n\n/**\n * API request body for setting a secret.\n * POST /api/secrets/set\n */\nexport interface SetSecretRequest {\n  workspaceId: string\n  environment: string\n  name: string\n  encryptedValue: {\n    data: Encrypted\n  }\n}\n\n/**\n * API response for deleting a secret.\n * POST /api/secrets/delete\n */\nexport interface DeleteSecretResponse {\n  success: true\n  message: string\n}\n\n/**\n * API request body for deleting a secret.\n * POST /api/secrets/delete\n */\nexport interface DeleteSecretRequest {\n  workspaceId: string\n  environment: string\n  name: string\n}\n\n/**\n * API error response for plan limit violations (403).\n * Returned by POST /api/secrets/set when the workspace has reached its secret limit.\n */\nexport interface PlanLimitError {\n  error: string\n  code: 'PLAN_LIMIT_REACHED'\n}\n\nexport interface DecryptedSecretResponse {\n  name: string\n  environment: string\n  value: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * The Secrets client provides a high-level API for managing encrypted secrets\n * stored in CipherStash. Secrets are encrypted locally before being sent to\n * the API, ensuring end-to-end encryption.\n */\nexport class Secrets {\n  private encryptionClient: EncryptionClient | null = null\n  private config: SecretsConfig\n  private readonly apiBaseUrl =\n    process.env.STASH_API_URL || 'https://dashboard.cipherstash.com/api/secrets'\n  private readonly secretsSchema = encryptedTable('secrets', {\n    value: encryptedColumn('value'),\n  })\n\n  constructor(config: SecretsConfig) {\n    this.config = config\n  }\n\n  private initPromise: Promise<void> | null = null\n\n  /**\n   * Initialize the Secrets client and underlying Encryption client\n   */\n  private async ensureInitialized(): Promise<void> {\n    if (!this.initPromise) {\n      this.initPromise = this._doInit()\n    }\n    return this.initPromise\n  }\n\n  private async _doInit(): Promise<void> {\n    this.encryptionClient = await Encryption({\n      schemas: [this.secretsSchema],\n      config: {\n        workspaceCrn: this.config.workspaceCRN,\n        clientId: this.config.clientId,\n        clientKey: this.config.clientKey,\n        accessKey: this.config.apiKey,\n        keyset: {\n          name: this.config.environment,\n        },\n      },\n    })\n  }\n\n  /**\n   * Get the authorization header for API requests\n   */\n  private getAuthHeader(): string {\n    return `Bearer ${this.config.apiKey}`\n  }\n\n  /**\n   * Make an API request with error handling.\n   *\n   * For GET requests, `params` are appended as URL query parameters.\n   * For POST requests, `body` is sent as JSON in the request body.\n   */\n  private async apiRequest<T>(\n    method: 'GET' | 'POST',\n    path: string,\n    options?: {\n      body?: unknown\n      params?: Record<string, string>\n    },\n  ): Promise<Result<T, SecretsError>> {\n    try {\n      let url = `${this.apiBaseUrl}${path}`\n\n      if (options?.params) {\n        const searchParams = new URLSearchParams(options.params)\n        url = `${url}?${searchParams.toString()}`\n      }\n\n      const headers: Record<string, string> = {\n        'Content-Type': 'application/json',\n        Authorization: this.getAuthHeader(),\n      }\n\n      const response = await fetch(url, {\n        method,\n        headers,\n        body: options?.body ? JSON.stringify(options.body) : undefined,\n      })\n\n      if (!response.ok) {\n        const errorText = await response.text()\n        let errorMessage = `API request failed with status ${response.status}`\n        try {\n          const errorJson = JSON.parse(errorText)\n          errorMessage = errorJson.message || errorJson.error || errorMessage\n        } catch {\n          errorMessage = errorText || errorMessage\n        }\n\n        return {\n          failure: {\n            type: 'ApiError',\n            message: errorMessage,\n          },\n        }\n      }\n\n      const data = await response.json()\n      return { data }\n    } catch (error) {\n      return {\n        failure: {\n          type: 'NetworkError',\n          message:\n            error instanceof Error\n              ? error.message\n              : 'Unknown network error occurred',\n        },\n      }\n    }\n  }\n\n  /**\n   * Store an encrypted secret in the vault.\n   * The value is encrypted locally before being sent to the API.\n   *\n   * API: POST /api/secrets/set\n   *\n   * @param name - The name of the secret\n   * @param value - The plaintext value to encrypt and store\n   * @returns A Result containing the API response or an error\n   */\n  async set(\n    name: SecretName,\n    value: SecretValue,\n  ): Promise<Result<SetSecretResponse, SecretsError>> {\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    // Encrypt the value locally\n    const encryptResult = await this.encryptionClient.encrypt(value, {\n      column: this.secretsSchema.value,\n      table: this.secretsSchema,\n    })\n\n    if (encryptResult.failure) {\n      return {\n        failure: {\n          type: 'EncryptionError',\n          message: encryptResult.failure.message,\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Send encrypted value to API\n    return await this.apiRequest<SetSecretResponse>('POST', '/set', {\n      body: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n        encryptedValue: encryptedToPgComposite(encryptResult.data),\n      },\n    })\n  }\n\n  /**\n   * Retrieve and decrypt a secret from the vault.\n   * The secret is decrypted locally after retrieval.\n   *\n   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...\n   *\n   * @param name - The name of the secret to retrieve\n   * @returns A Result containing the decrypted value or an error\n   */\n  async get(name: SecretName): Promise<Result<SecretValue, SecretsError>> {\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Fetch encrypted value from API via GET with query params\n    const apiResult = await this.apiRequest<GetSecretResponse>('GET', '/get', {\n      params: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n      },\n    })\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    // Decrypt the value locally\n    const decryptResult = await this.encryptionClient.decrypt(\n      apiResult.data.encryptedValue.data,\n    )\n\n    if (decryptResult.failure) {\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: decryptResult.failure.message,\n        },\n      }\n    }\n\n    if (typeof decryptResult.data !== 'string') {\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: 'Decrypted value is not a string',\n        },\n      }\n    }\n\n    return { data: decryptResult.data }\n  }\n\n  /**\n   * Retrieve and decrypt many secrets from the vault.\n   * The secrets are decrypted locally after retrieval.\n   * This method only triggers a single network request to the ZeroKMS.\n   *\n   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...\n   *\n   * Constraints:\n   *   - Minimum 2 secret names required\n   *   - Maximum 100 secret names per request\n   *\n   * @param names - The names of the secrets to retrieve (min 2, max 100)\n   * @returns A Result containing an object mapping secret names to their decrypted values\n   */\n  async getMany(\n    names: SecretName[],\n  ): Promise<Result<Record<SecretName, SecretValue>, SecretsError>> {\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    if (names.length < 2) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'At least 2 secret names are required for getMany',\n        },\n      }\n    }\n\n    if (names.length > 100) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Maximum 100 secret names per request',\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Fetch encrypted values from API via GET with comma-separated names\n    const apiResult = await this.apiRequest<GetManySecretsResponse>(\n      'GET',\n      '/get-many',\n      {\n        params: {\n          workspaceId,\n          environment: this.config.environment,\n          names: names.join(','),\n        },\n      },\n    )\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    const dataToDecrypt = apiResult.data.map((item) => ({\n      name: item.name,\n      value: item.encryptedValue.data,\n    }))\n\n    const decryptResult =\n      await this.encryptionClient.bulkDecryptModels(dataToDecrypt)\n\n    if (decryptResult.failure) {\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: decryptResult.failure.message,\n        },\n      }\n    }\n\n    // Transform array of decrypted secrets into an object keyed by secret name\n    const decryptedSecrets =\n      decryptResult.data as unknown as DecryptedSecretResponse[]\n    const secretsMap: Record<SecretName, SecretValue> = {}\n\n    for (const secret of decryptedSecrets) {\n      if (secret.name && secret.value) {\n        secretsMap[secret.name] = secret.value\n      }\n    }\n\n    return { data: secretsMap }\n  }\n\n  /**\n   * List all secrets in the environment.\n   * Only names and metadata are returned; values remain encrypted.\n   *\n   * API: GET /api/secrets/list?workspaceId=...&environment=...\n   *\n   * @returns A Result containing the list of secrets or an error\n   */\n  async list(): Promise<Result<SecretMetadata[], SecretsError>> {\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    const apiResult = await this.apiRequest<ListSecretsResponse>(\n      'GET',\n      '/list',\n      {\n        params: {\n          workspaceId,\n          environment: this.config.environment,\n        },\n      },\n    )\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    return { data: apiResult.data.secrets }\n  }\n\n  /**\n   * Delete a secret from the vault.\n   *\n   * API: POST /api/secrets/delete\n   *\n   * @param name - The name of the secret to delete\n   * @returns A Result containing the API response or an error\n   */\n  async delete(\n    name: SecretName,\n  ): Promise<Result<DeleteSecretResponse, SecretsError>> {\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    return await this.apiRequest<DeleteSecretResponse>('POST', '/delete', {\n      body: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n      },\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAwKO,IAAM,UAAN,MAAc;AAAA,EACX,mBAA4C;AAAA,EAC5C;AAAA,EACS,aACf,QAAQ,IAAI,iBAAiB;AAAA,EACd,gBAAgB,eAAe,WAAW;AAAA,IACzD,OAAO,gBAAgB,OAAO;AAAA,EAChC,CAAC;AAAA,EAED,YAAY,QAAuB;AACjC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,cAAoC;AAAA;AAAA;AAAA;AAAA,EAK5C,MAAc,oBAAmC;AAC/C,QAAI,CAAC,KAAK,aAAa;AACrB,WAAK,cAAc,KAAK,QAAQ;AAAA,IAClC;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAyB;AACrC,SAAK,mBAAmB,MAAM,WAAW;AAAA,MACvC,SAAS,CAAC,KAAK,aAAa;AAAA,MAC5B,QAAQ;AAAA,QACN,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,OAAO;AAAA,QACtB,WAAW,KAAK,OAAO;AAAA,QACvB,WAAW,KAAK,OAAO;AAAA,QACvB,QAAQ;AAAA,UACN,MAAM,KAAK,OAAO;AAAA,QACpB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAwB;AAC9B,WAAO,UAAU,KAAK,OAAO,MAAM;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,WACZ,QACA,MACA,SAIkC;AAClC,QAAI;AACF,UAAI,MAAM,GAAG,KAAK,UAAU,GAAG,IAAI;AAEnC,UAAI,SAAS,QAAQ;AACnB,cAAM,eAAe,IAAI,gBAAgB,QAAQ,MAAM;AACvD,cAAM,GAAG,GAAG,IAAI,aAAa,SAAS,CAAC;AAAA,MACzC;AAEA,YAAM,UAAkC;AAAA,QACtC,gBAAgB;AAAA,QAChB,eAAe,KAAK,cAAc;AAAA,MACpC;AAEA,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC;AAAA,QACA;AAAA,QACA,MAAM,SAAS,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,MACvD,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,YAAI,eAAe,kCAAkC,SAAS,MAAM;AACpE,YAAI;AACF,gBAAM,YAAY,KAAK,MAAM,SAAS;AACtC,yBAAe,UAAU,WAAW,UAAU,SAAS;AAAA,QACzD,QAAQ;AACN,yBAAe,aAAa;AAAA,QAC9B;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,YACP,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,EAAE,KAAK;AAAA,IAChB,SAAS,OAAO;AACd,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SACE,iBAAiB,QACb,MAAM,UACN;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,IACJ,MACA,OACkD;AAClD,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,QAAQ,OAAO;AAAA,MAC/D,QAAQ,KAAK,cAAc;AAAA,MAC3B,OAAO,KAAK;AAAA,IACd,CAAC;AAED,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,WAAO,MAAM,KAAK,WAA8B,QAAQ,QAAQ;AAAA,MAC9D,MAAM;AAAA,QACJ;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,QACA,gBAAgB,uBAAuB,cAAc,IAAI;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,IAAI,MAA8D;AACtE,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,UAAM,YAAY,MAAM,KAAK,WAA8B,OAAO,QAAQ;AAAA,MACxE,QAAQ;AAAA,QACN;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,MAAM,KAAK,iBAAiB;AAAA,MAChD,UAAU,KAAK,eAAe;AAAA,IAChC;AAEA,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,cAAc,SAAS,UAAU;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,cAAc,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,QACJ,OACgE;AAChE,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,KAAK;AACtB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,UACN;AAAA,UACA,aAAa,KAAK,OAAO;AAAA,UACzB,OAAO,MAAM,KAAK,GAAG;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,UAAU,KAAK,IAAI,CAAC,UAAU;AAAA,MAClD,MAAM,KAAK;AAAA,MACX,OAAO,KAAK,eAAe;AAAA,IAC7B,EAAE;AAEF,UAAM,gBACJ,MAAM,KAAK,iBAAiB,kBAAkB,aAAa;AAE7D,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,mBACJ,cAAc;AAChB,UAAM,aAA8C,CAAC;AAErD,eAAW,UAAU,kBAAkB;AACrC,UAAI,OAAO,QAAQ,OAAO,OAAO;AAC/B,mBAAW,OAAO,IAAI,IAAI,OAAO;AAAA,MACnC;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAwD;AAE5D,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAEtE,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,UACN;AAAA,UACA,aAAa,KAAK,OAAO;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,EAAE,MAAM,UAAU,KAAK,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OACJ,MACqD;AAErD,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAEtE,WAAO,MAAM,KAAK,WAAiC,QAAQ,WAAW;AAAA,MACpE,MAAM;AAAA,QACJ;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../../src/secrets/index.ts"],"sourcesContent":["/**\n * Placeholder: Corrected Secrets client interface\n *\n * This file reflects the actual dashboard API endpoints as implemented in:\n *   apps/dashboard/src/app/api/secrets/{get,set,list,get-many,delete}/route.ts\n *\n * Key corrections from the original interface:\n *   1. get, list, get-many are GET endpoints (not POST) with query params\n *   2. get-many takes a comma-separated `names` string (not a JSON array)\n *   3. set and delete return { success, message } (not void)\n *   4. SecretMetadata fields (id, createdAt, updatedAt) are non-optional\n *   5. GetSecretResponse fields (createdAt, updatedAt) are non-optional\n *   6. get-many enforces min 2 names (comma required) and max 100 names\n */\n\nimport type { EncryptionClient } from '@/encryption/index.js'\nimport { encryptedToPgComposite } from '@/encryption/helpers'\nimport { Encryption } from '@/index'\nimport { encryptedColumn, encryptedTable } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type { Result } from '@byteslice/result'\nimport { extractWorkspaceIdFromCrn } from '../utils/config/index.js'\n\nexport type SecretName = string\nexport type SecretValue = string\n\n/**\n * Discriminated error type for secrets operations.\n */\nexport type SecretsErrorType =\n  | 'ApiError'\n  | 'NetworkError'\n  | 'ClientError'\n  | 'EncryptionError'\n  | 'DecryptionError'\n\n/**\n * Error returned by secrets operations.\n */\nexport interface SecretsError {\n  type: SecretsErrorType\n  message: string\n}\n\n/**\n * Configuration options for initializing the Stash client\n */\nexport interface SecretsConfig {\n  workspaceCRN: string\n  clientId: string\n  clientKey: string\n  environment: string\n  apiKey: string\n  accessKey?: string\n}\n\n/**\n * Secret metadata returned from the API (list endpoint).\n * All fields are always present in API responses.\n */\nexport interface SecretMetadata {\n  id: string\n  name: string\n  environment: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * API response for listing secrets.\n * GET /api/secrets/list?workspaceId=...&environment=...\n */\nexport interface ListSecretsResponse {\n  environment: string\n  secrets: SecretMetadata[]\n}\n\n/**\n * API response for getting a single secret.\n * GET /api/secrets/get?workspaceId=...&environment=...&name=...\n *\n * The `encryptedValue` is the raw value stored in the vault's `value` column,\n * which is the `{ data: Encrypted }` object that was passed to the set endpoint.\n */\nexport interface GetSecretResponse {\n  name: string\n  environment: string\n  encryptedValue: {\n    data: Encrypted\n  }\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * API response for getting multiple secrets.\n * GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...\n *\n * Returns an array of GetSecretResponse objects.\n * Constraints:\n *   - `names` must be comma-separated (minimum 2 names)\n *   - Maximum 100 names per request\n */\nexport type GetManySecretsResponse = GetSecretResponse[]\n\n/**\n * API response for setting a secret.\n * POST /api/secrets/set\n */\nexport interface SetSecretResponse {\n  success: true\n  message: string\n}\n\n/**\n * API request body for setting a secret.\n * POST /api/secrets/set\n */\nexport interface SetSecretRequest {\n  workspaceId: string\n  environment: string\n  name: string\n  encryptedValue: {\n    data: Encrypted\n  }\n}\n\n/**\n * API response for deleting a secret.\n * POST /api/secrets/delete\n */\nexport interface DeleteSecretResponse {\n  success: true\n  message: string\n}\n\n/**\n * API request body for deleting a secret.\n * POST /api/secrets/delete\n */\nexport interface DeleteSecretRequest {\n  workspaceId: string\n  environment: string\n  name: string\n}\n\n/**\n * API error response for plan limit violations (403).\n * Returned by POST /api/secrets/set when the workspace has reached its secret limit.\n */\nexport interface PlanLimitError {\n  error: string\n  code: 'PLAN_LIMIT_REACHED'\n}\n\nexport interface DecryptedSecretResponse {\n  name: string\n  environment: string\n  value: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * The Secrets client provides a high-level API for managing encrypted secrets\n * stored in CipherStash. Secrets are encrypted locally before being sent to\n * the API, ensuring end-to-end encryption.\n */\nexport class Secrets {\n  private encryptionClient: EncryptionClient | null = null\n  private config: SecretsConfig\n  private readonly apiBaseUrl =\n    process.env.STASH_API_URL || 'https://dashboard.cipherstash.com/api/secrets'\n  private readonly secretsSchema = encryptedTable('secrets', {\n    value: encryptedColumn('value'),\n  })\n\n  constructor(config: SecretsConfig) {\n    this.config = config\n  }\n\n  private initPromise: Promise<void> | null = null\n\n  /**\n   * Initialize the Secrets client and underlying Encryption client\n   */\n  private async ensureInitialized(): Promise<void> {\n    if (!this.initPromise) {\n      this.initPromise = this._doInit()\n    }\n    return this.initPromise\n  }\n\n  private async _doInit(): Promise<void> {\n    this.encryptionClient = await Encryption({\n      schemas: [this.secretsSchema],\n      config: {\n        workspaceCrn: this.config.workspaceCRN,\n        clientId: this.config.clientId,\n        clientKey: this.config.clientKey,\n        accessKey: this.config.apiKey,\n        keyset: {\n          name: this.config.environment,\n        },\n      },\n    })\n  }\n\n  /**\n   * Get the authorization header for API requests\n   */\n  private getAuthHeader(): string {\n    return `Bearer ${this.config.apiKey}`\n  }\n\n  /**\n   * Make an API request with error handling.\n   *\n   * For GET requests, `params` are appended as URL query parameters.\n   * For POST requests, `body` is sent as JSON in the request body.\n   */\n  private async apiRequest<T>(\n    method: 'GET' | 'POST',\n    path: string,\n    options?: {\n      body?: unknown\n      params?: Record<string, string>\n    },\n  ): Promise<Result<T, SecretsError>> {\n    try {\n      let url = `${this.apiBaseUrl}${path}`\n\n      if (options?.params) {\n        const searchParams = new URLSearchParams(options.params)\n        url = `${url}?${searchParams.toString()}`\n      }\n\n      const headers: Record<string, string> = {\n        'Content-Type': 'application/json',\n        Authorization: this.getAuthHeader(),\n      }\n\n      const response = await fetch(url, {\n        method,\n        headers,\n        body: options?.body ? JSON.stringify(options.body) : undefined,\n      })\n\n      if (!response.ok) {\n        const errorText = await response.text()\n        let errorMessage = `API request failed with status ${response.status}`\n        try {\n          const errorJson = JSON.parse(errorText)\n          errorMessage = errorJson.message || errorJson.error || errorMessage\n        } catch {\n          errorMessage = errorText || errorMessage\n        }\n\n        return {\n          failure: {\n            type: 'ApiError',\n            message: errorMessage,\n          },\n        }\n      }\n\n      const data = await response.json()\n      return { data }\n    } catch (error) {\n      return {\n        failure: {\n          type: 'NetworkError',\n          message:\n            error instanceof Error\n              ? error.message\n              : 'Unknown network error occurred',\n        },\n      }\n    }\n  }\n\n  /**\n   * Store an encrypted secret in the vault.\n   * The value is encrypted locally before being sent to the API.\n   *\n   * API: POST /api/secrets/set\n   *\n   * @param name - The name of the secret\n   * @param value - The plaintext value to encrypt and store\n   * @returns A Result containing the API response or an error\n   */\n  async set(\n    name: SecretName,\n    value: SecretValue,\n  ): Promise<Result<SetSecretResponse, SecretsError>> {\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    // Encrypt the value locally\n    const encryptResult = await this.encryptionClient.encrypt(value, {\n      column: this.secretsSchema.value,\n      table: this.secretsSchema,\n    })\n\n    if (encryptResult.failure) {\n      return {\n        failure: {\n          type: 'EncryptionError',\n          message: encryptResult.failure.message,\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Send encrypted value to API\n    return await this.apiRequest<SetSecretResponse>('POST', '/set', {\n      body: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n        encryptedValue: encryptedToPgComposite(encryptResult.data),\n      },\n    })\n  }\n\n  /**\n   * Retrieve and decrypt a secret from the vault.\n   * The secret is decrypted locally after retrieval.\n   *\n   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...\n   *\n   * @param name - The name of the secret to retrieve\n   * @returns A Result containing the decrypted value or an error\n   */\n  async get(name: SecretName): Promise<Result<SecretValue, SecretsError>> {\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Fetch encrypted value from API via GET with query params\n    const apiResult = await this.apiRequest<GetSecretResponse>('GET', '/get', {\n      params: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n      },\n    })\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    // Decrypt the value locally\n    const decryptResult = await this.encryptionClient.decrypt(\n      apiResult.data.encryptedValue.data,\n    )\n\n    if (decryptResult.failure) {\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: decryptResult.failure.message,\n        },\n      }\n    }\n\n    if (typeof decryptResult.data !== 'string') {\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: 'Decrypted value is not a string',\n        },\n      }\n    }\n\n    return { data: decryptResult.data }\n  }\n\n  /**\n   * Retrieve and decrypt many secrets from the vault.\n   * The secrets are decrypted locally after retrieval.\n   * This method only triggers a single network request to the ZeroKMS.\n   *\n   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...\n   *\n   * Constraints:\n   *   - Minimum 2 secret names required\n   *   - Maximum 100 secret names per request\n   *\n   * @param names - The names of the secrets to retrieve (min 2, max 100)\n   * @returns A Result containing an object mapping secret names to their decrypted values\n   */\n  async getMany(\n    names: SecretName[],\n  ): Promise<Result<Record<SecretName, SecretValue>, SecretsError>> {\n    await this.ensureInitialized()\n\n    if (!this.encryptionClient) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Failed to initialize Encryption client',\n        },\n      }\n    }\n\n    if (names.length < 2) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'At least 2 secret names are required for getMany',\n        },\n      }\n    }\n\n    if (names.length > 100) {\n      return {\n        failure: {\n          type: 'ClientError',\n          message: 'Maximum 100 secret names per request',\n        },\n      }\n    }\n\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    // Fetch encrypted values from API via GET with comma-separated names\n    const apiResult = await this.apiRequest<GetManySecretsResponse>(\n      'GET',\n      '/get-many',\n      {\n        params: {\n          workspaceId,\n          environment: this.config.environment,\n          names: names.join(','),\n        },\n      },\n    )\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    const dataToDecrypt = apiResult.data.map((item) => ({\n      name: item.name,\n      value: item.encryptedValue.data,\n    }))\n\n    const decryptResult =\n      await this.encryptionClient.bulkDecryptModels(dataToDecrypt)\n\n    if (decryptResult.failure) {\n      return {\n        failure: {\n          type: 'DecryptionError',\n          message: decryptResult.failure.message,\n        },\n      }\n    }\n\n    // Transform array of decrypted secrets into an object keyed by secret name\n    const decryptedSecrets =\n      decryptResult.data as unknown as DecryptedSecretResponse[]\n    const secretsMap: Record<SecretName, SecretValue> = {}\n\n    for (const secret of decryptedSecrets) {\n      if (secret.name && secret.value) {\n        secretsMap[secret.name] = secret.value\n      }\n    }\n\n    return { data: secretsMap }\n  }\n\n  /**\n   * List all secrets in the environment.\n   * Only names and metadata are returned; values remain encrypted.\n   *\n   * API: GET /api/secrets/list?workspaceId=...&environment=...\n   *\n   * @returns A Result containing the list of secrets or an error\n   */\n  async list(): Promise<Result<SecretMetadata[], SecretsError>> {\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    const apiResult = await this.apiRequest<ListSecretsResponse>(\n      'GET',\n      '/list',\n      {\n        params: {\n          workspaceId,\n          environment: this.config.environment,\n        },\n      },\n    )\n\n    if (apiResult.failure) {\n      return apiResult\n    }\n\n    return { data: apiResult.data.secrets }\n  }\n\n  /**\n   * Delete a secret from the vault.\n   *\n   * API: POST /api/secrets/delete\n   *\n   * @param name - The name of the secret to delete\n   * @returns A Result containing the API response or an error\n   */\n  async delete(\n    name: SecretName,\n  ): Promise<Result<DeleteSecretResponse, SecretsError>> {\n    // Extract workspaceId from CRN\n    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN)\n\n    return await this.apiRequest<DeleteSecretResponse>('POST', '/delete', {\n      body: {\n        workspaceId,\n        environment: this.config.environment,\n        name,\n      },\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAwKO,IAAM,UAAN,MAAc;AAAA,EACX,mBAA4C;AAAA,EAC5C;AAAA,EACS,aACf,QAAQ,IAAI,iBAAiB;AAAA,EACd,gBAAgB,eAAe,WAAW;AAAA,IACzD,OAAO,gBAAgB,OAAO;AAAA,EAChC,CAAC;AAAA,EAED,YAAY,QAAuB;AACjC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,cAAoC;AAAA;AAAA;AAAA;AAAA,EAK5C,MAAc,oBAAmC;AAC/C,QAAI,CAAC,KAAK,aAAa;AACrB,WAAK,cAAc,KAAK,QAAQ;AAAA,IAClC;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAyB;AACrC,SAAK,mBAAmB,MAAM,WAAW;AAAA,MACvC,SAAS,CAAC,KAAK,aAAa;AAAA,MAC5B,QAAQ;AAAA,QACN,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,OAAO;AAAA,QACtB,WAAW,KAAK,OAAO;AAAA,QACvB,WAAW,KAAK,OAAO;AAAA,QACvB,QAAQ;AAAA,UACN,MAAM,KAAK,OAAO;AAAA,QACpB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAwB;AAC9B,WAAO,UAAU,KAAK,OAAO,MAAM;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,WACZ,QACA,MACA,SAIkC;AAClC,QAAI;AACF,UAAI,MAAM,GAAG,KAAK,UAAU,GAAG,IAAI;AAEnC,UAAI,SAAS,QAAQ;AACnB,cAAM,eAAe,IAAI,gBAAgB,QAAQ,MAAM;AACvD,cAAM,GAAG,GAAG,IAAI,aAAa,SAAS,CAAC;AAAA,MACzC;AAEA,YAAM,UAAkC;AAAA,QACtC,gBAAgB;AAAA,QAChB,eAAe,KAAK,cAAc;AAAA,MACpC;AAEA,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC;AAAA,QACA;AAAA,QACA,MAAM,SAAS,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,MACvD,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK;AACtC,YAAI,eAAe,kCAAkC,SAAS,MAAM;AACpE,YAAI;AACF,gBAAM,YAAY,KAAK,MAAM,SAAS;AACtC,yBAAe,UAAU,WAAW,UAAU,SAAS;AAAA,QACzD,QAAQ;AACN,yBAAe,aAAa;AAAA,QAC9B;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,YACP,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,EAAE,KAAK;AAAA,IAChB,SAAS,OAAO;AACd,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SACE,iBAAiB,QACb,MAAM,UACN;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,IACJ,MACA,OACkD;AAClD,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,QAAQ,OAAO;AAAA,MAC/D,QAAQ,KAAK,cAAc;AAAA,MAC3B,OAAO,KAAK;AAAA,IACd,CAAC;AAED,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,WAAO,MAAM,KAAK,WAA8B,QAAQ,QAAQ;AAAA,MAC9D,MAAM;AAAA,QACJ;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,QACA,gBAAgB,uBAAuB,cAAc,IAAI;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,IAAI,MAA8D;AACtE,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,UAAM,YAAY,MAAM,KAAK,WAA8B,OAAO,QAAQ;AAAA,MACxE,QAAQ;AAAA,QACN;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,MAAM,KAAK,iBAAiB;AAAA,MAChD,UAAU,KAAK,eAAe;AAAA,IAChC;AAEA,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,cAAc,SAAS,UAAU;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,cAAc,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,QACJ,OACgE;AAChE,UAAM,KAAK,kBAAkB;AAE7B,QAAI,CAAC,KAAK,kBAAkB;AAC1B,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,KAAK;AACtB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAGtE,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,UACN;AAAA,UACA,aAAa,KAAK,OAAO;AAAA,UACzB,OAAO,MAAM,KAAK,GAAG;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,UAAU,KAAK,IAAI,CAAC,UAAU;AAAA,MAClD,MAAM,KAAK;AAAA,MACX,OAAO,KAAK,eAAe;AAAA,IAC7B,EAAE;AAEF,UAAM,gBACJ,MAAM,KAAK,iBAAiB,kBAAkB,aAAa;AAE7D,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,UACP,MAAM;AAAA,UACN,SAAS,cAAc,QAAQ;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,mBACJ,cAAc;AAChB,UAAM,aAA8C,CAAC;AAErD,eAAW,UAAU,kBAAkB;AACrC,UAAI,OAAO,QAAQ,OAAO,OAAO;AAC/B,mBAAW,OAAO,IAAI,IAAI,OAAO;AAAA,MACnC;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAwD;AAE5D,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAEtE,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,UACN;AAAA,UACA,aAAa,KAAK,OAAO;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,SAAS;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,EAAE,MAAM,UAAU,KAAK,QAAQ;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OACJ,MACqD;AAErD,UAAM,cAAc,0BAA0B,KAAK,OAAO,YAAY;AAEtE,WAAO,MAAM,KAAK,WAAiC,QAAQ,WAAW;AAAA,MACpE,MAAM;AAAA,QACJ;AAAA,QACA,aAAa,KAAK,OAAO;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/supabase/index.cjs

@@ -99,7 +99,7 @@ var encryptConfigSchema = import_zod.z.object({
   v: import_zod.z.number(),
   tables: tablesSchema
 });
-var ProtectColumn = class {
+var EncryptedColumn = class {
   columnName;
   castAsValue;
   indexesValue = {};
@@ -115,7 +115,7 @@ var ProtectColumn = class {
    * before encrypting.
    *
    * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -134,7 +134,7 @@ var ProtectColumn = class {
    * ORE allows sorting, comparison, and range queries on encrypted data.
    * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
    *
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -157,7 +157,7 @@ var ProtectColumn = class {
    *
    * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
    *   When omitted, no token filters are applied.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -182,7 +182,7 @@ var ProtectColumn = class {
    *
    * @param opts - Optional match index configuration. Defaults to 3-character ngram
    *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -227,7 +227,7 @@ var ProtectColumn = class {
    * the plaintext type: strings become selector queries, objects/arrays become
    * containment queries.
    *
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -1076,7 +1076,7 @@ var EncryptedQueryBuilderImpl = class {
     const schema = this.schema;
     for (const colName of this.encryptedColumnNames) {
       const col = schema[colName];
-      if (col instanceof ProtectColumn) {
+      if (col instanceof EncryptedColumn) {
         map[colName] = col;
       }
     }