@cipherstash/stack 0.3.0 → 0.5.0

package/dist/dynamodb/index.cjs

@@ -24,6 +24,69 @@ __export(dynamodb_exports, {
 });
 module.exports = __toCommonJS(dynamodb_exports);
 
+// src/utils/logger/index.ts
+var import_evlog = require("evlog");
+var validLevels = ["debug", "info", "error"];
+function levelFromEnv() {
+  const env = process.env.STASH_STACK_LOG;
+  if (env && validLevels.includes(env)) return env;
+  return "error";
+}
+function samplingRatesForLevel(level) {
+  switch (level) {
+    case "debug":
+      return { debug: 100, info: 100, warn: 100, error: 100 };
+    case "info":
+      return { debug: 0, info: 100, warn: 100, error: 100 };
+    case "error":
+    default:
+      return { debug: 0, info: 0, warn: 0, error: 100 };
+  }
+}
+var initialized = false;
+function initStackLogger() {
+  if (initialized) return;
+  initialized = true;
+  const level = levelFromEnv();
+  const rates = samplingRatesForLevel(level);
+  (0, import_evlog.initLogger)({
+    env: { service: "@cipherstash/stack" },
+    enabled: true,
+    sampling: { rates }
+  });
+}
+initStackLogger();
+function safeMessage(args) {
+  return typeof args[0] === "string" ? args[0] : "";
+}
+var logger = {
+  debug(...args) {
+    const log = (0, import_evlog.createRequestLogger)();
+    log.set({
+      level: "debug",
+      source: "@cipherstash/stack",
+      message: safeMessage(args)
+    });
+    log.emit();
+  },
+  info(...args) {
+    const log = (0, import_evlog.createRequestLogger)();
+    log.set({ source: "@cipherstash/stack" });
+    log.info(safeMessage(args));
+    log.emit();
+  },
+  warn(...args) {
+    const log = (0, import_evlog.createRequestLogger)();
+    log.warn(safeMessage(args));
+    log.emit();
+  },
+  error(...args) {
+    const log = (0, import_evlog.createRequestLogger)();
+    log.error(safeMessage(args));
+    log.emit();
+  }
+};
+
 // src/dynamodb/operations/bulk-decrypt-models.ts
 var import_result = require("@byteslice/result");
 
@@ -46,6 +109,7 @@ function handleError(error, context, options) {
   const dynamoError = new EncryptedDynamoDBErrorImpl(errorMessage, errorCode, {
     context
   });
+  logger.error(`DynamoDB error in ${context}: ${errorMessage}`);
   if (options?.errorHandler) {
     options.errorHandler(dynamoError);
   }
@@ -213,6 +277,7 @@ var BulkDecryptModelsOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug(`DynamoDB: bulk decrypting ${this.items.length} models.`);
     return await (0, import_result.withResult)(
       async () => {
         const itemsWithEqlPayloads = this.items.map(
@@ -247,6 +312,7 @@ var BulkEncryptModelsOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug(`DynamoDB: bulk encrypting ${this.items.length} models.`);
     return await (0, import_result2.withResult)(
       async () => {
         const encryptResult = await this.encryptionClient.bulkEncryptModels(
@@ -285,6 +351,7 @@ var DecryptModelOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug("DynamoDB: decrypting model.");
     return await (0, import_result3.withResult)(
       async () => {
         const withEqlPayloads = toItemWithEqlPayloads(this.item, this.table);
@@ -317,6 +384,7 @@ var EncryptModelOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug("DynamoDB: encrypting model.");
     return await (0, import_result4.withResult)(
       async () => {
         const encryptResult = await this.encryptionClient.encryptModel(deepClone(this.item), this.table).audit(this.getAuditData());

package/dist/dynamodb/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/dynamodb/index.ts","../../src/dynamodb/operations/bulk-decrypt-models.ts","../../src/dynamodb/helpers.ts","../../src/dynamodb/operations/base-operation.ts","../../src/dynamodb/operations/bulk-encrypt-models.ts","../../src/dynamodb/operations/decrypt-model.ts","../../src/dynamodb/operations/encrypt-model.ts"],"sourcesContent":["import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport { BulkDecryptModelsOperation } from './operations/bulk-decrypt-models'\nimport { BulkEncryptModelsOperation } from './operations/bulk-encrypt-models'\nimport { DecryptModelOperation } from './operations/decrypt-model'\nimport { EncryptModelOperation } from './operations/encrypt-model'\nimport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBInstance,\n} from './types'\n\n/**\n * Create an encrypted DynamoDB helper bound to an `EncryptionClient`.\n *\n * Returns an object with `encryptModel`, `decryptModel`, `bulkEncryptModels`,\n * and `bulkDecryptModels` methods that transparently encrypt/decrypt DynamoDB\n * items according to the provided table schema.\n *\n * @param config - Configuration containing the `encryptionClient` and optional\n *   logging / error-handling callbacks.\n * @returns An {@link EncryptedDynamoDBInstance} with encrypt/decrypt operations.\n *\n * @example\n * ```typescript\n * import { Encryption } from \"@cipherstash/stack\"\n * import { encryptedDynamoDB } from \"@cipherstash/stack/dynamodb\"\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * const client = await Encryption({ schemas: [users] })\n * const dynamo = encryptedDynamoDB({ encryptionClient: client })\n *\n * const encrypted = await dynamo.encryptModel({ email: \"a@b.com\" }, users)\n * ```\n */\nexport function encryptedDynamoDB(\n  config: EncryptedDynamoDBConfig,\n): EncryptedDynamoDBInstance {\n  const { encryptionClient, options } = config\n\n  return {\n    encryptModel<T extends Record<string, unknown>>(\n      item: T,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new EncryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkEncryptModels<T extends Record<string, unknown>>(\n      items: T[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkEncryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n\n    decryptModel<T extends Record<string, unknown>>(\n      item: Record<string, EncryptedValue | unknown>,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new DecryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkDecryptModels<T extends Record<string, unknown>>(\n      items: Record<string, EncryptedValue | unknown>[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkDecryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n  }\n}\n\nexport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBError,\n  EncryptedDynamoDBInstance,\n} from './types'\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkDecryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>[]> {\n  private encryptionClient: EncryptionClient\n  private items: Record<string, EncryptedValue | unknown>[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: Record<string, EncryptedValue | unknown>[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>[], EncryptedDynamoDBError>\n  > {\n    return await withResult(\n      async () => {\n        const itemsWithEqlPayloads = this.items.map((item) =>\n          toItemWithEqlPayloads(item, this.table),\n        )\n\n        const decryptResult = await this.encryptionClient\n          .bulkDecryptModels<T>(itemsWithEqlPayloads as T[])\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'bulkDecryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport type { ProtectErrorCode } from '@cipherstash/protect-ffi'\nimport { ProtectError as FfiProtectError } from '@cipherstash/protect-ffi'\nimport type { EncryptedDynamoDBError } from './types'\n\nexport const ciphertextAttrSuffix = '__source'\nexport const searchTermAttrSuffix = '__hmac'\n\nexport class EncryptedDynamoDBErrorImpl\n  extends Error\n  implements EncryptedDynamoDBError\n{\n  constructor(\n    message: string,\n    public code: ProtectErrorCode | 'DYNAMODB_ENCRYPTION_ERROR',\n    public details?: Record<string, unknown>,\n  ) {\n    super(message)\n    this.name = 'EncryptedDynamoDBError'\n  }\n}\n\nexport function handleError(\n  error: unknown,\n  context: string,\n  options?: {\n    logger?: {\n      error: (message: string, error: Error) => void\n    }\n    errorHandler?: (error: EncryptedDynamoDBError) => void\n  },\n): EncryptedDynamoDBError {\n  // Preserve FFI error code if available, otherwise use generic DynamoDB error code\n  // Check for FfiProtectError instance or plain error objects with code property\n  const errorObj = error as Record<string, unknown>\n  const errorCode =\n    error instanceof FfiProtectError\n      ? error.code\n      : errorObj &&\n          typeof errorObj === 'object' &&\n          'code' in errorObj &&\n          typeof errorObj.code === 'string'\n        ? (errorObj.code as ProtectErrorCode)\n        : 'DYNAMODB_ENCRYPTION_ERROR'\n\n  const errorMessage =\n    error instanceof Error\n      ? error.message\n      : errorObj && typeof errorObj.message === 'string'\n        ? errorObj.message\n        : String(error)\n\n  const dynamoError = new EncryptedDynamoDBErrorImpl(errorMessage, errorCode, {\n    context,\n  })\n\n  if (options?.errorHandler) {\n    options.errorHandler(dynamoError)\n  }\n\n  if (options?.logger) {\n    options.logger.error(`Error in ${context}`, dynamoError)\n  }\n\n  return dynamoError\n}\n\nexport function deepClone<T>(obj: T): T {\n  if (obj === null || typeof obj !== 'object') {\n    return obj\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => deepClone(item)) as unknown as T\n  }\n\n  return Object.entries(obj as Record<string, unknown>).reduce(\n    (acc, [key, value]) => ({\n      // biome-ignore lint/performance/noAccumulatingSpread: TODO later\n      ...acc,\n      [key]: deepClone(value),\n    }),\n    {} as T,\n  )\n}\n\nexport function toEncryptedDynamoItem(\n  encrypted: Record<string, unknown>,\n  encryptedAttrs: string[],\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Handle encrypted payload\n    if (\n      encryptedAttrs.includes(attrName) ||\n      (isNested &&\n        typeof attrValue === 'object' &&\n        'c' in (attrValue as object))\n    ) {\n      const encryptPayload = attrValue as EncryptedValue\n      if (encryptPayload?.c) {\n        const result: Record<string, unknown> = {}\n        if (encryptPayload.hm) {\n          result[`${attrName}${searchTermAttrSuffix}`] = encryptPayload.hm\n        }\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.c\n        return result\n      }\n\n      if (encryptPayload?.sv) {\n        const result: Record<string, unknown> = {}\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.sv\n        return result\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(encrypted).reduce(\n    (putItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, putItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n\nexport function toItemWithEqlPayloads(\n  decrypted: Record<string, EncryptedValue | unknown>,\n  encryptionSchema: EncryptedTable<EncryptedTableColumn>,\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Skip HMAC fields\n    if (attrName.endsWith(searchTermAttrSuffix)) {\n      return {}\n    }\n\n    const encryptConfig = encryptionSchema.build()\n    const encryptedAttrs = Object.keys(encryptConfig.columns)\n    const columnName = attrName.slice(0, -ciphertextAttrSuffix.length)\n\n    // Handle encrypted payload\n    if (\n      attrName.endsWith(ciphertextAttrSuffix) &&\n      (encryptedAttrs.includes(columnName) || isNested)\n    ) {\n      const i = { c: columnName, t: encryptConfig.tableName }\n      const v = 2\n\n      // Nested values are not searchable, so we can just return the standard EQL payload.\n      // Worth noting, that encryptConfig.columns[columnName] will be undefined if isNested is true.\n      if (\n        !isNested &&\n        encryptConfig.columns[columnName].cast_as === 'json' &&\n        encryptConfig.columns[columnName].indexes.ste_vec\n      ) {\n        return {\n          [columnName]: {\n            i,\n            v,\n            k: 'sv',\n            sv: attrValue,\n          },\n        }\n      }\n\n      return {\n        [columnName]: {\n          i,\n          v,\n          k: 'ct',\n          c: attrValue,\n        },\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(decrypted).reduce(\n    (formattedItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, formattedItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n","import type { Result } from '@byteslice/result'\nimport type { EncryptedDynamoDBError } from '../types'\n\nexport type AuditConfig = {\n  metadata?: Record<string, unknown>\n}\n\nexport type AuditData = {\n  metadata?: Record<string, unknown>\n}\n\nexport type DynamoDBOperationOptions = {\n  logger?: {\n    error: (message: string, error: Error) => void\n  }\n  errorHandler?: (error: EncryptedDynamoDBError) => void\n}\n\nexport abstract class DynamoDBOperation<T> {\n  protected auditMetadata?: Record<string, unknown>\n  protected logger?: DynamoDBOperationOptions['logger']\n  protected errorHandler?: DynamoDBOperationOptions['errorHandler']\n\n  constructor(options?: DynamoDBOperationOptions) {\n    this.logger = options?.logger\n    this.errorHandler = options?.errorHandler\n  }\n\n  /**\n   * Attach audit metadata to this operation. Can be chained.\n   */\n  audit(config: AuditConfig): this {\n    this.auditMetadata = config.metadata\n    return this\n  }\n\n  /**\n   * Get the audit metadata for this operation.\n   */\n  protected getAuditData(): AuditData {\n    return {\n      metadata: this.auditMetadata,\n    }\n  }\n\n  /**\n   * Execute the operation and return a Result\n   */\n  abstract execute(): Promise<Result<T, EncryptedDynamoDBError>>\n\n  /**\n   * Make the operation thenable\n   */\n  public then<TResult1 = Result<T, EncryptedDynamoDBError>, TResult2 = never>(\n    onfulfilled?:\n      | ((\n          value: Result<T, EncryptedDynamoDBError>,\n        ) => TResult1 | PromiseLike<TResult1>)\n      | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): Promise<TResult1 | TResult2> {\n    return this.execute().then(onfulfilled, onrejected)\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkEncryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T[]> {\n  private encryptionClient: EncryptionClient\n  private items: T[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: T[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T[], EncryptedDynamoDBError>> {\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .bulkEncryptModels(\n            this.items.map((item) => deepClone(item)),\n            this.table,\n          )\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = encryptResult.data.map((item) => deepClone(item))\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return data.map(\n          (encrypted) => toEncryptedDynamoItem(encrypted, encryptedAttrs) as T,\n        )\n      },\n      (error) =>\n        handleError(error, 'bulkEncryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class DecryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>> {\n  private encryptionClient: EncryptionClient\n  private item: Record<string, EncryptedValue | unknown>\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: Record<string, EncryptedValue | unknown>,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>, EncryptedDynamoDBError>\n  > {\n    return await withResult(\n      async () => {\n        const withEqlPayloads = toItemWithEqlPayloads(this.item, this.table)\n\n        const decryptResult = await this.encryptionClient\n          .decryptModel<T>(withEqlPayloads as T)\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'decryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class EncryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T> {\n  private encryptionClient: EncryptionClient\n  private item: T\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: T,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T, EncryptedDynamoDBError>> {\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .encryptModel(deepClone(this.item), this.table)\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = deepClone(encryptResult.data)\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return toEncryptedDynamoItem(data, encryptedAttrs) as T\n      },\n      (error) =>\n        handleError(error, 'encryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,oBAAwC;;;ACAxC,yBAAgD;AAGzC,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAE7B,IAAM,6BAAN,cACG,MAEV;AAAA,EACE,YACE,SACO,MACA,SACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YACd,OACA,SACA,SAMwB;AAGxB,QAAM,WAAW;AACjB,QAAM,YACJ,iBAAiB,mBAAAA,eACb,MAAM,OACN,YACE,OAAO,aAAa,YACpB,UAAU,YACV,OAAO,SAAS,SAAS,WACxB,SAAS,OACV;AAER,QAAM,eACJ,iBAAiB,QACb,MAAM,UACN,YAAY,OAAO,SAAS,YAAY,WACtC,SAAS,UACT,OAAO,KAAK;AAEpB,QAAM,cAAc,IAAI,2BAA2B,cAAc,WAAW;AAAA,IAC1E;AAAA,EACF,CAAC;AAED,MAAI,SAAS,cAAc;AACzB,YAAQ,aAAa,WAAW;AAAA,EAClC;AAEA,MAAI,SAAS,QAAQ;AACnB,YAAQ,OAAO,MAAM,YAAY,OAAO,IAAI,WAAW;AAAA,EACzD;AAEA,SAAO;AACT;AAEO,SAAS,UAAa,KAAW;AACtC,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,WAAO,IAAI,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,EAC1C;AAEA,SAAO,OAAO,QAAQ,GAA8B,EAAE;AAAA,IACpD,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO;AAAA;AAAA,MAEtB,GAAG;AAAA,MACH,CAAC,GAAG,GAAG,UAAU,KAAK;AAAA,IACxB;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,gBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QACE,eAAe,SAAS,QAAQ,KAC/B,YACC,OAAO,cAAc,YACrB,OAAQ,WACV;AACA,YAAM,iBAAiB;AACvB,UAAI,gBAAgB,GAAG;AACrB,cAAM,SAAkC,CAAC;AACzC,YAAI,eAAe,IAAI;AACrB,iBAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAAA,QAChE;AACA,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAEA,UAAI,gBAAgB,IAAI;AACtB,cAAM,SAAkC,CAAC;AACzC,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,SAAS,CAAC,UAAU,SAAS,MAAM;AAClC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,SAAS,SAAS;AAAA,IAC7C;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,kBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QAAI,SAAS,SAAS,oBAAoB,GAAG;AAC3C,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,gBAAgB,iBAAiB,MAAM;AAC7C,UAAM,iBAAiB,OAAO,KAAK,cAAc,OAAO;AACxD,UAAM,aAAa,SAAS,MAAM,GAAG,CAAC,qBAAqB,MAAM;AAGjE,QACE,SAAS,SAAS,oBAAoB,MACrC,eAAe,SAAS,UAAU,KAAK,WACxC;AACA,YAAM,IAAI,EAAE,GAAG,YAAY,GAAG,cAAc,UAAU;AACtD,YAAM,IAAI;AAIV,UACE,CAAC,YACD,cAAc,QAAQ,UAAU,EAAE,YAAY,UAC9C,cAAc,QAAQ,UAAU,EAAE,QAAQ,SAC1C;AACA,eAAO;AAAA,UACL,CAAC,UAAU,GAAG;AAAA,YACZ;AAAA,YACA;AAAA,YACA,GAAG;AAAA,YACH,IAAI;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL,CAAC,UAAU,GAAG;AAAA,UACZ;AAAA,UACA;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,eAAe,CAAC,UAAU,SAAS,MAAM;AACxC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,eAAe,SAAS;AAAA,IACnD;AAAA,IACA,CAAC;AAAA,EACH;AACF;;;ACvNO,IAAe,oBAAf,MAAoC;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EAEV,YAAY,SAAoC;AAC9C,SAAK,SAAS,SAAS;AACvB,SAAK,eAAe,SAAS;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAA2B;AAC/B,SAAK,gBAAgB,OAAO;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKU,eAA0B;AAClC,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAUO,KACL,aAKA,YAC8B;AAC9B,WAAO,KAAK,QAAQ,EAAE,KAAK,aAAa,UAAU;AAAA,EACpD;AACF;;;AFpDO,IAAM,6BAAN,cAEG,kBAAkC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,uBAAuB,KAAK,MAAM;AAAA,UAAI,CAAC,SAC3C,sBAAsB,MAAM,KAAK,KAAK;AAAA,QACxC;AAEA,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,kBAAqB,oBAA2B,EAChD,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AG5DA,IAAAC,iBAAwC;AAQjC,IAAM,6BAAN,cAEG,kBAAuB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAwD;AACnE,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B;AAAA,UACC,KAAK,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,UACxC,KAAK;AAAA,QACP,EACC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,cAAc,KAAK,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAC7D,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,KAAK;AAAA,UACV,CAAC,cAAc,sBAAsB,WAAW,cAAc;AAAA,QAChE;AAAA,MACF;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC5DA,IAAAC,iBAAwC;AAQjC,IAAM,wBAAN,cAEG,kBAAgC;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,kBAAkB,sBAAsB,KAAK,MAAM,KAAK,KAAK;AAEnE,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAgB,eAAoB,EACpC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC1DA,IAAAC,iBAAwC;AAQjC,IAAM,wBAAN,cAEG,kBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAsD;AACjE,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAa,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,EAC7C,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,UAAU,cAAc,IAAI;AACzC,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,sBAAsB,MAAM,cAAc;AAAA,MACnD;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;ANpBO,SAAS,kBACd,QAC2B;AAC3B,QAAM,EAAE,kBAAkB,QAAQ,IAAI;AAEtC,SAAO;AAAA,IACL,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["FfiProtectError","import_result","import_result","import_result"]}
+{"version":3,"sources":["../../src/dynamodb/index.ts","../../src/utils/logger/index.ts","../../src/dynamodb/operations/bulk-decrypt-models.ts","../../src/dynamodb/helpers.ts","../../src/dynamodb/operations/base-operation.ts","../../src/dynamodb/operations/bulk-encrypt-models.ts","../../src/dynamodb/operations/decrypt-model.ts","../../src/dynamodb/operations/encrypt-model.ts"],"sourcesContent":["import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport { BulkDecryptModelsOperation } from './operations/bulk-decrypt-models'\nimport { BulkEncryptModelsOperation } from './operations/bulk-encrypt-models'\nimport { DecryptModelOperation } from './operations/decrypt-model'\nimport { EncryptModelOperation } from './operations/encrypt-model'\nimport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBInstance,\n} from './types'\n\n/**\n * Create an encrypted DynamoDB helper bound to an `EncryptionClient`.\n *\n * Returns an object with `encryptModel`, `decryptModel`, `bulkEncryptModels`,\n * and `bulkDecryptModels` methods that transparently encrypt/decrypt DynamoDB\n * items according to the provided table schema.\n *\n * @param config - Configuration containing the `encryptionClient` and optional\n *   logging / error-handling callbacks.\n * @returns An {@link EncryptedDynamoDBInstance} with encrypt/decrypt operations.\n *\n * @example\n * ```typescript\n * import { Encryption } from \"@cipherstash/stack\"\n * import { encryptedDynamoDB } from \"@cipherstash/stack/dynamodb\"\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * const client = await Encryption({ schemas: [users] })\n * const dynamo = encryptedDynamoDB({ encryptionClient: client })\n *\n * const encrypted = await dynamo.encryptModel({ email: \"a@b.com\" }, users)\n * ```\n */\nexport function encryptedDynamoDB(\n  config: EncryptedDynamoDBConfig,\n): EncryptedDynamoDBInstance {\n  const { encryptionClient, options } = config\n\n  return {\n    encryptModel<T extends Record<string, unknown>>(\n      item: T,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new EncryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkEncryptModels<T extends Record<string, unknown>>(\n      items: T[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkEncryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n\n    decryptModel<T extends Record<string, unknown>>(\n      item: Record<string, EncryptedValue | unknown>,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new DecryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkDecryptModels<T extends Record<string, unknown>>(\n      items: Record<string, EncryptedValue | unknown>[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkDecryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n  }\n}\n\nexport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBError,\n  EncryptedDynamoDBInstance,\n} from './types'\n","import { createRequestLogger, initLogger } from 'evlog'\n\n/**\n * Log level for the Stack logger.\n *\n * Configured via the `STASH_STACK_LOG` environment variable.\n *\n * - `'error'` — Only errors (default when `STASH_STACK_LOG` is not set).\n * - `'info'`  — Info and errors.\n * - `'debug'` — Debug, info, and errors.\n */\nexport type LogLevel = 'debug' | 'info' | 'error'\n\nconst validLevels: readonly LogLevel[] = ['debug', 'info', 'error'] as const\n\nfunction levelFromEnv(): LogLevel {\n  const env = process.env.STASH_STACK_LOG\n  if (env && validLevels.includes(env as LogLevel)) return env as LogLevel\n  return 'error'\n}\n\nfunction samplingRatesForLevel(level: LogLevel): Record<string, number> {\n  // evlog uses sampling rates: 100 = always emit, 0 = never emit\n  switch (level) {\n    case 'debug':\n      return { debug: 100, info: 100, warn: 100, error: 100 }\n    case 'info':\n      return { debug: 0, info: 100, warn: 100, error: 100 }\n    case 'error':\n    default:\n      return { debug: 0, info: 0, warn: 0, error: 100 }\n  }\n}\n\nlet initialized = false\n\n/**\n * Initialize the Stack logger.\n *\n * The log level is read from the `STASH_STACK_LOG` environment variable.\n * When the variable is not set, the default is `'error'` (errors only).\n *\n * @internal\n */\nexport function initStackLogger(): void {\n  if (initialized) return\n  initialized = true\n\n  const level = levelFromEnv()\n  const rates = samplingRatesForLevel(level)\n\n  initLogger({\n    env: { service: '@cipherstash/stack' },\n    enabled: true,\n    sampling: { rates },\n  })\n}\n\n// Auto-init with defaults on first import\ninitStackLogger()\n\nexport { createRequestLogger }\n\n// Stringify only the first arg (the message string); drop subsequent args\n// which may contain sensitive objects (e.g. encryptConfig, plaintext).\nfunction safeMessage(args: unknown[]): string {\n  return typeof args[0] === 'string' ? args[0] : ''\n}\n\n// Logger for simple one-off logs used across Stack interfaces.\nexport const logger = {\n  debug(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({\n      level: 'debug',\n      source: '@cipherstash/stack',\n      message: safeMessage(args),\n    })\n    log.emit()\n  },\n  info(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({ source: '@cipherstash/stack' })\n    log.info(safeMessage(args))\n    log.emit()\n  },\n  warn(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.warn(safeMessage(args))\n    log.emit()\n  },\n  error(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.error(safeMessage(args))\n    log.emit()\n  },\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkDecryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>[]> {\n  private encryptionClient: EncryptionClient\n  private items: Record<string, EncryptedValue | unknown>[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: Record<string, EncryptedValue | unknown>[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>[], EncryptedDynamoDBError>\n  > {\n    logger.debug(`DynamoDB: bulk decrypting ${this.items.length} models.`)\n    return await withResult(\n      async () => {\n        const itemsWithEqlPayloads = this.items.map((item) =>\n          toItemWithEqlPayloads(item, this.table),\n        )\n\n        const decryptResult = await this.encryptionClient\n          .bulkDecryptModels<T>(itemsWithEqlPayloads as T[])\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'bulkDecryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport { logger } from '@/utils/logger'\nimport type { ProtectErrorCode } from '@cipherstash/protect-ffi'\nimport { ProtectError as FfiProtectError } from '@cipherstash/protect-ffi'\nimport type { EncryptedDynamoDBError } from './types'\n\nexport const ciphertextAttrSuffix = '__source'\nexport const searchTermAttrSuffix = '__hmac'\n\nexport class EncryptedDynamoDBErrorImpl\n  extends Error\n  implements EncryptedDynamoDBError\n{\n  constructor(\n    message: string,\n    public code: ProtectErrorCode | 'DYNAMODB_ENCRYPTION_ERROR',\n    public details?: Record<string, unknown>,\n  ) {\n    super(message)\n    this.name = 'EncryptedDynamoDBError'\n  }\n}\n\nexport function handleError(\n  error: unknown,\n  context: string,\n  options?: {\n    logger?: {\n      error: (message: string, error: Error) => void\n    }\n    errorHandler?: (error: EncryptedDynamoDBError) => void\n  },\n): EncryptedDynamoDBError {\n  // Preserve FFI error code if available, otherwise use generic DynamoDB error code\n  // Check for FfiProtectError instance or plain error objects with code property\n  const errorObj = error as Record<string, unknown>\n  const errorCode =\n    error instanceof FfiProtectError\n      ? error.code\n      : errorObj &&\n          typeof errorObj === 'object' &&\n          'code' in errorObj &&\n          typeof errorObj.code === 'string'\n        ? (errorObj.code as ProtectErrorCode)\n        : 'DYNAMODB_ENCRYPTION_ERROR'\n\n  const errorMessage =\n    error instanceof Error\n      ? error.message\n      : errorObj && typeof errorObj.message === 'string'\n        ? errorObj.message\n        : String(error)\n\n  const dynamoError = new EncryptedDynamoDBErrorImpl(errorMessage, errorCode, {\n    context,\n  })\n\n  logger.error(`DynamoDB error in ${context}: ${errorMessage}`)\n\n  if (options?.errorHandler) {\n    options.errorHandler(dynamoError)\n  }\n\n  if (options?.logger) {\n    options.logger.error(`Error in ${context}`, dynamoError)\n  }\n\n  return dynamoError\n}\n\nexport function deepClone<T>(obj: T): T {\n  if (obj === null || typeof obj !== 'object') {\n    return obj\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => deepClone(item)) as unknown as T\n  }\n\n  return Object.entries(obj as Record<string, unknown>).reduce(\n    (acc, [key, value]) => ({\n      // biome-ignore lint/performance/noAccumulatingSpread: TODO later\n      ...acc,\n      [key]: deepClone(value),\n    }),\n    {} as T,\n  )\n}\n\nexport function toEncryptedDynamoItem(\n  encrypted: Record<string, unknown>,\n  encryptedAttrs: string[],\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Handle encrypted payload\n    if (\n      encryptedAttrs.includes(attrName) ||\n      (isNested &&\n        typeof attrValue === 'object' &&\n        'c' in (attrValue as object))\n    ) {\n      const encryptPayload = attrValue as EncryptedValue\n      if (encryptPayload?.c) {\n        const result: Record<string, unknown> = {}\n        if (encryptPayload.hm) {\n          result[`${attrName}${searchTermAttrSuffix}`] = encryptPayload.hm\n        }\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.c\n        return result\n      }\n\n      if (encryptPayload?.sv) {\n        const result: Record<string, unknown> = {}\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.sv\n        return result\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(encrypted).reduce(\n    (putItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, putItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n\nexport function toItemWithEqlPayloads(\n  decrypted: Record<string, EncryptedValue | unknown>,\n  encryptionSchema: EncryptedTable<EncryptedTableColumn>,\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Skip HMAC fields\n    if (attrName.endsWith(searchTermAttrSuffix)) {\n      return {}\n    }\n\n    const encryptConfig = encryptionSchema.build()\n    const encryptedAttrs = Object.keys(encryptConfig.columns)\n    const columnName = attrName.slice(0, -ciphertextAttrSuffix.length)\n\n    // Handle encrypted payload\n    if (\n      attrName.endsWith(ciphertextAttrSuffix) &&\n      (encryptedAttrs.includes(columnName) || isNested)\n    ) {\n      const i = { c: columnName, t: encryptConfig.tableName }\n      const v = 2\n\n      // Nested values are not searchable, so we can just return the standard EQL payload.\n      // Worth noting, that encryptConfig.columns[columnName] will be undefined if isNested is true.\n      if (\n        !isNested &&\n        encryptConfig.columns[columnName].cast_as === 'json' &&\n        encryptConfig.columns[columnName].indexes.ste_vec\n      ) {\n        return {\n          [columnName]: {\n            i,\n            v,\n            k: 'sv',\n            sv: attrValue,\n          },\n        }\n      }\n\n      return {\n        [columnName]: {\n          i,\n          v,\n          k: 'ct',\n          c: attrValue,\n        },\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(decrypted).reduce(\n    (formattedItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, formattedItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n","import type { Result } from '@byteslice/result'\nimport type { EncryptedDynamoDBError } from '../types'\n\nexport type AuditConfig = {\n  metadata?: Record<string, unknown>\n}\n\nexport type AuditData = {\n  metadata?: Record<string, unknown>\n}\n\nexport type DynamoDBOperationOptions = {\n  logger?: {\n    error: (message: string, error: Error) => void\n  }\n  errorHandler?: (error: EncryptedDynamoDBError) => void\n}\n\nexport abstract class DynamoDBOperation<T> {\n  protected auditMetadata?: Record<string, unknown>\n  protected logger?: DynamoDBOperationOptions['logger']\n  protected errorHandler?: DynamoDBOperationOptions['errorHandler']\n\n  constructor(options?: DynamoDBOperationOptions) {\n    this.logger = options?.logger\n    this.errorHandler = options?.errorHandler\n  }\n\n  /**\n   * Attach audit metadata to this operation. Can be chained.\n   */\n  audit(config: AuditConfig): this {\n    this.auditMetadata = config.metadata\n    return this\n  }\n\n  /**\n   * Get the audit metadata for this operation.\n   */\n  protected getAuditData(): AuditData {\n    return {\n      metadata: this.auditMetadata,\n    }\n  }\n\n  /**\n   * Execute the operation and return a Result\n   */\n  abstract execute(): Promise<Result<T, EncryptedDynamoDBError>>\n\n  /**\n   * Make the operation thenable\n   */\n  public then<TResult1 = Result<T, EncryptedDynamoDBError>, TResult2 = never>(\n    onfulfilled?:\n      | ((\n          value: Result<T, EncryptedDynamoDBError>,\n        ) => TResult1 | PromiseLike<TResult1>)\n      | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): Promise<TResult1 | TResult2> {\n    return this.execute().then(onfulfilled, onrejected)\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkEncryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T[]> {\n  private encryptionClient: EncryptionClient\n  private items: T[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: T[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T[], EncryptedDynamoDBError>> {\n    logger.debug(`DynamoDB: bulk encrypting ${this.items.length} models.`)\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .bulkEncryptModels(\n            this.items.map((item) => deepClone(item)),\n            this.table,\n          )\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = encryptResult.data.map((item) => deepClone(item))\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return data.map(\n          (encrypted) => toEncryptedDynamoItem(encrypted, encryptedAttrs) as T,\n        )\n      },\n      (error) =>\n        handleError(error, 'bulkEncryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class DecryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>> {\n  private encryptionClient: EncryptionClient\n  private item: Record<string, EncryptedValue | unknown>\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: Record<string, EncryptedValue | unknown>,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>, EncryptedDynamoDBError>\n  > {\n    logger.debug('DynamoDB: decrypting model.')\n    return await withResult(\n      async () => {\n        const withEqlPayloads = toItemWithEqlPayloads(this.item, this.table)\n\n        const decryptResult = await this.encryptionClient\n          .decryptModel<T>(withEqlPayloads as T)\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'decryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class EncryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T> {\n  private encryptionClient: EncryptionClient\n  private item: T\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: T,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T, EncryptedDynamoDBError>> {\n    logger.debug('DynamoDB: encrypting model.')\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .encryptModel(deepClone(this.item), this.table)\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = deepClone(encryptResult.data)\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return toEncryptedDynamoItem(data, encryptedAttrs) as T\n      },\n      (error) =>\n        handleError(error, 'encryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,mBAAgD;AAahD,IAAM,cAAmC,CAAC,SAAS,QAAQ,OAAO;AAElE,SAAS,eAAyB;AAChC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,YAAY,SAAS,GAAe,EAAG,QAAO;AACzD,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAyC;AAEtE,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,EAAE,OAAO,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI;AAAA,IACxD,KAAK;AACH,aAAO,EAAE,OAAO,GAAG,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI;AAAA,IACtD,KAAK;AAAA,IACL;AACE,aAAO,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,IAAI;AAAA,EACpD;AACF;AAEA,IAAI,cAAc;AAUX,SAAS,kBAAwB;AACtC,MAAI,YAAa;AACjB,gBAAc;AAEd,QAAM,QAAQ,aAAa;AAC3B,QAAM,QAAQ,sBAAsB,KAAK;AAEzC,+BAAW;AAAA,IACT,KAAK,EAAE,SAAS,qBAAqB;AAAA,IACrC,SAAS;AAAA,IACT,UAAU,EAAE,MAAM;AAAA,EACpB,CAAC;AACH;AAGA,gBAAgB;AAMhB,SAAS,YAAY,MAAyB;AAC5C,SAAO,OAAO,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI;AACjD;AAGO,IAAM,SAAS;AAAA,EACpB,SAAS,MAAiB;AACxB,UAAM,UAAM,kCAAoB;AAChC,QAAI,IAAI;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,YAAY,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,UAAM,kCAAoB;AAChC,QAAI,IAAI,EAAE,QAAQ,qBAAqB,CAAC;AACxC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,UAAM,kCAAoB;AAChC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,SAAS,MAAiB;AACxB,UAAM,UAAM,kCAAoB;AAChC,QAAI,MAAM,YAAY,IAAI,CAAC;AAC3B,QAAI,KAAK;AAAA,EACX;AACF;;;AC5FA,oBAAwC;;;ACAxC,yBAAgD;AAGzC,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAE7B,IAAM,6BAAN,cACG,MAEV;AAAA,EACE,YACE,SACO,MACA,SACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YACd,OACA,SACA,SAMwB;AAGxB,QAAM,WAAW;AACjB,QAAM,YACJ,iBAAiB,mBAAAA,eACb,MAAM,OACN,YACE,OAAO,aAAa,YACpB,UAAU,YACV,OAAO,SAAS,SAAS,WACxB,SAAS,OACV;AAER,QAAM,eACJ,iBAAiB,QACb,MAAM,UACN,YAAY,OAAO,SAAS,YAAY,WACtC,SAAS,UACT,OAAO,KAAK;AAEpB,QAAM,cAAc,IAAI,2BAA2B,cAAc,WAAW;AAAA,IAC1E;AAAA,EACF,CAAC;AAED,SAAO,MAAM,qBAAqB,OAAO,KAAK,YAAY,EAAE;AAE5D,MAAI,SAAS,cAAc;AACzB,YAAQ,aAAa,WAAW;AAAA,EAClC;AAEA,MAAI,SAAS,QAAQ;AACnB,YAAQ,OAAO,MAAM,YAAY,OAAO,IAAI,WAAW;AAAA,EACzD;AAEA,SAAO;AACT;AAEO,SAAS,UAAa,KAAW;AACtC,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,WAAO,IAAI,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,EAC1C;AAEA,SAAO,OAAO,QAAQ,GAA8B,EAAE;AAAA,IACpD,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO;AAAA;AAAA,MAEtB,GAAG;AAAA,MACH,CAAC,GAAG,GAAG,UAAU,KAAK;AAAA,IACxB;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,gBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QACE,eAAe,SAAS,QAAQ,KAC/B,YACC,OAAO,cAAc,YACrB,OAAQ,WACV;AACA,YAAM,iBAAiB;AACvB,UAAI,gBAAgB,GAAG;AACrB,cAAM,SAAkC,CAAC;AACzC,YAAI,eAAe,IAAI;AACrB,iBAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAAA,QAChE;AACA,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAEA,UAAI,gBAAgB,IAAI;AACtB,cAAM,SAAkC,CAAC;AACzC,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,SAAS,CAAC,UAAU,SAAS,MAAM;AAClC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,SAAS,SAAS;AAAA,IAC7C;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,kBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QAAI,SAAS,SAAS,oBAAoB,GAAG;AAC3C,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,gBAAgB,iBAAiB,MAAM;AAC7C,UAAM,iBAAiB,OAAO,KAAK,cAAc,OAAO;AACxD,UAAM,aAAa,SAAS,MAAM,GAAG,CAAC,qBAAqB,MAAM;AAGjE,QACE,SAAS,SAAS,oBAAoB,MACrC,eAAe,SAAS,UAAU,KAAK,WACxC;AACA,YAAM,IAAI,EAAE,GAAG,YAAY,GAAG,cAAc,UAAU;AACtD,YAAM,IAAI;AAIV,UACE,CAAC,YACD,cAAc,QAAQ,UAAU,EAAE,YAAY,UAC9C,cAAc,QAAQ,UAAU,EAAE,QAAQ,SAC1C;AACA,eAAO;AAAA,UACL,CAAC,UAAU,GAAG;AAAA,YACZ;AAAA,YACA;AAAA,YACA,GAAG;AAAA,YACH,IAAI;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL,CAAC,UAAU,GAAG;AAAA,UACZ;AAAA,UACA;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,eAAe,CAAC,UAAU,SAAS,MAAM;AACxC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,eAAe,SAAS;AAAA,IACnD;AAAA,IACA,CAAC;AAAA,EACH;AACF;;;AC1NO,IAAe,oBAAf,MAAoC;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EAEV,YAAY,SAAoC;AAC9C,SAAK,SAAS,SAAS;AACvB,SAAK,eAAe,SAAS;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAA2B;AAC/B,SAAK,gBAAgB,OAAO;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKU,eAA0B;AAClC,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAUO,KACL,aAKA,YAC8B;AAC9B,WAAO,KAAK,QAAQ,EAAE,KAAK,aAAa,UAAU;AAAA,EACpD;AACF;;;AFnDO,IAAM,6BAAN,cAEG,kBAAkC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,MAAM,6BAA6B,KAAK,MAAM,MAAM,UAAU;AACrE,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,uBAAuB,KAAK,MAAM;AAAA,UAAI,CAAC,SAC3C,sBAAsB,MAAM,KAAK,KAAK;AAAA,QACxC;AAEA,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,kBAAqB,oBAA2B,EAChD,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AG7DA,IAAAC,iBAAwC;AAQjC,IAAM,6BAAN,cAEG,kBAAuB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAwD;AACnE,WAAO,MAAM,6BAA6B,KAAK,MAAM,MAAM,UAAU;AACrE,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B;AAAA,UACC,KAAK,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,UACxC,KAAK;AAAA,QACP,EACC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,cAAc,KAAK,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAC7D,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,KAAK;AAAA,UACV,CAAC,cAAc,sBAAsB,WAAW,cAAc;AAAA,QAChE;AAAA,MACF;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC7DA,IAAAC,iBAAwC;AAQjC,IAAM,wBAAN,cAEG,kBAAgC;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,MAAM,6BAA6B;AAC1C,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,kBAAkB,sBAAsB,KAAK,MAAM,KAAK,KAAK;AAEnE,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAgB,eAAoB,EACpC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC3DA,IAAAC,iBAAwC;AAQjC,IAAM,wBAAN,cAEG,kBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAsD;AACjE,WAAO,MAAM,6BAA6B;AAC1C,WAAO,UAAM;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAa,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,EAC7C,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,UAAU,cAAc,IAAI;AACzC,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,sBAAsB,MAAM,cAAc;AAAA,MACnD;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;APtBO,SAAS,kBACd,QAC2B;AAC3B,QAAM,EAAE,kBAAkB,QAAQ,IAAI;AAEtC,SAAO;AAAA,IACL,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["FfiProtectError","import_result","import_result","import_result"]}

package/dist/dynamodb/index.d.cts

@@ -1,10 +1,10 @@
-import { E as EncryptionClient } from '../client-Bf0Xw2xo.cjs';
-import { D as Decrypted, k as EncryptedValue, f as EncryptedTable, g as EncryptedTableColumn } from '../types-public-0CzBV45X.cjs';
+import { a as EncryptionClient } from '../client-BVQvgvdY.cjs';
+import { D as Decrypted, g as EncryptedValue, c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-dKxDzTIL.cjs';
 import { ProtectErrorCode } from '@cipherstash/protect-ffi';
 import { Result } from '@byteslice/result';
-import '../index-9-Ya3fDK.cjs';
+import '../errors/index.cjs';
+import '../identity/index.cjs';
 import 'zod';
-import 'evlog';
 
 type AuditConfig = {
     metadata?: Record<string, unknown>;

package/dist/dynamodb/index.d.ts

@@ -1,10 +1,10 @@
-import { E as EncryptionClient } from '../client-Kfp8OsPB.js';
-import { D as Decrypted, k as EncryptedValue, f as EncryptedTable, g as EncryptedTableColumn } from '../types-public-0CzBV45X.js';
+import { a as EncryptionClient } from '../client-BFrHTgC6.js';
+import { D as Decrypted, g as EncryptedValue, c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-dKxDzTIL.js';
 import { ProtectErrorCode } from '@cipherstash/protect-ffi';
 import { Result } from '@byteslice/result';
-import '../index-9-Ya3fDK.js';
+import '../errors/index.js';
+import '../identity/index.js';
 import 'zod';
-import 'evlog';
 
 type AuditConfig = {
     metadata?: Record<string, unknown>;

package/dist/dynamodb/index.js

@@ -1,3 +1,7 @@
+import {
+  logger
+} from "../chunk-Q5FTQLYG.js";
+
 // src/dynamodb/operations/bulk-decrypt-models.ts
 import { withResult } from "@byteslice/result";
 
@@ -20,6 +24,7 @@ function handleError(error, context, options) {
   const dynamoError = new EncryptedDynamoDBErrorImpl(errorMessage, errorCode, {
     context
   });
+  logger.error(`DynamoDB error in ${context}: ${errorMessage}`);
   if (options?.errorHandler) {
     options.errorHandler(dynamoError);
   }
@@ -187,6 +192,7 @@ var BulkDecryptModelsOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug(`DynamoDB: bulk decrypting ${this.items.length} models.`);
     return await withResult(
       async () => {
         const itemsWithEqlPayloads = this.items.map(
@@ -221,6 +227,7 @@ var BulkEncryptModelsOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug(`DynamoDB: bulk encrypting ${this.items.length} models.`);
     return await withResult2(
       async () => {
         const encryptResult = await this.encryptionClient.bulkEncryptModels(
@@ -259,6 +266,7 @@ var DecryptModelOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug("DynamoDB: decrypting model.");
     return await withResult3(
       async () => {
         const withEqlPayloads = toItemWithEqlPayloads(this.item, this.table);
@@ -291,6 +299,7 @@ var EncryptModelOperation = class extends DynamoDBOperation {
     this.table = table;
   }
   async execute() {
+    logger.debug("DynamoDB: encrypting model.");
     return await withResult4(
       async () => {
         const encryptResult = await this.encryptionClient.encryptModel(deepClone(this.item), this.table).audit(this.getAuditData());

package/dist/dynamodb/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/dynamodb/operations/bulk-decrypt-models.ts","../../src/dynamodb/helpers.ts","../../src/dynamodb/operations/base-operation.ts","../../src/dynamodb/operations/bulk-encrypt-models.ts","../../src/dynamodb/operations/decrypt-model.ts","../../src/dynamodb/operations/encrypt-model.ts","../../src/dynamodb/index.ts"],"sourcesContent":["import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkDecryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>[]> {\n  private encryptionClient: EncryptionClient\n  private items: Record<string, EncryptedValue | unknown>[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: Record<string, EncryptedValue | unknown>[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>[], EncryptedDynamoDBError>\n  > {\n    return await withResult(\n      async () => {\n        const itemsWithEqlPayloads = this.items.map((item) =>\n          toItemWithEqlPayloads(item, this.table),\n        )\n\n        const decryptResult = await this.encryptionClient\n          .bulkDecryptModels<T>(itemsWithEqlPayloads as T[])\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'bulkDecryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport type { ProtectErrorCode } from '@cipherstash/protect-ffi'\nimport { ProtectError as FfiProtectError } from '@cipherstash/protect-ffi'\nimport type { EncryptedDynamoDBError } from './types'\n\nexport const ciphertextAttrSuffix = '__source'\nexport const searchTermAttrSuffix = '__hmac'\n\nexport class EncryptedDynamoDBErrorImpl\n  extends Error\n  implements EncryptedDynamoDBError\n{\n  constructor(\n    message: string,\n    public code: ProtectErrorCode | 'DYNAMODB_ENCRYPTION_ERROR',\n    public details?: Record<string, unknown>,\n  ) {\n    super(message)\n    this.name = 'EncryptedDynamoDBError'\n  }\n}\n\nexport function handleError(\n  error: unknown,\n  context: string,\n  options?: {\n    logger?: {\n      error: (message: string, error: Error) => void\n    }\n    errorHandler?: (error: EncryptedDynamoDBError) => void\n  },\n): EncryptedDynamoDBError {\n  // Preserve FFI error code if available, otherwise use generic DynamoDB error code\n  // Check for FfiProtectError instance or plain error objects with code property\n  const errorObj = error as Record<string, unknown>\n  const errorCode =\n    error instanceof FfiProtectError\n      ? error.code\n      : errorObj &&\n          typeof errorObj === 'object' &&\n          'code' in errorObj &&\n          typeof errorObj.code === 'string'\n        ? (errorObj.code as ProtectErrorCode)\n        : 'DYNAMODB_ENCRYPTION_ERROR'\n\n  const errorMessage =\n    error instanceof Error\n      ? error.message\n      : errorObj && typeof errorObj.message === 'string'\n        ? errorObj.message\n        : String(error)\n\n  const dynamoError = new EncryptedDynamoDBErrorImpl(errorMessage, errorCode, {\n    context,\n  })\n\n  if (options?.errorHandler) {\n    options.errorHandler(dynamoError)\n  }\n\n  if (options?.logger) {\n    options.logger.error(`Error in ${context}`, dynamoError)\n  }\n\n  return dynamoError\n}\n\nexport function deepClone<T>(obj: T): T {\n  if (obj === null || typeof obj !== 'object') {\n    return obj\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => deepClone(item)) as unknown as T\n  }\n\n  return Object.entries(obj as Record<string, unknown>).reduce(\n    (acc, [key, value]) => ({\n      // biome-ignore lint/performance/noAccumulatingSpread: TODO later\n      ...acc,\n      [key]: deepClone(value),\n    }),\n    {} as T,\n  )\n}\n\nexport function toEncryptedDynamoItem(\n  encrypted: Record<string, unknown>,\n  encryptedAttrs: string[],\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Handle encrypted payload\n    if (\n      encryptedAttrs.includes(attrName) ||\n      (isNested &&\n        typeof attrValue === 'object' &&\n        'c' in (attrValue as object))\n    ) {\n      const encryptPayload = attrValue as EncryptedValue\n      if (encryptPayload?.c) {\n        const result: Record<string, unknown> = {}\n        if (encryptPayload.hm) {\n          result[`${attrName}${searchTermAttrSuffix}`] = encryptPayload.hm\n        }\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.c\n        return result\n      }\n\n      if (encryptPayload?.sv) {\n        const result: Record<string, unknown> = {}\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.sv\n        return result\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(encrypted).reduce(\n    (putItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, putItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n\nexport function toItemWithEqlPayloads(\n  decrypted: Record<string, EncryptedValue | unknown>,\n  encryptionSchema: EncryptedTable<EncryptedTableColumn>,\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Skip HMAC fields\n    if (attrName.endsWith(searchTermAttrSuffix)) {\n      return {}\n    }\n\n    const encryptConfig = encryptionSchema.build()\n    const encryptedAttrs = Object.keys(encryptConfig.columns)\n    const columnName = attrName.slice(0, -ciphertextAttrSuffix.length)\n\n    // Handle encrypted payload\n    if (\n      attrName.endsWith(ciphertextAttrSuffix) &&\n      (encryptedAttrs.includes(columnName) || isNested)\n    ) {\n      const i = { c: columnName, t: encryptConfig.tableName }\n      const v = 2\n\n      // Nested values are not searchable, so we can just return the standard EQL payload.\n      // Worth noting, that encryptConfig.columns[columnName] will be undefined if isNested is true.\n      if (\n        !isNested &&\n        encryptConfig.columns[columnName].cast_as === 'json' &&\n        encryptConfig.columns[columnName].indexes.ste_vec\n      ) {\n        return {\n          [columnName]: {\n            i,\n            v,\n            k: 'sv',\n            sv: attrValue,\n          },\n        }\n      }\n\n      return {\n        [columnName]: {\n          i,\n          v,\n          k: 'ct',\n          c: attrValue,\n        },\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(decrypted).reduce(\n    (formattedItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, formattedItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n","import type { Result } from '@byteslice/result'\nimport type { EncryptedDynamoDBError } from '../types'\n\nexport type AuditConfig = {\n  metadata?: Record<string, unknown>\n}\n\nexport type AuditData = {\n  metadata?: Record<string, unknown>\n}\n\nexport type DynamoDBOperationOptions = {\n  logger?: {\n    error: (message: string, error: Error) => void\n  }\n  errorHandler?: (error: EncryptedDynamoDBError) => void\n}\n\nexport abstract class DynamoDBOperation<T> {\n  protected auditMetadata?: Record<string, unknown>\n  protected logger?: DynamoDBOperationOptions['logger']\n  protected errorHandler?: DynamoDBOperationOptions['errorHandler']\n\n  constructor(options?: DynamoDBOperationOptions) {\n    this.logger = options?.logger\n    this.errorHandler = options?.errorHandler\n  }\n\n  /**\n   * Attach audit metadata to this operation. Can be chained.\n   */\n  audit(config: AuditConfig): this {\n    this.auditMetadata = config.metadata\n    return this\n  }\n\n  /**\n   * Get the audit metadata for this operation.\n   */\n  protected getAuditData(): AuditData {\n    return {\n      metadata: this.auditMetadata,\n    }\n  }\n\n  /**\n   * Execute the operation and return a Result\n   */\n  abstract execute(): Promise<Result<T, EncryptedDynamoDBError>>\n\n  /**\n   * Make the operation thenable\n   */\n  public then<TResult1 = Result<T, EncryptedDynamoDBError>, TResult2 = never>(\n    onfulfilled?:\n      | ((\n          value: Result<T, EncryptedDynamoDBError>,\n        ) => TResult1 | PromiseLike<TResult1>)\n      | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): Promise<TResult1 | TResult2> {\n    return this.execute().then(onfulfilled, onrejected)\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkEncryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T[]> {\n  private encryptionClient: EncryptionClient\n  private items: T[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: T[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T[], EncryptedDynamoDBError>> {\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .bulkEncryptModels(\n            this.items.map((item) => deepClone(item)),\n            this.table,\n          )\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = encryptResult.data.map((item) => deepClone(item))\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return data.map(\n          (encrypted) => toEncryptedDynamoItem(encrypted, encryptedAttrs) as T,\n        )\n      },\n      (error) =>\n        handleError(error, 'bulkEncryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class DecryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>> {\n  private encryptionClient: EncryptionClient\n  private item: Record<string, EncryptedValue | unknown>\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: Record<string, EncryptedValue | unknown>,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>, EncryptedDynamoDBError>\n  > {\n    return await withResult(\n      async () => {\n        const withEqlPayloads = toItemWithEqlPayloads(this.item, this.table)\n\n        const decryptResult = await this.encryptionClient\n          .decryptModel<T>(withEqlPayloads as T)\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'decryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class EncryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T> {\n  private encryptionClient: EncryptionClient\n  private item: T\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: T,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T, EncryptedDynamoDBError>> {\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .encryptModel(deepClone(this.item), this.table)\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = deepClone(encryptResult.data)\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return toEncryptedDynamoItem(data, encryptedAttrs) as T\n      },\n      (error) =>\n        handleError(error, 'encryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport { BulkDecryptModelsOperation } from './operations/bulk-decrypt-models'\nimport { BulkEncryptModelsOperation } from './operations/bulk-encrypt-models'\nimport { DecryptModelOperation } from './operations/decrypt-model'\nimport { EncryptModelOperation } from './operations/encrypt-model'\nimport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBInstance,\n} from './types'\n\n/**\n * Create an encrypted DynamoDB helper bound to an `EncryptionClient`.\n *\n * Returns an object with `encryptModel`, `decryptModel`, `bulkEncryptModels`,\n * and `bulkDecryptModels` methods that transparently encrypt/decrypt DynamoDB\n * items according to the provided table schema.\n *\n * @param config - Configuration containing the `encryptionClient` and optional\n *   logging / error-handling callbacks.\n * @returns An {@link EncryptedDynamoDBInstance} with encrypt/decrypt operations.\n *\n * @example\n * ```typescript\n * import { Encryption } from \"@cipherstash/stack\"\n * import { encryptedDynamoDB } from \"@cipherstash/stack/dynamodb\"\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * const client = await Encryption({ schemas: [users] })\n * const dynamo = encryptedDynamoDB({ encryptionClient: client })\n *\n * const encrypted = await dynamo.encryptModel({ email: \"a@b.com\" }, users)\n * ```\n */\nexport function encryptedDynamoDB(\n  config: EncryptedDynamoDBConfig,\n): EncryptedDynamoDBInstance {\n  const { encryptionClient, options } = config\n\n  return {\n    encryptModel<T extends Record<string, unknown>>(\n      item: T,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new EncryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkEncryptModels<T extends Record<string, unknown>>(\n      items: T[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkEncryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n\n    decryptModel<T extends Record<string, unknown>>(\n      item: Record<string, EncryptedValue | unknown>,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new DecryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkDecryptModels<T extends Record<string, unknown>>(\n      items: Record<string, EncryptedValue | unknown>[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkDecryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n  }\n}\n\nexport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBError,\n  EncryptedDynamoDBInstance,\n} from './types'\n"],"mappings":";AAGA,SAAsB,kBAAkB;;;ACAxC,SAAS,gBAAgB,uBAAuB;AAGzC,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAE7B,IAAM,6BAAN,cACG,MAEV;AAAA,EACE,YACE,SACO,MACA,SACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YACd,OACA,SACA,SAMwB;AAGxB,QAAM,WAAW;AACjB,QAAM,YACJ,iBAAiB,kBACb,MAAM,OACN,YACE,OAAO,aAAa,YACpB,UAAU,YACV,OAAO,SAAS,SAAS,WACxB,SAAS,OACV;AAER,QAAM,eACJ,iBAAiB,QACb,MAAM,UACN,YAAY,OAAO,SAAS,YAAY,WACtC,SAAS,UACT,OAAO,KAAK;AAEpB,QAAM,cAAc,IAAI,2BAA2B,cAAc,WAAW;AAAA,IAC1E;AAAA,EACF,CAAC;AAED,MAAI,SAAS,cAAc;AACzB,YAAQ,aAAa,WAAW;AAAA,EAClC;AAEA,MAAI,SAAS,QAAQ;AACnB,YAAQ,OAAO,MAAM,YAAY,OAAO,IAAI,WAAW;AAAA,EACzD;AAEA,SAAO;AACT;AAEO,SAAS,UAAa,KAAW;AACtC,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,WAAO,IAAI,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,EAC1C;AAEA,SAAO,OAAO,QAAQ,GAA8B,EAAE;AAAA,IACpD,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO;AAAA;AAAA,MAEtB,GAAG;AAAA,MACH,CAAC,GAAG,GAAG,UAAU,KAAK;AAAA,IACxB;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,gBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QACE,eAAe,SAAS,QAAQ,KAC/B,YACC,OAAO,cAAc,YACrB,OAAQ,WACV;AACA,YAAM,iBAAiB;AACvB,UAAI,gBAAgB,GAAG;AACrB,cAAM,SAAkC,CAAC;AACzC,YAAI,eAAe,IAAI;AACrB,iBAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAAA,QAChE;AACA,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAEA,UAAI,gBAAgB,IAAI;AACtB,cAAM,SAAkC,CAAC;AACzC,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,SAAS,CAAC,UAAU,SAAS,MAAM;AAClC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,SAAS,SAAS;AAAA,IAC7C;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,kBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QAAI,SAAS,SAAS,oBAAoB,GAAG;AAC3C,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,gBAAgB,iBAAiB,MAAM;AAC7C,UAAM,iBAAiB,OAAO,KAAK,cAAc,OAAO;AACxD,UAAM,aAAa,SAAS,MAAM,GAAG,CAAC,qBAAqB,MAAM;AAGjE,QACE,SAAS,SAAS,oBAAoB,MACrC,eAAe,SAAS,UAAU,KAAK,WACxC;AACA,YAAM,IAAI,EAAE,GAAG,YAAY,GAAG,cAAc,UAAU;AACtD,YAAM,IAAI;AAIV,UACE,CAAC,YACD,cAAc,QAAQ,UAAU,EAAE,YAAY,UAC9C,cAAc,QAAQ,UAAU,EAAE,QAAQ,SAC1C;AACA,eAAO;AAAA,UACL,CAAC,UAAU,GAAG;AAAA,YACZ;AAAA,YACA;AAAA,YACA,GAAG;AAAA,YACH,IAAI;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL,CAAC,UAAU,GAAG;AAAA,UACZ;AAAA,UACA;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,eAAe,CAAC,UAAU,SAAS,MAAM;AACxC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,eAAe,SAAS;AAAA,IACnD;AAAA,IACA,CAAC;AAAA,EACH;AACF;;;ACvNO,IAAe,oBAAf,MAAoC;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EAEV,YAAY,SAAoC;AAC9C,SAAK,SAAS,SAAS;AACvB,SAAK,eAAe,SAAS;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAA2B;AAC/B,SAAK,gBAAgB,OAAO;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKU,eAA0B;AAClC,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAUO,KACL,aAKA,YAC8B;AAC9B,WAAO,KAAK,QAAQ,EAAE,KAAK,aAAa,UAAU;AAAA,EACpD;AACF;;;AFpDO,IAAM,6BAAN,cAEG,kBAAkC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,MAAM;AAAA,MACX,YAAY;AACV,cAAM,uBAAuB,KAAK,MAAM;AAAA,UAAI,CAAC,SAC3C,sBAAsB,MAAM,KAAK,KAAK;AAAA,QACxC;AAEA,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,kBAAqB,oBAA2B,EAChD,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AG5DA,SAAsB,cAAAA,mBAAkB;AAQjC,IAAM,6BAAN,cAEG,kBAAuB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAwD;AACnE,WAAO,MAAMC;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B;AAAA,UACC,KAAK,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,UACxC,KAAK;AAAA,QACP,EACC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,cAAc,KAAK,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAC7D,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,KAAK;AAAA,UACV,CAAC,cAAc,sBAAsB,WAAW,cAAc;AAAA,QAChE;AAAA,MACF;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC5DA,SAAsB,cAAAC,mBAAkB;AAQjC,IAAM,wBAAN,cAEG,kBAAgC;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,MAAMC;AAAA,MACX,YAAY;AACV,cAAM,kBAAkB,sBAAsB,KAAK,MAAM,KAAK,KAAK;AAEnE,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAgB,eAAoB,EACpC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC1DA,SAAsB,cAAAC,mBAAkB;AAQjC,IAAM,wBAAN,cAEG,kBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAsD;AACjE,WAAO,MAAMC;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAa,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,EAC7C,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,UAAU,cAAc,IAAI;AACzC,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,sBAAsB,MAAM,cAAc;AAAA,MACnD;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;ACpBO,SAAS,kBACd,QAC2B;AAC3B,QAAM,EAAE,kBAAkB,QAAQ,IAAI;AAEtC,SAAO;AAAA,IACL,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["withResult","withResult","withResult","withResult","withResult","withResult"]}
+{"version":3,"sources":["../../src/dynamodb/operations/bulk-decrypt-models.ts","../../src/dynamodb/helpers.ts","../../src/dynamodb/operations/base-operation.ts","../../src/dynamodb/operations/bulk-encrypt-models.ts","../../src/dynamodb/operations/decrypt-model.ts","../../src/dynamodb/operations/encrypt-model.ts","../../src/dynamodb/index.ts"],"sourcesContent":["import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkDecryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>[]> {\n  private encryptionClient: EncryptionClient\n  private items: Record<string, EncryptedValue | unknown>[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: Record<string, EncryptedValue | unknown>[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>[], EncryptedDynamoDBError>\n  > {\n    logger.debug(`DynamoDB: bulk decrypting ${this.items.length} models.`)\n    return await withResult(\n      async () => {\n        const itemsWithEqlPayloads = this.items.map((item) =>\n          toItemWithEqlPayloads(item, this.table),\n        )\n\n        const decryptResult = await this.encryptionClient\n          .bulkDecryptModels<T>(itemsWithEqlPayloads as T[])\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'bulkDecryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport { logger } from '@/utils/logger'\nimport type { ProtectErrorCode } from '@cipherstash/protect-ffi'\nimport { ProtectError as FfiProtectError } from '@cipherstash/protect-ffi'\nimport type { EncryptedDynamoDBError } from './types'\n\nexport const ciphertextAttrSuffix = '__source'\nexport const searchTermAttrSuffix = '__hmac'\n\nexport class EncryptedDynamoDBErrorImpl\n  extends Error\n  implements EncryptedDynamoDBError\n{\n  constructor(\n    message: string,\n    public code: ProtectErrorCode | 'DYNAMODB_ENCRYPTION_ERROR',\n    public details?: Record<string, unknown>,\n  ) {\n    super(message)\n    this.name = 'EncryptedDynamoDBError'\n  }\n}\n\nexport function handleError(\n  error: unknown,\n  context: string,\n  options?: {\n    logger?: {\n      error: (message: string, error: Error) => void\n    }\n    errorHandler?: (error: EncryptedDynamoDBError) => void\n  },\n): EncryptedDynamoDBError {\n  // Preserve FFI error code if available, otherwise use generic DynamoDB error code\n  // Check for FfiProtectError instance or plain error objects with code property\n  const errorObj = error as Record<string, unknown>\n  const errorCode =\n    error instanceof FfiProtectError\n      ? error.code\n      : errorObj &&\n          typeof errorObj === 'object' &&\n          'code' in errorObj &&\n          typeof errorObj.code === 'string'\n        ? (errorObj.code as ProtectErrorCode)\n        : 'DYNAMODB_ENCRYPTION_ERROR'\n\n  const errorMessage =\n    error instanceof Error\n      ? error.message\n      : errorObj && typeof errorObj.message === 'string'\n        ? errorObj.message\n        : String(error)\n\n  const dynamoError = new EncryptedDynamoDBErrorImpl(errorMessage, errorCode, {\n    context,\n  })\n\n  logger.error(`DynamoDB error in ${context}: ${errorMessage}`)\n\n  if (options?.errorHandler) {\n    options.errorHandler(dynamoError)\n  }\n\n  if (options?.logger) {\n    options.logger.error(`Error in ${context}`, dynamoError)\n  }\n\n  return dynamoError\n}\n\nexport function deepClone<T>(obj: T): T {\n  if (obj === null || typeof obj !== 'object') {\n    return obj\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => deepClone(item)) as unknown as T\n  }\n\n  return Object.entries(obj as Record<string, unknown>).reduce(\n    (acc, [key, value]) => ({\n      // biome-ignore lint/performance/noAccumulatingSpread: TODO later\n      ...acc,\n      [key]: deepClone(value),\n    }),\n    {} as T,\n  )\n}\n\nexport function toEncryptedDynamoItem(\n  encrypted: Record<string, unknown>,\n  encryptedAttrs: string[],\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Handle encrypted payload\n    if (\n      encryptedAttrs.includes(attrName) ||\n      (isNested &&\n        typeof attrValue === 'object' &&\n        'c' in (attrValue as object))\n    ) {\n      const encryptPayload = attrValue as EncryptedValue\n      if (encryptPayload?.c) {\n        const result: Record<string, unknown> = {}\n        if (encryptPayload.hm) {\n          result[`${attrName}${searchTermAttrSuffix}`] = encryptPayload.hm\n        }\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.c\n        return result\n      }\n\n      if (encryptPayload?.sv) {\n        const result: Record<string, unknown> = {}\n        result[`${attrName}${ciphertextAttrSuffix}`] = encryptPayload.sv\n        return result\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(encrypted).reduce(\n    (putItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, putItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n\nexport function toItemWithEqlPayloads(\n  decrypted: Record<string, EncryptedValue | unknown>,\n  encryptionSchema: EncryptedTable<EncryptedTableColumn>,\n): Record<string, unknown> {\n  function processValue(\n    attrName: string,\n    attrValue: unknown,\n    isNested: boolean,\n  ): Record<string, unknown> {\n    if (attrValue === null || attrValue === undefined) {\n      return { [attrName]: attrValue }\n    }\n\n    // Skip HMAC fields\n    if (attrName.endsWith(searchTermAttrSuffix)) {\n      return {}\n    }\n\n    const encryptConfig = encryptionSchema.build()\n    const encryptedAttrs = Object.keys(encryptConfig.columns)\n    const columnName = attrName.slice(0, -ciphertextAttrSuffix.length)\n\n    // Handle encrypted payload\n    if (\n      attrName.endsWith(ciphertextAttrSuffix) &&\n      (encryptedAttrs.includes(columnName) || isNested)\n    ) {\n      const i = { c: columnName, t: encryptConfig.tableName }\n      const v = 2\n\n      // Nested values are not searchable, so we can just return the standard EQL payload.\n      // Worth noting, that encryptConfig.columns[columnName] will be undefined if isNested is true.\n      if (\n        !isNested &&\n        encryptConfig.columns[columnName].cast_as === 'json' &&\n        encryptConfig.columns[columnName].indexes.ste_vec\n      ) {\n        return {\n          [columnName]: {\n            i,\n            v,\n            k: 'sv',\n            sv: attrValue,\n          },\n        }\n      }\n\n      return {\n        [columnName]: {\n          i,\n          v,\n          k: 'ct',\n          c: attrValue,\n        },\n      }\n    }\n\n    // Handle nested objects recursively\n    if (typeof attrValue === 'object' && !Array.isArray(attrValue)) {\n      const nestedResult = Object.entries(\n        attrValue as Record<string, unknown>,\n      ).reduce(\n        (acc, [key, val]) => {\n          const processed = processValue(key, val, true)\n          return Object.assign({}, acc, processed)\n        },\n        {} as Record<string, unknown>,\n      )\n      return { [attrName]: nestedResult }\n    }\n\n    // Handle non-encrypted values\n    return { [attrName]: attrValue }\n  }\n\n  return Object.entries(decrypted).reduce(\n    (formattedItem, [attrName, attrValue]) => {\n      const processed = processValue(attrName, attrValue, false)\n      return Object.assign({}, formattedItem, processed)\n    },\n    {} as Record<string, unknown>,\n  )\n}\n","import type { Result } from '@byteslice/result'\nimport type { EncryptedDynamoDBError } from '../types'\n\nexport type AuditConfig = {\n  metadata?: Record<string, unknown>\n}\n\nexport type AuditData = {\n  metadata?: Record<string, unknown>\n}\n\nexport type DynamoDBOperationOptions = {\n  logger?: {\n    error: (message: string, error: Error) => void\n  }\n  errorHandler?: (error: EncryptedDynamoDBError) => void\n}\n\nexport abstract class DynamoDBOperation<T> {\n  protected auditMetadata?: Record<string, unknown>\n  protected logger?: DynamoDBOperationOptions['logger']\n  protected errorHandler?: DynamoDBOperationOptions['errorHandler']\n\n  constructor(options?: DynamoDBOperationOptions) {\n    this.logger = options?.logger\n    this.errorHandler = options?.errorHandler\n  }\n\n  /**\n   * Attach audit metadata to this operation. Can be chained.\n   */\n  audit(config: AuditConfig): this {\n    this.auditMetadata = config.metadata\n    return this\n  }\n\n  /**\n   * Get the audit metadata for this operation.\n   */\n  protected getAuditData(): AuditData {\n    return {\n      metadata: this.auditMetadata,\n    }\n  }\n\n  /**\n   * Execute the operation and return a Result\n   */\n  abstract execute(): Promise<Result<T, EncryptedDynamoDBError>>\n\n  /**\n   * Make the operation thenable\n   */\n  public then<TResult1 = Result<T, EncryptedDynamoDBError>, TResult2 = never>(\n    onfulfilled?:\n      | ((\n          value: Result<T, EncryptedDynamoDBError>,\n        ) => TResult1 | PromiseLike<TResult1>)\n      | null,\n    onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null,\n  ): Promise<TResult1 | TResult2> {\n    return this.execute().then(onfulfilled, onrejected)\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class BulkEncryptModelsOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T[]> {\n  private encryptionClient: EncryptionClient\n  private items: T[]\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    items: T[],\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.items = items\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T[], EncryptedDynamoDBError>> {\n    logger.debug(`DynamoDB: bulk encrypting ${this.items.length} models.`)\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .bulkEncryptModels(\n            this.items.map((item) => deepClone(item)),\n            this.table,\n          )\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = encryptResult.data.map((item) => deepClone(item))\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return data.map(\n          (encrypted) => toEncryptedDynamoItem(encrypted, encryptedAttrs) as T,\n        )\n      },\n      (error) =>\n        handleError(error, 'bulkEncryptModels', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { Decrypted, EncryptedValue } from '@/types'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { handleError, toItemWithEqlPayloads } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class DecryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<Decrypted<T>> {\n  private encryptionClient: EncryptionClient\n  private item: Record<string, EncryptedValue | unknown>\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: Record<string, EncryptedValue | unknown>,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<\n    Result<Decrypted<T>, EncryptedDynamoDBError>\n  > {\n    logger.debug('DynamoDB: decrypting model.')\n    return await withResult(\n      async () => {\n        const withEqlPayloads = toItemWithEqlPayloads(this.item, this.table)\n\n        const decryptResult = await this.encryptionClient\n          .decryptModel<T>(withEqlPayloads as T)\n          .audit(this.getAuditData())\n\n        if (decryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(decryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = decryptResult.failure.code\n          throw error\n        }\n\n        return decryptResult.data\n      },\n      (error) =>\n        handleError(error, 'decryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptionClient } from '@/encryption'\nimport type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\nimport { deepClone, handleError, toEncryptedDynamoItem } from '../helpers'\nimport type { EncryptedDynamoDBError } from '../types'\nimport {\n  DynamoDBOperation,\n  type DynamoDBOperationOptions,\n} from './base-operation'\n\nexport class EncryptModelOperation<\n  T extends Record<string, unknown>,\n> extends DynamoDBOperation<T> {\n  private encryptionClient: EncryptionClient\n  private item: T\n  private table: EncryptedTable<EncryptedTableColumn>\n\n  constructor(\n    encryptionClient: EncryptionClient,\n    item: T,\n    table: EncryptedTable<EncryptedTableColumn>,\n    options?: DynamoDBOperationOptions,\n  ) {\n    super(options)\n    this.encryptionClient = encryptionClient\n    this.item = item\n    this.table = table\n  }\n\n  public async execute(): Promise<Result<T, EncryptedDynamoDBError>> {\n    logger.debug('DynamoDB: encrypting model.')\n    return await withResult(\n      async () => {\n        const encryptResult = await this.encryptionClient\n          .encryptModel(deepClone(this.item), this.table)\n          .audit(this.getAuditData())\n\n        if (encryptResult.failure) {\n          // Create an Error object that preserves the FFI error code\n          // This is necessary because withResult's ensureError wraps non-Error objects\n          const error = new Error(encryptResult.failure.message) as Error & {\n            code?: string\n          }\n          error.code = encryptResult.failure.code\n          throw error\n        }\n\n        const data = deepClone(encryptResult.data)\n        const encryptedAttrs = Object.keys(this.table.build().columns)\n\n        return toEncryptedDynamoItem(data, encryptedAttrs) as T\n      },\n      (error) =>\n        handleError(error, 'encryptModel', {\n          logger: this.logger,\n          errorHandler: this.errorHandler,\n        }),\n    )\n  }\n}\n","import type { EncryptedTable, EncryptedTableColumn } from '@/schema'\nimport type { EncryptedValue } from '@/types'\nimport { BulkDecryptModelsOperation } from './operations/bulk-decrypt-models'\nimport { BulkEncryptModelsOperation } from './operations/bulk-encrypt-models'\nimport { DecryptModelOperation } from './operations/decrypt-model'\nimport { EncryptModelOperation } from './operations/encrypt-model'\nimport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBInstance,\n} from './types'\n\n/**\n * Create an encrypted DynamoDB helper bound to an `EncryptionClient`.\n *\n * Returns an object with `encryptModel`, `decryptModel`, `bulkEncryptModels`,\n * and `bulkDecryptModels` methods that transparently encrypt/decrypt DynamoDB\n * items according to the provided table schema.\n *\n * @param config - Configuration containing the `encryptionClient` and optional\n *   logging / error-handling callbacks.\n * @returns An {@link EncryptedDynamoDBInstance} with encrypt/decrypt operations.\n *\n * @example\n * ```typescript\n * import { Encryption } from \"@cipherstash/stack\"\n * import { encryptedDynamoDB } from \"@cipherstash/stack/dynamodb\"\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * const client = await Encryption({ schemas: [users] })\n * const dynamo = encryptedDynamoDB({ encryptionClient: client })\n *\n * const encrypted = await dynamo.encryptModel({ email: \"a@b.com\" }, users)\n * ```\n */\nexport function encryptedDynamoDB(\n  config: EncryptedDynamoDBConfig,\n): EncryptedDynamoDBInstance {\n  const { encryptionClient, options } = config\n\n  return {\n    encryptModel<T extends Record<string, unknown>>(\n      item: T,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new EncryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkEncryptModels<T extends Record<string, unknown>>(\n      items: T[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkEncryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n\n    decryptModel<T extends Record<string, unknown>>(\n      item: Record<string, EncryptedValue | unknown>,\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new DecryptModelOperation<T>(\n        encryptionClient,\n        item,\n        table,\n        options,\n      )\n    },\n\n    bulkDecryptModels<T extends Record<string, unknown>>(\n      items: Record<string, EncryptedValue | unknown>[],\n      table: EncryptedTable<EncryptedTableColumn>,\n    ) {\n      return new BulkDecryptModelsOperation<T>(\n        encryptionClient,\n        items,\n        table,\n        options,\n      )\n    },\n  }\n}\n\nexport type {\n  EncryptedDynamoDBConfig,\n  EncryptedDynamoDBError,\n  EncryptedDynamoDBInstance,\n} from './types'\n"],"mappings":";;;;;AAIA,SAAsB,kBAAkB;;;ACAxC,SAAS,gBAAgB,uBAAuB;AAGzC,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAE7B,IAAM,6BAAN,cACG,MAEV;AAAA,EACE,YACE,SACO,MACA,SACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YACd,OACA,SACA,SAMwB;AAGxB,QAAM,WAAW;AACjB,QAAM,YACJ,iBAAiB,kBACb,MAAM,OACN,YACE,OAAO,aAAa,YACpB,UAAU,YACV,OAAO,SAAS,SAAS,WACxB,SAAS,OACV;AAER,QAAM,eACJ,iBAAiB,QACb,MAAM,UACN,YAAY,OAAO,SAAS,YAAY,WACtC,SAAS,UACT,OAAO,KAAK;AAEpB,QAAM,cAAc,IAAI,2BAA2B,cAAc,WAAW;AAAA,IAC1E;AAAA,EACF,CAAC;AAED,SAAO,MAAM,qBAAqB,OAAO,KAAK,YAAY,EAAE;AAE5D,MAAI,SAAS,cAAc;AACzB,YAAQ,aAAa,WAAW;AAAA,EAClC;AAEA,MAAI,SAAS,QAAQ;AACnB,YAAQ,OAAO,MAAM,YAAY,OAAO,IAAI,WAAW;AAAA,EACzD;AAEA,SAAO;AACT;AAEO,SAAS,UAAa,KAAW;AACtC,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,WAAO,IAAI,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,EAC1C;AAEA,SAAO,OAAO,QAAQ,GAA8B,EAAE;AAAA,IACpD,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO;AAAA;AAAA,MAEtB,GAAG;AAAA,MACH,CAAC,GAAG,GAAG,UAAU,KAAK;AAAA,IACxB;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,gBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QACE,eAAe,SAAS,QAAQ,KAC/B,YACC,OAAO,cAAc,YACrB,OAAQ,WACV;AACA,YAAM,iBAAiB;AACvB,UAAI,gBAAgB,GAAG;AACrB,cAAM,SAAkC,CAAC;AACzC,YAAI,eAAe,IAAI;AACrB,iBAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAAA,QAChE;AACA,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAEA,UAAI,gBAAgB,IAAI;AACtB,cAAM,SAAkC,CAAC;AACzC,eAAO,GAAG,QAAQ,GAAG,oBAAoB,EAAE,IAAI,eAAe;AAC9D,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,SAAS,CAAC,UAAU,SAAS,MAAM;AAClC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,SAAS,SAAS;AAAA,IAC7C;AAAA,IACA,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,WACA,kBACyB;AACzB,WAAS,aACP,UACA,WACA,UACyB;AACzB,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,IACjC;AAGA,QAAI,SAAS,SAAS,oBAAoB,GAAG;AAC3C,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,gBAAgB,iBAAiB,MAAM;AAC7C,UAAM,iBAAiB,OAAO,KAAK,cAAc,OAAO;AACxD,UAAM,aAAa,SAAS,MAAM,GAAG,CAAC,qBAAqB,MAAM;AAGjE,QACE,SAAS,SAAS,oBAAoB,MACrC,eAAe,SAAS,UAAU,KAAK,WACxC;AACA,YAAM,IAAI,EAAE,GAAG,YAAY,GAAG,cAAc,UAAU;AACtD,YAAM,IAAI;AAIV,UACE,CAAC,YACD,cAAc,QAAQ,UAAU,EAAE,YAAY,UAC9C,cAAc,QAAQ,UAAU,EAAE,QAAQ,SAC1C;AACA,eAAO;AAAA,UACL,CAAC,UAAU,GAAG;AAAA,YACZ;AAAA,YACA;AAAA,YACA,GAAG;AAAA,YACH,IAAI;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL,CAAC,UAAU,GAAG;AAAA,UACZ;AAAA,UACA;AAAA,UACA,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9D,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,MACF,EAAE;AAAA,QACA,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM;AACnB,gBAAM,YAAY,aAAa,KAAK,KAAK,IAAI;AAC7C,iBAAO,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,QACzC;AAAA,QACA,CAAC;AAAA,MACH;AACA,aAAO,EAAE,CAAC,QAAQ,GAAG,aAAa;AAAA,IACpC;AAGA,WAAO,EAAE,CAAC,QAAQ,GAAG,UAAU;AAAA,EACjC;AAEA,SAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,IAC/B,CAAC,eAAe,CAAC,UAAU,SAAS,MAAM;AACxC,YAAM,YAAY,aAAa,UAAU,WAAW,KAAK;AACzD,aAAO,OAAO,OAAO,CAAC,GAAG,eAAe,SAAS;AAAA,IACnD;AAAA,IACA,CAAC;AAAA,EACH;AACF;;;AC1NO,IAAe,oBAAf,MAAoC;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EAEV,YAAY,SAAoC;AAC9C,SAAK,SAAS,SAAS;AACvB,SAAK,eAAe,SAAS;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAA2B;AAC/B,SAAK,gBAAgB,OAAO;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKU,eAA0B;AAClC,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAUO,KACL,aAKA,YAC8B;AAC9B,WAAO,KAAK,QAAQ,EAAE,KAAK,aAAa,UAAU;AAAA,EACpD;AACF;;;AFnDO,IAAM,6BAAN,cAEG,kBAAkC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,MAAM,6BAA6B,KAAK,MAAM,MAAM,UAAU;AACrE,WAAO,MAAM;AAAA,MACX,YAAY;AACV,cAAM,uBAAuB,KAAK,MAAM;AAAA,UAAI,CAAC,SAC3C,sBAAsB,MAAM,KAAK,KAAK;AAAA,QACxC;AAEA,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,kBAAqB,oBAA2B,EAChD,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AG7DA,SAAsB,cAAAA,mBAAkB;AAQjC,IAAM,6BAAN,cAEG,kBAAuB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,OACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAwD;AACnE,WAAO,MAAM,6BAA6B,KAAK,MAAM,MAAM,UAAU;AACrE,WAAO,MAAMC;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B;AAAA,UACC,KAAK,MAAM,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAAA,UACxC,KAAK;AAAA,QACP,EACC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,cAAc,KAAK,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC;AAC7D,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,KAAK;AAAA,UACV,CAAC,cAAc,sBAAsB,WAAW,cAAc;AAAA,QAChE;AAAA,MACF;AAAA,MACA,CAAC,UACC,YAAY,OAAO,qBAAqB;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC7DA,SAAsB,cAAAC,mBAAkB;AAQjC,IAAM,wBAAN,cAEG,kBAAgC;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAEX;AACA,WAAO,MAAM,6BAA6B;AAC1C,WAAO,MAAMC;AAAA,MACX,YAAY;AACV,cAAM,kBAAkB,sBAAsB,KAAK,MAAM,KAAK,KAAK;AAEnE,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAgB,eAAoB,EACpC,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,eAAO,cAAc;AAAA,MACvB;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;AC3DA,SAAsB,cAAAC,mBAAkB;AAQjC,IAAM,wBAAN,cAEG,kBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,kBACA,MACA,OACA,SACA;AACA,UAAM,OAAO;AACb,SAAK,mBAAmB;AACxB,SAAK,OAAO;AACZ,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAa,UAAsD;AACjE,WAAO,MAAM,6BAA6B;AAC1C,WAAO,MAAMC;AAAA,MACX,YAAY;AACV,cAAM,gBAAgB,MAAM,KAAK,iBAC9B,aAAa,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,EAC7C,MAAM,KAAK,aAAa,CAAC;AAE5B,YAAI,cAAc,SAAS;AAGzB,gBAAM,QAAQ,IAAI,MAAM,cAAc,QAAQ,OAAO;AAGrD,gBAAM,OAAO,cAAc,QAAQ;AACnC,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,UAAU,cAAc,IAAI;AACzC,cAAM,iBAAiB,OAAO,KAAK,KAAK,MAAM,MAAM,EAAE,OAAO;AAE7D,eAAO,sBAAsB,MAAM,cAAc;AAAA,MACnD;AAAA,MACA,CAAC,UACC,YAAY,OAAO,gBAAgB;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACF;;;ACtBO,SAAS,kBACd,QAC2B;AAC3B,QAAM,EAAE,kBAAkB,QAAQ,IAAI;AAEtC,SAAO;AAAA,IACL,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,aACE,MACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,kBACE,OACA,OACA;AACA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["withResult","withResult","withResult","withResult","withResult","withResult"]}