@cipherstash/stack 0.3.0 → 0.5.0

package/dist/index.cjs

@@ -31,31 +31,18 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   Encryption: () => Encryption,
-  EncryptionErrorTypes: () => EncryptionErrorTypes,
+  Secrets: () => Secrets,
   encryptedColumn: () => encryptedColumn,
   encryptedField: () => encryptedField,
   encryptedTable: () => encryptedTable,
-  getErrorMessage: () => getErrorMessage
+  encryptedToPgComposite: () => encryptedToPgComposite,
+  isEncryptedPayload: () => isEncryptedPayload
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/errors/index.ts
-var EncryptionErrorTypes = {
-  ClientInitError: "ClientInitError",
-  EncryptionError: "EncryptionError",
-  DecryptionError: "DecryptionError",
-  LockContextError: "LockContextError",
-  CtsTokenError: "CtsTokenError"
-};
-function getErrorMessage(error) {
-  if (error instanceof Error) return error.message;
-  if (typeof error === "string") return error;
-  return String(error);
-}
-
 // src/schema/index.ts
 var import_zod = require("zod");
-var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json"]).default("string");
+var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
 var tokenFilterSchema = import_zod.z.object({
   kind: import_zod.z.literal("downcase")
 });
@@ -103,7 +90,7 @@ var EncryptedField = class {
   castAsValue;
   constructor(valueName) {
     this.valueName = valueName;
-    this.castAsValue = "string";
+    this.castAsValue = "text";
   }
   /**
    * Set or override the plaintext data type for this field.
@@ -112,7 +99,7 @@ var EncryptedField = class {
    * a different type so the encryption layer knows how to encode the plaintext
    * before encrypting.
    *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
    * @returns This `EncryptedField` instance for method chaining.
    *
    * @example
@@ -128,7 +115,7 @@ var EncryptedField = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue,
+      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
       indexes: {}
     };
   }
@@ -282,7 +269,7 @@ var EncryptedColumn = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue,
+      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
       indexes: this.indexesValue
     };
   }
@@ -380,6 +367,15 @@ function buildEncryptConfig(...protectTables) {
   return config;
 }
 
+// src/errors/index.ts
+var EncryptionErrorTypes = {
+  ClientInitError: "ClientInitError",
+  EncryptionError: "EncryptionError",
+  DecryptionError: "DecryptionError",
+  LockContextError: "LockContextError",
+  CtsTokenError: "CtsTokenError"
+};
+
 // src/utils/config/index.ts
 var import_node_fs = __toESM(require("fs"), 1);
 var import_node_path = __toESM(require("path"), 1);
@@ -445,25 +441,33 @@ function loadWorkSpaceId(suppliedCrn) {
 
 // src/utils/logger/index.ts
 var import_evlog = require("evlog");
-function samplingFromEnv() {
-  const env = process.env.STASH_LOG_LEVEL;
-  if (!env) return void 0;
-  const levels = ["debug", "info", "warn", "error"];
-  const idx = levels.indexOf(env);
-  if (idx === -1) return void 0;
-  return Object.fromEntries(levels.map((l, i) => [l, i >= idx ? 100 : 0]));
+var validLevels = ["debug", "info", "error"];
+function levelFromEnv() {
+  const env = process.env.STASH_STACK_LOG;
+  if (env && validLevels.includes(env)) return env;
+  return "error";
+}
+function samplingRatesForLevel(level) {
+  switch (level) {
+    case "debug":
+      return { debug: 100, info: 100, warn: 100, error: 100 };
+    case "info":
+      return { debug: 0, info: 100, warn: 100, error: 100 };
+    case "error":
+    default:
+      return { debug: 0, info: 0, warn: 0, error: 100 };
+  }
 }
 var initialized = false;
-function initStackLogger(config) {
+function initStackLogger() {
   if (initialized) return;
   initialized = true;
-  const rates = samplingFromEnv();
+  const level = levelFromEnv();
+  const rates = samplingRatesForLevel(level);
   (0, import_evlog.initLogger)({
     env: { service: "@cipherstash/stack" },
-    enabled: config?.enabled ?? !!rates,
-    pretty: config?.pretty,
-    ...rates && { sampling: { rates } },
-    ...config?.drain && { drain: config.drain }
+    enabled: true,
+    sampling: { rates }
   });
 }
 initStackLogger();
@@ -501,18 +505,18 @@ var logger = {
 // src/encryption/index.ts
 var import_result11 = require("@byteslice/result");
 var import_protect_ffi9 = require("@cipherstash/protect-ffi");
+var import_uuid = require("uuid");
 
 // src/encryption/helpers/index.ts
+function encryptedToPgComposite(obj) {
+  return {
+    data: obj
+  };
+}
 function encryptedToCompositeLiteral(obj) {
-  if (obj === null) {
-    throw new Error("encryptedToCompositeLiteral: obj cannot be null");
-  }
   return `(${JSON.stringify(JSON.stringify(obj))})`;
 }
 function encryptedToEscapedCompositeLiteral(obj) {
-  if (obj === null) {
-    throw new Error("encryptedToEscapedCompositeLiteral: obj cannot be null");
-  }
   return JSON.stringify(encryptedToCompositeLiteral(obj));
 }
 function formatEncryptedResult(encrypted, returnType) {
@@ -695,18 +699,6 @@ var EncryptionOperation = class {
 };
 
 // src/encryption/operations/batch-encrypt-query.ts
-function filterNullTerms(terms) {
-  const nullIndices = /* @__PURE__ */ new Set();
-  const nonNullTerms = [];
-  terms.forEach((term, index) => {
-    if (term.value === null || term.value === void 0) {
-      nullIndices.add(index);
-    } else {
-      nonNullTerms.push({ term, originalIndex: index });
-    }
-  });
-  return { nullIndices, nonNullTerms };
-}
 function buildQueryPayload(term, lockContext) {
   assertValidNumericValue(term.value);
   const { indexType, queryOp } = resolveIndexType(
@@ -727,13 +719,10 @@ function buildQueryPayload(term, lockContext) {
   }
   return payload;
 }
-function assembleResults(totalLength, encryptedValues, nonNullTerms) {
-  const results = new Array(totalLength).fill(null);
-  nonNullTerms.forEach(({ term, originalIndex }, i) => {
-    const encrypted = encryptedValues[i];
-    results[originalIndex] = formatEncryptedResult(encrypted, term.returnType);
-  });
-  return results;
+function assembleResults(terms, encryptedValues) {
+  return terms.map(
+    (term, i) => formatEncryptedResult(encryptedValues[i], term.returnType)
+  );
 }
 var BatchEncryptQueryOperation = class extends EncryptionOperation {
   constructor(client, terms) {
@@ -760,23 +749,18 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { data: [] };
     }
-    const { nullIndices, nonNullTerms } = filterNullTerms(this.terms);
-    if (nonNullTerms.length === 0) {
-      log.emit();
-      return { data: this.terms.map(() => null) };
-    }
     const result = await (0, import_result.withResult)(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = nonNullTerms.map(
-          ({ term }) => buildQueryPayload(term)
+        const queries = this.terms.map(
+          (term) => buildQueryPayload(term)
         );
         const encrypted = await (0, import_protect_ffi2.encryptQueryBulk)(this.client, {
           queries,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms.length, encrypted, nonNullTerms);
+        return assembleResults(this.terms, encrypted);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -810,11 +794,6 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: [] };
     }
-    const { nullIndices, nonNullTerms } = filterNullTerms(this.terms);
-    if (nonNullTerms.length === 0) {
-      log.emit();
-      return { data: this.terms.map(() => null) };
-    }
     const lockContextResult = await this.lockContext.getLockContext();
     if (lockContextResult.failure) {
       log.emit();
@@ -825,15 +804,15 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = nonNullTerms.map(
-          ({ term }) => buildQueryPayload(term, context)
+        const queries = this.terms.map(
+          (term) => buildQueryPayload(term, context)
         );
         const encrypted = await (0, import_protect_ffi2.encryptQueryBulk)(this.client, {
           queries,
           serviceToken: ctsToken,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms.length, encrypted, nonNullTerms);
+        return assembleResults(this.terms, encrypted);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -853,42 +832,25 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
 var import_result2 = require("@byteslice/result");
 var import_protect_ffi3 = require("@cipherstash/protect-ffi");
 var createDecryptPayloads = (encryptedPayloads, lockContext) => {
-  return encryptedPayloads.map((item, index) => ({ ...item, originalIndex: index })).filter(({ data }) => data !== null).map(({ id, data, originalIndex }) => ({
+  return encryptedPayloads.map(({ id, data }) => ({
     id,
     ciphertext: data,
-    originalIndex,
     ...lockContext && { lockContext }
   }));
 };
-var createNullResult = (encryptedPayloads) => {
-  return encryptedPayloads.map(({ id }) => ({
-    id,
-    data: null
-  }));
-};
 var mapDecryptedDataToResult = (encryptedPayloads, decryptedData) => {
-  const result = new Array(encryptedPayloads.length);
-  let decryptedIndex = 0;
-  for (let i = 0; i < encryptedPayloads.length; i++) {
-    if (encryptedPayloads[i].data === null) {
-      result[i] = { id: encryptedPayloads[i].id, data: null };
-    } else {
-      const decryptResult = decryptedData[decryptedIndex];
-      if ("error" in decryptResult) {
-        result[i] = {
-          id: encryptedPayloads[i].id,
-          error: decryptResult.error
-        };
-      } else {
-        result[i] = {
-          id: encryptedPayloads[i].id,
-          data: decryptResult.data
-        };
-      }
-      decryptedIndex++;
+  return decryptedData.map((decryptResult, i) => {
+    if ("error" in decryptResult) {
+      return {
+        id: encryptedPayloads[i].id,
+        error: decryptResult.error
+      };
     }
-  }
-  return result;
+    return {
+      id: encryptedPayloads[i].id,
+      data: decryptResult.data
+    };
+  });
 };
 var BulkDecryptOperation = class extends EncryptionOperation {
   client;
@@ -913,13 +875,10 @@ var BulkDecryptOperation = class extends EncryptionOperation {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
           return [];
-        const nonNullPayloads = createDecryptPayloads(this.encryptedPayloads);
-        if (nonNullPayloads.length === 0) {
-          return createNullResult(this.encryptedPayloads);
-        }
+        const payloads = createDecryptPayloads(this.encryptedPayloads);
         const { metadata } = this.getAuditData();
         const decryptedData = await (0, import_protect_ffi3.decryptBulkFallible)(this.client, {
-          ciphertexts: nonNullPayloads,
+          ciphertexts: payloads,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(this.encryptedPayloads, decryptedData);
@@ -971,16 +930,13 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const nonNullPayloads = createDecryptPayloads(
+        const payloads = createDecryptPayloads(
           encryptedPayloads,
           context.data.context
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult(encryptedPayloads);
-        }
         const { metadata } = this.getAuditData();
         const decryptedData = await (0, import_protect_ffi3.decryptBulkFallible)(client, {
-          ciphertexts: nonNullPayloads,
+          ciphertexts: payloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
@@ -1619,34 +1575,14 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 var import_result4 = require("@byteslice/result");
 var import_protect_ffi5 = require("@cipherstash/protect-ffi");
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.map((item, index) => ({ ...item, originalIndex: index })).filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext, originalIndex }) => ({
+  return plaintexts.map(({ id, plaintext }) => ({
     id,
     plaintext,
     column: column.getName(),
     table: table.tableName,
-    originalIndex,
     ...lockContext && { lockContext }
   }));
 };
-var createNullResult2 = (plaintexts) => {
-  return plaintexts.map(({ id }) => ({ id, data: null }));
-};
-var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
-  const result = new Array(plaintexts.length);
-  let encryptedIndex = 0;
-  for (let i = 0; i < plaintexts.length; i++) {
-    if (plaintexts[i].plaintext === null) {
-      result[i] = { id: plaintexts[i].id, data: null };
-    } else {
-      result[i] = {
-        id: plaintexts[i].id,
-        data: encryptedData[encryptedIndex]
-      };
-      encryptedIndex++;
-    }
-  }
-  return result;
-};
 var BulkEncryptOperation = class extends EncryptionOperation {
   client;
   plaintexts;
@@ -1679,20 +1615,20 @@ var BulkEncryptOperation = class extends EncryptionOperation {
         if (!this.plaintexts || this.plaintexts.length === 0) {
           return [];
         }
-        const nonNullPayloads = createEncryptPayloads(
+        const payloads = createEncryptPayloads(
           this.plaintexts,
           this.column,
           this.table
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult2(this.plaintexts);
-        }
         const { metadata } = this.getAuditData();
         const encryptedData = await (0, import_protect_ffi5.encryptBulk)(this.client, {
-          plaintexts: nonNullPayloads,
+          plaintexts: payloads,
           unverifiedContext: metadata
         });
-        return mapEncryptedDataToResult(this.plaintexts, encryptedData);
+        return encryptedData.map((data, i) => ({
+          id: this.plaintexts[i].id,
+          data
+        }));
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1749,22 +1685,22 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const nonNullPayloads = createEncryptPayloads(
+        const payloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
           context.data.context
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult2(plaintexts);
-        }
         const { metadata } = this.getAuditData();
         const encryptedData = await (0, import_protect_ffi5.encryptBulk)(client, {
-          plaintexts: nonNullPayloads,
+          plaintexts: payloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
-        return mapEncryptedDataToResult(plaintexts, encryptedData);
+        return encryptedData.map((data, i) => ({
+          id: plaintexts[i].id,
+          data
+        }));
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1914,9 +1850,6 @@ var DecryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
-        if (this.encryptedData === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         return await (0, import_protect_ffi6.decrypt)(this.client, {
           ciphertext: this.encryptedData,
@@ -1967,9 +1900,6 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
-        if (encryptedData === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -2123,9 +2053,6 @@ var EncryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
-        if (this.plaintext === null) {
-          return null;
-        }
         if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
           throw new Error("[encryption]: Cannot encrypt NaN value");
         }
@@ -2187,9 +2114,6 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
-        if (plaintext === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -2353,10 +2277,6 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: false
     });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
     const validationError = validateNumericValue(this.plaintext);
     if (validationError?.failure) {
       log.emit();
@@ -2420,10 +2340,6 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: true
     });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
     const validationError = validateNumericValue(this.plaintext);
     if (validationError?.failure) {
       log.emit();
@@ -2528,7 +2444,7 @@ var EncryptionClient = class {
   /**
    * Encrypt a value - returns a promise which resolves to an encrypted value.
    *
-   * @param plaintext - The plaintext value to be encrypted. Can be null.
+   * @param plaintext - The plaintext value to be encrypted.
    * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
    * @returns An EncryptOperation that can be awaited or chained with additional methods.
    *
@@ -2829,7 +2745,7 @@ var EncryptionClient = class {
    *
    * Each value is encrypted with its own unique key via a single call to ZeroKMS.
    * Values can include optional `id` fields for correlating results back to
-   * your application data. Null plaintext values are preserved as null.
+   * your application data.
    *
    * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
    * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
@@ -2850,7 +2766,6 @@ var EncryptionClient = class {
    *   [
    *     { id: "u1", plaintext: "alice@example.com" },
    *     { id: "u2", plaintext: "bob@example.com" },
-   *     { id: "u3", plaintext: null },
    *   ],
    *   { column: users.email, table: users },
    * )
@@ -2904,23 +2819,14 @@ var EncryptionClient = class {
     };
   }
 };
-
-// src/index.ts
-function isValidUuid(uuid) {
-  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  return uuidRegex.test(uuid);
-}
 var Encryption = async (config) => {
-  if (config.logging) {
-    initStackLogger(config.logging);
-  }
   const { schemas, config: clientConfig } = config;
   if (!schemas.length) {
     throw new Error(
       "[encryption]: At least one encryptedTable must be provided to initialize the encryption client"
     );
   }
-  if (clientConfig?.keyset && "id" in clientConfig.keyset && !isValidUuid(clientConfig.keyset.id)) {
+  if (clientConfig?.keyset && "id" in clientConfig.keyset && !(0, import_uuid.validate)(clientConfig.keyset.id)) {
     throw new Error(
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
@@ -2936,13 +2842,350 @@ var Encryption = async (config) => {
   }
   return result.data;
 };
+
+// src/secrets/index.ts
+var Secrets = class {
+  encryptionClient = null;
+  config;
+  apiBaseUrl = process.env.STASH_API_URL || "https://dashboard.cipherstash.com/api/secrets";
+  secretsSchema = encryptedTable("secrets", {
+    value: encryptedColumn("value")
+  });
+  constructor(config) {
+    const workspaceCRN = config.workspaceCRN ?? process.env.CS_WORKSPACE_CRN;
+    const clientId = config.clientId ?? process.env.CS_CLIENT_ID;
+    const clientKey = config.clientKey ?? process.env.CS_CLIENT_KEY;
+    const accessKey = config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY;
+    if (!workspaceCRN || !clientId || !clientKey || !accessKey) {
+      throw new Error(
+        "Missing required configuration or environment variables."
+      );
+    }
+    this.config = {
+      environment: config.environment,
+      workspaceCRN,
+      clientId,
+      clientKey,
+      accessKey
+    };
+  }
+  initPromise = null;
+  /**
+   * Initialize the Secrets client and underlying Encryption client
+   */
+  async ensureInitialized() {
+    if (!this.initPromise) {
+      this.initPromise = this._doInit();
+    }
+    return this.initPromise;
+  }
+  async _doInit() {
+    logger.debug("Initializing the Secrets client.");
+    this.encryptionClient = await Encryption({
+      schemas: [this.secretsSchema],
+      config: {
+        workspaceCrn: this.config.workspaceCRN,
+        clientId: this.config.clientId,
+        clientKey: this.config.clientKey,
+        accessKey: this.config.accessKey,
+        keyset: { name: this.config.environment }
+      }
+    });
+    logger.debug("Successfully initialized the Secrets client.");
+  }
+  /**
+   * Get the authorization header for API requests
+   */
+  getAuthHeader() {
+    return `Bearer ${this.config.accessKey}`;
+  }
+  /**
+   * Make an API request with error handling.
+   *
+   * For GET requests, `params` are appended as URL query parameters.
+   * For POST requests, `body` is sent as JSON in the request body.
+   */
+  async apiRequest(method, path2, options) {
+    try {
+      let url = `${this.apiBaseUrl}${path2}`;
+      if (options?.params) {
+        const searchParams = new URLSearchParams(options.params);
+        url = `${url}?${searchParams.toString()}`;
+      }
+      logger.debug(`Secrets API request: ${method} ${path2}`);
+      const headers = {
+        "Content-Type": "application/json",
+        Authorization: this.getAuthHeader()
+      };
+      const response = await fetch(url, {
+        method,
+        headers,
+        body: options?.body ? JSON.stringify(options.body) : void 0
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        let errorMessage = `API request failed with status ${response.status}`;
+        try {
+          const errorJson = JSON.parse(errorText);
+          errorMessage = errorJson.message || errorJson.error || errorMessage;
+        } catch {
+          errorMessage = errorText || errorMessage;
+        }
+        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
+        return {
+          failure: {
+            type: "ApiError",
+            message: errorMessage
+          }
+        };
+      }
+      logger.debug(`Secrets API request successful: ${method} ${path2}`);
+      const data = await response.json();
+      return { data };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error occurred";
+      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
+      return {
+        failure: {
+          type: "NetworkError",
+          message
+        }
+      };
+    }
+  }
+  /**
+   * Store an encrypted secret in the vault.
+   * The value is encrypted locally before being sent to the API.
+   *
+   * API: POST /api/secrets/set
+   *
+   * @param name - The name of the secret
+   * @param value - The plaintext value to encrypt and store
+   * @returns A Result containing the API response or an error
+   */
+  async set(name, value) {
+    logger.debug("Setting secret");
+    await this.ensureInitialized();
+    if (!this.encryptionClient) {
+      return {
+        failure: {
+          type: "ClientError",
+          message: "Failed to initialize Encryption client"
+        }
+      };
+    }
+    const encryptResult = await this.encryptionClient.encrypt(value, {
+      column: this.secretsSchema.value,
+      table: this.secretsSchema
+    });
+    if (encryptResult.failure) {
+      logger.error("Failed to encrypt secret");
+      return {
+        failure: {
+          type: "EncryptionError",
+          message: encryptResult.failure.message
+        }
+      };
+    }
+    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
+    return await this.apiRequest("POST", "/set", {
+      body: {
+        workspaceId,
+        environment: this.config.environment,
+        name,
+        encryptedValue: encryptedToPgComposite(encryptResult.data)
+      }
+    });
+  }
+  /**
+   * Retrieve and decrypt a secret from the vault.
+   * The secret is decrypted locally after retrieval.
+   *
+   * API: GET /api/secrets/get?workspaceId=...&environment=...&name=...
+   *
+   * @param name - The name of the secret to retrieve
+   * @returns A Result containing the decrypted value or an error
+   */
+  async get(name) {
+    logger.debug("Getting secret");
+    await this.ensureInitialized();
+    if (!this.encryptionClient) {
+      return {
+        failure: {
+          type: "ClientError",
+          message: "Failed to initialize Encryption client"
+        }
+      };
+    }
+    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
+    const apiResult = await this.apiRequest("GET", "/get", {
+      params: {
+        workspaceId,
+        environment: this.config.environment,
+        name
+      }
+    });
+    if (apiResult.failure) {
+      return apiResult;
+    }
+    const decryptResult = await this.encryptionClient.decrypt(
+      apiResult.data.encryptedValue.data
+    );
+    if (decryptResult.failure) {
+      logger.error("Failed to decrypt secret");
+      return {
+        failure: {
+          type: "DecryptionError",
+          message: decryptResult.failure.message
+        }
+      };
+    }
+    if (typeof decryptResult.data !== "string") {
+      logger.error("Decrypted secret value is not a string");
+      return {
+        failure: {
+          type: "DecryptionError",
+          message: "Decrypted value is not a string"
+        }
+      };
+    }
+    return { data: decryptResult.data };
+  }
+  /**
+   * Retrieve and decrypt many secrets from the vault.
+   * The secrets are decrypted locally after retrieval.
+   * This method only triggers a single network request to the ZeroKMS.
+   *
+   * API: GET /api/secrets/get-many?workspaceId=...&environment=...&names=name1,name2,...
+   *
+   * Constraints:
+   *   - Minimum 2 secret names required
+   *   - Maximum 100 secret names per request
+   *
+   * @param names - The names of the secrets to retrieve (min 2, max 100)
+   * @returns A Result containing an object mapping secret names to their decrypted values
+   */
+  async getMany(names) {
+    logger.debug(`Getting ${names.length} secrets.`);
+    await this.ensureInitialized();
+    if (!this.encryptionClient) {
+      return {
+        failure: {
+          type: "ClientError",
+          message: "Failed to initialize Encryption client"
+        }
+      };
+    }
+    if (names.length < 2) {
+      return {
+        failure: {
+          type: "ClientError",
+          message: "At least 2 secret names are required for getMany"
+        }
+      };
+    }
+    if (names.length > 100) {
+      return {
+        failure: {
+          type: "ClientError",
+          message: "Maximum 100 secret names per request"
+        }
+      };
+    }
+    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
+    const apiResult = await this.apiRequest(
+      "GET",
+      "/get-many",
+      {
+        params: {
+          workspaceId,
+          environment: this.config.environment,
+          names: names.join(",")
+        }
+      }
+    );
+    if (apiResult.failure) {
+      return apiResult;
+    }
+    const dataToDecrypt = apiResult.data.map((item) => ({
+      name: item.name,
+      value: item.encryptedValue.data
+    }));
+    const decryptResult = await this.encryptionClient.bulkDecryptModels(dataToDecrypt);
+    if (decryptResult.failure) {
+      logger.error(
+        `Failed to decrypt secrets: ${decryptResult.failure.message}`
+      );
+      return {
+        failure: {
+          type: "DecryptionError",
+          message: decryptResult.failure.message
+        }
+      };
+    }
+    const decryptedSecrets = decryptResult.data;
+    const secretsMap = {};
+    for (const secret of decryptedSecrets) {
+      if (secret.name && secret.value) {
+        secretsMap[secret.name] = secret.value;
+      }
+    }
+    return { data: secretsMap };
+  }
+  /**
+   * List all secrets in the environment.
+   * Only names and metadata are returned; values remain encrypted.
+   *
+   * API: GET /api/secrets/list?workspaceId=...&environment=...
+   *
+   * @returns A Result containing the list of secrets or an error
+   */
+  async list() {
+    logger.debug("Listing secrets.");
+    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
+    const apiResult = await this.apiRequest(
+      "GET",
+      "/list",
+      {
+        params: {
+          workspaceId,
+          environment: this.config.environment
+        }
+      }
+    );
+    if (apiResult.failure) {
+      return apiResult;
+    }
+    return { data: apiResult.data.secrets };
+  }
+  /**
+   * Delete a secret from the vault.
+   *
+   * API: POST /api/secrets/delete
+   *
+   * @param name - The name of the secret to delete
+   * @returns A Result containing the API response or an error
+   */
+  async delete(name) {
+    logger.debug("Deleting secret");
+    const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
+    return await this.apiRequest("POST", "/delete", {
+      body: {
+        workspaceId,
+        environment: this.config.environment,
+        name
+      }
+    });
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Encryption,
-  EncryptionErrorTypes,
+  Secrets,
   encryptedColumn,
   encryptedField,
   encryptedTable,
-  getErrorMessage
+  encryptedToPgComposite,
+  isEncryptedPayload
 });
 //# sourceMappingURL=index.cjs.map