@cipherstash/stack 0.4.0 → 0.5.0

package/dist/errors/index.d.cts

@@ -0,0 +1,94 @@
+import { ProtectErrorCode } from '@cipherstash/protect-ffi';
+
+declare const EncryptionErrorTypes: {
+    ClientInitError: string;
+    EncryptionError: string;
+    DecryptionError: string;
+    LockContextError: string;
+    CtsTokenError: string;
+};
+/**
+ * Base error interface returned by all encryption operations.
+ *
+ * Every operation that can fail returns `Result<T, EncryptionError>`.
+ * Use the `type` field to narrow to a specific error kind, or use
+ * {@link StackError} for an exhaustive discriminated union.
+ *
+ * @example
+ * ```typescript
+ * const result = await client.encrypt(value, opts)
+ * if (result.failure) {
+ *   switch (result.failure.type) {
+ *     case EncryptionErrorTypes.EncryptionError:
+ *       console.error('Encryption failed:', result.failure.message)
+ *       break
+ *     case EncryptionErrorTypes.LockContextError:
+ *       console.error('Lock context issue:', result.failure.message)
+ *       break
+ *   }
+ * }
+ * ```
+ */
+interface EncryptionError {
+    type: (typeof EncryptionErrorTypes)[keyof typeof EncryptionErrorTypes];
+    message: string;
+    code?: ProtectErrorCode;
+}
+interface ClientInitError {
+    type: typeof EncryptionErrorTypes.ClientInitError;
+    message: string;
+}
+interface EncryptionOperationError {
+    type: typeof EncryptionErrorTypes.EncryptionError;
+    message: string;
+    code?: ProtectErrorCode;
+}
+interface DecryptionOperationError {
+    type: typeof EncryptionErrorTypes.DecryptionError;
+    message: string;
+    code?: ProtectErrorCode;
+}
+interface LockContextError {
+    type: typeof EncryptionErrorTypes.LockContextError;
+    message: string;
+}
+interface CtsTokenError {
+    type: typeof EncryptionErrorTypes.CtsTokenError;
+    message: string;
+}
+/**
+ * Discriminated union of all specific error types.
+ *
+ * Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.
+ *
+ * @example
+ * ```typescript
+ * function handleError(error: StackError) {
+ *   switch (error.type) {
+ *     case 'ClientInitError':
+ *       // re-initialize client
+ *       break
+ *     case 'EncryptionError':
+ *     case 'DecryptionError':
+ *       // log and retry
+ *       break
+ *     case 'LockContextError':
+ *       // re-authenticate
+ *       break
+ *     case 'CtsTokenError':
+ *       // refresh token
+ *       break
+ *     default:
+ *       error satisfies never
+ *   }
+ * }
+ * ```
+ */
+type StackError = ClientInitError | EncryptionOperationError | DecryptionOperationError | LockContextError | CtsTokenError;
+/**
+ * Safely extract an error message from an unknown thrown value.
+ * Unlike `(error as Error).message`, this handles non-Error values gracefully.
+ */
+declare function getErrorMessage(error: unknown): string;
+
+export { type ClientInitError, type CtsTokenError, type DecryptionOperationError, type EncryptionError, EncryptionErrorTypes, type EncryptionOperationError, type LockContextError, type StackError, getErrorMessage };

package/dist/errors/index.d.ts

@@ -0,0 +1,94 @@
+import { ProtectErrorCode } from '@cipherstash/protect-ffi';
+
+declare const EncryptionErrorTypes: {
+    ClientInitError: string;
+    EncryptionError: string;
+    DecryptionError: string;
+    LockContextError: string;
+    CtsTokenError: string;
+};
+/**
+ * Base error interface returned by all encryption operations.
+ *
+ * Every operation that can fail returns `Result<T, EncryptionError>`.
+ * Use the `type` field to narrow to a specific error kind, or use
+ * {@link StackError} for an exhaustive discriminated union.
+ *
+ * @example
+ * ```typescript
+ * const result = await client.encrypt(value, opts)
+ * if (result.failure) {
+ *   switch (result.failure.type) {
+ *     case EncryptionErrorTypes.EncryptionError:
+ *       console.error('Encryption failed:', result.failure.message)
+ *       break
+ *     case EncryptionErrorTypes.LockContextError:
+ *       console.error('Lock context issue:', result.failure.message)
+ *       break
+ *   }
+ * }
+ * ```
+ */
+interface EncryptionError {
+    type: (typeof EncryptionErrorTypes)[keyof typeof EncryptionErrorTypes];
+    message: string;
+    code?: ProtectErrorCode;
+}
+interface ClientInitError {
+    type: typeof EncryptionErrorTypes.ClientInitError;
+    message: string;
+}
+interface EncryptionOperationError {
+    type: typeof EncryptionErrorTypes.EncryptionError;
+    message: string;
+    code?: ProtectErrorCode;
+}
+interface DecryptionOperationError {
+    type: typeof EncryptionErrorTypes.DecryptionError;
+    message: string;
+    code?: ProtectErrorCode;
+}
+interface LockContextError {
+    type: typeof EncryptionErrorTypes.LockContextError;
+    message: string;
+}
+interface CtsTokenError {
+    type: typeof EncryptionErrorTypes.CtsTokenError;
+    message: string;
+}
+/**
+ * Discriminated union of all specific error types.
+ *
+ * Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.
+ *
+ * @example
+ * ```typescript
+ * function handleError(error: StackError) {
+ *   switch (error.type) {
+ *     case 'ClientInitError':
+ *       // re-initialize client
+ *       break
+ *     case 'EncryptionError':
+ *     case 'DecryptionError':
+ *       // log and retry
+ *       break
+ *     case 'LockContextError':
+ *       // re-authenticate
+ *       break
+ *     case 'CtsTokenError':
+ *       // refresh token
+ *       break
+ *     default:
+ *       error satisfies never
+ *   }
+ * }
+ * ```
+ */
+type StackError = ClientInitError | EncryptionOperationError | DecryptionOperationError | LockContextError | CtsTokenError;
+/**
+ * Safely extract an error message from an unknown thrown value.
+ * Unlike `(error as Error).message`, this handles non-Error values gracefully.
+ */
+declare function getErrorMessage(error: unknown): string;
+
+export { type ClientInitError, type CtsTokenError, type DecryptionOperationError, type EncryptionError, EncryptionErrorTypes, type EncryptionOperationError, type LockContextError, type StackError, getErrorMessage };

package/dist/errors/index.js

@@ -0,0 +1,9 @@
+import {
+  EncryptionErrorTypes,
+  getErrorMessage
+} from "../chunk-LBMC4D6D.js";
+export {
+  EncryptionErrorTypes,
+  getErrorMessage
+};
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/identity/index.cjs

@@ -108,25 +108,33 @@ function loadWorkSpaceId(suppliedCrn) {
 
 // src/utils/logger/index.ts
 var import_evlog = require("evlog");
-function samplingFromEnv() {
-  const env = process.env.STASH_LOG_LEVEL;
-  if (!env) return void 0;
-  const levels = ["debug", "info", "warn", "error"];
-  const idx = levels.indexOf(env);
-  if (idx === -1) return void 0;
-  return Object.fromEntries(levels.map((l, i) => [l, i >= idx ? 100 : 0]));
+var validLevels = ["debug", "info", "error"];
+function levelFromEnv() {
+  const env = process.env.STASH_STACK_LOG;
+  if (env && validLevels.includes(env)) return env;
+  return "error";
+}
+function samplingRatesForLevel(level) {
+  switch (level) {
+    case "debug":
+      return { debug: 100, info: 100, warn: 100, error: 100 };
+    case "info":
+      return { debug: 0, info: 100, warn: 100, error: 100 };
+    case "error":
+    default:
+      return { debug: 0, info: 0, warn: 0, error: 100 };
+  }
 }
 var initialized = false;
-function initStackLogger(config) {
+function initStackLogger() {
   if (initialized) return;
   initialized = true;
-  const rates = samplingFromEnv();
+  const level = levelFromEnv();
+  const rates = samplingRatesForLevel(level);
   (0, import_evlog.initLogger)({
     env: { service: "@cipherstash/stack" },
-    enabled: config?.enabled ?? !!rates,
-    pretty: config?.pretty,
-    ...rates && { sampling: { rates } },
-    ...config?.drain && { drain: config.drain }
+    enabled: true,
+    sampling: { rates }
   });
 }
 initStackLogger();

package/dist/identity/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/identity/index.ts","../../src/errors/index.ts","../../src/utils/config/index.ts","../../src/utils/logger/index.ts"],"sourcesContent":["import { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken: CtsToken\n  context: Context\n}\n\n/**\n * Manages CipherStash lock contexts for row-level access control.\n *\n * A `LockContext` ties encryption/decryption operations to an authenticated\n * user identity via CTS (CipherStash Token Service). Call {@link identify}\n * with a user's JWT to obtain a CTS token, then pass the `LockContext`\n * to `.withLockContext()` on any encrypt/decrypt operation.\n *\n * @example\n * ```typescript\n * import { LockContext } from \"@cipherstash/stack/identity\"\n *\n * const lc = new LockContext()\n * const identified = await lc.identify(userJwt)\n *\n * if (identified.failure) throw new Error(identified.failure.message)\n *\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext(identified.data)\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.\n   *\n   * @example\n   * ```typescript\n   * const lc = new LockContext()\n   * const result = await lc.identify(userJwt)\n   * if (result.failure) {\n   *   console.error(\"Auth failed:\", result.failure.message)\n   * }\n   * ```\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the current CTS token and context for use with encryption operations.\n   *\n   * Must be called after {@link identify}. Returns the token/context pair that\n   * `.withLockContext()` expects.\n   *\n   * @returns A `Result` containing the CTS token and identity context, or an error\n   *   if {@link identify} has not been called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => {\n        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {\n          throw new Error(\n            'The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext().',\n          )\n        }\n\n        return {\n          context: this.context,\n          ctsToken: this.ctsToken,\n        }\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n","import type { ProtectErrorCode } from '@cipherstash/protect-ffi'\n\nexport const EncryptionErrorTypes = {\n  ClientInitError: 'ClientInitError',\n  EncryptionError: 'EncryptionError',\n  DecryptionError: 'DecryptionError',\n  LockContextError: 'LockContextError',\n  CtsTokenError: 'CtsTokenError',\n}\n\n/**\n * Base error interface returned by all encryption operations.\n *\n * Every operation that can fail returns `Result<T, EncryptionError>`.\n * Use the `type` field to narrow to a specific error kind, or use\n * {@link StackError} for an exhaustive discriminated union.\n *\n * @example\n * ```typescript\n * const result = await client.encrypt(value, opts)\n * if (result.failure) {\n *   switch (result.failure.type) {\n *     case 'EncryptionError':\n *       console.error('Encryption failed:', result.failure.message)\n *       break\n *     case 'LockContextError':\n *       console.error('Lock context issue:', result.failure.message)\n *       break\n *   }\n * }\n * ```\n */\nexport interface EncryptionError {\n  type: (typeof EncryptionErrorTypes)[keyof typeof EncryptionErrorTypes]\n  message: string\n  code?: ProtectErrorCode\n}\n\n// ---------------------------------------------------------------------------\n// Specific error types (discriminated union members)\n// ---------------------------------------------------------------------------\n\nexport interface ClientInitError {\n  type: typeof EncryptionErrorTypes.ClientInitError\n  message: string\n}\n\nexport interface EncryptionOperationError {\n  type: typeof EncryptionErrorTypes.EncryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface DecryptionOperationError {\n  type: typeof EncryptionErrorTypes.DecryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface LockContextError {\n  type: typeof EncryptionErrorTypes.LockContextError\n  message: string\n}\n\nexport interface CtsTokenError {\n  type: typeof EncryptionErrorTypes.CtsTokenError\n  message: string\n}\n\n/**\n * Discriminated union of all specific error types.\n *\n * Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.\n *\n * @example\n * ```typescript\n * function handleError(error: StackError) {\n *   switch (error.type) {\n *     case 'ClientInitError':\n *       // re-initialize client\n *       break\n *     case 'EncryptionError':\n *     case 'DecryptionError':\n *       // log and retry\n *       break\n *     case 'LockContextError':\n *       // re-authenticate\n *       break\n *     case 'CtsTokenError':\n *       // refresh token\n *       break\n *     default:\n *       error satisfies never\n *   }\n * }\n * ```\n */\nexport type StackError =\n  | ClientInitError\n  | EncryptionOperationError\n  | DecryptionOperationError\n  | LockContextError\n  | CtsTokenError\n\n// ---------------------------------------------------------------------------\n// Error utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Safely extract an error message from an unknown thrown value.\n * Unlike `(error as Error).message`, this handles non-Error values gracefully.\n */\nexport function getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message\n  if (typeof error === 'string') return error\n  return String(error)\n}\n","import fs from 'node:fs'\nimport path from 'node:path'\n\n/**\n * A lightweight function that parses a TOML-like string\n * and returns the `workspace_crn` value found under `[auth]`.\n *\n * @param tomlString The contents of the TOML file as a string.\n * @returns The workspace_crn if found, otherwise undefined.\n */\nfunction getWorkspaceCrn(tomlString: string): string | undefined {\n  let currentSection = ''\n  let workspaceCrn: string | undefined\n\n  const lines = tomlString.split(/\\r?\\n/)\n\n  for (const line of lines) {\n    const trimmedLine = line.trim()\n\n    if (!trimmedLine || trimmedLine.startsWith('#')) {\n      continue\n    }\n\n    const sectionMatch = trimmedLine.match(/^\\[([^\\]]+)\\]$/)\n    if (sectionMatch) {\n      currentSection = sectionMatch[1]\n      continue\n    }\n\n    const kvMatch = trimmedLine.match(/^(\\w+)\\s*=\\s*\"([^\"]+)\"$/)\n    if (kvMatch) {\n      const [_, key, value] = kvMatch\n\n      if (currentSection === 'auth' && key === 'workspace_crn') {\n        workspaceCrn = value\n        break\n      }\n    }\n  }\n\n  return workspaceCrn\n}\n\n/**\n * Extracts the workspace ID from a CRN string.\n * CRN format: crn:region.aws:ID\n *\n * @param crn The CRN string to extract from\n * @returns The workspace ID portion of the CRN\n */\nexport function extractWorkspaceIdFromCrn(crn: string): string {\n  const match = crn.match(/crn:[^:]+:([^:]+)$/)\n  if (!match) {\n    throw new Error('Invalid CRN format')\n  }\n  return match[1]\n}\n\nexport function loadWorkSpaceId(suppliedCrn?: string): string {\n  const configPath = path.join(process.cwd(), 'cipherstash.toml')\n\n  if (suppliedCrn) {\n    return extractWorkspaceIdFromCrn(suppliedCrn)\n  }\n\n  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  // Environment variables take precedence over config files\n  if (process.env.CS_WORKSPACE_CRN) {\n    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN)\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  const tomlString = fs.readFileSync(configPath, 'utf8')\n  const workspaceCrn = getWorkspaceCrn(tomlString)\n\n  if (!workspaceCrn) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  return extractWorkspaceIdFromCrn(workspaceCrn)\n}\n","import { initLogger, createRequestLogger } from 'evlog'\nimport type { LoggerConfig } from 'evlog'\n\nexport type LoggingConfig = {\n  enabled?: boolean\n  pretty?: boolean\n  drain?: LoggerConfig['drain']\n}\n\nfunction samplingFromEnv() {\n  const env = process.env.STASH_LOG_LEVEL\n  if (!env) return undefined\n  const levels = ['debug', 'info', 'warn', 'error'] as const\n  const idx = levels.indexOf(env as (typeof levels)[number])\n  if (idx === -1) return undefined\n  return Object.fromEntries(levels.map((l, i) => [l, i >= idx ? 100 : 0]))\n}\n\nlet initialized = false\n\nexport function initStackLogger(config?: LoggingConfig): void {\n  if (initialized) return\n  initialized = true\n  const rates = samplingFromEnv()\n  initLogger({\n    env: { service: '@cipherstash/stack' },\n    enabled: config?.enabled ?? !!rates,\n    pretty: config?.pretty,\n    ...(rates && { sampling: { rates } }),\n    ...(config?.drain && { drain: config.drain }),\n  })\n}\n\n// Auto-init with defaults on first import\ninitStackLogger()\n\nexport { createRequestLogger }\n\n// Stringify only the first arg (the message string); drop subsequent args\n// which may contain sensitive objects (e.g. encryptConfig, plaintext).\nfunction safeMessage(args: unknown[]): string {\n  return typeof args[0] === 'string' ? args[0] : ''\n}\n\n// Legacy logger for simple one-off logs (used by encryption/ffi/index.ts + identity/index.ts)\nexport const logger = {\n  debug(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({\n      level: 'debug',\n      source: '@cipherstash/stack',\n      message: safeMessage(args),\n    })\n    log.emit()\n  },\n  info(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({ source: '@cipherstash/stack' })\n    log.info(safeMessage(args))\n    log.emit()\n  },\n  warn(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.warn(safeMessage(args))\n    log.emit()\n  },\n  error(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.error(safeMessage(args))\n    log.emit()\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,uBAAuB;AAAA,EAClC,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,eAAe;AACjB;;;ACRA,qBAAe;AACf,uBAAiB;AASjB,SAAS,gBAAgB,YAAwC;AAC/D,MAAI,iBAAiB;AACrB,MAAI;AAEJ,QAAM,QAAQ,WAAW,MAAM,OAAO;AAEtC,aAAW,QAAQ,OAAO;AACxB,UAAM,cAAc,KAAK,KAAK;AAE9B,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG,GAAG;AAC/C;AAAA,IACF;AAEA,UAAM,eAAe,YAAY,MAAM,gBAAgB;AACvD,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,MAAM,yBAAyB;AAC3D,QAAI,SAAS;AACX,YAAM,CAAC,GAAG,KAAK,KAAK,IAAI;AAExB,UAAI,mBAAmB,UAAU,QAAQ,iBAAiB;AACxD,uBAAe;AACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,0BAA0B,KAAqB;AAC7D,QAAM,QAAQ,IAAI,MAAM,oBAAoB;AAC5C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,SAAO,MAAM,CAAC;AAChB;AAEO,SAAS,gBAAgB,aAA8B;AAC5D,QAAM,aAAa,iBAAAA,QAAK,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAE9D,MAAI,aAAa;AACf,WAAO,0BAA0B,WAAW;AAAA,EAC9C;AAEA,MAAI,CAAC,eAAAC,QAAG,WAAW,UAAU,KAAK,CAAC,QAAQ,IAAI,kBAAkB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,IAAI,kBAAkB;AAChC,WAAO,0BAA0B,QAAQ,IAAI,gBAAgB;AAAA,EAC/D;AAEA,MAAI,CAAC,eAAAA,QAAG,WAAW,UAAU,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,eAAAA,QAAG,aAAa,YAAY,MAAM;AACrD,QAAM,eAAe,gBAAgB,UAAU;AAE/C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,0BAA0B,YAAY;AAC/C;;;AC5FA,mBAAgD;AAShD,SAAS,kBAAkB;AACzB,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,CAAC,SAAS,QAAQ,QAAQ,OAAO;AAChD,QAAM,MAAM,OAAO,QAAQ,GAA8B;AACzD,MAAI,QAAQ,GAAI,QAAO;AACvB,SAAO,OAAO,YAAY,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC;AACzE;AAEA,IAAI,cAAc;AAEX,SAAS,gBAAgB,QAA8B;AAC5D,MAAI,YAAa;AACjB,gBAAc;AACd,QAAM,QAAQ,gBAAgB;AAC9B,+BAAW;AAAA,IACT,KAAK,EAAE,SAAS,qBAAqB;AAAA,IACrC,SAAS,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC9B,QAAQ,QAAQ;AAAA,IAChB,GAAI,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;AAAA,IACnC,GAAI,QAAQ,SAAS,EAAE,OAAO,OAAO,MAAM;AAAA,EAC7C,CAAC;AACH;AAGA,gBAAgB;AAMhB,SAAS,YAAY,MAAyB;AAC5C,SAAO,OAAO,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI;AACjD;AAGO,IAAM,SAAS;AAAA,EACpB,SAAS,MAAiB;AACxB,UAAM,UAAM,kCAAoB;AAChC,QAAI,IAAI;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,YAAY,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,UAAM,kCAAoB;AAChC,QAAI,IAAI,EAAE,QAAQ,qBAAqB,CAAC;AACxC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,UAAM,kCAAoB;AAChC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,SAAS,MAAiB;AACxB,UAAM,UAAM,kCAAoB;AAChC,QAAI,MAAM,YAAY,IAAI,CAAC;AAC3B,QAAI,KAAK;AAAA,EACX;AACF;;;AHpEA,oBAAwC;AAiDjC,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,UAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,UAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,iBAA2E;AACzE,eAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,UAAU,QAAQ;AACzD,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,SAAS,KAAK;AAAA,UACd,UAAU,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":["path","fs"]}
+{"version":3,"sources":["../../src/identity/index.ts","../../src/errors/index.ts","../../src/utils/config/index.ts","../../src/utils/logger/index.ts"],"sourcesContent":["import { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken: CtsToken\n  context: Context\n}\n\n/**\n * Manages CipherStash lock contexts for row-level access control.\n *\n * A `LockContext` ties encryption/decryption operations to an authenticated\n * user identity via CTS (CipherStash Token Service). Call {@link identify}\n * with a user's JWT to obtain a CTS token, then pass the `LockContext`\n * to `.withLockContext()` on any encrypt/decrypt operation.\n *\n * @example\n * ```typescript\n * import { LockContext } from \"@cipherstash/stack/identity\"\n *\n * const lc = new LockContext()\n * const identified = await lc.identify(userJwt)\n *\n * if (identified.failure) throw new Error(identified.failure.message)\n *\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext(identified.data)\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.\n   *\n   * @example\n   * ```typescript\n   * const lc = new LockContext()\n   * const result = await lc.identify(userJwt)\n   * if (result.failure) {\n   *   console.error(\"Auth failed:\", result.failure.message)\n   * }\n   * ```\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the current CTS token and context for use with encryption operations.\n   *\n   * Must be called after {@link identify}. Returns the token/context pair that\n   * `.withLockContext()` expects.\n   *\n   * @returns A `Result` containing the CTS token and identity context, or an error\n   *   if {@link identify} has not been called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => {\n        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {\n          throw new Error(\n            'The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext().',\n          )\n        }\n\n        return {\n          context: this.context,\n          ctsToken: this.ctsToken,\n        }\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n","import type { ProtectErrorCode } from '@cipherstash/protect-ffi'\n\nexport const EncryptionErrorTypes = {\n  ClientInitError: 'ClientInitError',\n  EncryptionError: 'EncryptionError',\n  DecryptionError: 'DecryptionError',\n  LockContextError: 'LockContextError',\n  CtsTokenError: 'CtsTokenError',\n}\n\n/**\n * Base error interface returned by all encryption operations.\n *\n * Every operation that can fail returns `Result<T, EncryptionError>`.\n * Use the `type` field to narrow to a specific error kind, or use\n * {@link StackError} for an exhaustive discriminated union.\n *\n * @example\n * ```typescript\n * const result = await client.encrypt(value, opts)\n * if (result.failure) {\n *   switch (result.failure.type) {\n *     case EncryptionErrorTypes.EncryptionError:\n *       console.error('Encryption failed:', result.failure.message)\n *       break\n *     case EncryptionErrorTypes.LockContextError:\n *       console.error('Lock context issue:', result.failure.message)\n *       break\n *   }\n * }\n * ```\n */\nexport interface EncryptionError {\n  type: (typeof EncryptionErrorTypes)[keyof typeof EncryptionErrorTypes]\n  message: string\n  code?: ProtectErrorCode\n}\n\n// ---------------------------------------------------------------------------\n// Specific error types (discriminated union members)\n// ---------------------------------------------------------------------------\n\nexport interface ClientInitError {\n  type: typeof EncryptionErrorTypes.ClientInitError\n  message: string\n}\n\nexport interface EncryptionOperationError {\n  type: typeof EncryptionErrorTypes.EncryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface DecryptionOperationError {\n  type: typeof EncryptionErrorTypes.DecryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface LockContextError {\n  type: typeof EncryptionErrorTypes.LockContextError\n  message: string\n}\n\nexport interface CtsTokenError {\n  type: typeof EncryptionErrorTypes.CtsTokenError\n  message: string\n}\n\n/**\n * Discriminated union of all specific error types.\n *\n * Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.\n *\n * @example\n * ```typescript\n * function handleError(error: StackError) {\n *   switch (error.type) {\n *     case 'ClientInitError':\n *       // re-initialize client\n *       break\n *     case 'EncryptionError':\n *     case 'DecryptionError':\n *       // log and retry\n *       break\n *     case 'LockContextError':\n *       // re-authenticate\n *       break\n *     case 'CtsTokenError':\n *       // refresh token\n *       break\n *     default:\n *       error satisfies never\n *   }\n * }\n * ```\n */\nexport type StackError =\n  | ClientInitError\n  | EncryptionOperationError\n  | DecryptionOperationError\n  | LockContextError\n  | CtsTokenError\n\n// ---------------------------------------------------------------------------\n// Error utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Safely extract an error message from an unknown thrown value.\n * Unlike `(error as Error).message`, this handles non-Error values gracefully.\n */\nexport function getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message\n  if (typeof error === 'string') return error\n  return String(error)\n}\n","import fs from 'node:fs'\nimport path from 'node:path'\n\n/**\n * A lightweight function that parses a TOML-like string\n * and returns the `workspace_crn` value found under `[auth]`.\n *\n * @param tomlString The contents of the TOML file as a string.\n * @returns The workspace_crn if found, otherwise undefined.\n */\nfunction getWorkspaceCrn(tomlString: string): string | undefined {\n  let currentSection = ''\n  let workspaceCrn: string | undefined\n\n  const lines = tomlString.split(/\\r?\\n/)\n\n  for (const line of lines) {\n    const trimmedLine = line.trim()\n\n    if (!trimmedLine || trimmedLine.startsWith('#')) {\n      continue\n    }\n\n    const sectionMatch = trimmedLine.match(/^\\[([^\\]]+)\\]$/)\n    if (sectionMatch) {\n      currentSection = sectionMatch[1]\n      continue\n    }\n\n    const kvMatch = trimmedLine.match(/^(\\w+)\\s*=\\s*\"([^\"]+)\"$/)\n    if (kvMatch) {\n      const [_, key, value] = kvMatch\n\n      if (currentSection === 'auth' && key === 'workspace_crn') {\n        workspaceCrn = value\n        break\n      }\n    }\n  }\n\n  return workspaceCrn\n}\n\n/**\n * Extracts the workspace ID from a CRN string.\n * CRN format: crn:region.aws:ID\n *\n * @param crn The CRN string to extract from\n * @returns The workspace ID portion of the CRN\n */\nexport function extractWorkspaceIdFromCrn(crn: string): string {\n  const match = crn.match(/crn:[^:]+:([^:]+)$/)\n  if (!match) {\n    throw new Error('Invalid CRN format')\n  }\n  return match[1]\n}\n\nexport function loadWorkSpaceId(suppliedCrn?: string): string {\n  const configPath = path.join(process.cwd(), 'cipherstash.toml')\n\n  if (suppliedCrn) {\n    return extractWorkspaceIdFromCrn(suppliedCrn)\n  }\n\n  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  // Environment variables take precedence over config files\n  if (process.env.CS_WORKSPACE_CRN) {\n    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN)\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  const tomlString = fs.readFileSync(configPath, 'utf8')\n  const workspaceCrn = getWorkspaceCrn(tomlString)\n\n  if (!workspaceCrn) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  return extractWorkspaceIdFromCrn(workspaceCrn)\n}\n","import { createRequestLogger, initLogger } from 'evlog'\n\n/**\n * Log level for the Stack logger.\n *\n * Configured via the `STASH_STACK_LOG` environment variable.\n *\n * - `'error'` — Only errors (default when `STASH_STACK_LOG` is not set).\n * - `'info'`  — Info and errors.\n * - `'debug'` — Debug, info, and errors.\n */\nexport type LogLevel = 'debug' | 'info' | 'error'\n\nconst validLevels: readonly LogLevel[] = ['debug', 'info', 'error'] as const\n\nfunction levelFromEnv(): LogLevel {\n  const env = process.env.STASH_STACK_LOG\n  if (env && validLevels.includes(env as LogLevel)) return env as LogLevel\n  return 'error'\n}\n\nfunction samplingRatesForLevel(level: LogLevel): Record<string, number> {\n  // evlog uses sampling rates: 100 = always emit, 0 = never emit\n  switch (level) {\n    case 'debug':\n      return { debug: 100, info: 100, warn: 100, error: 100 }\n    case 'info':\n      return { debug: 0, info: 100, warn: 100, error: 100 }\n    case 'error':\n    default:\n      return { debug: 0, info: 0, warn: 0, error: 100 }\n  }\n}\n\nlet initialized = false\n\n/**\n * Initialize the Stack logger.\n *\n * The log level is read from the `STASH_STACK_LOG` environment variable.\n * When the variable is not set, the default is `'error'` (errors only).\n *\n * @internal\n */\nexport function initStackLogger(): void {\n  if (initialized) return\n  initialized = true\n\n  const level = levelFromEnv()\n  const rates = samplingRatesForLevel(level)\n\n  initLogger({\n    env: { service: '@cipherstash/stack' },\n    enabled: true,\n    sampling: { rates },\n  })\n}\n\n// Auto-init with defaults on first import\ninitStackLogger()\n\nexport { createRequestLogger }\n\n// Stringify only the first arg (the message string); drop subsequent args\n// which may contain sensitive objects (e.g. encryptConfig, plaintext).\nfunction safeMessage(args: unknown[]): string {\n  return typeof args[0] === 'string' ? args[0] : ''\n}\n\n// Logger for simple one-off logs used across Stack interfaces.\nexport const logger = {\n  debug(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({\n      level: 'debug',\n      source: '@cipherstash/stack',\n      message: safeMessage(args),\n    })\n    log.emit()\n  },\n  info(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.set({ source: '@cipherstash/stack' })\n    log.info(safeMessage(args))\n    log.emit()\n  },\n  warn(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.warn(safeMessage(args))\n    log.emit()\n  },\n  error(...args: unknown[]) {\n    const log = createRequestLogger()\n    log.error(safeMessage(args))\n    log.emit()\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,uBAAuB;AAAA,EAClC,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,eAAe;AACjB;;;ACRA,qBAAe;AACf,uBAAiB;AASjB,SAAS,gBAAgB,YAAwC;AAC/D,MAAI,iBAAiB;AACrB,MAAI;AAEJ,QAAM,QAAQ,WAAW,MAAM,OAAO;AAEtC,aAAW,QAAQ,OAAO;AACxB,UAAM,cAAc,KAAK,KAAK;AAE9B,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG,GAAG;AAC/C;AAAA,IACF;AAEA,UAAM,eAAe,YAAY,MAAM,gBAAgB;AACvD,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,MAAM,yBAAyB;AAC3D,QAAI,SAAS;AACX,YAAM,CAAC,GAAG,KAAK,KAAK,IAAI;AAExB,UAAI,mBAAmB,UAAU,QAAQ,iBAAiB;AACxD,uBAAe;AACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,0BAA0B,KAAqB;AAC7D,QAAM,QAAQ,IAAI,MAAM,oBAAoB;AAC5C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,SAAO,MAAM,CAAC;AAChB;AAEO,SAAS,gBAAgB,aAA8B;AAC5D,QAAM,aAAa,iBAAAA,QAAK,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAE9D,MAAI,aAAa;AACf,WAAO,0BAA0B,WAAW;AAAA,EAC9C;AAEA,MAAI,CAAC,eAAAC,QAAG,WAAW,UAAU,KAAK,CAAC,QAAQ,IAAI,kBAAkB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,IAAI,kBAAkB;AAChC,WAAO,0BAA0B,QAAQ,IAAI,gBAAgB;AAAA,EAC/D;AAEA,MAAI,CAAC,eAAAA,QAAG,WAAW,UAAU,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,eAAAA,QAAG,aAAa,YAAY,MAAM;AACrD,QAAM,eAAe,gBAAgB,UAAU;AAE/C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,0BAA0B,YAAY;AAC/C;;;AC5FA,mBAAgD;AAahD,IAAM,cAAmC,CAAC,SAAS,QAAQ,OAAO;AAElE,SAAS,eAAyB;AAChC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,YAAY,SAAS,GAAe,EAAG,QAAO;AACzD,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAyC;AAEtE,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,EAAE,OAAO,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI;AAAA,IACxD,KAAK;AACH,aAAO,EAAE,OAAO,GAAG,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI;AAAA,IACtD,KAAK;AAAA,IACL;AACE,aAAO,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,IAAI;AAAA,EACpD;AACF;AAEA,IAAI,cAAc;AAUX,SAAS,kBAAwB;AACtC,MAAI,YAAa;AACjB,gBAAc;AAEd,QAAM,QAAQ,aAAa;AAC3B,QAAM,QAAQ,sBAAsB,KAAK;AAEzC,+BAAW;AAAA,IACT,KAAK,EAAE,SAAS,qBAAqB;AAAA,IACrC,SAAS;AAAA,IACT,UAAU,EAAE,MAAM;AAAA,EACpB,CAAC;AACH;AAGA,gBAAgB;AAMhB,SAAS,YAAY,MAAyB;AAC5C,SAAO,OAAO,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI;AACjD;AAGO,IAAM,SAAS;AAAA,EACpB,SAAS,MAAiB;AACxB,UAAM,UAAM,kCAAoB;AAChC,QAAI,IAAI;AAAA,MACN,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,YAAY,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,UAAM,kCAAoB;AAChC,QAAI,IAAI,EAAE,QAAQ,qBAAqB,CAAC;AACxC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,QAAQ,MAAiB;AACvB,UAAM,UAAM,kCAAoB;AAChC,QAAI,KAAK,YAAY,IAAI,CAAC;AAC1B,QAAI,KAAK;AAAA,EACX;AAAA,EACA,SAAS,MAAiB;AACxB,UAAM,UAAM,kCAAoB;AAChC,QAAI,MAAM,YAAY,IAAI,CAAC;AAC3B,QAAI,KAAK;AAAA,EACX;AACF;;;AH7FA,oBAAwC;AAiDjC,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,UAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,UAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,iBAA2E;AACzE,eAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,UAAU,QAAQ;AACzD,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,SAAS,KAAK;AAAA,UACd,UAAU,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":["path","fs"]}

package/dist/identity/index.d.cts

@@ -1,3 +1,79 @@
-export { h as Context, e as CtsRegions, f as CtsToken, G as GetLockContextResponse, I as IdentifyOptions, d as LockContext, i as LockContextOptions } from '../index-9-Ya3fDK.cjs';
-import '@byteslice/result';
+import { EncryptionError } from '../errors/index.cjs';
+import { Result } from '@byteslice/result';
 import '@cipherstash/protect-ffi';
+
+type CtsRegions = 'ap-southeast-2';
+type IdentifyOptions = {
+    fetchFromCts?: boolean;
+};
+type CtsToken = {
+    accessToken: string;
+    expiry: number;
+};
+type Context = {
+    identityClaim: string[];
+};
+type LockContextOptions = {
+    context?: Context;
+    ctsToken?: CtsToken;
+};
+type GetLockContextResponse = {
+    ctsToken: CtsToken;
+    context: Context;
+};
+/**
+ * Manages CipherStash lock contexts for row-level access control.
+ *
+ * A `LockContext` ties encryption/decryption operations to an authenticated
+ * user identity via CTS (CipherStash Token Service). Call {@link identify}
+ * with a user's JWT to obtain a CTS token, then pass the `LockContext`
+ * to `.withLockContext()` on any encrypt/decrypt operation.
+ *
+ * @example
+ * ```typescript
+ * import { LockContext } from "@cipherstash/stack/identity"
+ *
+ * const lc = new LockContext()
+ * const identified = await lc.identify(userJwt)
+ *
+ * if (identified.failure) throw new Error(identified.failure.message)
+ *
+ * const result = await client
+ *   .encrypt(value, { column: users.email, table: users })
+ *   .withLockContext(identified.data)
+ * ```
+ */
+declare class LockContext {
+    private ctsToken;
+    private workspaceId;
+    private context;
+    constructor({ context, ctsToken, }?: LockContextOptions);
+    /**
+     * Exchange a user's JWT for a CTS token and bind it to this lock context.
+     *
+     * @param jwtToken - A valid OIDC / JWT token for the current user.
+     * @returns A `Result` containing this `LockContext` (now authenticated) or an error.
+     *
+     * @example
+     * ```typescript
+     * const lc = new LockContext()
+     * const result = await lc.identify(userJwt)
+     * if (result.failure) {
+     *   console.error("Auth failed:", result.failure.message)
+     * }
+     * ```
+     */
+    identify(jwtToken: string): Promise<Result<LockContext, EncryptionError>>;
+    /**
+     * Retrieve the current CTS token and context for use with encryption operations.
+     *
+     * Must be called after {@link identify}. Returns the token/context pair that
+     * `.withLockContext()` expects.
+     *
+     * @returns A `Result` containing the CTS token and identity context, or an error
+     *   if {@link identify} has not been called.
+     */
+    getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>>;
+}
+
+export { type Context, type CtsRegions, type CtsToken, type GetLockContextResponse, type IdentifyOptions, LockContext, type LockContextOptions };

package/dist/identity/index.d.ts

@@ -1,3 +1,79 @@
-export { h as Context, e as CtsRegions, f as CtsToken, G as GetLockContextResponse, I as IdentifyOptions, d as LockContext, i as LockContextOptions } from '../index-9-Ya3fDK.js';
-import '@byteslice/result';
+import { EncryptionError } from '../errors/index.js';
+import { Result } from '@byteslice/result';
 import '@cipherstash/protect-ffi';
+
+type CtsRegions = 'ap-southeast-2';
+type IdentifyOptions = {
+    fetchFromCts?: boolean;
+};
+type CtsToken = {
+    accessToken: string;
+    expiry: number;
+};
+type Context = {
+    identityClaim: string[];
+};
+type LockContextOptions = {
+    context?: Context;
+    ctsToken?: CtsToken;
+};
+type GetLockContextResponse = {
+    ctsToken: CtsToken;
+    context: Context;
+};
+/**
+ * Manages CipherStash lock contexts for row-level access control.
+ *
+ * A `LockContext` ties encryption/decryption operations to an authenticated
+ * user identity via CTS (CipherStash Token Service). Call {@link identify}
+ * with a user's JWT to obtain a CTS token, then pass the `LockContext`
+ * to `.withLockContext()` on any encrypt/decrypt operation.
+ *
+ * @example
+ * ```typescript
+ * import { LockContext } from "@cipherstash/stack/identity"
+ *
+ * const lc = new LockContext()
+ * const identified = await lc.identify(userJwt)
+ *
+ * if (identified.failure) throw new Error(identified.failure.message)
+ *
+ * const result = await client
+ *   .encrypt(value, { column: users.email, table: users })
+ *   .withLockContext(identified.data)
+ * ```
+ */
+declare class LockContext {
+    private ctsToken;
+    private workspaceId;
+    private context;
+    constructor({ context, ctsToken, }?: LockContextOptions);
+    /**
+     * Exchange a user's JWT for a CTS token and bind it to this lock context.
+     *
+     * @param jwtToken - A valid OIDC / JWT token for the current user.
+     * @returns A `Result` containing this `LockContext` (now authenticated) or an error.
+     *
+     * @example
+     * ```typescript
+     * const lc = new LockContext()
+     * const result = await lc.identify(userJwt)
+     * if (result.failure) {
+     *   console.error("Auth failed:", result.failure.message)
+     * }
+     * ```
+     */
+    identify(jwtToken: string): Promise<Result<LockContext, EncryptionError>>;
+    /**
+     * Retrieve the current CTS token and context for use with encryption operations.
+     *
+     * Must be called after {@link identify}. Returns the token/context pair that
+     * `.withLockContext()` expects.
+     *
+     * @returns A `Result` containing the CTS token and identity context, or an error
+     *   if {@link identify} has not been called.
+     */
+    getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>>;
+}
+
+export { type Context, type CtsRegions, type CtsToken, type GetLockContextResponse, type IdentifyOptions, LockContext, type LockContextOptions };

package/dist/identity/index.js

@@ -1,8 +1,12 @@
 import {
-  EncryptionErrorTypes,
-  loadWorkSpaceId,
+  loadWorkSpaceId
+} from "../chunk-GXGEW6T4.js";
+import {
   logger
-} from "../chunk-OAPLZLR5.js";
+} from "../chunk-Q5FTQLYG.js";
+import {
+  EncryptionErrorTypes
+} from "../chunk-LBMC4D6D.js";
 
 // src/identity/index.ts
 import { withResult } from "@byteslice/result";

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/identity/index.ts"],"sourcesContent":["import { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken: CtsToken\n  context: Context\n}\n\n/**\n * Manages CipherStash lock contexts for row-level access control.\n *\n * A `LockContext` ties encryption/decryption operations to an authenticated\n * user identity via CTS (CipherStash Token Service). Call {@link identify}\n * with a user's JWT to obtain a CTS token, then pass the `LockContext`\n * to `.withLockContext()` on any encrypt/decrypt operation.\n *\n * @example\n * ```typescript\n * import { LockContext } from \"@cipherstash/stack/identity\"\n *\n * const lc = new LockContext()\n * const identified = await lc.identify(userJwt)\n *\n * if (identified.failure) throw new Error(identified.failure.message)\n *\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext(identified.data)\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.\n   *\n   * @example\n   * ```typescript\n   * const lc = new LockContext()\n   * const result = await lc.identify(userJwt)\n   * if (result.failure) {\n   *   console.error(\"Auth failed:\", result.failure.message)\n   * }\n   * ```\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the current CTS token and context for use with encryption operations.\n   *\n   * Must be called after {@link identify}. Returns the token/context pair that\n   * `.withLockContext()` expects.\n   *\n   * @returns A `Result` containing the CTS token and identity context, or an error\n   *   if {@link identify} has not been called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => {\n        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {\n          throw new Error(\n            'The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext().',\n          )\n        }\n\n        return {\n          context: this.context,\n          ctsToken: this.ctsToken,\n        }\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n"],"mappings":";;;;;;;AAGA,SAAsB,kBAAkB;AAiDjC,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,MAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,iBAA2E;AACzE,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,UAAU,QAAQ;AACzD,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,SAAS,KAAK;AAAA,UACd,UAAU,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/identity/index.ts"],"sourcesContent":["import { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\nimport { type Result, withResult } from '@byteslice/result'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken: CtsToken\n  context: Context\n}\n\n/**\n * Manages CipherStash lock contexts for row-level access control.\n *\n * A `LockContext` ties encryption/decryption operations to an authenticated\n * user identity via CTS (CipherStash Token Service). Call {@link identify}\n * with a user's JWT to obtain a CTS token, then pass the `LockContext`\n * to `.withLockContext()` on any encrypt/decrypt operation.\n *\n * @example\n * ```typescript\n * import { LockContext } from \"@cipherstash/stack/identity\"\n *\n * const lc = new LockContext()\n * const identified = await lc.identify(userJwt)\n *\n * if (identified.failure) throw new Error(identified.failure.message)\n *\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext(identified.data)\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.\n   *\n   * @example\n   * ```typescript\n   * const lc = new LockContext()\n   * const result = await lc.identify(userJwt)\n   * if (result.failure) {\n   *   console.error(\"Auth failed:\", result.failure.message)\n   * }\n   * ```\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the current CTS token and context for use with encryption operations.\n   *\n   * Must be called after {@link identify}. Returns the token/context pair that\n   * `.withLockContext()` expects.\n   *\n   * @returns A `Result` containing the CTS token and identity context, or an error\n   *   if {@link identify} has not been called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => {\n        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {\n          throw new Error(\n            'The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext().',\n          )\n        }\n\n        return {\n          context: this.context,\n          ctsToken: this.ctsToken,\n        }\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;AAGA,SAAsB,kBAAkB;AAiDjC,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,MAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,iBAA2E;AACzE,WAAO;AAAA,MACL,MAAM;AACJ,YAAI,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,UAAU,QAAQ;AACzD,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,SAAS,KAAK;AAAA,UACd,UAAU,KAAK;AAAA,QACjB;AAAA,MACF;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}