@cipherstash/stack 0.4.0 → 0.6.0

package/dist/index.d.cts

@@ -1,22 +1,24 @@
-import { E as EncryptionClient } from './client-CUGXheRq.cjs';
-import { E as EncryptionClientConfig } from './types-public-Wj6tB_ux.cjs';
-export { d as EncryptedColumn, h as EncryptedField, i as EncryptedFromSchema, f as EncryptedTable, g as EncryptedTableColumn, c as InferEncrypted, I as InferPlaintext, a as encryptedColumn, b as encryptedField, e as encryptedTable } from './types-public-Wj6tB_ux.cjs';
-export { C as ClientInitError, c as CtsTokenError, D as DecryptionOperationError, a as EncryptionError, E as EncryptionErrorTypes, b as EncryptionOperationError, L as LockContextError, S as StackError, g as getErrorMessage } from './index-9-Ya3fDK.cjs';
-import '@byteslice/result';
-import '@cipherstash/protect-ffi';
+import { E as Encrypted } from './types-public-07ilcGY-.cjs';
+export { e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-07ilcGY-.cjs';
+export { E as Encryption } from './client-CJueivkw.cjs';
+export { Secrets } from './secrets/index.cjs';
 import 'zod';
-import 'evlog';
-
-/** Initialize an Encryption client with the provided configuration.
-
-  @param config - The configuration object for initializing the Encryption client.
-
-  @see {@link EncryptionClientConfig} for details on the configuration options.
-
-  @returns A Promise that resolves to an instance of EncryptionClient.
+import '@cipherstash/protect-ffi';
+import './errors/index.cjs';
+import '@byteslice/result';
+import './identity/index.cjs';
 
-  @throws Will throw an error if no schemas are provided or if the keyset ID is not a valid UUID.
-*/
-declare const Encryption: (config: EncryptionClientConfig) => Promise<EncryptionClient>;
+type EncryptedPgComposite = {
+    data: Encrypted;
+};
+/**
+ * Helper function to transform an encrypted payload into a PostgreSQL composite type.
+ * Use this when inserting data via Supabase or similar clients.
+ */
+declare function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite;
+/**
+ * Helper function to check if a value is an encrypted payload
+ */
+declare function isEncryptedPayload(value: unknown): value is Encrypted;
 
-export { Encryption };
+export { Encrypted, encryptedToPgComposite, isEncryptedPayload };

package/dist/index.d.ts

@@ -1,22 +1,24 @@
-import { E as EncryptionClient } from './client-CrGQnSlk.js';
-import { E as EncryptionClientConfig } from './types-public-Wj6tB_ux.js';
-export { d as EncryptedColumn, h as EncryptedField, i as EncryptedFromSchema, f as EncryptedTable, g as EncryptedTableColumn, c as InferEncrypted, I as InferPlaintext, a as encryptedColumn, b as encryptedField, e as encryptedTable } from './types-public-Wj6tB_ux.js';
-export { C as ClientInitError, c as CtsTokenError, D as DecryptionOperationError, a as EncryptionError, E as EncryptionErrorTypes, b as EncryptionOperationError, L as LockContextError, S as StackError, g as getErrorMessage } from './index-9-Ya3fDK.js';
-import '@byteslice/result';
-import '@cipherstash/protect-ffi';
+import { E as Encrypted } from './types-public-07ilcGY-.js';
+export { e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-07ilcGY-.js';
+export { E as Encryption } from './client-hHEpZIZH.js';
+export { Secrets } from './secrets/index.js';
 import 'zod';
-import 'evlog';
-
-/** Initialize an Encryption client with the provided configuration.
-
-  @param config - The configuration object for initializing the Encryption client.
-
-  @see {@link EncryptionClientConfig} for details on the configuration options.
-
-  @returns A Promise that resolves to an instance of EncryptionClient.
+import '@cipherstash/protect-ffi';
+import './errors/index.js';
+import '@byteslice/result';
+import './identity/index.js';
 
-  @throws Will throw an error if no schemas are provided or if the keyset ID is not a valid UUID.
-*/
-declare const Encryption: (config: EncryptionClientConfig) => Promise<EncryptionClient>;
+type EncryptedPgComposite = {
+    data: Encrypted;
+};
+/**
+ * Helper function to transform an encrypted payload into a PostgreSQL composite type.
+ * Use this when inserting data via Supabase or similar clients.
+ */
+declare function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite;
+/**
+ * Helper function to check if a value is an encrypted payload
+ */
+declare function isEncryptedPayload(value: unknown): value is Encrypted;
 
-export { Encryption };
+export { Encrypted, encryptedToPgComposite, isEncryptedPayload };

package/dist/index.js

@@ -1,23 +1,29 @@
+import {
+  Secrets
+} from "./chunk-YLISU7FD.js";
 import {
   Encryption
-} from "./chunk-WUZGKTMG.js";
-import "./chunk-4RNBI3UH.js";
-import "./chunk-KOU2MHXJ.js";
+} from "./chunk-TGUELLJS.js";
 import {
-  EncryptionErrorTypes,
-  getErrorMessage
-} from "./chunk-OAPLZLR5.js";
+  encryptedToPgComposite,
+  isEncryptedPayload
+} from "./chunk-4RNBI3UH.js";
 import {
   encryptedColumn,
   encryptedField,
   encryptedTable
 } from "./chunk-Y35W4WFN.js";
+import "./chunk-HCL75LXQ.js";
+import "./chunk-GXGEW6T4.js";
+import "./chunk-Q5FTQLYG.js";
+import "./chunk-LBMC4D6D.js";
 export {
   Encryption,
-  EncryptionErrorTypes,
+  Secrets,
   encryptedColumn,
   encryptedField,
   encryptedTable,
-  getErrorMessage
+  encryptedToPgComposite,
+  isEncryptedPayload
 };
 //# sourceMappingURL=index.js.map

package/dist/schema/index.d.cts

@@ -1,4 +1,3 @@
-export { C as CastAs, x as ColumnSchema, t as EncryptConfig, d as EncryptedColumn, h as EncryptedField, f as EncryptedTable, g as EncryptedTableColumn, c as InferEncrypted, I as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, w as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, y as buildEncryptConfig, u as castAsEnum, v as encryptConfigSchema, a as encryptedColumn, b as encryptedField, e as encryptedTable } from '../types-public-Wj6tB_ux.cjs';
+export { C as CastAs, u as ColumnSchema, q as EncryptConfig, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, v as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, w as buildEncryptConfig, x as castAsEnum, y as encryptConfigSchema, e as encryptedColumn, a as encryptedField, b as encryptedTable } from '../types-public-07ilcGY-.cjs';
 import 'zod';
-import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/schema/index.d.ts

@@ -1,4 +1,3 @@
-export { C as CastAs, x as ColumnSchema, t as EncryptConfig, d as EncryptedColumn, h as EncryptedField, f as EncryptedTable, g as EncryptedTableColumn, c as InferEncrypted, I as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, w as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, y as buildEncryptConfig, u as castAsEnum, v as encryptConfigSchema, a as encryptedColumn, b as encryptedField, e as encryptedTable } from '../types-public-Wj6tB_ux.js';
+export { C as CastAs, u as ColumnSchema, q as EncryptConfig, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, v as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, w as buildEncryptConfig, x as castAsEnum, y as encryptConfigSchema, e as encryptedColumn, a as encryptedField, b as encryptedTable } from '../types-public-07ilcGY-.js';
 import 'zod';
-import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/secrets/index.cjs

@@ -72,15 +72,6 @@ function isEncryptedPayload(value) {
   return true;
 }
 
-// src/errors/index.ts
-var EncryptionErrorTypes = {
-  ClientInitError: "ClientInitError",
-  EncryptionError: "EncryptionError",
-  DecryptionError: "DecryptionError",
-  LockContextError: "LockContextError",
-  CtsTokenError: "CtsTokenError"
-};
-
 // src/schema/index.ts
 var import_zod = require("zod");
 var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
@@ -405,6 +396,15 @@ function buildEncryptConfig(...protectTables) {
   return config;
 }
 
+// src/errors/index.ts
+var EncryptionErrorTypes = {
+  ClientInitError: "ClientInitError",
+  EncryptionError: "EncryptionError",
+  DecryptionError: "DecryptionError",
+  LockContextError: "LockContextError",
+  CtsTokenError: "CtsTokenError"
+};
+
 // src/utils/config/index.ts
 var import_node_fs = __toESM(require("fs"), 1);
 var import_node_path = __toESM(require("path"), 1);
@@ -470,25 +470,33 @@ function loadWorkSpaceId(suppliedCrn) {
 
 // src/utils/logger/index.ts
 var import_evlog = require("evlog");
-function samplingFromEnv() {
-  const env = process.env.STASH_LOG_LEVEL;
-  if (!env) return void 0;
-  const levels = ["debug", "info", "warn", "error"];
-  const idx = levels.indexOf(env);
-  if (idx === -1) return void 0;
-  return Object.fromEntries(levels.map((l, i) => [l, i >= idx ? 100 : 0]));
+var validLevels = ["debug", "info", "error"];
+function levelFromEnv() {
+  const env = process.env.STASH_STACK_LOG;
+  if (env && validLevels.includes(env)) return env;
+  return "error";
+}
+function samplingRatesForLevel(level) {
+  switch (level) {
+    case "debug":
+      return { debug: 100, info: 100, warn: 100, error: 100 };
+    case "info":
+      return { debug: 0, info: 100, warn: 100, error: 100 };
+    case "error":
+    default:
+      return { debug: 0, info: 0, warn: 0, error: 100 };
+  }
 }
 var initialized = false;
-function initStackLogger(config) {
+function initStackLogger() {
   if (initialized) return;
   initialized = true;
-  const rates = samplingFromEnv();
+  const level = levelFromEnv();
+  const rates = samplingRatesForLevel(level);
   (0, import_evlog.initLogger)({
     env: { service: "@cipherstash/stack" },
-    enabled: config?.enabled ?? !!rates,
-    pretty: config?.pretty,
-    ...rates && { sampling: { rates } },
-    ...config?.drain && { drain: config.drain }
+    enabled: true,
+    sampling: { rates }
   });
 }
 initStackLogger();
@@ -526,6 +534,7 @@ var logger = {
 // src/encryption/index.ts
 var import_result11 = require("@byteslice/result");
 var import_protect_ffi9 = require("@cipherstash/protect-ffi");
+var import_uuid = require("uuid");
 
 // src/encryption/helpers/type-guards.ts
 function isScalarQueryTermArray(value) {
@@ -2801,23 +2810,14 @@ var EncryptionClient = class {
     };
   }
 };
-
-// src/index.ts
-function isValidUuid(uuid) {
-  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  return uuidRegex.test(uuid);
-}
 var Encryption = async (config) => {
-  if (config.logging) {
-    initStackLogger(config.logging);
-  }
   const { schemas, config: clientConfig } = config;
   if (!schemas.length) {
     throw new Error(
       "[encryption]: At least one encryptedTable must be provided to initialize the encryption client"
     );
   }
-  if (clientConfig?.keyset && "id" in clientConfig.keyset && !isValidUuid(clientConfig.keyset.id)) {
+  if (clientConfig?.keyset && "id" in clientConfig.keyset && !(0, import_uuid.validate)(clientConfig.keyset.id)) {
     throw new Error(
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
@@ -2843,7 +2843,22 @@ var Secrets = class {
     value: encryptedColumn("value")
   });
   constructor(config) {
-    this.config = config;
+    const workspaceCRN = config.workspaceCRN ?? process.env.CS_WORKSPACE_CRN;
+    const clientId = config.clientId ?? process.env.CS_CLIENT_ID;
+    const clientKey = config.clientKey ?? process.env.CS_CLIENT_KEY;
+    const accessKey = config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY;
+    if (!workspaceCRN || !clientId || !clientKey || !accessKey) {
+      throw new Error(
+        "Missing required configuration or environment variables."
+      );
+    }
+    this.config = {
+      environment: config.environment,
+      workspaceCRN,
+      clientId,
+      clientKey,
+      accessKey
+    };
   }
   initPromise = null;
   /**
@@ -2856,24 +2871,24 @@ var Secrets = class {
     return this.initPromise;
   }
   async _doInit() {
+    logger.debug("Initializing the Secrets client.");
     this.encryptionClient = await Encryption({
       schemas: [this.secretsSchema],
       config: {
         workspaceCrn: this.config.workspaceCRN,
         clientId: this.config.clientId,
         clientKey: this.config.clientKey,
-        accessKey: this.config.apiKey,
-        keyset: {
-          name: this.config.environment
-        }
+        accessKey: this.config.accessKey,
+        keyset: { name: this.config.environment }
       }
     });
+    logger.debug("Successfully initialized the Secrets client.");
   }
   /**
    * Get the authorization header for API requests
    */
   getAuthHeader() {
-    return `Bearer ${this.config.apiKey}`;
+    return `Bearer ${this.config.accessKey}`;
   }
   /**
    * Make an API request with error handling.
@@ -2888,6 +2903,7 @@ var Secrets = class {
         const searchParams = new URLSearchParams(options.params);
         url = `${url}?${searchParams.toString()}`;
       }
+      logger.debug(`Secrets API request: ${method} ${path2}`);
       const headers = {
         "Content-Type": "application/json",
         Authorization: this.getAuthHeader()
@@ -2906,6 +2922,7 @@ var Secrets = class {
         } catch {
           errorMessage = errorText || errorMessage;
         }
+        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
         return {
           failure: {
             type: "ApiError",
@@ -2913,13 +2930,16 @@ var Secrets = class {
           }
         };
       }
+      logger.debug(`Secrets API request successful: ${method} ${path2}`);
       const data = await response.json();
       return { data };
     } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown network error occurred";
+      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
       return {
         failure: {
           type: "NetworkError",
-          message: error instanceof Error ? error.message : "Unknown network error occurred"
+          message
         }
       };
     }
@@ -2935,6 +2955,7 @@ var Secrets = class {
    * @returns A Result containing the API response or an error
    */
   async set(name, value) {
+    logger.debug("Setting secret");
     await this.ensureInitialized();
     if (!this.encryptionClient) {
       return {
@@ -2949,6 +2970,7 @@ var Secrets = class {
       table: this.secretsSchema
     });
     if (encryptResult.failure) {
+      logger.error("Failed to encrypt secret");
       return {
         failure: {
           type: "EncryptionError",
@@ -2976,6 +2998,7 @@ var Secrets = class {
    * @returns A Result containing the decrypted value or an error
    */
   async get(name) {
+    logger.debug("Getting secret");
     await this.ensureInitialized();
     if (!this.encryptionClient) {
       return {
@@ -3000,6 +3023,7 @@ var Secrets = class {
       apiResult.data.encryptedValue.data
     );
     if (decryptResult.failure) {
+      logger.error("Failed to decrypt secret");
       return {
         failure: {
           type: "DecryptionError",
@@ -3008,6 +3032,7 @@ var Secrets = class {
       };
     }
     if (typeof decryptResult.data !== "string") {
+      logger.error("Decrypted secret value is not a string");
       return {
         failure: {
           type: "DecryptionError",
@@ -3032,6 +3057,7 @@ var Secrets = class {
    * @returns A Result containing an object mapping secret names to their decrypted values
    */
   async getMany(names) {
+    logger.debug(`Getting ${names.length} secrets.`);
     await this.ensureInitialized();
     if (!this.encryptionClient) {
       return {
@@ -3078,6 +3104,9 @@ var Secrets = class {
     }));
     const decryptResult = await this.encryptionClient.bulkDecryptModels(dataToDecrypt);
     if (decryptResult.failure) {
+      logger.error(
+        `Failed to decrypt secrets: ${decryptResult.failure.message}`
+      );
       return {
         failure: {
           type: "DecryptionError",
@@ -3103,6 +3132,7 @@ var Secrets = class {
    * @returns A Result containing the list of secrets or an error
    */
   async list() {
+    logger.debug("Listing secrets.");
     const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
     const apiResult = await this.apiRequest(
       "GET",
@@ -3128,6 +3158,7 @@ var Secrets = class {
    * @returns A Result containing the API response or an error
    */
   async delete(name) {
+    logger.debug("Deleting secret");
     const workspaceId = extractWorkspaceIdFromCrn(this.config.workspaceCRN);
     return await this.apiRequest("POST", "/delete", {
       body: {