@cipherstash/stack 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @cipherstash/stack
 
+## 0.11.0
+
+### Minor Changes
+
+- b0e56b8: Upgrade protect-ffi to 0.21.0 and enable array_index_mode for searchable JSON
+
+  - Upgrade `@cipherstash/protect-ffi` to 0.21.0 across all packages
+  - Enable `array_index_mode: 'all'` on STE vec indexes so JSON array operations
+    (jsonb_array_elements, jsonb_array_length, array containment) work correctly
+  - Delegate credential resolution entirely to protect-ffi's `withEnvCredentials`
+  - Download latest EQL at build/runtime instead of bundling hardcoded SQL files
+
+## 0.10.0
+
+### Minor Changes
+
+- 5245cd7: Improved CLI setup and initialization commands.
+
 ## 0.9.0
 
 ### Minor Changes

package/dist/bin/stash.js

@@ -104,8 +104,8 @@ var require_package = __commonJS({
 var require_main = __commonJS({
   "../../node_modules/.pnpm/dotenv@16.4.7/node_modules/dotenv/lib/main.js"(exports, module) {
     "use strict";
-    var fs2 = __require("fs");
-    var path2 = __require("path");
+    var fs = __require("fs");
+    var path = __require("path");
     var os = __require("os");
     var crypto = __require("crypto");
     var packageJson = require_package();
@@ -211,7 +211,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs2.existsSync(filepath)) {
+            if (fs.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -219,15 +219,15 @@ var require_main = __commonJS({
           possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
         }
       } else {
-        possibleVaultPath = path2.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
       }
-      if (fs2.existsSync(possibleVaultPath)) {
+      if (fs.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path2.join(os.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       _log("Loading env from encrypted .env.vault");
@@ -240,7 +240,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options) {
-      const dotenvPath = path2.resolve(process.cwd(), ".env");
+      const dotenvPath = path.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options && options.debug);
       if (options && options.encoding) {
@@ -263,13 +263,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path3 of optionPaths) {
+      for (const path2 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs2.readFileSync(path3, { encoding }));
+          const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e2) {
           if (debug) {
-            _debug(`Failed to load ${path3} ${e2.message}`);
+            _debug(`Failed to load ${path2} ${e2.message}`);
           }
           lastError = e2;
         }
@@ -1295,6 +1295,18 @@ function detectPackageManager() {
   if (existsSync(resolve(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
+function prodInstallCommand(pm, packageName) {
+  switch (pm) {
+    case "bun":
+      return `bun add ${packageName}`;
+    case "pnpm":
+      return `pnpm add ${packageName}`;
+    case "yarn":
+      return `yarn add ${packageName}`;
+    case "npm":
+      return `npm install ${packageName}`;
+  }
+}
 function devInstallCommand(pm, packageName) {
   switch (pm) {
     case "bun":
@@ -1568,44 +1580,50 @@ var buildSchemaStep = {
 
 // src/bin/commands/init/steps/install-forge.ts
 import { execSync } from "node:child_process";
+var STACK_PACKAGE = "@cipherstash/stack";
 var FORGE_PACKAGE = "@cipherstash/stack-forge";
+async function installIfNeeded(packageName, buildCommand, depLabel) {
+  if (isPackageInstalled(packageName)) {
+    M2.success(`${packageName} is already installed.`);
+    return true;
+  }
+  const pm = detectPackageManager();
+  const cmd = buildCommand(pm, packageName);
+  const install = await ye({
+    message: `Install ${packageName} as a ${depLabel} dependency? (${cmd})`
+  });
+  if (pD(install)) throw new CancelledError();
+  if (!install) {
+    M2.info(`Skipping ${packageName} installation.`);
+    Me(
+      `You can install it manually later:
+  ${cmd}`,
+      "Manual Installation"
+    );
+    return false;
+  }
+  const s = Y2();
+  s.start(`Installing ${packageName}...`);
+  try {
+    execSync(cmd, { cwd: process.cwd(), stdio: "pipe" });
+    s.stop(`${packageName} installed successfully`);
+    return true;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    s.stop(`${packageName} installation failed`);
+    M2.error(message);
+    Me(`You can install it manually:
+  ${cmd}`, "Manual Installation");
+    return false;
+  }
+}
 var installForgeStep = {
   id: "install-forge",
-  name: "Install stack-forge",
+  name: "Install stack dependencies",
   async run(state, _provider) {
-    if (isPackageInstalled(FORGE_PACKAGE)) {
-      M2.success(`${FORGE_PACKAGE} is already installed.`);
-      return { ...state, forgeInstalled: true };
-    }
-    const pm = detectPackageManager();
-    const cmd = devInstallCommand(pm, FORGE_PACKAGE);
-    const install = await ye({
-      message: `Install ${FORGE_PACKAGE} as a dev dependency? (${cmd})`
-    });
-    if (pD(install)) throw new CancelledError();
-    if (!install) {
-      M2.info(`Skipping ${FORGE_PACKAGE} installation.`);
-      Me(
-        `You can install it manually later:
-  ${cmd}`,
-        "Manual Installation"
-      );
-      return { ...state, forgeInstalled: false };
-    }
-    const s = Y2();
-    s.start(`Installing ${FORGE_PACKAGE}...`);
-    try {
-      execSync(cmd, { cwd: process.cwd(), stdio: "pipe" });
-      s.stop(`${FORGE_PACKAGE} installed successfully`);
-      return { ...state, forgeInstalled: true };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      s.stop(`${FORGE_PACKAGE} installation failed`);
-      M2.error(message);
-      Me(`You can install it manually:
-  ${cmd}`, "Manual Installation");
-      return { ...state, forgeInstalled: false };
-    }
+    const stackInstalled = await installIfNeeded(STACK_PACKAGE, prodInstallCommand, "production");
+    const forgeInstalled = await installIfNeeded(FORGE_PACKAGE, devInstallCommand, "dev");
+    return { ...state, forgeInstalled, stackInstalled };
   }
 };
 
@@ -1750,8 +1768,18 @@ var matchIndexOptsSchema = z2.object({
   m: z2.number().default(2048).optional(),
   include_original: z2.boolean().default(false).optional()
 });
+var arrayIndexModeSchema = z2.union([
+  z2.literal("all"),
+  z2.literal("none"),
+  z2.object({
+    item: z2.boolean().optional(),
+    wildcard: z2.boolean().optional(),
+    position: z2.boolean().optional()
+  })
+]);
 var steVecIndexOptsSchema = z2.object({
-  prefix: z2.string()
+  prefix: z2.string(),
+  array_index_mode: arrayIndexModeSchema.optional()
 });
 var indexesSchema = z2.object({
   ore: oreIndexOptsSchema.optional(),
@@ -1948,7 +1976,7 @@ var EncryptedColumn = class {
    */
   searchableJson() {
     this.castAsValue = "json";
-    this.indexesValue.ste_vec = { prefix: "enabled" };
+    this.indexesValue.ste_vec = { prefix: "enabled", array_index_mode: "all" };
     return this;
   }
   build() {
@@ -1996,6 +2024,7 @@ var EncryptedTable = class {
             indexes: {
               ...builtColumn.indexes,
               ste_vec: {
+                ...builtColumn.indexes.ste_vec,
                 prefix: `${this.tableName}/${colName}`
               }
             }
@@ -2057,69 +2086,6 @@ var EncryptionErrorTypes = {
   CtsTokenError: "CtsTokenError"
 };
 
-// src/utils/config/index.ts
-import fs from "node:fs";
-import path from "node:path";
-function getWorkspaceCrn(tomlString) {
-  let currentSection = "";
-  let workspaceCrn;
-  const lines = tomlString.split(/\r?\n/);
-  for (const line of lines) {
-    const trimmedLine = line.trim();
-    if (!trimmedLine || trimmedLine.startsWith("#")) {
-      continue;
-    }
-    const sectionMatch = trimmedLine.match(/^\[([^\]]+)\]$/);
-    if (sectionMatch) {
-      currentSection = sectionMatch[1];
-      continue;
-    }
-    const kvMatch = trimmedLine.match(/^(\w+)\s*=\s*"([^"]+)"$/);
-    if (kvMatch) {
-      const [_3, key, value] = kvMatch;
-      if (currentSection === "auth" && key === "workspace_crn") {
-        workspaceCrn = value;
-        break;
-      }
-    }
-  }
-  return workspaceCrn;
-}
-function extractWorkspaceIdFromCrn(crn) {
-  const match = crn.match(/crn:[^:]+:([^:]+)$/);
-  if (!match) {
-    throw new Error("Invalid CRN format");
-  }
-  return match[1];
-}
-function loadWorkSpaceId(suppliedCrn) {
-  const configPath = path.join(process.cwd(), "cipherstash.toml");
-  if (suppliedCrn) {
-    return extractWorkspaceIdFromCrn(suppliedCrn);
-  }
-  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  if (process.env.CS_WORKSPACE_CRN) {
-    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN);
-  }
-  if (!fs.existsSync(configPath)) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  const tomlString = fs.readFileSync(configPath, "utf8");
-  const workspaceCrn = getWorkspaceCrn(tomlString);
-  if (!workspaceCrn) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  return extractWorkspaceIdFromCrn(workspaceCrn);
-}
-
 // src/utils/logger/index.ts
 import { createRequestLogger, initLogger } from "evlog";
 var validLevels = ["debug", "info", "error"];
@@ -2613,11 +2579,11 @@ import {
   decryptBulk,
   encryptBulk
 } from "@cipherstash/protect-ffi";
-function setNestedValue(obj, path2, value) {
+function setNestedValue(obj, path, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
   let current = obj;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const part = path2[i];
+  for (let i = 0; i < path.length - 1; i++) {
+    const part = path[i];
     if (FORBIDDEN_KEYS.includes(part)) {
       throw new Error(`[encryption]: Forbidden key "${part}" in field path`);
     }
@@ -2626,7 +2592,7 @@ function setNestedValue(obj, path2, value) {
     }
     current = current[part];
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path[path.length - 1];
   if (FORBIDDEN_KEYS.includes(lastKey)) {
     throw new Error(`[encryption]: Forbidden key "${lastKey}" in field path`);
   }
@@ -2703,7 +2669,7 @@ function prepareFieldsForEncryption(model, table) {
         continue;
       }
       if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths2.includes(fullKey)) {
-        if (columnPaths2.some((path2) => path2.startsWith(fullKey))) {
+        if (columnPaths2.some((path) => path.startsWith(fullKey))) {
           processNestedFields(
             value,
             fullKey,
@@ -2881,7 +2847,7 @@ function prepareBulkModelsForOperation(models, table) {
           continue;
         }
         if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths.includes(fullKey)) {
-          if (columnPaths.some((path2) => path2.startsWith(fullKey))) {
+          if (columnPaths.some((path) => path.startsWith(fullKey))) {
             processNestedFields(
               value,
               fullKey,
@@ -4056,11 +4022,6 @@ var noClientError = () => new Error(
 var EncryptionClient = class {
   client;
   encryptConfig;
-  workspaceId;
-  constructor(workspaceCrn) {
-    const workspaceId = loadWorkSpaceId(workspaceCrn);
-    this.workspaceId = workspaceId;
-  }
   /**
    * Initializes the EncryptionClient with the provided configuration.
    * @internal
@@ -4082,10 +4043,10 @@ var EncryptionClient = class {
         this.client = await newClient({
           encryptConfig: validated,
           clientOpts: {
-            workspaceCrn: config3.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
-            accessKey: config3.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
-            clientId: config3.clientId ?? process.env.CS_CLIENT_ID,
-            clientKey: config3.clientKey ?? process.env.CS_CLIENT_KEY,
+            workspaceCrn: config3.workspaceCrn,
+            accessKey: config3.accessKey,
+            clientId: config3.clientId,
+            clientKey: config3.clientKey,
             keyset: toFfiKeysetIdentifier(config3.keyset)
           }
         });
@@ -4470,12 +4431,6 @@ var EncryptionClient = class {
   bulkDecrypt(encryptedPayloads) {
     return new BulkDecryptOperation(this.client, encryptedPayloads);
   }
-  /** e.g., debugging or environment info */
-  clientInfo() {
-    return {
-      workspaceId: this.workspaceId
-    };
-  }
   /**
    * Get the encrypt config object.
    *
@@ -4497,7 +4452,7 @@ var Encryption = async (config3) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
-  const client = new EncryptionClient(clientConfig?.workspaceCrn);
+  const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
   const result = await client.init({
     encryptConfig,
@@ -4509,6 +4464,15 @@ var Encryption = async (config3) => {
   return result.data;
 };
 
+// src/utils/config/index.ts
+function extractWorkspaceIdFromCrn(crn) {
+  const match = crn.match(/crn:[^:]+:([^:]+)$/);
+  if (!match) {
+    throw new Error("Invalid CRN format");
+  }
+  return match[1];
+}
+
 // src/secrets/index.ts
 var Secrets = class {
   encryptionClient = null;
@@ -4571,14 +4535,14 @@ var Secrets = class {
    * For GET requests, `params` are appended as URL query parameters.
    * For POST requests, `body` is sent as JSON in the request body.
    */
-  async apiRequest(method, path2, options) {
+  async apiRequest(method, path, options) {
     try {
-      let url = `${this.apiBaseUrl}${path2}`;
+      let url = `${this.apiBaseUrl}${path}`;
       if (options?.params) {
         const searchParams = new URLSearchParams(options.params);
         url = `${url}?${searchParams.toString()}`;
       }
-      logger.debug(`Secrets API request: ${method} ${path2}`);
+      logger.debug(`Secrets API request: ${method} ${path}`);
       const headers = {
         "Content-Type": "application/json",
         Authorization: this.getAuthHeader()
@@ -4597,7 +4561,7 @@ var Secrets = class {
         } catch {
           errorMessage = errorText || errorMessage;
         }
-        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
+        logger.error(`Secrets API error on ${method} ${path}: ${errorMessage}`);
         return {
           failure: {
             type: "ApiError",
@@ -4605,12 +4569,12 @@ var Secrets = class {
           }
         };
       }
-      logger.debug(`Secrets API request successful: ${method} ${path2}`);
+      logger.debug(`Secrets API request successful: ${method} ${path}`);
       const data = await response.json();
       return { data };
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown network error occurred";
-      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
+      logger.error(`Secrets network error on ${method} ${path}: ${message}`);
       return {
         failure: {
           type: "NetworkError",