@delma/fylo 2.1.0 → 2.1.1

package/README.md

@@ -94,6 +94,33 @@ For compatibility with older `s3-files` experiments, FYLO still accepts `s3Files
 | `SCHEMA_DIR`        | Directory containing JSON validation schemas                     |
 | `STRICT`            | When truthy, validate documents with `@delma/chex` before writes |
 | `ENCRYPTION_KEY`    | Required when schemas declare `$encrypted` fields                |
+| `CIPHER_SALT`       | Recommended unique salt for field encryption key derivation      |
+
+## Security-sensitive behavior
+
+### Encrypted fields
+
+Schemas can declare encrypted fields with a `$encrypted` array. When a collection schema declares encrypted fields, FYLO fails closed unless `ENCRYPTION_KEY` is set and at least 32 characters long.
+
+Encrypted document values are stored with AES-GCM. Exact-match queries on encrypted fields use keyed HMAC blind indexes, so equality and frequency can still be inferred from index tokens, but plaintext field values are not written to document files, index files, or event journals.
+
+If you are upgrading encrypted collections from a version before `2.1.1`, rewrite encrypted documents or otherwise rebuild affected indexes before relying on `$eq` queries for encrypted fields. Older encrypted document bodies can still be read, but old deterministic encrypted index entries do not match the new HMAC blind-index format.
+
+### Bulk imports
+
+`importBulkData()` is intended for trusted JSON or JSONL sources. By default, HTTP(S) imports reject localhost, private, loopback, link-local, and other private-network addresses, and responses are capped at 50 MiB.
+
+You can tighten the import boundary with explicit options:
+
+```ts
+await fylo.importBulkData('users', new URL('https://data.example.com/users.json'), {
+    limit: 1000,
+    maxBytes: 5 * 1024 * 1024,
+    allowedHosts: ['data.example.com']
+})
+```
+
+Only set `allowPrivateNetwork: true` when the import URL is fully trusted by your application.
 
 ## Syncing to S3-compatible storage
 

package/dist/adapters/cipher.js

@@ -0,0 +1,155 @@
+/**
+ * AES-256-GCM encryption adapter for field-level value encryption.
+ *
+ * Two modes are supported via the `deterministic` flag on `encrypt()`:
+ *
+ * - **Random IV (default)**: A cryptographically random IV is generated per
+ *   encryption operation. Identical plaintexts produce different ciphertexts.
+ *   Use this for fields that do not need exact-match ($eq/$ne) queries.
+ *
+ * Exact-match queries use a separate keyed HMAC blind index. This leaks equality
+ * and frequency for indexed values, but stored document bodies use random nonces.
+ *
+ * Encrypted fields are declared per-collection in JSON schema files via the
+ * `$encrypted` array. The encryption key is sourced from `ENCRYPTION_KEY` env var.
+ * Set `CIPHER_SALT` to a unique random value to prevent cross-deployment attacks.
+ */
+export class Cipher {
+    static key = null;
+    static legacyCbcKey = null;
+    static hmacKey = null;
+    /** Per-collection encrypted field sets, loaded from schema `$encrypted` arrays. */
+    static collections = new Map();
+    static isConfigured() {
+        return Cipher.key !== null;
+    }
+    static hasEncryptedFields(collection) {
+        const fields = Cipher.collections.get(collection);
+        return !!fields && fields.size > 0;
+    }
+    static isEncryptedField(collection, field) {
+        const fields = Cipher.collections.get(collection);
+        if (!fields || fields.size === 0)
+            return false;
+        for (const pattern of fields) {
+            if (field === pattern)
+                return true;
+            // Support nested: encrypting "address" encrypts "address/city" etc.
+            if (field.startsWith(`${pattern}/`))
+                return true;
+        }
+        return false;
+    }
+    /**
+     * Registers encrypted fields for a collection (from schema `$encrypted` array).
+     */
+    static registerFields(collection, fields) {
+        if (fields.length > 0) {
+            Cipher.collections.set(collection, new Set(fields));
+        }
+    }
+    /**
+     * Derives AES + HMAC keys from a secret string. Called once at startup.
+     */
+    static async configure(secret) {
+        const encoder = new TextEncoder();
+        const keyMaterial = await crypto.subtle.importKey('raw', encoder.encode(secret), 'PBKDF2', false, ['deriveBits']);
+        const cipherSalt = process.env.CIPHER_SALT;
+        if (!cipherSalt) {
+            console.warn('CIPHER_SALT is not set. Using default salt is insecure for multi-deployment use. Set CIPHER_SALT to a unique random value.');
+        }
+        // Derive 64 bytes: 32 for AES-GCM key + 32 for HMAC blind indexes.
+        const bits = await crypto.subtle.deriveBits({
+            name: 'PBKDF2',
+            salt: encoder.encode(cipherSalt ?? 'fylo-cipher'),
+            iterations: 100000,
+            hash: 'SHA-256'
+        }, keyMaterial, 512);
+        const derived = new Uint8Array(bits);
+        const key = await crypto.subtle.importKey('raw', derived.slice(0, 32), { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+        const legacyCbcKey = await crypto.subtle.importKey('raw', derived.slice(0, 32), { name: 'AES-CBC' }, false, ['decrypt']);
+        const hmacKey = await crypto.subtle.importKey('raw', derived.slice(32, 64), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        Cipher.key = key;
+        Cipher.legacyCbcKey = legacyCbcKey;
+        Cipher.hmacKey = hmacKey;
+    }
+    static reset() {
+        Cipher.key = null;
+        Cipher.legacyCbcKey = null;
+        Cipher.hmacKey = null;
+        Cipher.collections = new Map();
+    }
+    /**
+     * Deterministic nonce from HMAC-SHA256 of plaintext, truncated to 12 bytes.
+     */
+    static async deriveNonce(plaintext) {
+        const encoder = new TextEncoder();
+        const sig = await crypto.subtle.sign('HMAC', Cipher.hmacKey, encoder.encode(plaintext));
+        return new Uint8Array(sig).slice(0, 12);
+    }
+    static base64Url(bytes) {
+        let binary = '';
+        for (let i = 0; i < bytes.length; i += 0x8000) {
+            binary += String.fromCharCode(...bytes.slice(i, i + 0x8000));
+        }
+        return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    }
+    static fromBase64Url(encoded) {
+        const b64 = encoded.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+        return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+    }
+    /**
+     * Produces a keyed lookup token for encrypted exact-match indexes.
+     */
+    static async blindIndex(value) {
+        if (!Cipher.hmacKey)
+            throw new Error('Cipher not configured — set ENCRYPTION_KEY env var');
+        const sig = await crypto.subtle.sign('HMAC', Cipher.hmacKey, new TextEncoder().encode(value));
+        return `idx1.${Cipher.base64Url(new Uint8Array(sig))}`;
+    }
+    /**
+     * Encrypts a value. Returns a URL-safe base64 string (no slashes).
+     *
+     * @param value - The plaintext to encrypt.
+     * @param deterministic - Compatibility mode for legacy deterministic callers.
+     *   Prefer `blindIndex()` for query indexes and random nonces for stored data.
+     */
+    static async encrypt(value, deterministic = false) {
+        if (!Cipher.key)
+            throw new Error('Cipher not configured — set ENCRYPTION_KEY env var');
+        const nonce = deterministic
+            ? await Cipher.deriveNonce(value)
+            : crypto.getRandomValues(new Uint8Array(12));
+        const encoder = new TextEncoder();
+        const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, Cipher.key, encoder.encode(value));
+        const combined = new Uint8Array(nonce.length + encrypted.byteLength);
+        combined.set(nonce);
+        combined.set(new Uint8Array(encrypted), nonce.length);
+        return `v2.${Cipher.base64Url(combined)}`;
+    }
+    /**
+     * Decrypts a URL-safe base64 encoded value back to plaintext.
+     */
+    static async decrypt(encoded) {
+        if (!Cipher.key)
+            throw new Error('Cipher not configured — set ENCRYPTION_KEY env var');
+        if (!encoded.startsWith('v2.'))
+            return await Cipher.decryptLegacyCbc(encoded);
+        const combined = Cipher.fromBase64Url(encoded.slice(3));
+        const nonce = combined.slice(0, 12);
+        const ciphertext = combined.slice(12);
+        const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, Cipher.key, ciphertext);
+        return new TextDecoder().decode(decrypted);
+    }
+    static async decryptLegacyCbc(encoded) {
+        if (!Cipher.legacyCbcKey)
+            throw new Error('Cipher not configured — set ENCRYPTION_KEY env var');
+        const combined = Cipher.fromBase64Url(encoded);
+        const iv = combined.slice(0, 16);
+        const ciphertext = combined.slice(16);
+        const decrypted = await crypto.subtle.decrypt({ name: 'AES-CBC', iv }, Cipher.legacyCbcKey, ciphertext);
+        return new TextDecoder().decode(decrypted);
+    }
+}
+//# sourceMappingURL=cipher.js.map

package/dist/adapters/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/adapters/cipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,OAAO,MAAM;IACP,MAAM,CAAC,GAAG,GAAqB,IAAI,CAAA;IACnC,MAAM,CAAC,YAAY,GAAqB,IAAI,CAAA;IAC5C,MAAM,CAAC,OAAO,GAAqB,IAAI,CAAA;IAE/C,mFAAmF;IAC3E,MAAM,CAAC,WAAW,GAA6B,IAAI,GAAG,EAAE,CAAA;IAEhE,MAAM,CAAC,YAAY;QACf,OAAO,MAAM,CAAC,GAAG,KAAK,IAAI,CAAA;IAC9B,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACjD,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;IACtC,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,UAAkB,EAAE,KAAa;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAE9C,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAA;YAClC,oEAAoE;YACpE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;QACpD,CAAC;QAED,OAAO,KAAK,CAAA;IAChB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,UAAkB,EAAE,MAAgB;QACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACvD,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAc;QACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACjB,CAAA;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CACR,4HAA4H,CAC/H,CAAA;QACL,CAAC;QAED,mEAAmE;QACnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACvC;YACI,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,aAAa,CAAC;YACjD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,SAAS;SAClB,EACD,WAAW,EACX,GAAG,CACN,CAAA;QAED,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;QAEpC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC9C,KAAK,EACL,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACd,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACzC,KAAK,EACL,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EACrB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACX,CAAA;QAED,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;QAChB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAA;QAClC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IAC5B,CAAC;IAED,MAAM,CAAC,KAAK;QACR,MAAM,CAAC,GAAG,GAAG,IAAI,CAAA;QACjB,MAAM,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;QACrB,MAAM,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,SAAiB;QAC9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3C,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,KAAiB;QACtC,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAClF,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,OAAe;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3D,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAChE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAa;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAE1F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAChC,MAAM,EACN,MAAM,CAAC,OAAO,EACd,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAClC,CAAA;QACD,OAAO,QAAQ,MAAM,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,aAAa,GAAG,KAAK;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAEtF,MAAM,KAAK,GAAG,aAAa;YACvB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;QAEjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAY,EAAE,EACrC,MAAM,CAAC,GAAG,EACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CACxB,CAAA;QAED,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACpE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAErD,OAAO,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAe;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAEtF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAC9B,MAAM,CAAC,GAAG,EACV,UAAU,CACb,CAAA;QAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACjD,IAAI,CAAC,MAAM,CAAC,YAAY;YACpB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAEzE,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,MAAM,CAAC,YAAY,EACnB,UAAU,CACb,CAAA;QAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC"}

package/dist/core/collection.js

@@ -0,0 +1,6 @@
+export function validateCollectionName(collection) {
+    if (!/^[a-z0-9][a-z0-9\-]*[a-z0-9]$/.test(collection)) {
+        throw new Error('Invalid collection name');
+    }
+}
+//# sourceMappingURL=collection.js.map

package/dist/core/collection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.js","sourceRoot":"","sources":["../../src/core/collection.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACrD,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC9C,CAAC;AACL,CAAC"}

package/{src/core/directory.ts → dist/core/directory.js}

@@ -1,55 +1,48 @@
-import { Cipher } from '../adapters/cipher'
-
+import { Cipher } from '../adapters/cipher';
 export class Dir {
-    private static readonly SLASH_ASCII = '%2F'
-
-    static async extractKeys<T>(collection: string, _id: _ttid, data: T, parentField?: string) {
-        const keys: { data: string[]; indexes: string[] } = { data: [], indexes: [] }
-        const obj = { ...data } as Record<string, any>
-
+    static SLASH_ASCII = '%2F';
+    static async extractKeys(collection, _id, data, parentField) {
+        const keys = { data: [], indexes: [] };
+        const obj = { ...data };
         for (const field in obj) {
-            const newField = parentField ? `${parentField}/${field}` : field
-            const fieldValue = obj[field]
-
+            const newField = parentField ? `${parentField}/${field}` : field;
+            const fieldValue = obj[field];
             if (fieldValue && typeof fieldValue === 'object' && !Array.isArray(fieldValue)) {
-                const items = await this.extractKeys(collection, _id, fieldValue, newField)
-                keys.data.push(...items.data)
-                keys.indexes.push(...items.indexes)
-                continue
+                const items = await this.extractKeys(collection, _id, fieldValue, newField);
+                keys.data.push(...items.data);
+                keys.indexes.push(...items.indexes);
+                continue;
             }
-
             if (Array.isArray(fieldValue)) {
                 if (fieldValue.some((item) => typeof item === 'object')) {
-                    throw new Error(`Cannot have an array of objects`)
+                    throw new Error(`Cannot have an array of objects`);
                 }
-
                 for (let i = 0; i < fieldValue.length; i++) {
-                    let val = String(fieldValue[i]).replaceAll('/', this.SLASH_ASCII)
+                    let val = String(fieldValue[i]).replaceAll('/', this.SLASH_ASCII);
                     if (Cipher.isConfigured() && Cipher.isEncryptedField(collection, newField)) {
-                        val = await Cipher.encrypt(val, true)
+                        val = await Cipher.blindIndex(val);
                     }
-                    keys.data.push(`${_id}/${newField}/${i}/${val}`)
-                    keys.indexes.push(`${newField}/${i}/${val}/${_id}`)
+                    keys.data.push(`${_id}/${newField}/${i}/${val}`);
+                    keys.indexes.push(`${newField}/${i}/${val}/${_id}`);
                 }
-                continue
+                continue;
             }
-
-            let val = String(fieldValue).replaceAll('/', this.SLASH_ASCII)
+            let val = String(fieldValue).replaceAll('/', this.SLASH_ASCII);
             if (Cipher.isConfigured() && Cipher.isEncryptedField(collection, newField)) {
-                val = await Cipher.encrypt(val, true)
+                val = await Cipher.blindIndex(val);
             }
-            keys.data.push(`${_id}/${newField}/${val}`)
-            keys.indexes.push(`${newField}/${val}/${_id}`)
+            keys.data.push(`${_id}/${newField}/${val}`);
+            keys.indexes.push(`${newField}/${val}/${_id}`);
         }
-
-        return keys
+        return keys;
     }
-
-    static parseValue(value: string) {
+    static parseValue(value) {
         try {
-            return JSON.parse(value)
-        } catch {
-            return value
+            return JSON.parse(value);
+        }
+        catch {
+            return value;
         }
     }
 }
+//# sourceMappingURL=directory.js.map

package/dist/core/directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../src/core/directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,MAAM,OAAO,GAAG;IACJ,MAAM,CAAU,WAAW,GAAG,KAAK,CAAA;IAE3C,MAAM,CAAC,KAAK,CAAC,WAAW,CAAI,UAAkB,EAAE,GAAU,EAAE,IAAO,EAAE,WAAoB;QACrF,MAAM,IAAI,GAA0C,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;QAC7E,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAyB,CAAA;QAE9C,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;YAChE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YAE7B,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;gBAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;gBACnC,SAAQ;YACZ,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBACtD,CAAC;gBAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACzC,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;oBACjE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;wBACzE,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;oBACtC,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;oBAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,CAAA;gBACvD,CAAC;gBACD,SAAQ;YACZ,CAAC;YAED,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YAC9D,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzE,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAA;YAC3C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,CAAA;QAClD,CAAC;QAED,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC3B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAA;QAChB,CAAC;IACL,CAAC"}

package/dist/core/doc-id.js

@@ -0,0 +1,15 @@
+import path from 'node:path';
+import TTID from '@delma/ttid';
+export function validateDocId(docId) {
+    if (!TTID.isTTID(docId))
+        throw new Error(`Invalid document ID: ${docId}`);
+}
+export function assertPathInside(parent, target) {
+    const resolvedParent = path.resolve(parent);
+    const resolvedTarget = path.resolve(target);
+    const relative = path.relative(resolvedParent, resolvedTarget);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Unsafe document path: ${target}`);
+    }
+}
+//# sourceMappingURL=doc-id.js.map

package/dist/core/doc-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-id.js","sourceRoot":"","sources":["../../src/core/doc-id.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,IAAI,MAAM,aAAa,CAAA;AAE9B,MAAM,UAAU,aAAa,CAAC,KAAa;IACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,CAAA;IAE9D,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC;AACL,CAAC"}

package/dist/core/extensions.js

@@ -0,0 +1,16 @@
+"use strict";
+/* eslint-disable @typescript-eslint/no-explicit-any */
+Object.appendGroup = function (target, source) {
+    const result = { ...target };
+    for (const [sourceId, sourceGroup] of Object.entries(source)) {
+        if (!result[sourceId]) {
+            result[sourceId] = sourceGroup;
+            continue;
+        }
+        for (const [groupId, groupDoc] of Object.entries(sourceGroup)) {
+            result[sourceId][groupId] = groupDoc;
+        }
+    }
+    return result;
+};
+//# sourceMappingURL=extensions.js.map

package/dist/core/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../src/core/extensions.ts"],"names":[],"mappings":";AAAA,uDAAuD;AAEvD,MAAM,CAAC,WAAW,GAAG,UACjB,MAA2B,EAC3B,MAA2B;IAE3B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IAE5B,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAA;YAC9B,SAAQ;QACZ,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAA;AACjB,CAAC,CAAA"}