@northstartech/cipher 0.0.0-stage → 1.0.0

package/dist/integrations/drizzle.js

@@ -0,0 +1,285 @@
+/**
+ * Drizzle ORM helpers. Drizzle has no async lifecycle hooks, so encryption is an
+ * explicit, typed step around your queries.
+ *
+ * ```ts
+ * import { encrypted, northstarDrizzle, cipherEq } from '@northstartech/cipher/drizzle'
+ *
+ * export const todos = encrypted(
+ *   pgTable('todos', { id: serial('id').primaryKey(), title: text('title'), email: text('email'), emailBidx: varchar('email_bidx', { length: 64 }) }),
+ *   { title: true, email: { searchable: 'email', indexField: 'emailBidx' } },
+ * )
+ * const nsc = northstarDrizzle(cipher, { db })          // `db` reserves serial ids on PostgreSQL
+ *
+ * await db.insert(todos).values(await nsc.encryptRows(todos, [{ title: 'Buy milk', email: 'ana@example.com' }]))
+ * const rows = await nsc.decryptRows(todos, await db.select().from(todos))        // one decrypt request
+ * const tokens = await nsc.searchTokens(todos.email, 'ANA@example.com')
+ * const mine = await nsc.decryptRows(todos, await db.select().from(todos).where(cipherEq(todos.email, tokens)))
+ *
+ * // Northstar Search: index stored rows as they are (the enclave decrypts the ciphertext)
+ * await cipher.index('todos').upsert(searchDocuments(todos, await db.select().from(todos), ['title', 'email', 'done']))
+ * ```
+ */
+import { Column, Table, getTableColumns, getTableName, inArray, is, sql } from 'drizzle-orm';
+import { CipherError } from '../errors.js';
+import { INDEX_SUFFIX, PENDING_SENTINEL, configError, decryptValues, encryptValues, normalizeFieldSpec, plaintextOf, qualifiedTable, recordIdOf, requestError, reservedIdsFrom, searchDocumentOf, searchTokensFor, } from './shared.js';
+export { CIPHERTEXT_PREFIX, PENDING_SENTINEL } from './shared.js';
+const tablePlans = new WeakMap();
+const columnPlans = new WeakMap();
+const SERIAL_TYPES = new Set(['PgSerial', 'PgSmallSerial', 'PgBigSerial53', 'PgBigSerial64']);
+const STRING_TYPES = new Set(['PgText', 'PgVarchar', 'PgChar', 'MySqlText', 'MySqlVarChar', 'MySqlChar', 'SQLiteText']);
+/**
+ * Declare the encrypted columns of a Drizzle table (call once, next to the table
+ * definition). Returns the table unchanged so it can wrap the definition.
+ */
+export function encrypted(table, fields, options = {}) {
+    if (!is(table, Table))
+        throw configError('Drizzle: encrypted(table, fields) expects a Drizzle table');
+    if (tablePlans.has(table))
+        throw configError(`Drizzle: ${getTableName(table)} is already configured`);
+    const columns = getTableColumns(table);
+    const name = getTableName(table);
+    const byDbName = new Map(Object.entries(columns).map(([k, c]) => [c.name, k]));
+    let pkKey = options.primaryKey;
+    if (pkKey === undefined) {
+        const pks = Object.entries(columns).filter(([, c]) => c.primary);
+        if (pks.length !== 1)
+            throw configError(`Drizzle: ${name} needs exactly one .primaryKey() column (or pass { primaryKey }) to bind ciphertext to records`);
+        pkKey = pks[0][0];
+    }
+    const pkColumn = columns[pkKey];
+    if (!pkColumn)
+        throw configError(`Drizzle: ${name}.${pkKey}: no such column`);
+    const plan = { table, name, schema: table[Symbol.for('drizzle:Schema')], pkKey, pkColumn, fields: [], byKey: new Map() };
+    for (const [key, spec] of Object.entries(fields)) {
+        if (spec === undefined)
+            continue;
+        const lb = `Drizzle: ${name}.${key}`;
+        const column = columns[key];
+        if (!column)
+            throw configError(`${lb}: no such column`);
+        if (key === pkKey)
+            throw configError(`${lb}: the primary key cannot be encrypted`);
+        if (!STRING_TYPES.has(column.columnType))
+            throw configError(`${lb}: encrypted columns must be text (got ${column.columnType})`);
+        const n = normalizeFieldSpec(spec, lb);
+        let indexKey;
+        if (n.searchable) {
+            indexKey = n.indexField ?? byDbName.get(`${column.name}${INDEX_SUFFIX}`) ?? (columns[`${key}${INDEX_SUFFIX}`] ? `${key}${INDEX_SUFFIX}` : columns[`${key}Bidx`] ? `${key}Bidx` : undefined);
+            if (!indexKey || !columns[indexKey])
+                throw configError(`${lb}: searchable columns need a blind-index column (${column.name}${INDEX_SUFFIX} varchar(64), indexed) or indexField`);
+        }
+        const f = {
+            key,
+            column,
+            name: column.name,
+            ...(n.normalization ? { normalization: n.normalization } : {}),
+            ...(indexKey ? { indexKey, indexColumn: columns[indexKey] } : {}),
+        };
+        plan.fields.push(f);
+        plan.byKey.set(key, f);
+        columnPlans.set(column, { plan, field: f, isIndex: false });
+        if (f.indexColumn)
+            columnPlans.set(f.indexColumn, { plan, field: f, isIndex: true });
+    }
+    if (!plan.fields.length)
+        throw configError(`Drizzle: ${name}: no encrypted columns listed`);
+    tablePlans.set(table, plan);
+    return table;
+}
+function planOf(table) {
+    const p = tablePlans.get(table);
+    if (!p)
+        throw configError(`Drizzle: ${is(table, Table) ? getTableName(table) : 'value'} is not configured; wrap the table with encrypted(table, { … })`);
+    return p;
+}
+/**
+ * Exact-match condition: `cipherEq(todos.email, tokens)` → `email_bidx IN (…tokens)`.
+ * Accepts the encrypted column (mapped to its blind index) or the blind-index column.
+ * Empty token lists match nothing.
+ */
+export function cipherEq(column, tokens) {
+    const hit = columnPlans.get(column);
+    if (!hit || !hit.field.indexColumn)
+        throw configError(`Drizzle: ${column?.name ?? 'column'} is not a searchable encrypted column or its blind index`);
+    const flat = [...new Set(tokens.flat().map((t) => {
+            if (typeof t !== 'string')
+                throw requestError('Drizzle: cipherEq tokens must be strings (from searchTokens)');
+            return t;
+        }))];
+    if (!flat.length)
+        return sql `false`;
+    return inArray(hit.field.indexColumn, flat);
+}
+/**
+ * Two-phase write, step 1 (databases where the id is only known after INSERT):
+ * the row with every non-null encrypted value replaced by the `nsc:pending:v1`
+ * sentinel. Insert it, then `update(...).set(await nsc.encryptRow(table, row, { recordId }))`
+ * `.where(and(eq(table.id, id), eq(table.col, PENDING_SENTINEL)))`, ideally in one transaction.
+ */
+export function pendingRow(table, row) {
+    const plan = planOf(table);
+    const out = { ...row };
+    for (const f of plan.fields) {
+        if (out[f.key] === undefined)
+            continue;
+        if (out[f.key] !== null)
+            out[f.key] = PENDING_SENTINEL;
+        if (f.indexKey)
+            out[f.indexKey] = null;
+    }
+    return out;
+}
+/**
+ * Northstar Search documents for stored rows (`db.select().from(table)`, not
+ * decrypted): encrypted columns are sent as their ciphertext with the context
+ * they are bound to and decrypted inside the enclave, so indexing needs no
+ * decrypt request. Rows already decrypted with `decryptRows` work too (their
+ * plaintext is sent). Document ids are the primary keys; field names are the
+ * table's JS keys.
+ */
+export function searchDocuments(table, rows, fields) {
+    const plan = planOf(table);
+    const columns = getTableColumns(table);
+    const plans = fields.map((key) => {
+        if (!columns[key])
+            throw configError(`Drizzle: ${plan.name}.${key}: no such column`);
+        const f = plan.byKey.get(key);
+        return { attr: key, ...(f ? { encrypted: { collection: plan.name, field: f.name } } : {}) };
+    });
+    return rows.map((row) => searchDocumentOf(row, { id: row[plan.pkKey], fields: plans, label: plan.name }));
+}
+/** Bind the helpers to a Northstar Cipher client. */
+export function northstarDrizzle(cipher, options = {}) {
+    if (!cipher || typeof cipher.encryptManySettled !== 'function')
+        throw configError('Drizzle: northstarDrizzle(cipher) requires a NorthstarCipher client');
+    const reserveIds = async (table, count, db = options.db) => {
+        const plan = planOf(table);
+        if (!db)
+            throw configError(`Drizzle: ${plan.name}.${plan.pkColumn.name}: pass { db } to reserve serial ids`);
+        if (!SERIAL_TYPES.has(plan.pkColumn.columnType) && !plan.pkColumn.generatedIdentity) {
+            throw configError(`Drizzle: ${plan.name}.${plan.pkColumn.name} is not a PostgreSQL serial/identity column`);
+        }
+        if (plan.pkColumn.generatedIdentity?.type === 'always') {
+            throw configError(`Drizzle: ${plan.name}.${plan.pkColumn.name} is GENERATED ALWAYS AS IDENTITY, which rejects explicit ids; use generatedByDefaultAsIdentity()`);
+        }
+        const res = await db.execute(sql `SELECT nextval(pg_get_serial_sequence(${qualifiedTable(plan.name, plan.schema)}, ${plan.pkColumn.name}))::text AS id FROM generate_series(1, ${count}::int)`);
+        const big = plan.pkColumn.columnType === 'PgBigSerial64' || plan.pkColumn.dataType === 'bigint';
+        return reservedIdsFrom(res, count, `${plan.name}.${plan.pkColumn.name}`).map((v) => (big ? BigInt(v) : Number(v)));
+    };
+    const fillIds = async (plan, rows, db) => {
+        const missing = rows.filter((r) => r[plan.pkKey] === undefined || r[plan.pkKey] === null);
+        if (!missing.length)
+            return;
+        const gen = plan.pkColumn.defaultFn;
+        if (gen) {
+            for (const r of missing) {
+                const v = gen();
+                if (v && typeof v === 'object')
+                    throw configError(`Drizzle: ${plan.name}.${plan.pkColumn.name}: $defaultFn returns SQL; generate ids in JS to encrypt before insert`);
+                r[plan.pkKey] = v;
+            }
+            return;
+        }
+        if (SERIAL_TYPES.has(plan.pkColumn.columnType) || plan.pkColumn.generatedIdentity) {
+            const ids = await reserveIds(plan.table, missing.length, db);
+            missing.forEach((r, i) => (r[plan.pkKey] = ids[i]));
+            return;
+        }
+        throw requestError(`${plan.name}.${plan.pkColumn.name} is unknown before the insert: pass it, give the column a $defaultFn (e.g. crypto.randomUUID), ` +
+            `pass { db } for PostgreSQL serial keys, or use the two-phase write (pendingRow, then encryptRow with { recordId })`);
+    };
+    const encryptMany = async (plan, rows, ids) => {
+        const out = rows.map((r) => ({ ...r }));
+        const items = [];
+        const targets = [];
+        out.forEach((row, i) => {
+            for (const f of plan.fields) {
+                if (f.indexKey && row[f.indexKey] !== undefined && row[f.key] === undefined) {
+                    throw requestError(`${plan.name}.${f.indexColumn.name} is the blind index of ${f.name} and is managed by Northstar Cipher`);
+                }
+                const v = row[f.key];
+                if (v === undefined)
+                    continue;
+                if (v === null) {
+                    if (f.indexKey)
+                        row[f.indexKey] = null;
+                    continue;
+                }
+                const lb = `${plan.name}.${f.name}`;
+                const recordId = recordIdOf(ids[i], lb);
+                items.push({ collection: plan.name, field: f.name, recordId, plaintext: plaintextOf(v, lb), normalization: f.normalization, label: `${lb} (${plan.pkColumn.name}=${recordId})` });
+                targets.push({ row, f });
+            }
+        });
+        const enc = await encryptValues(cipher, items, { keyId: options.keyId });
+        enc.forEach((e, i) => {
+            const { row, f } = targets[i];
+            row[f.key] = e.ciphertext;
+            if (f.indexKey)
+                row[f.indexKey] = e.index ?? null;
+        });
+        return out;
+    };
+    const decryptMany = async (plan, rows, purpose) => {
+        const out = rows.map((r) => ({ ...r }));
+        const items = [];
+        const targets = [];
+        for (const row of out) {
+            for (const f of plan.fields) {
+                if (!(f.key in row))
+                    continue;
+                const stored = row[f.key];
+                const lb = `${plan.name}.${f.name}`;
+                if (stored !== null && stored !== undefined && (row[plan.pkKey] === undefined || row[plan.pkKey] === null)) {
+                    throw requestError(`${lb}: select the primary key (${plan.pkKey}) together with encrypted columns`);
+                }
+                const recordId = stored === null || stored === undefined ? '' : recordIdOf(row[plan.pkKey], lb);
+                items.push({ collection: plan.name, field: f.name, recordId, stored, label: `${lb} (${plan.pkColumn.name}=${recordId})` });
+                targets.push({ row, key: f.key });
+            }
+        }
+        const plain = await decryptValues(cipher, items, { purpose: purpose ?? options.purpose, readLegacyPlaintext: options.readLegacyPlaintext === true });
+        plain.forEach((p, i) => (targets[i].row[targets[i].key] = p));
+        return out;
+    };
+    return {
+        async encryptRow(table, row, opts = {}) {
+            const plan = planOf(table);
+            if (!row || typeof row !== 'object')
+                throw requestError('Drizzle: encryptRow expects a row object');
+            const copy = { ...row };
+            let id = opts.recordId;
+            if (id === undefined) {
+                if (plan.fields.some((f) => copy[f.key] !== undefined && copy[f.key] !== null))
+                    await fillIds(plan, [copy], opts.db);
+                id = copy[plan.pkKey];
+            }
+            return (await encryptMany(plan, [copy], [id]))[0];
+        },
+        async encryptRows(table, rows, opts = {}) {
+            const plan = planOf(table);
+            const copies = rows.map((r) => ({ ...r }));
+            await fillIds(plan, copies.filter((r) => plan.fields.some((f) => r[f.key] !== undefined && r[f.key] !== null)), opts.db);
+            return (await encryptMany(plan, copies, copies.map((r) => r[plan.pkKey])));
+        },
+        async decryptRows(table, rows, opts = {}) {
+            return decryptMany(planOf(table), rows, opts.purpose);
+        },
+        async decryptRow(table, row, opts = {}) {
+            if (row === undefined || row === null)
+                return row;
+            return (await decryptMany(planOf(table), [row], opts.purpose))[0];
+        },
+        async searchTokens(column, value) {
+            const hit = columnPlans.get(column);
+            if (!hit || !hit.field.indexColumn)
+                throw configError(`Drizzle: ${column?.name ?? 'column'} is not a searchable encrypted column`);
+            const f = hit.field;
+            return searchTokensFor(cipher, { collection: hit.plan.name, field: f.name, normalization: f.normalization, values: value, keyId: options.keyId, label: `${hit.plan.name}.${f.name}` });
+        },
+        reserveIds,
+    };
+}
+export { CipherError };
+//# sourceMappingURL=drizzle.js.map

package/dist/integrations/drizzle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle.js","sourceRoot":"","sources":["../../src/integrations/drizzle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,MAAM,EAAY,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEtG,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAKL,YAAY,EACZ,gBAAgB,EAEhB,WAAW,EACX,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AA2CjE,MAAM,UAAU,GAAG,IAAI,OAAO,EAAoB,CAAA;AAClD,MAAM,WAAW,GAAG,IAAI,OAAO,EAAmE,CAAA;AAClG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAA;AAC7F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;AAEvH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAkB,KAAQ,EAAE,MAA8B,EAAE,UAAoC,EAAE;IACzH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,2DAA2D,CAAC,CAAA;IACrG,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,YAAY,YAAY,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;IACrG,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAA2B,CAAA;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,KAAK,GAAG,OAAO,CAAC,UAAgC,CAAA;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,WAAW,CAAC,YAAY,IAAI,gGAAgG,CAAC,CAAA;QACzJ,KAAK,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,QAAQ;QAAE,MAAM,WAAW,CAAC,YAAY,IAAI,IAAI,KAAK,kBAAkB,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAG,KAAuD,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;IACtL,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAwD,CAAC,EAAE,CAAC;QACnG,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAChC,MAAM,EAAE,GAAG,YAAY,IAAI,IAAI,GAAG,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,MAAM;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,KAAK,KAAK;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAA;QAClF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,yCAAyC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAA;QAC/H,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACtC,IAAI,QAA4B,CAAA;QAChC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC3L,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,MAAM,WAAW,CAAC,GAAG,EAAE,mDAAmD,MAAM,CAAC,IAAI,GAAG,YAAY,sCAAsC,CAAC,CAAA;QAClL,CAAC;QACD,MAAM,CAAC,GAAc;YACnB,GAAG;YACH,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACtB,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,CAAC,WAAW;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,YAAY,IAAI,+BAA+B,CAAC,CAAA;IAC3F,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAY;IAC1B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,iEAAiE,CAAC,CAAA;IACxJ,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,MAA0D;IACjG,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW;QAAE,MAAM,WAAW,CAAC,YAAY,MAAM,EAAE,IAAI,IAAI,QAAQ,0DAA0D,CAAC,CAAA;IACrJ,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAE,MAA6B,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACvE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,YAAY,CAAC,8DAA8D,CAAC,CAAA;YAC7G,OAAO,CAAC,CAAA;QACV,CAAC,CAAC,CAAC,CAAC,CAAA;IACJ,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA,OAAO,CAAA;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAqD,KAAQ,EAAE,GAAM;IAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,GAAG,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAA;IAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,SAAQ;QACtC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAA;QACtD,IAAI,CAAC,CAAC,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAkB,KAAQ,EAAE,IAA+B,EAAE,MAAsB;IAChH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAA2B,CAAA;IAChE,MAAM,KAAK,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,WAAW,CAAC,YAAY,IAAI,CAAC,IAAI,IAAI,GAAG,kBAAkB,CAAC,CAAA;QACpF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAC7F,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3G,CAAC;AAsBD,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,MAAuB,EAAE,UAAmC,EAAE;IAC7F,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2C,CAAC,kBAAkB,KAAK,UAAU;QAAE,MAAM,WAAW,CAAC,qEAAqE,CAAC,CAAA;IAE9L,MAAM,UAAU,GAAG,KAAK,EAAmB,KAAQ,EAAE,KAAa,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,EAAgC,EAAE;QACnH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,EAAE;YAAE,MAAM,WAAW,CAAC,YAAY,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,qCAAqC,CAAC,CAAA;QAC5G,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACpF,MAAM,WAAW,CAAC,YAAY,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,6CAA6C,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,WAAW,CAAC,YAAY,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,kGAAkG,CAAC,CAAA;QAClK,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,GAAG,CAAA,yCAAyC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,0CAA0C,KAAK,QAAQ,CACjK,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAA;QAC/F,OAAO,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpH,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,IAAe,EAAE,IAA+B,EAAE,EAAoB,EAAE,EAAE;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;QACzF,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAM;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAA;QACnC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;gBACf,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,WAAW,CAAC,YAAY,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,uEAAuE,CAAC,CAAA;gBACrK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAClF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC5D,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACnD,OAAM;QACR,CAAC;QACD,MAAM,YAAY,CAChB,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,iGAAiG;YACjI,oHAAoH,CACvH,CAAA;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,EAAqC,IAAe,EAAE,IAAS,EAAE,GAAc,EAAgB,EAAE;QACxH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAA4B,CAAC,CAAA;QAClE,MAAM,KAAK,GAAkB,EAAE,CAAA;QAC/B,MAAM,OAAO,GAAqD,EAAE,CAAA;QACpE,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC5E,MAAM,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,WAAY,CAAC,IAAI,0BAA0B,CAAC,CAAC,IAAI,qCAAqC,CAAC,CAAA;gBAC9H,CAAC;gBACD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBACpB,IAAI,CAAC,KAAK,SAAS;oBAAE,SAAQ;gBAC7B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,QAAQ;wBAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;oBACtC,SAAQ;gBACV,CAAC;gBACD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;gBACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBACvC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAA;gBACjL,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACxE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;YAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;YACzB,IAAI,CAAC,CAAC,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAA;QACnD,CAAC,CAAC,CAAA;QACF,OAAO,GAAU,CAAA;IACnB,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,EAAqC,IAAe,EAAE,IAAS,EAAE,OAAgB,EAAgB,EAAE;QAC1H,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAA4B,CAAC,CAAA;QAClE,MAAM,KAAK,GAAkB,EAAE,CAAA;QAC/B,MAAM,OAAO,GAAoD,EAAE,CAAA;QACnE,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;oBAAE,SAAQ;gBAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBACzB,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;gBACnC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC3G,MAAM,YAAY,CAAC,GAAG,EAAE,6BAA6B,IAAI,CAAC,KAAK,mCAAmC,CAAC,CAAA;gBACrG,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC/F,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAA;gBAC1H,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC,CAAA;QACpJ,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,GAAU,CAAA;IACnB,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAA;YACnG,MAAM,IAAI,GAA4B,EAAE,GAAI,GAA+B,EAAE,CAAA;YAC7E,IAAI,EAAE,GAAY,IAAI,CAAC,QAAQ,CAAA;YAC/B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;oBAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBACpH,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvB,CAAC;YACD,OAAO,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAA2C,CAAA;QAC7F,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAA6B,EAAE,CAAC,CAAC,CAAA;YACvE,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;YACxH,OAAO,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAwD,CAAA;QACnI,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YACtC,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACvD,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;YACpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAA;YACjD,OAAO,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW;gBAAE,MAAM,WAAW,CAAC,YAAY,MAAM,EAAE,IAAI,IAAI,QAAQ,uCAAuC,CAAC,CAAA;YAClI,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAA;YACnB,OAAO,eAAe,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACxL,CAAC;QACD,UAAU;KACX,CAAA;AACH,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAA"}

package/dist/integrations/mongoose.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Mongoose (v9) schema plugin: transparent field-level encryption.
+ *
+ * ```ts
+ * import { northstarCipherPlugin } from '@northstartech/cipher/mongoose'
+ *
+ * const todoSchema = new Schema({ title: String, email: String })
+ * todoSchema.plugin(northstarCipherPlugin, { cipher, fields: ['title', { path: 'email', searchable: 'email' }] })
+ * const Todo = model('Todo', todoSchema)
+ *
+ * await Todo.create({ title: 'Buy milk', email: 'ana@example.com' })
+ * const todos = await Todo.find()                                          // one decrypt request per query
+ * const mine = await Todo.find().cipherWhere('email', 'ANA@example.com')   // exact match on email_bidx
+ * ```
+ *
+ * ObjectIds exist before the insert, so `_id` is the record id. Validation always
+ * sees plaintext; setters (`lowercase`, `trim`, …) apply to plaintext and never
+ * to ciphertext. See README "Mongoose".
+ *
+ * Northstar Search: `search: { index: cipher.index('todos'), fields: ['title', 'email', 'done'] }`
+ * keeps an index in sync on `save()`, `insertMany()`, `doc.deleteOne()` and
+ * `findOneAndDelete()` (encrypted paths are indexed from their stored ciphertext,
+ * which the enclave decrypts); `Todo.cipherSearchDocuments(docs)` builds documents for a (re)index.
+ */
+import { type Schema } from 'mongoose';
+import type { NorthstarCipher } from '../client.js';
+import { CipherError } from '../errors.js';
+import { type CipherIntegrationOptions, type EncryptedFieldOptions, type EncryptedFieldSpec, type SearchSyncOptions } from './shared.js';
+import type { SearchDocument } from '../search.js';
+export { CIPHERTEXT_PREFIX, PENDING_SENTINEL } from './shared.js';
+export type { EncryptedFieldOptions, EncryptedFieldSpec, CipherIntegrationOptions, SearchSyncOptions } from './shared.js';
+export type MongooseFieldSpec = string | ({
+    path: string;
+} & EncryptedFieldOptions);
+export interface NorthstarMongooseOptions extends CipherIntegrationOptions {
+    cipher: NorthstarCipher;
+    /** Encrypted String paths: `['title', { path: 'email', searchable: 'email' }]` or `{ title: true, … }`. */
+    fields: MongooseFieldSpec[] | Record<string, EncryptedFieldSpec>;
+    /**
+     * Keep a Northstar Search index in sync (`save()`, `insertMany()`, `doc.deleteOne()`,
+     * `findOneAndDelete()`; changes are indexed when the write returns, also inside
+     * transactions). Query updates and `deleteMany()` are not tracked: reindex after those.
+     */
+    search?: SearchSyncOptions;
+}
+/** Query helper added by the plugin (add to your schema's `TQueryHelpers` type). */
+export interface CipherQueryHelpers {
+    /** Exact match on a searchable encrypted path (resolved to `<path>_bidx: { $in: tokens }` when the query runs). */
+    cipherWhere(path: string, value: string | string[]): this;
+}
+/** Statics added by the plugin. */
+export interface CipherModelStatics {
+    /** `{ <path>_bidx: { $in: tokens } }` for use in any filter. */
+    cipherFilter(path: string, value: string | string[]): Promise<Record<string, {
+        $in: string[];
+    }>>;
+    /** Decrypt documents or plain objects obtained outside `find` (aggregate, cursors, change streams). */
+    cipherDecrypt<T>(docs: T | T[]): Promise<T | T[]>;
+    /**
+     * Northstar Search documents for documents or plain objects (`fields` default to
+     * `search.fields`). Raw reads skip decryption, so
+     * `Todo.cipherSearchDocuments(await Todo.collection.find().toArray())` (or `aggregate()`
+     * results) index the stored ciphertext, which the enclave decrypts.
+     */
+    cipherSearchDocuments(docs: unknown[], fields?: string[]): SearchDocument[];
+}
+/**
+ * Mongoose schema plugin. `schema.plugin(northstarCipherPlugin, { cipher, fields })`.
+ * Apply before compiling the model.
+ */
+export declare function northstarCipherPlugin(schema: Schema, options: NorthstarMongooseOptions): void;
+export { CipherError };