@northstartech/cipher 0.0.0-stage → 1.0.0

package/dist/integrations/sequelize.js

@@ -0,0 +1,677 @@
+/**
+ * Sequelize v6 integration: encrypt model attributes with hooks.
+ *
+ * ```ts
+ * import { northstarCipher } from '@northstartech/cipher/sequelize'
+ *
+ * class Todo extends Model {}
+ * Todo.init({ title: DataTypes.TEXT, email: DataTypes.TEXT, email_bidx: DataTypes.STRING(64) }, { sequelize, tableName: 'todos' })
+ * northstarCipher(Todo, cipher, { fields: ['title', { name: 'email', searchable: 'email' }] })
+ *
+ * await Todo.create({ title: 'Buy milk', email: 'ana@example.com' })
+ * const rows = await Todo.findAll()                                      // one decrypt request per query
+ * const mine = await Todo.findAll({ where: await Todo.cipherWhere('email', 'ANA@example.com') })
+ * ```
+ *
+ * Northstar Search: pass `search: { index: cipher.index('todos'), fields: ['title', 'email', 'done'] }`
+ * to keep an index in sync (encrypted attributes are indexed from their stored
+ * ciphertext, which the enclave decrypts); `Todo.cipherSearchDocuments(rows)`
+ * builds documents for a (re)index.
+ *
+ * Record ids: explicit/default ids (UUIDV4, …) are used directly; auto-increment
+ * keys are reserved from the PostgreSQL sequence before the INSERT; on other
+ * dialects a two-phase write inserts the `nsc:pending:v1` sentinel and replaces
+ * it with ciphertext in `afterCreate` (inside `options.transaction` when given).
+ */
+import { Op, QueryTypes } from 'sequelize';
+import { CipherError } from '../errors.js';
+import { INDEX_SUFFIX, PENDING_SENTINEL, PlaintextLedger, RESERVE_IDS_SQL, SearchChangeSet, applySearchChange, configError, decryptValues, encryptValues, isCiphertext, normalizeFieldSpec, normalizeSearchSync, plaintextOf, qualifiedTable, recordIdOf, requestError, reservedIdsFrom, searchDocumentOf, searchTokensFor, } from './shared.js';
+export { CIPHERTEXT_PREFIX, PENDING_SENTINEL } from './shared.js';
+const plans = new WeakMap();
+/** Search index changes waiting for their transaction to commit (shared by every synced model). */
+const txChanges = new WeakMap();
+const ledger = new PlaintextLedger();
+const swapped = new WeakSet();
+const bulkPins = new WeakMap();
+const HOOK_NAME = 'northstarCipher';
+const STRING_TYPES = new Set(['STRING', 'TEXT', 'CITEXT', 'CHAR']);
+function planOf(inst) {
+    return inst && typeof inst === 'object' ? plans.get(inst.constructor) : undefined;
+}
+function ensureFields(options, attrs) {
+    if (!Array.isArray(options.fields))
+        return;
+    for (const a of attrs)
+        if (!options.fields.includes(a))
+            options.fields.push(a);
+}
+function coerceId(plan, v) {
+    if (!plan.pkInteger)
+        return v;
+    const n = Number(v);
+    return Number.isSafeInteger(n) ? n : v; // BIGINT stays a string, as Sequelize returns it
+}
+async function reserveIds(plan, n, transaction) {
+    const rows = await plan.model.sequelize.query(RESERVE_IDS_SQL, {
+        bind: [qualifiedTable(plan.table, plan.schema), plan.pkColumn, n],
+        type: QueryTypes.SELECT,
+        ...(transaction ? { transaction } : {}),
+    });
+    return reservedIdsFrom(rows, n, `${plan.table}.${plan.pkColumn}`).map((v) => coerceId(plan, v));
+}
+function label(plan, f, id) {
+    return `${plan.table}.${f.column}${id === undefined || id === null ? '' : ` (${plan.pk}=${String(id)})`}`;
+}
+/** Plaintext an attribute currently stands for (our own ciphertext maps back to its plaintext). */
+function currentPlaintext(inst, attr) {
+    return ledger.resolve(inst, attr, inst.dataValues[attr]);
+}
+/** Encrypt `attrs` of each instance (bound to its primary key) in ONE batch and swap in ciphertext. */
+async function encryptInstances(plan, work) {
+    const items = [];
+    const targets = [];
+    for (const { inst, attrs } of work) {
+        const id = inst.dataValues[plan.pk];
+        for (const f of attrs) {
+            const v = currentPlaintext(inst, f.attr);
+            if (v === null || v === undefined) {
+                inst.dataValues[f.attr] = v ?? null;
+                if (f.indexAttr)
+                    inst.dataValues[f.indexAttr] = null;
+                ledger.set(inst, f.attr, null, null);
+                continue;
+            }
+            const lb = label(plan, f, id);
+            const plaintext = plaintextOf(v, lb);
+            items.push({ collection: plan.table, field: f.column, recordId: recordIdOf(id, lb), plaintext, normalization: f.normalization, label: lb });
+            targets.push({ inst, f, plaintext });
+        }
+    }
+    const enc = await encryptValues(plan.cipher, items, { keyId: plan.options.keyId });
+    enc.forEach((e, i) => {
+        const { inst, f, plaintext } = targets[i];
+        inst.dataValues[f.attr] = e.ciphertext;
+        if (f.indexAttr)
+            inst.dataValues[f.indexAttr] = e.index ?? null;
+        ledger.set(inst, f.attr, plaintext, e.ciphertext);
+    });
+}
+/** Two-phase: put the sentinel in place of every non-null encrypted value. */
+function markPending(plan, inst, attrs) {
+    for (const f of attrs) {
+        const v = currentPlaintext(inst, f.attr);
+        if (v === null || v === undefined) {
+            inst.dataValues[f.attr] = v ?? null;
+            if (f.indexAttr)
+                inst.dataValues[f.indexAttr] = null;
+            continue;
+        }
+        const plaintext = plaintextOf(v, label(plan, f));
+        inst.dataValues[f.attr] = PENDING_SENTINEL;
+        if (f.indexAttr)
+            inst.dataValues[f.indexAttr] = null;
+        ledger.set(inst, f.attr, plaintext, PENDING_SENTINEL);
+    }
+}
+/** Put plaintext back on the instance after a write (or a failed write) and mark it clean. */
+function restore(inst, clean) {
+    for (const [attr, e] of ledger.entries(inst)) {
+        const cur = inst.dataValues[attr];
+        if (e.ciphertext === null || cur === e.ciphertext || cur === undefined) {
+            inst.dataValues[attr] = e.plaintext;
+            if (clean) {
+                inst._previousDataValues[attr] = e.plaintext;
+                inst.changed(attr, false);
+            }
+        }
+    }
+    if (clean) {
+        const plan = planOf(inst);
+        for (const a of plan?.indexAttrs ?? []) {
+            inst._previousDataValues[a] = inst.dataValues[a];
+            inst.changed(a, false);
+        }
+    }
+    ledger.clear(inst);
+    swapped.delete(inst);
+}
+function pendingAttrs(inst) {
+    return ledger.entries(inst).filter(([, e]) => e.ciphertext === PENDING_SENTINEL).map(([a]) => a);
+}
+/** Second phase of a two-phase insert: encrypt with the real id and replace the sentinel (same transaction). */
+async function completeTwoPhase(plan, insts, transaction) {
+    const work = insts.map((inst) => ({ inst, attrs: pendingAttrs(inst).map((a) => plan.byAttr.get(a)) })).filter((w) => w.attrs.length);
+    if (!work.length)
+        return;
+    const qi = plan.model.sequelize.getQueryInterface();
+    const tableName = plan.model.getTableName();
+    try {
+        // The ledger maps the sentinel back to its plaintext, so this encrypts the real values with the real ids.
+        await encryptInstances(plan, work);
+        for (const { inst, attrs } of work) {
+            const values = {};
+            const where = { [plan.pkColumn]: inst.dataValues[plan.pk] };
+            for (const f of attrs) {
+                values[f.column] = inst.dataValues[f.attr];
+                if (f.indexAttr && f.indexColumn)
+                    values[f.indexColumn] = inst.dataValues[f.indexAttr];
+                where[f.column] = PENDING_SENTINEL;
+            }
+            const res = (await qi.bulkUpdate(tableName, values, where, { ...(transaction ? { transaction } : {}) }));
+            const affected = typeof res === 'number' ? res : Array.isArray(res) ? Number(res[1] ?? res[0]) : NaN;
+            if (affected !== 1)
+                throw new CipherError('PROTOCOL_ERROR', `${plan.table}: two-phase write could not find the pending row ${plan.pk}=${String(inst.dataValues[plan.pk])}`);
+        }
+    }
+    catch (e) {
+        // Fail closed: drop the sentinel rows we inserted (best effort; a transaction rollback also removes them).
+        const ids = work.map((w) => w.inst.dataValues[plan.pk]).filter((x) => x !== null && x !== undefined);
+        if (ids.length) {
+            await qi.bulkDelete(tableName, { [plan.pkColumn]: { [Op.in]: ids } }, { ...(transaction ? { transaction } : {}) }).catch(() => undefined);
+        }
+        for (const w of work)
+            restore(w.inst, false);
+        throw e;
+    }
+}
+/** Refuse plaintext in writes that skip hooks (`hooks: false`): mirrors the `LIKE 'nsc:%'` CHECK constraint. */
+function assertNoPlaintext(plan, values, what) {
+    for (const f of plan.fields) {
+        const v = values[f.attr];
+        if (v !== undefined && v !== null && !(typeof v === 'string' && (isCiphertext(v) || v === PENDING_SENTINEL))) {
+            throw requestError(`${plan.table}.${f.column}: ${what} with hooks disabled would store plaintext in an encrypted column`);
+        }
+    }
+}
+/** Filters on ciphertext never match: refuse them (null checks are fine). */
+function assertWhere(plan, where) {
+    if (!where || typeof where !== 'object' || Array.isArray(where)) {
+        if (Array.isArray(where))
+            for (const w of where)
+                assertWhere(plan, w);
+        return;
+    }
+    const w = where;
+    for (const k of Object.keys(w)) {
+        const f = plan.byAttr.get(k) ?? plan.fields.find((x) => x.column === k);
+        if (!f)
+            continue;
+        const v = w[k];
+        const nullOnly = v === null ||
+            (v !== undefined &&
+                typeof v === 'object' &&
+                !Array.isArray(v) &&
+                Object.keys(v).length === 0 &&
+                Object.getOwnPropertySymbols(v).every((s) => (s === Op.is || s === Op.not || s === Op.ne || s === Op.eq) && v[s] === null));
+        if (!nullOnly) {
+            throw requestError(`${plan.table}.${f.column} is encrypted: only null checks can filter it` + (f.indexAttr ? ` (use ${plan.model.name}.cipherWhere('${f.attr}', value))` : ''));
+        }
+    }
+    for (const s of Object.getOwnPropertySymbols(w)) {
+        if (s === Op.and || s === Op.or || s === Op.not) {
+            const v = w[s];
+            for (const x of Array.isArray(v) ? v : [v])
+                assertWhere(plan, x);
+        }
+    }
+}
+/** Collect instances (and eagerly loaded associations) produced by one query. */
+function collect(value, out) {
+    if (Array.isArray(value)) {
+        for (const v of value)
+            collect(v, out);
+        return;
+    }
+    if (!value || typeof value !== 'object' || !('dataValues' in value))
+        return;
+    const inst = value;
+    if (out.has(inst))
+        return;
+    out.add(inst);
+    for (const v of Object.values(inst.dataValues))
+        if (v && typeof v === 'object')
+            collect(v, out);
+}
+async function decryptFound(plan, result, options) {
+    const raw = options.raw === true;
+    const insts = new Set();
+    const rows = [];
+    if (raw) {
+        for (const r of Array.isArray(result) ? result : [result])
+            if (r && typeof r === 'object')
+                rows.push(r);
+    }
+    else
+        collect(result, insts);
+    const items = [];
+    const targets = [];
+    const add = (p, obj, prev) => {
+        for (const f of p.fields) {
+            if (!(f.attr in obj))
+                continue;
+            const stored = obj[f.attr];
+            const lb = label(p, f, obj[p.pk]);
+            if (stored !== null && stored !== undefined && (obj[p.pk] === undefined || obj[p.pk] === null)) {
+                throw requestError(`${lb}: select the primary key "${p.pk}" together with encrypted attributes`);
+            }
+            items.push({ collection: p.table, field: f.column, recordId: stored === null || stored === undefined ? '' : recordIdOf(obj[p.pk], lb), stored, label: lb });
+            targets.push({ obj, prev, attr: f.attr });
+        }
+    };
+    for (const r of rows)
+        add(plan, r);
+    for (const inst of insts) {
+        const p = planOf(inst);
+        if (p)
+            add(p, inst.dataValues, inst._previousDataValues);
+    }
+    const plain = await decryptValues(plan.cipher, items, { purpose: plan.options.purpose, readLegacyPlaintext: plan.options.readLegacyPlaintext === true });
+    plain.forEach((p, i) => {
+        const t = targets[i];
+        t.obj[t.attr] = p;
+        if (t.prev)
+            t.prev[t.attr] = p;
+    });
+}
+function parseFields(model, spec) {
+    if (Array.isArray(spec)) {
+        return spec.map((s) => {
+            if (typeof s === 'string')
+                return [s, true];
+            if (!s || typeof s !== 'object' || typeof s.name !== 'string')
+                throw configError(`Sequelize: ${model.name}: field entries are names or { name, searchable? }`);
+            const { name, ...rest } = s;
+            return [name, Object.keys(rest).length ? rest : true];
+        });
+    }
+    if (spec && typeof spec === 'object')
+        return Object.entries(spec);
+    throw configError(`Sequelize: ${model.name}: options.fields is required`);
+}
+/**
+ * Encrypt attributes of a Sequelize model. Call once per model, after `init`/`define`
+ * and before use. Returns the model, extended with `cipherWhere`.
+ */
+export function northstarCipher(model, cipher, options) {
+    if (!model || typeof model.getAttributes !== 'function' || !model.sequelize)
+        throw configError('Sequelize: northstarCipher(Model, …) needs an initialized model');
+    if (!cipher || typeof cipher.encryptManySettled !== 'function')
+        throw configError('Sequelize: a NorthstarCipher client is required');
+    if (plans.has(model))
+        throw configError(`Sequelize: ${model.name} is already configured for Northstar Cipher`);
+    const attrs = model.getAttributes();
+    const pks = model.primaryKeyAttributes;
+    if (pks.length !== 1)
+        throw configError(`Sequelize: ${model.name} must have exactly one primary key to bind ciphertext to records`);
+    const pk = pks[0];
+    const pkAttr = attrs[pk];
+    const pkType = String(pkAttr.type?.key ?? '');
+    const pkInteger = ['INTEGER', 'BIGINT', 'SMALLINT', 'MEDIUMINT', 'TINYINT'].includes(pkType);
+    const dialect = model.sequelize.getDialect();
+    const tableName = model.getTableName();
+    const table = typeof tableName === 'string' ? tableName : String(tableName.tableName);
+    const schema = typeof tableName === 'object' && tableName ? tableName.schema : undefined;
+    const fields = [];
+    for (const [attr, spec] of parseFields(model, options.fields)) {
+        const lb = `Sequelize: ${model.name}.${attr}`;
+        const a = attrs[attr];
+        if (!a)
+            throw configError(`${lb}: no such attribute`);
+        if (attr === pk)
+            throw configError(`${lb}: the primary key cannot be encrypted`);
+        if (!STRING_TYPES.has(String(a.type?.key ?? '')))
+            throw configError(`${lb}: encrypted attributes must be TEXT (the column stores nsc:v1:… text)`);
+        const n = normalizeFieldSpec(spec, lb);
+        let indexAttr;
+        if (n.searchable) {
+            indexAttr = n.indexField ?? [`${attr}${INDEX_SUFFIX}`, `${attr}Bidx`].find((k) => attrs[k]);
+            if (!indexAttr || !attrs[indexAttr])
+                throw configError(`${lb}: searchable attributes need a blind-index attribute (add ${attr}${INDEX_SUFFIX}: DataTypes.STRING(64) with an index, or set indexField)`);
+        }
+        fields.push({
+            attr,
+            column: a.field ?? attr,
+            ...(n.normalization ? { normalization: n.normalization } : {}),
+            ...(indexAttr ? { indexAttr, indexColumn: attrs[indexAttr].field ?? indexAttr } : {}),
+        });
+    }
+    if (!fields.length)
+        throw configError(`Sequelize: ${model.name}: no encrypted attributes listed`);
+    const plan = {
+        model,
+        table,
+        schema,
+        pk,
+        pkColumn: pkAttr.field ?? pk,
+        pkInteger,
+        strategy: pkAttr.autoIncrement ? (dialect === 'postgres' ? 'sequence' : 'two-phase') : 'explicit',
+        fields,
+        byAttr: new Map(fields.map((f) => [f.attr, f])),
+        indexAttrs: new Set(fields.flatMap((f) => (f.indexAttr ? [f.indexAttr] : []))),
+        cipher,
+        options,
+    };
+    plans.set(model, plan);
+    const allAttrs = (f) => f.flatMap((x) => (x.indexAttr ? [x.attr, x.indexAttr] : [x.attr]));
+    // ------------------------------------------------------- Northstar Search
+    const searchPlans = (names) => names.map((attr) => {
+        if (!attrs[attr])
+            throw configError(`Sequelize: ${model.name}.${attr}: no such attribute (search fields)`);
+        const f = plan.byAttr.get(attr);
+        return { attr, ...(f ? { encrypted: { collection: table, field: f.column } } : {}) };
+    });
+    const sync = options.search ? normalizeSearchSync(options.search, `Sequelize: ${model.name}`) : undefined;
+    const syncPlans = sync ? searchPlans(sync.fields) : undefined;
+    const docOf = (record, fp) => {
+        const values = record && typeof record === 'object' && 'dataValues' in record ? record.dataValues : (record ?? {});
+        return searchDocumentOf(values, { id: values[pk], fields: fp, label: table });
+    };
+    /** Stored documents of rows by primary key (`hooks: false`: ciphertext stays as stored). */
+    const storedDocs = async (ids, opts) => {
+        if (!syncPlans || !ids.length)
+            return [];
+        // `hooks: false` (honoured by findAll, missing from its type) skips afterFind: no decryption.
+        const rows = await model.findAll({ where: { [pk]: { [Op.in]: ids } }, hooks: false, ...(opts.transaction ? { transaction: opts.transaction } : {}) });
+        return rows.map((r) => docOf(r, syncPlans));
+    };
+    const idsWhere = async (opts) => {
+        const rows = await model.findAll({
+            attributes: [pk],
+            where: opts.where,
+            hooks: false,
+            raw: true,
+            ...(opts.limit ? { limit: opts.limit } : {}),
+            ...(opts.force ? { paranoid: false } : {}),
+            ...(opts.transaction ? { transaction: opts.transaction } : {}),
+        });
+        return rows.map((r) => r[pk]);
+    };
+    /** Apply an index change now, or (inside a transaction) once the outermost transaction commits. */
+    const syncChange = async (opts, change) => {
+        if (!sync || (!change.upsert?.length && !change.delete?.length))
+            return;
+        let t = opts?.transaction;
+        while (t?.parent)
+            t = t.parent;
+        if (!t || typeof t.afterCommit !== 'function')
+            return applySearchChange(sync, change);
+        let set = txChanges.get(t);
+        if (!set) {
+            txChanges.set(t, (set = new SearchChangeSet()));
+            const pending = set;
+            t.afterCommit(() => pending.apply(true));
+        }
+        set.add(sync, change);
+    };
+    const bulkIds = new WeakMap();
+    const add = (name, fn) => model.addHook(name, HOOK_NAME, fn);
+    add('beforeCreate', (async (inst, opts) => {
+        const touched = fields.filter((f) => inst.dataValues[f.attr] !== undefined);
+        if (!touched.length)
+            return;
+        if (inst.dataValues[pk] === undefined || inst.dataValues[pk] === null) {
+            if (plan.strategy === 'sequence')
+                inst.dataValues[pk] = (await reserveIds(plan, 1, opts.transaction))[0];
+            else if (plan.strategy === 'two-phase') {
+                markPending(plan, inst, touched);
+                ensureFields(opts, allAttrs(touched));
+                return;
+            }
+            else
+                throw requestError(`${table}.${plan.pkColumn} must be set before writing encrypted attributes`);
+        }
+        await encryptInstances(plan, [{ inst, attrs: touched }]);
+        ensureFields(opts, [pk, ...allAttrs(touched)]);
+    }));
+    add('afterCreate', (async (inst, opts) => {
+        if (pendingAttrs(inst).length)
+            await completeTwoPhase(plan, [inst], opts.transaction);
+        const doc = syncPlans ? docOf(inst, syncPlans) : undefined; // before restore: encrypted attributes still hold ciphertext
+        restore(inst, true);
+        if (doc)
+            await syncChange(opts, { upsert: [doc] });
+    }));
+    add('beforeUpdate', (async (inst, opts) => {
+        if (inst.changed(pk) && inst._previousDataValues[pk] !== undefined) {
+            throw requestError(`${table}.${plan.pkColumn}: changing the primary key would invalidate the record's ciphertext`);
+        }
+        const touched = fields.filter((f) => inst.changed(f.attr));
+        if (!touched.length)
+            return;
+        await encryptInstances(plan, [{ inst, attrs: touched }]);
+        ensureFields(opts, allAttrs(touched));
+        swapped.delete(inst);
+        // Model.update(..., { individualHooks }) may fall back to one UPDATE for all rows: pin it to the ids we encrypted for.
+        if (opts.individualHooks && opts.where !== undefined) {
+            let pin = bulkPins.get(opts);
+            if (!pin)
+                bulkPins.set(opts, (pin = { where: opts.where, ids: new Set() }));
+            pin.ids.add(inst.dataValues[pk]);
+            opts.where = { [Op.and]: [pin.where, { [pk]: { [Op.in]: [...pin.ids] } }] };
+        }
+    }));
+    add('afterUpdate', (async (inst, opts) => {
+        const doc = syncPlans && sync.fields.some((a) => inst.changed(a)) ? docOf(inst, syncPlans) : undefined;
+        restore(inst, true);
+        if (doc)
+            await syncChange(opts, { upsert: [doc] });
+    }));
+    if (sync) {
+        add('afterDestroy', (async (inst, opts) => {
+            await syncChange(opts, { delete: [recordIdOf(inst.dataValues[pk], table)] });
+        }));
+        // Model.destroy()/update() without per-instance hooks: note the affected ids first.
+        add('beforeBulkDestroy', (async (opts) => {
+            if (!opts.individualHooks)
+                bulkIds.set(opts, await idsWhere(opts));
+        }));
+        add('afterBulkDestroy', (async (opts) => {
+            const ids = bulkIds.get(opts);
+            bulkIds.delete(opts);
+            if (ids?.length)
+                await syncChange(opts, { delete: ids.map((id) => recordIdOf(id, table)) });
+        }));
+        add('afterBulkUpdate', (async (opts) => {
+            const ids = bulkIds.get(opts);
+            bulkIds.delete(opts);
+            if (ids?.length)
+                await syncChange(opts, { upsert: await storedDocs(ids, opts) });
+        }));
+    }
+    // Sequelize re-validates attributes changed by before* hooks: validate the plaintext, not our ciphertext.
+    add('beforeValidate', ((inst) => {
+        if (!ledger.has(inst))
+            return;
+        for (const [attr, e] of ledger.entries(inst))
+            if (e.ciphertext !== null && inst.dataValues[attr] === e.ciphertext)
+                inst.dataValues[attr] = e.plaintext;
+        swapped.add(inst);
+    }));
+    add('afterValidate', ((inst) => {
+        if (!swapped.has(inst))
+            return;
+        for (const [attr, e] of ledger.entries(inst))
+            if (e.ciphertext !== null && inst.dataValues[attr] === e.plaintext)
+                inst.dataValues[attr] = e.ciphertext;
+        swapped.delete(inst);
+    }));
+    add('validationFailed', ((inst) => {
+        if (swapped.has(inst))
+            restore(inst, false);
+    }));
+    add('beforeBulkCreate', (async (insts, opts) => {
+        if (opts.individualHooks)
+            return; // each instance goes through beforeCreate
+        const work = insts.map((inst) => ({ inst, attrs: fields.filter((f) => inst.dataValues[f.attr] !== undefined) })).filter((w) => w.attrs.length);
+        if (!work.length)
+            return;
+        const upd = opts.updateOnDuplicate;
+        if (Array.isArray(upd) && upd.some((a) => plan.byAttr.has(a) || plan.indexAttrs.has(a))) {
+            throw requestError(`${table}: bulkCreate updateOnDuplicate cannot target encrypted attributes (conflicting rows keep their own ids)`);
+        }
+        if (opts.validate) {
+            // Validate plaintext now; Sequelize would otherwise validate our ciphertext after this hook.
+            const S = model.sequelize.constructor;
+            const errors = [];
+            await Promise.all(insts.map(async (inst) => {
+                try {
+                    await inst.validate({ ...opts, hooks: false });
+                }
+                catch (err) {
+                    errors.push(new S.BulkRecordError(err, inst));
+                }
+            }));
+            if (errors.length)
+                throw new S.AggregateError(errors);
+            opts.validate = false;
+        }
+        const missing = work.filter((w) => w.inst.dataValues[pk] === undefined || w.inst.dataValues[pk] === null);
+        if (missing.length) {
+            if (plan.strategy === 'sequence') {
+                const ids = await reserveIds(plan, missing.length, opts.transaction);
+                missing.forEach((w, i) => (w.inst.dataValues[pk] = ids[i]));
+                ensureFields(opts, [pk]);
+            }
+            else if (plan.strategy === 'two-phase') {
+                if (opts.ignoreDuplicates)
+                    throw requestError(`${table}: bulkCreate ignoreDuplicates cannot be combined with the two-phase write (generated ids cannot be matched to rows)`);
+                for (const w of missing)
+                    markPending(plan, w.inst, w.attrs);
+            }
+            else
+                throw requestError(`${table}.${plan.pkColumn} must be set before writing encrypted attributes`);
+        }
+        const ready = work.filter((w) => !pendingAttrs(w.inst).length);
+        await encryptInstances(plan, ready);
+        ensureFields(opts, allAttrs(fields));
+    }));
+    add('afterBulkCreate', (async (insts, opts) => {
+        if (opts.individualHooks)
+            return;
+        const pending = insts.filter((i) => pendingAttrs(i).length);
+        if (pending.length)
+            await completeTwoPhase(plan, pending, opts.transaction);
+        // Rows skipped by ignoreDuplicates come back without an id: nothing to index.
+        const docs = syncPlans ? insts.filter((i) => i.dataValues[pk] !== undefined && i.dataValues[pk] !== null).map((i) => docOf(i, syncPlans)) : [];
+        for (const inst of insts)
+            restore(inst, true);
+        if (docs.length)
+            await syncChange(opts, { upsert: docs });
+    }));
+    add('beforeBulkUpdate', ((opts) => {
+        const values = opts.attributes ?? {};
+        assertWhere(plan, opts.where);
+        if (values[pk] !== undefined)
+            throw requestError(`${table}.${plan.pkColumn}: changing the primary key would invalidate the record's ciphertext`);
+        for (const f of fields) {
+            if (f.indexAttr && values[f.indexAttr] !== undefined && values[f.attr] === undefined) {
+                throw requestError(`${table}.${f.indexAttr} is the blind index of ${f.attr} and is managed by Northstar Cipher`);
+            }
+        }
+        if (fields.some((f) => values[f.attr] !== undefined)) {
+            // Every record needs its own ciphertext: run per-instance hooks (Sequelize then updates row by row).
+            opts.individualHooks = true;
+            ensureFields(opts, allAttrs(fields.filter((f) => values[f.attr] !== undefined)));
+        }
+    }));
+    if (sync) {
+        add('beforeBulkUpdate', (async (opts) => {
+            const values = opts.attributes ?? {};
+            if (!opts.individualHooks && sync.fields.some((a) => values[a] !== undefined))
+                bulkIds.set(opts, await idsWhere(opts));
+        }));
+    }
+    add('beforeUpsert', ((values) => {
+        if (fields.some((f) => values[f.attr] !== undefined)) {
+            throw requestError(`${table}: Model.upsert() cannot encrypt (Sequelize builds the statement before hooks run); use findOrCreate()/save() instead`);
+        }
+    }));
+    for (const h of ['beforeFind', 'beforeCount', 'beforeBulkDestroy']) {
+        add(h, ((opts) => {
+            assertWhere(plan, opts?.where);
+            // Ordering by ciphertext is meaningless: refuse `order: [['title', 'ASC']]` / `order: ['title']`.
+            for (const o of Array.isArray(opts?.order) ? opts.order : opts?.order ? [opts.order] : []) {
+                const name = typeof o === 'string' ? o : Array.isArray(o) && typeof o[0] === 'string' ? o[0] : undefined;
+                if (name !== undefined && (plan.byAttr.has(name) || fields.some((f) => f.column === name)))
+                    throw requestError(`${table}.${name} is encrypted: ordering by it is not supported`);
+            }
+        }));
+    }
+    add('afterFind', (async (result, opts) => {
+        if (result === null || result === undefined)
+            return;
+        await decryptFound(plan, result, opts ?? {});
+    }));
+    // Hooks are bypassed with `hooks: false`: refuse plaintext there, and restore plaintext after failed saves.
+    const proto = model.prototype;
+    const prevSave = proto.save;
+    Object.defineProperty(proto, 'save', {
+        configurable: true,
+        writable: true,
+        value: async function save(o) {
+            if (o?.hooks === false) {
+                const changed = {};
+                for (const f of fields)
+                    if (this.isNewRecord || this.changed(f.attr))
+                        changed[f.attr] = this.dataValues[f.attr];
+                assertNoPlaintext(plan, changed, 'save()');
+            }
+            try {
+                return await prevSave.call(this, o);
+            }
+            catch (e) {
+                if (ledger.has(this))
+                    restore(this, false);
+                throw e;
+            }
+        },
+    });
+    const statics = model;
+    const prevBulkCreate = statics.bulkCreate;
+    const prevUpdate = statics.update;
+    Object.defineProperty(model, 'bulkCreate', {
+        configurable: true,
+        writable: true,
+        value: async function bulkCreate(records, o) {
+            if (o?.hooks === false)
+                for (const r of records ?? [])
+                    assertNoPlaintext(plan, r && typeof r === 'object' ? r : {}, 'bulkCreate()');
+            return prevBulkCreate.call(this, records, o);
+        },
+    });
+    Object.defineProperty(model, 'update', {
+        configurable: true,
+        writable: true,
+        value: async function update(values, o) {
+            if (o?.hooks === false)
+                assertNoPlaintext(plan, values ?? {}, 'update()');
+            return prevUpdate.call(this, values, o);
+        },
+    });
+    Object.defineProperty(model, 'cipherSearchDocuments', {
+        configurable: true,
+        writable: true,
+        value: function cipherSearchDocuments(records, names) {
+            const fp = names ? searchPlans(names) : syncPlans;
+            if (!fp)
+                throw configError(`Sequelize: ${model.name}.cipherSearchDocuments(records, fields): pass the fields to index (or configure search)`);
+            return records.map((r) => docOf(r, fp));
+        },
+    });
+    Object.defineProperty(model, 'cipherWhere', {
+        configurable: true,
+        writable: true,
+        value: async function cipherWhere(field, value) {
+            const f = plan.byAttr.get(field);
+            if (!f)
+                throw configError(`Sequelize: ${model.name}.${field} is not an encrypted attribute`);
+            if (!f.indexAttr)
+                throw configError(`Sequelize: ${model.name}.${field} is not searchable (set searchable)`);
+            const tokens = await searchTokensFor(cipher, { collection: table, field: f.column, normalization: f.normalization, values: value, keyId: options.keyId, label: `${table}.${f.column}` });
+            return { [f.indexAttr]: { [Op.in]: tokens } };
+        },
+    });
+    return model;
+}
+export { CipherError };
+//# sourceMappingURL=sequelize.js.map