@proteinjs/db 1.35.0 → 1.36.0

package/dist/src/encryption/EncryptionTokenMaintenance.d.ts

@@ -0,0 +1,34 @@
+import { QueryBuilder } from '@proteinjs/db-query';
+import type { Table } from '../Table';
+import type { Record } from '../Record';
+/**
+ * Search-token upkeep for `encrypted: { searchable: 'contains' }` columns: the same write
+ * that stores a row's ciphertext also derives the value's search tokens (words, trigrams,
+ * short prefixes — `SearchTokenizer`), fingerprints each with the row owner's index key,
+ * and maintains them as rows of the derived token table (`EncryptedColumns.tokenTableFor`)
+ * — the portable inverted index the query translator's candidate step reads.
+ *
+ * Invoked by `Db` around its DML (insert/update/delete), through a SYSTEM Db riding the
+ * same driver and ambient transaction — inside a transaction, token rows commit or roll
+ * back with the row; outside one, the token write follows the row write immediately.
+ */
+export declare class EncryptionTokenMaintenance {
+    private static readonly ID_CHUNK_SIZE;
+    private encryptedColumns;
+    private tokenizer;
+    /** Write token rows for the contains-searchable columns present in an inserted record. */
+    afterInsert(table: Table<any>, record: any, keyOwner: string, systemDb: TokenMaintenanceDb): Promise<void>;
+    /** Rewrite token rows of the touched contains-searchable columns for the updated row ids. */
+    afterUpdate(table: Table<any>, recordIds: string[], record: any, keyOwner: string, systemDb: TokenMaintenanceDb): Promise<void>;
+    /** Remove every token row of deleted records. */
+    afterDelete(table: Table<any>, deletedIds: string[], systemDb: TokenMaintenanceDb): Promise<void>;
+    private writeTokenRows;
+    private touchedContainsProps;
+    private chunk;
+}
+/** The Db surface token maintenance needs (a system Db instance — see class doc). */
+export interface TokenMaintenanceDb {
+    insert<T extends Record>(table: Table<T>, record: Omit<T, keyof Record>): Promise<T>;
+    delete<T extends Record>(table: Table<T>, query: QueryBuilder<T>): Promise<number>;
+}
+//# sourceMappingURL=EncryptionTokenMaintenance.d.ts.map

package/dist/src/encryption/EncryptionTokenMaintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionTokenMaintenance.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptionTokenMaintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC;;;;;;;;;;GAUG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAO;IAC5C,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,SAAS,CAAyB;IAE1C,0FAA0F;IACpF,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAShH,6FAA6F;IACvF,WAAW,CACf,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,GAAG,EACX,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC;IAkBhB,iDAAiD;IAC3C,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;YAgBzF,cAAc;IA6B5B,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,KAAK;CAQd;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpF"}

package/dist/src/encryption/EncryptionTokenMaintenance.js

@@ -0,0 +1,211 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionTokenMaintenance = void 0;
+var db_query_1 = require("@proteinjs/db-query");
+var EncryptedColumns_1 = require("./EncryptedColumns");
+var DataKeyStore_1 = require("./DataKeyStore");
+var SearchTokenizer_1 = require("./SearchTokenizer");
+/**
+ * Search-token upkeep for `encrypted: { searchable: 'contains' }` columns: the same write
+ * that stores a row's ciphertext also derives the value's search tokens (words, trigrams,
+ * short prefixes — `SearchTokenizer`), fingerprints each with the row owner's index key,
+ * and maintains them as rows of the derived token table (`EncryptedColumns.tokenTableFor`)
+ * — the portable inverted index the query translator's candidate step reads.
+ *
+ * Invoked by `Db` around its DML (insert/update/delete), through a SYSTEM Db riding the
+ * same driver and ambient transaction — inside a transaction, token rows commit or roll
+ * back with the row; outside one, the token write follows the row write immediately.
+ */
+var EncryptionTokenMaintenance = /** @class */ (function () {
+    function EncryptionTokenMaintenance() {
+        this.encryptedColumns = new EncryptedColumns_1.EncryptedColumns();
+        this.tokenizer = new SearchTokenizer_1.SearchTokenizer();
+    }
+    /** Write token rows for the contains-searchable columns present in an inserted record. */
+    EncryptionTokenMaintenance.prototype.afterInsert = function (table, record, keyOwner, systemDb) {
+        return __awaiter(this, void 0, void 0, function () {
+            var touched;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        touched = this.touchedContainsProps(table, record);
+                        if (touched.length === 0) {
+                            return [2 /*return*/];
+                        }
+                        return [4 /*yield*/, this.writeTokenRows(table, [record.id], record, touched, keyOwner, systemDb)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** Rewrite token rows of the touched contains-searchable columns for the updated row ids. */
+    EncryptionTokenMaintenance.prototype.afterUpdate = function (table, recordIds, record, keyOwner, systemDb) {
+        return __awaiter(this, void 0, void 0, function () {
+            var touched, tokenTable, touchedColumnNames, _i, _a, idsChunk, deleteQb;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        touched = this.touchedContainsProps(table, record);
+                        if (touched.length === 0 || recordIds.length === 0) {
+                            return [2 /*return*/];
+                        }
+                        tokenTable = this.encryptedColumns.tokenTableFor(table);
+                        touchedColumnNames = touched.map(function (prop) { return table.columns[prop].name; });
+                        _i = 0, _a = this.chunk(recordIds, EncryptionTokenMaintenance.ID_CHUNK_SIZE);
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        idsChunk = _a[_i];
+                        deleteQb = new db_query_1.QueryBuilder(tokenTable.name)
+                            .condition({ field: 'recordId', operator: 'IN', value: idsChunk })
+                            .condition({ field: 'columnName', operator: 'IN', value: touchedColumnNames });
+                        return [4 /*yield*/, systemDb.delete(tokenTable, deleteQb)];
+                    case 2:
+                        _b.sent();
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [4 /*yield*/, this.writeTokenRows(table, recordIds, record, touched, keyOwner, systemDb)];
+                    case 5:
+                        _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** Remove every token row of deleted records. */
+    EncryptionTokenMaintenance.prototype.afterDelete = function (table, deletedIds, systemDb) {
+        return __awaiter(this, void 0, void 0, function () {
+            var tokenTable, _i, _a, idsChunk, deleteQb;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        tokenTable = this.encryptedColumns.tokenTableFor(table);
+                        if (!tokenTable || deletedIds.length === 0) {
+                            return [2 /*return*/];
+                        }
+                        _i = 0, _a = this.chunk(deletedIds, EncryptionTokenMaintenance.ID_CHUNK_SIZE);
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        idsChunk = _a[_i];
+                        deleteQb = new db_query_1.QueryBuilder(tokenTable.name).condition({
+                            field: 'recordId',
+                            operator: 'IN',
+                            value: idsChunk,
+                        });
+                        return [4 /*yield*/, systemDb.delete(tokenTable, deleteQb)];
+                    case 2:
+                        _b.sent();
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    EncryptionTokenMaintenance.prototype.writeTokenRows = function (table, recordIds, record, touchedProps, keyOwner, systemDb) {
+        return __awaiter(this, void 0, void 0, function () {
+            var tokenTable, writeKey, _i, touchedProps_1, prop, value, columnName, fingerprints, _a, recordIds_1, recordId, _b, fingerprints_1, token;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        tokenTable = this.encryptedColumns.tokenTableFor(table);
+                        return [4 /*yield*/, new DataKeyStore_1.DataKeyStore().getWriteKey(keyOwner)];
+                    case 1:
+                        writeKey = _c.sent();
+                        _i = 0, touchedProps_1 = touchedProps;
+                        _c.label = 2;
+                    case 2:
+                        if (!(_i < touchedProps_1.length)) return [3 /*break*/, 9];
+                        prop = touchedProps_1[_i];
+                        value = record[prop];
+                        if (value === null) {
+                            return [3 /*break*/, 8]; // null values carry no tokens
+                        }
+                        columnName = table.columns[prop].name;
+                        fingerprints = this.tokenizer.fingerprints(this.tokenizer.tokensForValue(String(value)), writeKey.indexKey);
+                        _a = 0, recordIds_1 = recordIds;
+                        _c.label = 3;
+                    case 3:
+                        if (!(_a < recordIds_1.length)) return [3 /*break*/, 8];
+                        recordId = recordIds_1[_a];
+                        _b = 0, fingerprints_1 = fingerprints;
+                        _c.label = 4;
+                    case 4:
+                        if (!(_b < fingerprints_1.length)) return [3 /*break*/, 7];
+                        token = fingerprints_1[_b];
+                        return [4 /*yield*/, systemDb.insert(tokenTable, { recordId: recordId, columnName: columnName, token: token })];
+                    case 5:
+                        _c.sent();
+                        _c.label = 6;
+                    case 6:
+                        _b++;
+                        return [3 /*break*/, 4];
+                    case 7:
+                        _a++;
+                        return [3 /*break*/, 3];
+                    case 8:
+                        _i++;
+                        return [3 /*break*/, 2];
+                    case 9: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    EncryptionTokenMaintenance.prototype.touchedContainsProps = function (table, record) {
+        return this.encryptedColumns.containsProps(table).filter(function (prop) { return typeof record[prop] !== 'undefined'; });
+    };
+    EncryptionTokenMaintenance.prototype.chunk = function (items, size) {
+        var chunks = [];
+        for (var i = 0; i < items.length; i += size) {
+            chunks.push(items.slice(i, i + size));
+        }
+        return chunks;
+    };
+    EncryptionTokenMaintenance.ID_CHUNK_SIZE = 500;
+    return EncryptionTokenMaintenance;
+}());
+exports.EncryptionTokenMaintenance = EncryptionTokenMaintenance;
+//# sourceMappingURL=EncryptionTokenMaintenance.js.map

package/dist/src/encryption/EncryptionTokenMaintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionTokenMaintenance.js","sourceRoot":"","sources":["../../../src/encryption/EncryptionTokenMaintenance.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAAmD;AAGnD,uDAA6E;AAC7E,+CAA8C;AAC9C,qDAAoD;AAEpD;;;;;;;;;;GAUG;AACH;IAAA;QAEU,qBAAgB,GAAG,IAAI,mCAAgB,EAAE,CAAC;QAC1C,cAAS,GAAG,IAAI,iCAAe,EAAE,CAAC;IA+F5C,CAAC;IA7FC,0FAA0F;IACpF,gDAAW,GAAjB,UAAkB,KAAiB,EAAE,MAAW,EAAE,QAAgB,EAAE,QAA4B;;;;;;wBACxF,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;4BACxB,sBAAO;yBACR;wBAED,qBAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAA;;wBAAlF,SAAkF,CAAC;;;;;KACpF;IAED,6FAA6F;IACvF,gDAAW,GAAjB,UACE,KAAiB,EACjB,SAAmB,EACnB,MAAW,EACX,QAAgB,EAChB,QAA4B;;;;;;wBAEtB,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;4BAClD,sBAAO;yBACR;wBAEK,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAE,CAAC;wBACzD,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAC,IAAI,IAAK,OAAE,KAAK,CAAC,OAAe,CAAC,IAAI,CAAsB,CAAC,IAAI,EAAvD,CAAuD,CAAC,CAAC;8BACpB,EAA/D,KAAA,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,CAAC,aAAa,CAAC;;;6BAA/D,CAAA,cAA+D,CAAA;wBAA3E,QAAQ;wBACX,QAAQ,GAAG,IAAI,uBAAY,CAAwB,UAAU,CAAC,IAAI,CAAC;6BACtE,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;6BACjE,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBACjF,qBAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAA;;wBAA3C,SAA2C,CAAC;;;wBAJvB,IAA+D,CAAA;;4BAOtF,qBAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAA;;wBAAhF,SAAgF,CAAC;;;;;KAClF;IAED,iDAAiD;IAC3C,gDAAW,GAAjB,UAAkB,KAAiB,EAAE,UAAoB,EAAE,QAA4B;;;;;;wBAC/E,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;wBAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE;4BAC1C,sBAAO;yBACR;8BAEsF,EAAhE,KAAA,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,0BAA0B,CAAC,aAAa,CAAC;;;6BAAhE,CAAA,cAAgE,CAAA;wBAA5E,QAAQ;wBACX,QAAQ,GAAG,IAAI,uBAAY,CAAwB,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;4BAClF,KAAK,EAAE,UAAU;4BACjB,QAAQ,EAAE,IAAI;4BACd,KAAK,EAAE,QAAQ;yBAChB,CAAC,CAAC;wBACH,qBAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAA;;wBAA3C,SAA2C,CAAC;;;wBANvB,IAAgE,CAAA;;;;;;KAQxF;IAEa,mDAAc,GAA5B,UACE,KAAiB,EACjB,SAAmB,EACnB,MAAW,EACX,YAAsB,EACtB,QAAgB,EAChB,QAA4B;;;;;;wBAEtB,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAE,CAAC;wBAC9C,qBAAM,IAAI,2BAAY,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAA;;wBAAzD,QAAQ,GAAG,SAA8C;8BAChC,EAAZ,6BAAY;;;6BAAZ,CAAA,0BAAY,CAAA;wBAApB,IAAI;wBACP,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;wBAC3B,IAAI,KAAK,KAAK,IAAI,EAAE;4BAClB,wBAAS,CAAC,8BAA8B;yBACzC;wBAEK,UAAU,GAAK,KAAK,CAAC,OAAe,CAAC,IAAI,CAAsB,CAAC,IAAI,CAAC;wBACrE,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;8BAClF,EAAT,uBAAS;;;6BAAT,CAAA,uBAAS,CAAA;wBAArB,QAAQ;8BACe,EAAZ,6BAAY;;;6BAAZ,CAAA,0BAAY,CAAA;wBAArB,KAAK;wBACd,qBAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,QAAQ,UAAA,EAAE,UAAU,YAAA,EAAE,KAAK,OAAA,EAG9D,CAAC,EAAA;;wBAHF,SAGE,CAAC;;;wBAJe,IAAY,CAAA;;;wBADX,IAAS,CAAA;;;wBARf,IAAY,CAAA;;;;;;KAiBhC;IAEO,yDAAoB,GAA5B,UAA6B,KAAiB,EAAE,MAAW;QACzD,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,WAAW,EAAnC,CAAmC,CAAC,CAAC;IAC1G,CAAC;IAEO,0CAAK,GAAb,UAAiB,KAAU,EAAE,IAAY;QACvC,IAAM,MAAM,GAAU,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;SACvC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAhGuB,wCAAa,GAAG,GAAG,AAAN,CAAO;IAiG9C,iCAAC;CAAA,AAlGD,IAkGC;AAlGY,gEAA0B"}

package/dist/src/encryption/InMemoryMasterKeyProvider.d.ts

@@ -0,0 +1,20 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { MasterKeyProvider } from './MasterKeyProvider';
+/**
+ * A `MasterKeyProvider` holding the master key in process memory. For tests and local
+ * development only — a production deployment keeps its master key in a vault
+ * (`GcpKmsMasterKeyProvider`), where the key material never enters the app process.
+ *
+ * Wraps with AES-256-GCM. Constructing with the same `secret` yields a provider that can
+ * unwrap keys wrapped by a previous instance (test fixtures across processes); constructing
+ * with no secret generates a random master key for the life of the process.
+ */
+export declare class InMemoryMasterKeyProvider implements MasterKeyProvider {
+    private masterKey;
+    constructor(secret?: string);
+    wrapDataKey(plaintextKeyMaterial: Buffer): Promise<string>;
+    unwrapDataKey(wrappedKeyMaterial: string): Promise<Buffer>;
+    getMasterKeyId(): string;
+}
+//# sourceMappingURL=InMemoryMasterKeyProvider.d.ts.map

package/dist/src/encryption/InMemoryMasterKeyProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryMasterKeyProvider.d.ts","sourceRoot":"","sources":["../../../src/encryption/InMemoryMasterKeyProvider.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,SAAS,CAAS;gBAEd,MAAM,CAAC,EAAE,MAAM;IAIrB,WAAW,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1D,aAAa,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhE,cAAc,IAAI,MAAM;CAGzB"}

package/dist/src/encryption/InMemoryMasterKeyProvider.js

@@ -0,0 +1,87 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryMasterKeyProvider = void 0;
+var crypto_1 = require("crypto");
+var Base64Url_1 = require("./Base64Url");
+/**
+ * A `MasterKeyProvider` holding the master key in process memory. For tests and local
+ * development only — a production deployment keeps its master key in a vault
+ * (`GcpKmsMasterKeyProvider`), where the key material never enters the app process.
+ *
+ * Wraps with AES-256-GCM. Constructing with the same `secret` yields a provider that can
+ * unwrap keys wrapped by a previous instance (test fixtures across processes); constructing
+ * with no secret generates a random master key for the life of the process.
+ */
+var InMemoryMasterKeyProvider = /** @class */ (function () {
+    function InMemoryMasterKeyProvider(secret) {
+        this.masterKey = secret ? (0, crypto_1.createHash)('sha256').update(secret).digest() : (0, crypto_1.randomBytes)(32);
+    }
+    InMemoryMasterKeyProvider.prototype.wrapDataKey = function (plaintextKeyMaterial) {
+        return __awaiter(this, void 0, void 0, function () {
+            var iv, cipher, ciphertext, authTag;
+            return __generator(this, function (_a) {
+                iv = (0, crypto_1.randomBytes)(12);
+                cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', this.masterKey, iv);
+                ciphertext = Buffer.concat([cipher.update(plaintextKeyMaterial), cipher.final()]);
+                authTag = cipher.getAuthTag();
+                return [2 /*return*/, Base64Url_1.Base64Url.encode(Buffer.concat([iv, authTag, ciphertext]))];
+            });
+        });
+    };
+    InMemoryMasterKeyProvider.prototype.unwrapDataKey = function (wrappedKeyMaterial) {
+        return __awaiter(this, void 0, void 0, function () {
+            var bytes, iv, authTag, ciphertext, decipher;
+            return __generator(this, function (_a) {
+                bytes = Base64Url_1.Base64Url.decode(wrappedKeyMaterial);
+                iv = bytes.subarray(0, 12);
+                authTag = bytes.subarray(12, 28);
+                ciphertext = bytes.subarray(28);
+                decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', this.masterKey, iv);
+                decipher.setAuthTag(authTag);
+                return [2 /*return*/, Buffer.concat([decipher.update(ciphertext), decipher.final()])];
+            });
+        });
+    };
+    InMemoryMasterKeyProvider.prototype.getMasterKeyId = function () {
+        return 'in-memory';
+    };
+    return InMemoryMasterKeyProvider;
+}());
+exports.InMemoryMasterKeyProvider = InMemoryMasterKeyProvider;
+//# sourceMappingURL=InMemoryMasterKeyProvider.js.map

package/dist/src/encryption/InMemoryMasterKeyProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryMasterKeyProvider.js","sourceRoot":"","sources":["../../../src/encryption/InMemoryMasterKeyProvider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAmF;AACnF,yCAAwC;AAGxC;;;;;;;;GAQG;AACH;IAGE,mCAAY,MAAe;QACzB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAEK,+CAAW,GAAjB,UAAkB,oBAA4B;;;;gBACtC,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;gBACrB,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC3D,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAClF,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpC,sBAAO,qBAAS,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAC;;;KACnE;IAEK,iDAAa,GAAnB,UAAoB,kBAA0B;;;;gBACtC,KAAK,GAAG,qBAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAC7C,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACjC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChC,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACrE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC7B,sBAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAC;;;KACvE;IAED,kDAAc,GAAd;QACE,OAAO,WAAW,CAAC;IACrB,CAAC;IACH,gCAAC;AAAD,CAAC,AA5BD,IA4BC;AA5BY,8DAAyB"}

package/dist/src/encryption/MasterKeyProvider.d.ts

@@ -0,0 +1,27 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * The master-key seam of column encryption (see `EncryptedColumnConfig`).
+ *
+ * One master key exists per deployment, held in a key vault (Cloud KMS in production, an
+ * in-memory key in tests). The master key never encrypts row data directly — it wraps
+ * (encrypts) each user's randomly generated data key, and those per-user data keys encrypt
+ * the rows in that user's scope. The vault is therefore called once per data key
+ * (unwrap-once-per-key caching lives in `DataKeyStore`), never per row.
+ *
+ * Implementations:
+ * - `InMemoryMasterKeyProvider` (this package) — tests and local development.
+ * - `GcpKmsMasterKeyProvider` (`@proteinjs/db-encryption-driver-gcp-kms`) — Cloud KMS.
+ */
+export interface MasterKeyProvider {
+    /**
+     * Encrypt (wrap) raw data-key material under the master key.
+     * @returns an opaque string safe to store in the data-key table
+     */
+    wrapDataKey(plaintextKeyMaterial: Buffer): Promise<string>;
+    /** Decrypt (unwrap) previously wrapped data-key material. */
+    unwrapDataKey(wrappedKeyMaterial: string): Promise<Buffer>;
+    /** Stable identifier of the master key (a KMS resource name, or 'in-memory') — observability only. */
+    getMasterKeyId(): string;
+}
+//# sourceMappingURL=MasterKeyProvider.d.ts.map

package/dist/src/encryption/MasterKeyProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MasterKeyProvider.d.ts","sourceRoot":"","sources":["../../../src/encryption/MasterKeyProvider.ts"],"names":[],"mappings":";;AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3D,6DAA6D;IAC7D,aAAa,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3D,sGAAsG;IACtG,cAAc,IAAI,MAAM,CAAC;CAC1B"}

package/dist/src/encryption/MasterKeyProvider.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=MasterKeyProvider.js.map

package/dist/src/encryption/MasterKeyProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MasterKeyProvider.js","sourceRoot":"","sources":["../../../src/encryption/MasterKeyProvider.ts"],"names":[],"mappings":""}

package/dist/src/encryption/SearchTokenizer.d.ts

@@ -0,0 +1,49 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * Search tokens and keyed fingerprints for encrypted columns
+ * (`encrypted: { searchable: 'contains' | 'equality' }`).
+ *
+ * Definitions:
+ * - **Search token** — a normalized fragment of a text value: its lowercased words, each
+ *   word's trigrams (three-letter fragments), and each word's 1- and 2-letter prefixes
+ *   (so 1–2 character queries behave as word-prefix search).
+ * - **Keyed fingerprint (HMAC-SHA256)** — computable only with the owner's index key
+ *   (`DataKeyMaterial.indexKey`); without it, stored fingerprints can be neither created
+ *   nor reversed, so raw database access cannot probe ("does any title contain X?").
+ *
+ * Query-side cover: a candidate row must hold ALL of the query's fragment fingerprints.
+ * The cover can over-match (fragments present but not contiguous) and — for query words of
+ * ≥3 characters — can never under-match; the query layer verifies every candidate against
+ * the decrypted value before returning it (the pg_trgm recheck semantics), so results are
+ * exact. Documented narrowing: a 1–2 character query WORD matches word beginnings only
+ * (a 1–2 character mid-word substring is unsupported and behaves as prefix search).
+ *
+ * Equality fingerprints cover the EXACT serialized value (no normalization): `=` keeps its
+ * native case-sensitive semantics with no recheck, and a unique index on the fingerprint
+ * column enforces per-owner value uniqueness.
+ */
+export declare class SearchTokenizer {
+    /** All write-side tokens of `value` (deduplicated, un-fingerprinted). */
+    tokensForValue(value: string): string[];
+    /**
+     * The query-side fragment cover of `query`: for each query word, its trigrams (≥3 chars)
+     * or its prefix token (1–2 chars). Every fragment must match for a row to be a candidate.
+     */
+    fragmentsForQuery(query: string): string[];
+    /** Keyed fingerprint of one token. */
+    fingerprint(token: string, indexKey: Buffer): string;
+    fingerprints(tokens: string[], indexKey: Buffer): string[];
+    /** Whole-value equality fingerprint — over the exact serialized value (see class doc). */
+    equalityFingerprint(value: string, indexKey: Buffer): string;
+    /**
+     * The declared bounded reveal for `encrypted: { sortKey: { revealPrefix: N } }`: the
+     * normalized (lowercased) first N characters, stored beside the ciphertext for native
+     * ORDER BY. Raw database access can read those N characters — the declared, documented
+     * leak, chosen at the schema, never the default.
+     */
+    sortPrefix(value: string, revealPrefix: number): string;
+    private words;
+    private trigrams;
+}
+//# sourceMappingURL=SearchTokenizer.d.ts.map

package/dist/src/encryption/SearchTokenizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SearchTokenizer.d.ts","sourceRoot":"","sources":["../../../src/encryption/SearchTokenizer.ts"],"names":[],"mappings":";;AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,eAAe;IAC1B,yEAAyE;IACzE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAgBvC;;;OAGG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAe1C,sCAAsC;IACtC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIpD,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAI1D,0FAA0F;IAC1F,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI5D;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAIvD,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,QAAQ;CAQjB"}

package/dist/src/encryption/SearchTokenizer.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SearchTokenizer = void 0;
+var crypto_1 = require("crypto");
+var Base64Url_1 = require("./Base64Url");
+/**
+ * Search tokens and keyed fingerprints for encrypted columns
+ * (`encrypted: { searchable: 'contains' | 'equality' }`).
+ *
+ * Definitions:
+ * - **Search token** — a normalized fragment of a text value: its lowercased words, each
+ *   word's trigrams (three-letter fragments), and each word's 1- and 2-letter prefixes
+ *   (so 1–2 character queries behave as word-prefix search).
+ * - **Keyed fingerprint (HMAC-SHA256)** — computable only with the owner's index key
+ *   (`DataKeyMaterial.indexKey`); without it, stored fingerprints can be neither created
+ *   nor reversed, so raw database access cannot probe ("does any title contain X?").
+ *
+ * Query-side cover: a candidate row must hold ALL of the query's fragment fingerprints.
+ * The cover can over-match (fragments present but not contiguous) and — for query words of
+ * ≥3 characters — can never under-match; the query layer verifies every candidate against
+ * the decrypted value before returning it (the pg_trgm recheck semantics), so results are
+ * exact. Documented narrowing: a 1–2 character query WORD matches word beginnings only
+ * (a 1–2 character mid-word substring is unsupported and behaves as prefix search).
+ *
+ * Equality fingerprints cover the EXACT serialized value (no normalization): `=` keeps its
+ * native case-sensitive semantics with no recheck, and a unique index on the fingerprint
+ * column enforces per-owner value uniqueness.
+ */
+var SearchTokenizer = /** @class */ (function () {
+    function SearchTokenizer() {
+    }
+    /** All write-side tokens of `value` (deduplicated, un-fingerprinted). */
+    SearchTokenizer.prototype.tokensForValue = function (value) {
+        var tokens = new Set();
+        for (var _i = 0, _a = this.words(value); _i < _a.length; _i++) {
+            var word = _a[_i];
+            tokens.add("w:".concat(word));
+            tokens.add("p:".concat(word.slice(0, 1)));
+            if (word.length >= 2) {
+                tokens.add("p:".concat(word.slice(0, 2)));
+            }
+            for (var _b = 0, _c = this.trigrams(word); _b < _c.length; _b++) {
+                var trigram = _c[_b];
+                tokens.add("t:".concat(trigram));
+            }
+        }
+        return Array.from(tokens);
+    };
+    /**
+     * The query-side fragment cover of `query`: for each query word, its trigrams (≥3 chars)
+     * or its prefix token (1–2 chars). Every fragment must match for a row to be a candidate.
+     */
+    SearchTokenizer.prototype.fragmentsForQuery = function (query) {
+        var fragments = new Set();
+        for (var _i = 0, _a = this.words(query); _i < _a.length; _i++) {
+            var word = _a[_i];
+            if (word.length >= 3) {
+                for (var _b = 0, _c = this.trigrams(word); _b < _c.length; _b++) {
+                    var trigram = _c[_b];
+                    fragments.add("t:".concat(trigram));
+                }
+            }
+            else {
+                fragments.add("p:".concat(word));
+            }
+        }
+        return Array.from(fragments);
+    };
+    /** Keyed fingerprint of one token. */
+    SearchTokenizer.prototype.fingerprint = function (token, indexKey) {
+        return Base64Url_1.Base64Url.encode((0, crypto_1.createHmac)('sha256', indexKey).update(token, 'utf8').digest());
+    };
+    SearchTokenizer.prototype.fingerprints = function (tokens, indexKey) {
+        var _this = this;
+        return tokens.map(function (token) { return _this.fingerprint(token, indexKey); });
+    };
+    /** Whole-value equality fingerprint — over the exact serialized value (see class doc). */
+    SearchTokenizer.prototype.equalityFingerprint = function (value, indexKey) {
+        return Base64Url_1.Base64Url.encode((0, crypto_1.createHmac)('sha256', indexKey).update("eq:".concat(value), 'utf8').digest());
+    };
+    /**
+     * The declared bounded reveal for `encrypted: { sortKey: { revealPrefix: N } }`: the
+     * normalized (lowercased) first N characters, stored beside the ciphertext for native
+     * ORDER BY. Raw database access can read those N characters — the declared, documented
+     * leak, chosen at the schema, never the default.
+     */
+    SearchTokenizer.prototype.sortPrefix = function (value, revealPrefix) {
+        return value.toLowerCase().slice(0, revealPrefix);
+    };
+    SearchTokenizer.prototype.words = function (text) {
+        return text
+            .toLowerCase()
+            .split(/[^\p{L}\p{N}]+/u)
+            .filter(function (word) { return word.length > 0; });
+    };
+    SearchTokenizer.prototype.trigrams = function (word) {
+        var trigrams = [];
+        for (var i = 0; i + 3 <= word.length; i++) {
+            trigrams.push(word.slice(i, i + 3));
+        }
+        return trigrams;
+    };
+    return SearchTokenizer;
+}());
+exports.SearchTokenizer = SearchTokenizer;
+//# sourceMappingURL=SearchTokenizer.js.map

package/dist/src/encryption/SearchTokenizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SearchTokenizer.js","sourceRoot":"","sources":["../../../src/encryption/SearchTokenizer.ts"],"names":[],"mappings":";;;AAAA,iCAAoC;AACpC,yCAAwC;AAExC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;IAAA;IA4EA,CAAC;IA3EC,yEAAyE;IACzE,wCAAc,GAAd,UAAe,KAAa;QAC1B,IAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAmB,UAAiB,EAAjB,KAAA,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAjB,cAAiB,EAAjB,IAAiB,EAAE;YAAjC,IAAM,IAAI,SAAA;YACb,MAAM,CAAC,GAAG,CAAC,YAAK,IAAI,CAAE,CAAC,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,YAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,CAAC,YAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;aACrC;YACD,KAAsB,UAAmB,EAAnB,KAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAnB,cAAmB,EAAnB,IAAmB,EAAE;gBAAtC,IAAM,OAAO,SAAA;gBAChB,MAAM,CAAC,GAAG,CAAC,YAAK,OAAO,CAAE,CAAC,CAAC;aAC5B;SACF;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,2CAAiB,GAAjB,UAAkB,KAAa;QAC7B,IAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAmB,UAAiB,EAAjB,KAAA,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAjB,cAAiB,EAAjB,IAAiB,EAAE;YAAjC,IAAM,IAAI,SAAA;YACb,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE;gBACpB,KAAsB,UAAmB,EAAnB,KAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAnB,cAAmB,EAAnB,IAAmB,EAAE;oBAAtC,IAAM,OAAO,SAAA;oBAChB,SAAS,CAAC,GAAG,CAAC,YAAK,OAAO,CAAE,CAAC,CAAC;iBAC/B;aACF;iBAAM;gBACL,SAAS,CAAC,GAAG,CAAC,YAAK,IAAI,CAAE,CAAC,CAAC;aAC5B;SACF;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,sCAAsC;IACtC,qCAAW,GAAX,UAAY,KAAa,EAAE,QAAgB;QACzC,OAAO,qBAAS,CAAC,MAAM,CAAC,IAAA,mBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,sCAAY,GAAZ,UAAa,MAAgB,EAAE,QAAgB;QAA/C,iBAEC;QADC,OAAO,MAAM,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAjC,CAAiC,CAAC,CAAC;IAClE,CAAC;IAED,0FAA0F;IAC1F,6CAAmB,GAAnB,UAAoB,KAAa,EAAE,QAAgB;QACjD,OAAO,qBAAS,CAAC,MAAM,CAAC,IAAA,mBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAM,KAAK,CAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACH,oCAAU,GAAV,UAAW,KAAa,EAAE,YAAoB;QAC5C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAEO,+BAAK,GAAb,UAAc,IAAY;QACxB,OAAO,IAAI;aACR,WAAW,EAAE;aACb,KAAK,CAAC,iBAAiB,CAAC;aACxB,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,CAAC,MAAM,GAAG,CAAC,EAAf,CAAe,CAAC,CAAC;IACvC,CAAC;IAEO,kCAAQ,GAAhB,UAAiB,IAAY;QAC3B,IAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACrC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IACH,sBAAC;AAAD,CAAC,AA5ED,IA4EC;AA5EY,0CAAe"}

package/dist/src/schema/TableManager.d.ts

@@ -40,6 +40,16 @@ export declare class TableManager {
      */
     loadTables(): Promise<void>;
     loadTable(table: Table<any>): Promise<void>;
+    private loadSingleTable;
+    /**
+     * Column-encryption schema pass (`ColumnOptions.encrypted`): validate declarations,
+     * inject the derived companion columns, and append each table's derived search-token
+     * table so it is created/altered alongside its base table. When the deployment turns on
+     * `requireEncryptedDeclarations` (or `DB_REQUIRE_ENCRYPTED_DECLARATIONS=true`), every
+     * text-holding column must declare `encrypted` — registration fails loudly here otherwise.
+     */
+    private prepareTablesForLoad;
+    private requireEncryptedDeclarations;
     private alterTableIfChanged;
     /**
      * Reconcile a create/alter DDL failure against a concurrent schema change, closing the

package/dist/src/schema/TableManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TableManager.d.ts","sourceRoot":"","sources":["../../../src/schema/TableManager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAoC,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAgB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAIjC;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;gBAC/C,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE;IAYhF,MAAM,CAAC,QAAQ,CAAC,mBAAmB,MAAM;CAC1C;AAKD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;CAC3C;AAED,qBAAa,YAAY;IACvB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAO;IAC9D,OAAO,CAAC,MAAM,CAA2F;IACzG,OAAO,CAAC,QAAQ,CAAW;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;gBAGpC,QAAQ,EAAE,QAAQ,EAClB,iBAAiB,EAAE,iBAAiB,EACpC,gBAAgB,EAAE,gBAAgB,EAClC,cAAc,CAAC,EAAE,cAAc;IAQ3B,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;IAInC;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YAgBnC,mBAAmB;IAcjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,+BAA+B;IAiB7C;;;;;;;;;;;OAWG;YACW,wBAAwB;IAyCtC;sEACkE;IAClE,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,+BAA+B;IAwDvC,OAAO,CAAC,gBAAgB;YAgBV,eAAe;YA6Ff,kBAAkB;IA+ChC;;;;;;;OAOG;YACW,6BAA6B;IAe3C;;;;OAIG;YACW,uBAAuB;CAyCtC"}
+{"version":3,"file":"TableManager.d.ts","sourceRoot":"","sources":["../../../src/schema/TableManager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAoC,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAgB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAMjC;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;gBAC/C,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE;IAYhF,MAAM,CAAC,QAAQ,CAAC,mBAAmB,MAAM;CAC1C;AAKD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;CAC3C;AAED,qBAAa,YAAY;IACvB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAO;IAC9D,OAAO,CAAC,MAAM,CAA2F;IACzG,OAAO,CAAC,QAAQ,CAAW;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;gBAGpC,QAAQ,EAAE,QAAQ,EAClB,iBAAiB,EAAE,iBAAiB,EACpC,gBAAgB,EAAE,gBAAgB,EAClC,cAAc,CAAC,EAAE,cAAc;IAQ3B,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;IAInC;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YAMnC,eAAe;IAgB7B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAmB5B,OAAO,CAAC,4BAA4B;YAQtB,mBAAmB;IAcjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,+BAA+B;IAiB7C;;;;;;;;;;;OAWG;YACW,wBAAwB;IAyCtC;sEACkE;IAClE,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,+BAA+B;IAwDvC,OAAO,CAAC,gBAAgB;YAgBV,eAAe;YA6Ff,kBAAkB;IA+ChC;;;;;;;OAOG;YACW,6BAA6B;IAe3C;;;;OAIG;YACW,uBAAuB;CAyCtC"}