@proteinjs/db 1.35.0 → 1.36.0

package/dist/src/encryption/DataKeyStore.js

@@ -0,0 +1,481 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataKeyStore = exports.EncryptionKeyUnavailableError = void 0;
+var crypto_1 = require("crypto");
+var logger_1 = require("@proteinjs/logger");
+var DbEncryptionConfig_1 = require("./DbEncryptionConfig");
+var DataEncryptionKeyTable_1 = require("./DataEncryptionKeyTable");
+/**
+ * Decrypt was asked for a key that does not exist — most often because the owner's keys were
+ * crypto-shredded (account deletion): the ciphertext is permanently unreadable, by design.
+ */
+var EncryptionKeyUnavailableError = /** @class */ (function (_super) {
+    __extends(EncryptionKeyUnavailableError, _super);
+    function EncryptionKeyUnavailableError(owner, version) {
+        var _this = _super.call(this, "No data key exists for owner '".concat(owner, "' version ").concat(version, ". If the owner's keys were ") +
+            "deleted (crypto-shred), rows encrypted under them are permanently unreadable.") || this;
+        _this.name = 'EncryptionKeyUnavailableError';
+        Object.setPrototypeOf(_this, EncryptionKeyUnavailableError.prototype);
+        return _this;
+    }
+    return EncryptionKeyUnavailableError;
+}(Error));
+exports.EncryptionKeyUnavailableError = EncryptionKeyUnavailableError;
+/**
+ * Per-owner data keys for column encryption: creation, unwrap-once caching, rotation,
+ * retirement, and crypto-shred. Key rows live in `DataEncryptionKeyTable`, wrapped by the
+ * deployment's `MasterKeyProvider`; the vault is called once per key (then cached), never
+ * per row.
+ *
+ * All database access runs as system, OUTSIDE any ambient transaction: a key row must be
+ * durable independent of the caller's transaction outcome, because unwrapped material is
+ * cached in-process the moment it exists — a key created inside a transaction that later
+ * rolls back would leave the cache claiming a key the database lost. An orphaned key row
+ * from a rolled-back first write is harmless (a key no envelope names).
+ *
+ * The caches live on the global object (the per-package-install duplicate-module pattern —
+ * see `Db.getDefaultDbDriver`), so every live copy of this package shares one cache.
+ */
+var DataKeyStore = /** @class */ (function () {
+    function DataKeyStore() {
+        this.logger = new logger_1.Logger({ name: this.constructor.name });
+        this.table = new DataEncryptionKeyTable_1.DataEncryptionKeyTable();
+    }
+    /**
+     * The key that encrypts new writes for `owner`: the highest active version, created on
+     * first use (each owner gets a randomly generated data key, wrapped by the master key).
+     */
+    DataKeyStore.prototype.getWriteKey = function (owner) {
+        return __awaiter(this, void 0, void 0, function () {
+            var rows, active;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.requireOwner(owner);
+                        return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 1:
+                        rows = _a.sent();
+                        active = this.highestActive(rows);
+                        if (!!active) return [3 /*break*/, 4];
+                        return [4 /*yield*/, this.createKeyVersion(owner, 1)];
+                    case 2:
+                        _a.sent();
+                        this.evictOwner(owner);
+                        return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 3:
+                        rows = _a.sent();
+                        active = this.highestActive(rows);
+                        if (!active) {
+                            throw new EncryptionKeyUnavailableError(owner, 1);
+                        }
+                        _a.label = 4;
+                    case 4: return [4 /*yield*/, this.unwrap(active)];
+                    case 5: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    /** The key an envelope names — any status; decrypt must work until the key is shredded. */
+    DataKeyStore.prototype.getKeyByVersion = function (owner, version) {
+        return __awaiter(this, void 0, void 0, function () {
+            var rows, row, freshRows, freshRow;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 1:
+                        rows = _a.sent();
+                        row = rows.find(function (candidate) { return candidate.version === version; });
+                        if (!!row) return [3 /*break*/, 4];
+                        // The row list may be cached from before this version existed (e.g. a fresh rotation
+                        // in another process) — refresh once before declaring the key gone.
+                        this.evictOwner(owner);
+                        return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 2:
+                        freshRows = _a.sent();
+                        freshRow = freshRows.find(function (candidate) { return candidate.version === version; });
+                        if (!freshRow) {
+                            throw new EncryptionKeyUnavailableError(owner, version);
+                        }
+                        return [4 /*yield*/, this.unwrap(freshRow)];
+                    case 3: return [2 /*return*/, _a.sent()];
+                    case 4: return [4 /*yield*/, this.unwrap(row)];
+                    case 5: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    /**
+     * The index keys a query fingerprints with: every ACTIVE version of every accessible
+     * owner (normally one per owner; two during a rotation window). Owners with no keys yet
+     * contribute nothing — they cannot have encrypted rows.
+     */
+    DataKeyStore.prototype.getQueryIndexKeys = function (owners) {
+        return __awaiter(this, void 0, void 0, function () {
+            var keys, _i, owners_1, owner, rows, _a, rows_1, row, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        keys = [];
+                        _i = 0, owners_1 = owners;
+                        _d.label = 1;
+                    case 1:
+                        if (!(_i < owners_1.length)) return [3 /*break*/, 7];
+                        owner = owners_1[_i];
+                        return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 2:
+                        rows = _d.sent();
+                        _a = 0, rows_1 = rows;
+                        _d.label = 3;
+                    case 3:
+                        if (!(_a < rows_1.length)) return [3 /*break*/, 6];
+                        row = rows_1[_a];
+                        if (!(row.status === 'active')) return [3 /*break*/, 5];
+                        _c = (_b = keys).push;
+                        return [4 /*yield*/, this.unwrap(row)];
+                    case 4:
+                        _c.apply(_b, [_d.sent()]);
+                        _d.label = 5;
+                    case 5:
+                        _a++;
+                        return [3 /*break*/, 3];
+                    case 6:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 7: return [2 /*return*/, keys];
+                }
+            });
+        });
+    };
+    /**
+     * Mint the next key version for `owner` (new writes use it immediately; the old version
+     * stays active — still fingerprinting queries — until a rotation walk
+     * (`EncryptionLifecycleWalker` mode 'rotate-keys') has rewritten every row, after which
+     * the caller retires it via `retireKeyVersion`).
+     * @returns the new version number
+     */
+    DataKeyStore.prototype.rotateKey = function (owner) {
+        return __awaiter(this, void 0, void 0, function () {
+            var rows, highest, newVersion;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.requireOwner(owner);
+                        return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 1:
+                        rows = _a.sent();
+                        highest = rows.reduce(function (max, row) { return Math.max(max, row.version); }, 0);
+                        newVersion = highest + 1;
+                        return [4 /*yield*/, this.createKeyVersion(owner, newVersion)];
+                    case 2:
+                        _a.sent();
+                        this.evictOwner(owner);
+                        return [2 /*return*/, newVersion];
+                }
+            });
+        });
+    };
+    /** Retire a version: envelopes naming it still decrypt; queries and writes stop using it. */
+    DataKeyStore.prototype.retireKeyVersion = function (owner, version) {
+        return __awaiter(this, void 0, void 0, function () {
+            var db;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.systemDb()];
+                    case 1:
+                        db = _a.sent();
+                        return [4 /*yield*/, db.update(this.table, { status: 'retired' }, {
+                                owner: owner,
+                                version: version,
+                            })];
+                    case 2:
+                        _a.sent();
+                        this.evictOwner(owner);
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Crypto-shred: delete every key version of `owner` and evict the caches. Every envelope
+     * naming the owner — in live rows and in every backup — becomes permanently unreadable.
+     */
+    DataKeyStore.prototype.shredOwnerKeys = function (owner) {
+        return __awaiter(this, void 0, void 0, function () {
+            var db, deleted, caches, _i, _a, cacheKey;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, this.systemDb()];
+                    case 1:
+                        db = _b.sent();
+                        return [4 /*yield*/, db.delete(this.table, { owner: owner })];
+                    case 2:
+                        deleted = _b.sent();
+                        this.evictOwner(owner);
+                        caches = this.caches();
+                        for (_i = 0, _a = Array.from(caches.material.keys()); _i < _a.length; _i++) {
+                            cacheKey = _a[_i];
+                            if (cacheKey.startsWith("".concat(owner, ":"))) {
+                                caches.material.delete(cacheKey);
+                            }
+                        }
+                        this.logger.info({ message: "Crypto-shredded data keys", obj: { owner: owner, deleted: deleted } });
+                        return [2 /*return*/, deleted];
+                }
+            });
+        });
+    };
+    DataKeyStore.prototype.createKeyVersion = function (owner, version) {
+        return __awaiter(this, void 0, void 0, function () {
+            var config, material, wrappedKey, db, error_1, rows;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        config = (0, DbEncryptionConfig_1.getDbEncryptionConfig)();
+                        material = (0, crypto_1.randomBytes)(DataKeyStore.KEY_MATERIAL_BYTES);
+                        return [4 /*yield*/, config.masterKeyProvider.wrapDataKey(material)];
+                    case 1:
+                        wrappedKey = _a.sent();
+                        return [4 /*yield*/, this.systemDb()];
+                    case 2:
+                        db = _a.sent();
+                        _a.label = 3;
+                    case 3:
+                        _a.trys.push([3, 5, , 7]);
+                        return [4 /*yield*/, db.insert(this.table, { owner: owner, version: version, wrappedKey: wrappedKey, status: 'active' })];
+                    case 4:
+                        _a.sent();
+                        return [3 /*break*/, 7];
+                    case 5:
+                        error_1 = _a.sent();
+                        // Named race: two first writes for the same owner both create version 1; the unique
+                        // (owner, version) index rejects the loser. Re-read — if the winner's key is there,
+                        // use it; otherwise the failure was real.
+                        this.evictOwner(owner);
+                        return [4 /*yield*/, this.getOwnerRows(owner)];
+                    case 6:
+                        rows = _a.sent();
+                        if (!rows.some(function (row) { return row.version === version; })) {
+                            throw error_1;
+                        }
+                        return [3 /*break*/, 7];
+                    case 7: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    DataKeyStore.prototype.getOwnerRows = function (owner) {
+        return __awaiter(this, void 0, void 0, function () {
+            var caches, cached, db, rows, entry;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        caches = this.caches();
+                        cached = caches.ownerRows.get(owner);
+                        if (cached && Date.now() - cached.fetchedAt < DataKeyStore.OWNER_ROWS_TTL_MS) {
+                            return [2 /*return*/, cached.rows];
+                        }
+                        return [4 /*yield*/, this.systemDb()];
+                    case 1:
+                        db = _a.sent();
+                        return [4 /*yield*/, db.query(this.table, { owner: owner })];
+                    case 2:
+                        rows = _a.sent();
+                        entry = {
+                            fetchedAt: Date.now(),
+                            rows: rows.map(function (row) { return ({
+                                owner: row.owner,
+                                version: row.version,
+                                wrappedKey: row.wrappedKey,
+                                status: row.status,
+                            }); }),
+                        };
+                        caches.ownerRows.set(owner, entry);
+                        return [2 /*return*/, entry.rows];
+                }
+            });
+        });
+    };
+    DataKeyStore.prototype.unwrap = function (row) {
+        return __awaiter(this, void 0, void 0, function () {
+            var caches, cacheKey, cached, config, materialBytes, material;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        caches = this.caches();
+                        cacheKey = "".concat(row.owner, ":").concat(row.version);
+                        cached = caches.material.get(cacheKey);
+                        if (cached && Date.now() - cached.cachedAt < DataKeyStore.MATERIAL_TTL_MS) {
+                            return [2 /*return*/, cached.material];
+                        }
+                        config = (0, DbEncryptionConfig_1.getDbEncryptionConfig)();
+                        return [4 /*yield*/, config.masterKeyProvider.unwrapDataKey(row.wrappedKey)];
+                    case 1:
+                        materialBytes = _a.sent();
+                        if (materialBytes.length !== DataKeyStore.KEY_MATERIAL_BYTES) {
+                            throw new Error("Data key material for owner '".concat(row.owner, "' version ").concat(row.version, " has unexpected length ") +
+                                "".concat(materialBytes.length, " (expected ").concat(DataKeyStore.KEY_MATERIAL_BYTES, ") \u2014 wrong master key?"));
+                        }
+                        material = {
+                            owner: row.owner,
+                            version: row.version,
+                            cipherKey: materialBytes.subarray(0, 32),
+                            indexKey: materialBytes.subarray(32, 64),
+                        };
+                        caches.material.set(cacheKey, { cachedAt: Date.now(), material: material });
+                        return [2 /*return*/, material];
+                }
+            });
+        });
+    };
+    DataKeyStore.prototype.highestActive = function (rows) {
+        return rows.filter(function (row) { return row.status === 'active'; }).sort(function (a, b) { return b.version - a.version; })[0];
+    };
+    DataKeyStore.prototype.requireOwner = function (owner) {
+        if (!owner || typeof owner !== 'string') {
+            throw new Error("Data key operations require a non-empty owner id; got: ".concat(JSON.stringify(owner)));
+        }
+    };
+    /**
+     * A system Db pinned OUTSIDE any ambient transaction (see class doc). Imported lazily —
+     * this module is reachable from the serializer layer, below `Db` in the module graph.
+     */
+    DataKeyStore.prototype.systemDb = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var Db, getDefaultTransactionContextFactory, db, factory;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require('../Db')); })];
+                    case 1:
+                        Db = (_a.sent()).Db;
+                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require('../transaction/TransactionContextFactory')); })];
+                    case 2:
+                        getDefaultTransactionContextFactory = (_a.sent()).getDefaultTransactionContextFactory;
+                        db = new Db(undefined, undefined, undefined, true);
+                        factory = getDefaultTransactionContextFactory();
+                        if (!factory) {
+                            return [2 /*return*/, db];
+                        }
+                        // Proxy every operation through an empty transaction context so key-table IO
+                        // auto-commits even when the caller is mid-transaction.
+                        return [2 /*return*/, new Proxy(db, {
+                                get: function (target, prop, receiver) {
+                                    var _this = this;
+                                    var value = Reflect.get(target, prop, receiver);
+                                    if (typeof value !== 'function') {
+                                        return value;
+                                    }
+                                    return function () {
+                                        var args = [];
+                                        for (var _i = 0; _i < arguments.length; _i++) {
+                                            args[_i] = arguments[_i];
+                                        }
+                                        return factory.runInContext({}, function () { return __awaiter(_this, void 0, void 0, function () { return __generator(this, function (_a) {
+                                            switch (_a.label) {
+                                                case 0: return [4 /*yield*/, value.apply(target, args)];
+                                                case 1: return [2 /*return*/, _a.sent()];
+                                            }
+                                        }); }); });
+                                    };
+                                },
+                            })];
+                }
+            });
+        });
+    };
+    DataKeyStore.prototype.caches = function () {
+        var globalObject = globalThis;
+        if (!globalObject[DataKeyStore.CACHES_GLOBAL_KEY]) {
+            globalObject[DataKeyStore.CACHES_GLOBAL_KEY] = {
+                ownerRows: new Map(),
+                material: new Map(),
+            };
+        }
+        return globalObject[DataKeyStore.CACHES_GLOBAL_KEY];
+    };
+    DataKeyStore.prototype.evictOwner = function (owner) {
+        this.caches().ownerRows.delete(owner);
+    };
+    /** Unwrapped material cache TTL — bounds how long a shredded key can linger in a warm process. */
+    DataKeyStore.MATERIAL_TTL_MS = 10 * 60 * 1000;
+    /** Owner key-row list TTL — bounds cross-process staleness of the active-version set. */
+    DataKeyStore.OWNER_ROWS_TTL_MS = 60 * 1000;
+    DataKeyStore.CACHES_GLOBAL_KEY = '__proteinjs_db_dataKeyCaches';
+    DataKeyStore.KEY_MATERIAL_BYTES = 64;
+    return DataKeyStore;
+}());
+exports.DataKeyStore = DataKeyStore;
+//# sourceMappingURL=DataKeyStore.js.map

package/dist/src/encryption/DataKeyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DataKeyStore.js","sourceRoot":"","sources":["../../../src/encryption/DataKeyStore.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqC;AACrC,4CAA2C;AAC3C,2DAA6D;AAC7D,mEAAqF;AAErF;;;GAGG;AACH;IAAmD,iDAAK;IACtD,uCAAY,KAAa,EAAE,OAAe;QAA1C,YACE,kBACE,wCAAiC,KAAK,uBAAa,OAAO,gCAA6B;YACrF,+EAA+E,CAClF,SAGF;QAFC,KAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,KAAI,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;;IACvE,CAAC;IACH,oCAAC;AAAD,CAAC,AATD,CAAmD,KAAK,GASvD;AATY,sEAA6B;AAoC1C;;;;;;;;;;;;;;GAcG;AACH;IAAA;QAOU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,UAAK,GAAG,IAAI,+CAAsB,EAAE,CAAC;IA4O/C,CAAC;IA1OC;;;OAGG;IACG,kCAAW,GAAjB,UAAkB,KAAa;;;;;;wBAC7B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACd,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBACrC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;6BAClC,CAAC,MAAM,EAAP,wBAAO;wBACT,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAA;;wBAArC,SAAqC,CAAC;wBACtC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBAChB,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B,CAAC;wBACtC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;wBAClC,IAAI,CAAC,MAAM,EAAE;4BACX,MAAM,IAAI,6BAA6B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;yBACnD;;4BAGI,qBAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAA;4BAAhC,sBAAO,SAAyB,EAAC;;;;KAClC;IAED,2FAA2F;IACrF,sCAAe,GAArB,UAAsB,KAAa,EAAE,OAAe;;;;;4BACrC,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBACrC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,OAAO,KAAK,OAAO,EAA7B,CAA6B,CAAC,CAAC;6BAChE,CAAC,GAAG,EAAJ,wBAAI;wBACN,qFAAqF;wBACrF,oEAAoE;wBACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACL,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAA1C,SAAS,GAAG,SAA8B;wBAC1C,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,OAAO,KAAK,OAAO,EAA7B,CAA6B,CAAC,CAAC;wBAC9E,IAAI,CAAC,QAAQ,EAAE;4BACb,MAAM,IAAI,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;yBACzD;wBACM,qBAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAA;4BAAlC,sBAAO,SAA2B,EAAC;4BAG9B,qBAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAA;4BAA7B,sBAAO,SAAsB,EAAC;;;;KAC/B;IAED;;;;OAIG;IACG,wCAAiB,GAAvB,UAAwB,MAAgB;;;;;;wBAChC,IAAI,GAAsB,EAAE,CAAC;8BACT,EAAN,iBAAM;;;6BAAN,CAAA,oBAAM,CAAA;wBAAf,KAAK;wBACD,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;8BACrB,EAAJ,aAAI;;;6BAAJ,CAAA,kBAAI,CAAA;wBAAX,GAAG;6BACR,CAAA,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAA,EAAvB,wBAAuB;wBACzB,KAAA,CAAA,KAAA,IAAI,CAAA,CAAC,IAAI,CAAA;wBAAC,qBAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAA;;wBAAhC,cAAU,SAAsB,EAAC,CAAC;;;wBAFpB,IAAI,CAAA;;;wBAFJ,IAAM,CAAA;;4BAS1B,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;;;;OAMG;IACG,gCAAS,GAAf,UAAgB,KAAa;;;;;;wBAC3B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACZ,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBACrC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAC,GAAG,EAAE,GAAG,IAAK,OAAA,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAA1B,CAA0B,EAAE,CAAC,CAAC,CAAC;wBACnE,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC;wBAC/B,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,EAAA;;wBAA9C,SAA8C,CAAC;wBAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACvB,sBAAO,UAAU,EAAC;;;;KACnB;IAED,6FAA6F;IACvF,uCAAgB,GAAtB,UAAuB,KAAa,EAAE,OAAe;;;;;4BACxC,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;wBAChC,qBAAM,EAAE,CAAC,MAAM,CACb,IAAI,CAAC,KAAK,EACV,EAAE,MAAM,EAAE,SAAS,EAAgC,EACnD;gCACE,KAAK,OAAA;gCACL,OAAO,SAAA;6BACsB,CAChC,EAAA;;wBAPD,SAOC,CAAC;wBACF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;;;;;KACxB;IAED;;;OAGG;IACG,qCAAc,GAApB,UAAqB,KAAa;;;;;4BACrB,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;wBAChB,qBAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,OAAA,EAAgC,CAAC,EAAA;;wBAA9E,OAAO,GAAG,SAAoE;wBACpF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACjB,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC7B,WAAyD,EAAlC,KAAA,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAlC,cAAkC,EAAlC,IAAkC,EAAE;4BAAhD,QAAQ;4BACjB,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAG,KAAK,MAAG,CAAC,EAAE;gCACpC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;6BAClC;yBACF;wBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,OAAO,SAAA,EAAE,EAAE,CAAC,CAAC;wBACpF,sBAAO,OAAO,EAAC;;;;KAChB;IAEa,uCAAgB,GAA9B,UAA+B,KAAa,EAAE,OAAe;;;;;;wBACrD,MAAM,GAAG,IAAA,0CAAqB,GAAE,CAAC;wBACjC,QAAQ,GAAG,IAAA,oBAAW,EAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;wBAC3C,qBAAM,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAA;;wBAAjE,UAAU,GAAG,SAAoD;wBAC5D,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;;;;wBAE9B,qBAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,OAAA,EAAE,OAAO,SAAA,EAAE,UAAU,YAAA,EAAE,MAAM,EAAE,QAAQ,EAGzE,CAAC,EAAA;;wBAHF,SAGE,CAAC;;;;wBAEH,oFAAoF;wBACpF,oFAAoF;wBACpF,0CAA0C;wBAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACV,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,OAAO,KAAK,OAAO,EAAvB,CAAuB,CAAC,EAAE;4BAChD,MAAM,OAAK,CAAC;yBACb;;;;;;KAEJ;IAEa,mCAAY,GAA1B,UAA2B,KAAa;;;;;;wBAChC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;wBAC3C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE;4BAC5E,sBAAO,MAAM,CAAC,IAAI,EAAC;yBACpB;wBAEU,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;wBACnB,qBAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,OAAA,EAAgC,CAAC,EAAA;;wBAA1E,IAAI,GAAG,SAAmE;wBAC1E,KAAK,GAA2B;4BACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;4BACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,CAAC;gCACvB,KAAK,EAAE,GAAG,CAAC,KAAK;gCAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gCACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gCAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;6BACnB,CAAC,EALsB,CAKtB,CAAC;yBACJ,CAAC;wBACF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;wBACnC,sBAAO,KAAK,CAAC,IAAI,EAAC;;;;KACnB;IAEa,6BAAM,GAApB,UAAqB,GAAgE;;;;;;wBAC7E,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,UAAG,GAAG,CAAC,KAAK,cAAI,GAAG,CAAC,OAAO,CAAE,CAAC;wBACzC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC7C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,eAAe,EAAE;4BACzE,sBAAO,MAAM,CAAC,QAAQ,EAAC;yBACxB;wBAEK,MAAM,GAAG,IAAA,0CAAqB,GAAE,CAAC;wBACjB,qBAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAA;;wBAA5E,aAAa,GAAG,SAA4D;wBAClF,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,kBAAkB,EAAE;4BAC5D,MAAM,IAAI,KAAK,CACb,uCAAgC,GAAG,CAAC,KAAK,uBAAa,GAAG,CAAC,OAAO,4BAAyB;gCACxF,UAAG,aAAa,CAAC,MAAM,wBAAc,YAAY,CAAC,kBAAkB,+BAAuB,CAC9F,CAAC;yBACH;wBAEK,QAAQ,GAAoB;4BAChC,KAAK,EAAE,GAAG,CAAC,KAAK;4BAChB,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;4BACxC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;yBACzC,CAAC;wBACF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,UAAA,EAAE,CAAC,CAAC;wBAClE,sBAAO,QAAQ,EAAC;;;;KACjB;IAEO,oCAAa,GAArB,UAAsB,IAAoC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAvB,CAAuB,CAAC,CAAC,IAAI,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAArB,CAAqB,CAAC,CAAC,CAAC,CAE/E,CAAC;IAChB,CAAC;IAEO,mCAAY,GAApB,UAAqB,KAAa;QAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC,iEAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAE,CAAC,CAAC;SACpG;IACH,CAAC;IAED;;;OAGG;IACW,+BAAQ,GAAtB;;;;;4BACiB,sFAAa,OAAO,QAAC;;wBAA5B,EAAE,GAAK,CAAA,SAAqB,CAAA,GAA1B;wBACsC,sFAAa,0CAA0C,QAAC;;wBAAhG,mCAAmC,GAAK,CAAA,SAAwD,CAAA,oCAA7D;wBACrC,EAAE,GAAG,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;wBACnD,OAAO,GAAG,mCAAmC,EAAE,CAAC;wBACtD,IAAI,CAAC,OAAO,EAAE;4BACZ,sBAAO,EAAE,EAAC;yBACX;wBAED,6EAA6E;wBAC7E,wDAAwD;wBACxD,sBAAO,IAAI,KAAK,CAAC,EAAE,EAAE;gCACnB,GAAG,YAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;oCAA1B,iBAOC;oCANC,IAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;oCAClD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE;wCAC/B,OAAO,KAAK,CAAC;qCACd;oCAED,OAAO;wCAAC,cAAc;6CAAd,UAAc,EAAd,qBAAc,EAAd,IAAc;4CAAd,yBAAc;;wCAAK,OAAA,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE;;wDAAY,qBAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAA;wDAA/B,sBAAA,SAA+B,EAAA;;iDAAA,CAAC;oCAArE,CAAqE,CAAC;gCACnG,CAAC;6BACF,CAA4B,EAAC;;;;KAC/B;IAEO,6BAAM,GAAd;QACE,IAAM,YAAY,GAAG,UAAiB,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE;YACjD,YAAY,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG;gBAC7C,SAAS,EAAE,IAAI,GAAG,EAAE;gBACpB,QAAQ,EAAE,IAAI,GAAG,EAAE;aACH,CAAC;SACpB;QAED,OAAO,YAAY,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IAEO,iCAAU,GAAlB,UAAmB,KAAa;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAlPD,kGAAkG;IAC1E,4BAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,AAAjB,CAAkB;IACzD,yFAAyF;IACjE,8BAAiB,GAAG,EAAE,GAAG,IAAI,AAAZ,CAAa;IAC9B,8BAAiB,GAAG,8BAA8B,AAAjC,CAAkC;IACnD,+BAAkB,GAAG,EAAE,AAAL,CAAM;IA8OlD,mBAAC;CAAA,AApPD,IAoPC;AApPY,oCAAY"}

package/dist/src/encryption/DbEncryptionConfig.d.ts

@@ -0,0 +1,62 @@
+import { Loadable } from '@proteinjs/reflection';
+import type { Table } from '../Table';
+import { MasterKeyProvider } from './MasterKeyProvider';
+/**
+ * A column-encryption configuration problem — a misdeclared column, a missing
+ * `DbEncryptionConfigFactory`, an unresolvable key owner. Always a dev-time/boot-time
+ * error class, never a data error.
+ */
+export declare class EncryptedColumnConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Deployment-level configuration for column encryption (`ColumnOptions.encrypted`).
+ * Registered once per app through a `DbEncryptionConfigFactory`; every encrypted read,
+ * write, and translated query resolves it through `getDbEncryptionConfig`.
+ */
+export interface DbEncryptionConfig {
+    /** The vault that wraps/unwraps per-user data keys (see `MasterKeyProvider`). */
+    masterKeyProvider: MasterKeyProvider;
+    /**
+     * Resolve the key-owner id whose data key encrypts a row being written — the row's
+     * permission-source scope owner. Return `undefined` to fall through to the framework
+     * default (the row's `scope` column value). Consumer layers with richer sharing models
+     * (e.g. permission-source trees) supply their scope→owner mapping here; the framework
+     * stays generic.
+     */
+    resolveKeyOwner?: (args: {
+        table: Table<any>;
+        record: any;
+    }) => Promise<string | undefined>;
+    /**
+     * The key owners whose rows the current caller can read — the caller's own id plus the
+     * (bounded) set of owners sharing rows into the caller's view. Search conditions on
+     * encrypted columns fingerprint the query once per accessible owner and OR the matches,
+     * so this powers shared-scope search. Required for any query that searches an encrypted
+     * column; without it such queries are rejected loudly.
+     */
+    getAccessibleKeyOwners?: (args: {
+        runAsSystem: boolean;
+    }) => Promise<string[]>;
+    /**
+     * When true, every text-holding column of every registered table MUST declare
+     * `encrypted` (`false` or a config object) — registration fails loudly otherwise
+     * (see `EncryptedColumns.validateDeclarations`). Ships default-OFF so existing schemas
+     * keep booting; the app-wide declaration sweep turns it on.
+     */
+    requireEncryptedDeclarations?: boolean;
+}
+/** Registers the app's `DbEncryptionConfig`. Implement as a Loadable so the framework finds it. */
+export interface DbEncryptionConfigFactory extends Loadable {
+    getConfig(): DbEncryptionConfig;
+}
+/**
+ * Set (or clear) the config without a Loadable factory — test harnesses and bootstrap
+ * contexts that run outside the source-repository graph.
+ */
+export declare const setDbEncryptionConfig: (config?: DbEncryptionConfig) => void;
+/** The registered config, or undefined when the deployment has none (a plaintext-only app). */
+export declare const findDbEncryptionConfig: () => DbEncryptionConfig | undefined;
+/** The registered config; throws a named error when encryption is used without one. */
+export declare const getDbEncryptionConfig: () => DbEncryptionConfig;
+//# sourceMappingURL=DbEncryptionConfig.d.ts.map

package/dist/src/encryption/DbEncryptionConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbEncryptionConfig.d.ts","sourceRoot":"","sources":["../../../src/encryption/DbEncryptionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAO5B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5F;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,mGAAmG;AACnG,MAAM,WAAW,yBAA0B,SAAQ,QAAQ;IACzD,SAAS,IAAI,kBAAkB,CAAC;CACjC;AAID;;;GAGG;AACH,eAAO,MAAM,qBAAqB,YAAa,kBAAkB,SAEhE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,QAAO,kBAAkB,GAAG,SAS9D,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,QAAO,kBAWxC,CAAC"}

package/dist/src/encryption/DbEncryptionConfig.js

@@ -0,0 +1,67 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDbEncryptionConfig = exports.findDbEncryptionConfig = exports.setDbEncryptionConfig = exports.EncryptedColumnConfigError = void 0;
+var reflection_1 = require("@proteinjs/reflection");
+/**
+ * A column-encryption configuration problem — a misdeclared column, a missing
+ * `DbEncryptionConfigFactory`, an unresolvable key owner. Always a dev-time/boot-time
+ * error class, never a data error.
+ */
+var EncryptedColumnConfigError = /** @class */ (function (_super) {
+    __extends(EncryptedColumnConfigError, _super);
+    function EncryptedColumnConfigError(message) {
+        var _this = _super.call(this, message) || this;
+        _this.name = 'EncryptedColumnConfigError';
+        // ES5 down-leveled `extends Error` loses the subclass prototype — restore it so
+        // `instanceof` holds for catchers.
+        Object.setPrototypeOf(_this, EncryptedColumnConfigError.prototype);
+        return _this;
+    }
+    return EncryptedColumnConfigError;
+}(Error));
+exports.EncryptedColumnConfigError = EncryptedColumnConfigError;
+var configOverride;
+/**
+ * Set (or clear) the config without a Loadable factory — test harnesses and bootstrap
+ * contexts that run outside the source-repository graph.
+ */
+var setDbEncryptionConfig = function (config) {
+    configOverride = config;
+};
+exports.setDbEncryptionConfig = setDbEncryptionConfig;
+/** The registered config, or undefined when the deployment has none (a plaintext-only app). */
+var findDbEncryptionConfig = function () {
+    if (configOverride) {
+        return configOverride;
+    }
+    var factory = reflection_1.SourceRepository.get().object('@proteinjs/db/DbEncryptionConfigFactory');
+    return factory === null || factory === void 0 ? void 0 : factory.getConfig();
+};
+exports.findDbEncryptionConfig = findDbEncryptionConfig;
+/** The registered config; throws a named error when encryption is used without one. */
+var getDbEncryptionConfig = function () {
+    var config = (0, exports.findDbEncryptionConfig)();
+    if (!config) {
+        throw new EncryptedColumnConfigError("A column declares 'encrypted' but no DbEncryptionConfig is registered. Implement " +
+            "@proteinjs/db/DbEncryptionConfigFactory (or call setDbEncryptionConfig) with a " +
+            "masterKeyProvider before using encrypted columns.");
+    }
+    return config;
+};
+exports.getDbEncryptionConfig = getDbEncryptionConfig;
+//# sourceMappingURL=DbEncryptionConfig.js.map

package/dist/src/encryption/DbEncryptionConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbEncryptionConfig.js","sourceRoot":"","sources":["../../../src/encryption/DbEncryptionConfig.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,oDAAmE;AAInE;;;;GAIG;AACH;IAAgD,8CAAK;IACnD,oCAAY,OAAe;QAA3B,YACE,kBAAM,OAAO,CAAC,SAKf;QAJC,KAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,gFAAgF;QAChF,mCAAmC;QACnC,MAAM,CAAC,cAAc,CAAC,KAAI,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;;IACpE,CAAC;IACH,iCAAC;AAAD,CAAC,AARD,CAAgD,KAAK,GAQpD;AARY,gEAA0B;AAgDvC,IAAI,cAA8C,CAAC;AAEnD;;;GAGG;AACI,IAAM,qBAAqB,GAAG,UAAC,MAA2B;IAC/D,cAAc,GAAG,MAAM,CAAC;AAC1B,CAAC,CAAC;AAFW,QAAA,qBAAqB,yBAEhC;AAEF,+FAA+F;AACxF,IAAM,sBAAsB,GAAG;IACpC,IAAI,cAAc,EAAE;QAClB,OAAO,cAAc,CAAC;KACvB;IAED,IAAM,OAAO,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,yCAAyC,CAC1C,CAAC;IACF,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAC;AAC9B,CAAC,CAAC;AATW,QAAA,sBAAsB,0BASjC;AAEF,uFAAuF;AAChF,IAAM,qBAAqB,GAAG;IACnC,IAAM,MAAM,GAAG,IAAA,8BAAsB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE;QACX,MAAM,IAAI,0BAA0B,CAClC,mFAAmF;YACjF,iFAAiF;YACjF,mDAAmD,CACtD,CAAC;KACH;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC"}

package/dist/src/encryption/EncryptedColumnQueryError.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A query asked an encrypted column for a shape outside the compatibility contract
+ * (`EncryptionQueryTranslator`). Thrown at query-build time, before any statement runs —
+ * the message names the limitation and the sanctioned paths, so the limitation cannot be
+ * hit silently.
+ */
+export declare class EncryptedColumnQueryError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=EncryptedColumnQueryError.d.ts.map

package/dist/src/encryption/EncryptedColumnQueryError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptedColumnQueryError.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptedColumnQueryError.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAO5B"}