@proteinjs/db 1.35.1 → 1.37.0

package/dist/src/encryption/DataKeyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DataKeyStore.js","sourceRoot":"","sources":["../../../src/encryption/DataKeyStore.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqC;AACrC,4CAA2C;AAC3C,2DAA6D;AAC7D,mEAAqF;AAErF;;;GAGG;AACH;IAAmD,iDAAK;IACtD,uCAAY,KAAa,EAAE,OAAe;QAA1C,YACE,kBACE,wCAAiC,KAAK,uBAAa,OAAO,gCAA6B;YACrF,+EAA+E,CAClF,SAGF;QAFC,KAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,KAAI,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;;IACvE,CAAC;IACH,oCAAC;AAAD,CAAC,AATD,CAAmD,KAAK,GASvD;AATY,sEAA6B;AAoC1C;;;;;;;;;;;;;;GAcG;AACH;IAAA;QAOU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,UAAK,GAAG,IAAI,+CAAsB,EAAE,CAAC;IA4O/C,CAAC;IA1OC;;;OAGG;IACG,kCAAW,GAAjB,UAAkB,KAAa;;;;;;wBAC7B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACd,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBACrC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;6BAClC,CAAC,MAAM,EAAP,wBAAO;wBACT,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAA;;wBAArC,SAAqC,CAAC;wBACtC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBAChB,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B,CAAC;wBACtC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;wBAClC,IAAI,CAAC,MAAM,EAAE;4BACX,MAAM,IAAI,6BAA6B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;yBACnD;;4BAGI,qBAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAA;4BAAhC,sBAAO,SAAyB,EAAC;;;;KAClC;IAED,2FAA2F;IACrF,sCAAe,GAArB,UAAsB,KAAa,EAAE,OAAe;;;;;4BACrC,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBACrC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,OAAO,KAAK,OAAO,EAA7B,CAA6B,CAAC,CAAC;6BAChE,CAAC,GAAG,EAAJ,wBAAI;wBACN,qFAAqF;wBACrF,oEAAoE;wBACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACL,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAA1C,SAAS,GAAG,SAA8B;wBAC1C,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,SAAS,CAAC,OAAO,KAAK,OAAO,EAA7B,CAA6B,CAAC,CAAC;wBAC9E,IAAI,CAAC,QAAQ,EAAE;4BACb,MAAM,IAAI,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;yBACzD;wBACM,qBAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAA;4BAAlC,sBAAO,SAA2B,EAAC;4BAG9B,qBAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAA;4BAA7B,sBAAO,SAAsB,EAAC;;;;KAC/B;IAED;;;;OAIG;IACG,wCAAiB,GAAvB,UAAwB,MAAgB;;;;;;wBAChC,IAAI,GAAsB,EAAE,CAAC;8BACT,EAAN,iBAAM;;;6BAAN,CAAA,oBAAM,CAAA;wBAAf,KAAK;wBACD,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;8BACrB,EAAJ,aAAI;;;6BAAJ,CAAA,kBAAI,CAAA;wBAAX,GAAG;6BACR,CAAA,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAA,EAAvB,wBAAuB;wBACzB,KAAA,CAAA,KAAA,IAAI,CAAA,CAAC,IAAI,CAAA;wBAAC,qBAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAA;;wBAAhC,cAAU,SAAsB,EAAC,CAAC;;;wBAFpB,IAAI,CAAA;;;wBAFJ,IAAM,CAAA;;4BAS1B,sBAAO,IAAI,EAAC;;;;KACb;IAED;;;;;;OAMG;IACG,gCAAS,GAAf,UAAgB,KAAa;;;;;;wBAC3B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBACZ,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBACrC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAC,GAAG,EAAE,GAAG,IAAK,OAAA,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAA1B,CAA0B,EAAE,CAAC,CAAC,CAAC;wBACnE,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC;wBAC/B,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,EAAA;;wBAA9C,SAA8C,CAAC;wBAC/C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACvB,sBAAO,UAAU,EAAC;;;;KACnB;IAED,6FAA6F;IACvF,uCAAgB,GAAtB,UAAuB,KAAa,EAAE,OAAe;;;;;4BACxC,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;wBAChC,qBAAM,EAAE,CAAC,MAAM,CACb,IAAI,CAAC,KAAK,EACV,EAAE,MAAM,EAAE,SAAS,EAAgC,EACnD;gCACE,KAAK,OAAA;gCACL,OAAO,SAAA;6BACsB,CAChC,EAAA;;wBAPD,SAOC,CAAC;wBACF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;;;;;KACxB;IAED;;;OAGG;IACG,qCAAc,GAApB,UAAqB,KAAa;;;;;4BACrB,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;wBAChB,qBAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,OAAA,EAAgC,CAAC,EAAA;;wBAA9E,OAAO,GAAG,SAAoE;wBACpF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACjB,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC7B,WAAyD,EAAlC,KAAA,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAlC,cAAkC,EAAlC,IAAkC,EAAE;4BAAhD,QAAQ;4BACjB,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAG,KAAK,MAAG,CAAC,EAAE;gCACpC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;6BAClC;yBACF;wBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,OAAO,SAAA,EAAE,EAAE,CAAC,CAAC;wBACpF,sBAAO,OAAO,EAAC;;;;KAChB;IAEa,uCAAgB,GAA9B,UAA+B,KAAa,EAAE,OAAe;;;;;;wBACrD,MAAM,GAAG,IAAA,0CAAqB,GAAE,CAAC;wBACjC,QAAQ,GAAG,IAAA,oBAAW,EAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;wBAC3C,qBAAM,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAA;;wBAAjE,UAAU,GAAG,SAAoD;wBAC5D,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;;;;wBAE9B,qBAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,OAAA,EAAE,OAAO,SAAA,EAAE,UAAU,YAAA,EAAE,MAAM,EAAE,QAAQ,EAGzE,CAAC,EAAA;;wBAHF,SAGE,CAAC;;;;wBAEH,oFAAoF;wBACpF,oFAAoF;wBACpF,0CAA0C;wBAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBACV,qBAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;wBAArC,IAAI,GAAG,SAA8B;wBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,OAAO,KAAK,OAAO,EAAvB,CAAuB,CAAC,EAAE;4BAChD,MAAM,OAAK,CAAC;yBACb;;;;;;KAEJ;IAEa,mCAAY,GAA1B,UAA2B,KAAa;;;;;;wBAChC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;wBAC3C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE;4BAC5E,sBAAO,MAAM,CAAC,IAAI,EAAC;yBACpB;wBAEU,qBAAM,IAAI,CAAC,QAAQ,EAAE,EAAA;;wBAA1B,EAAE,GAAG,SAAqB;wBACnB,qBAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,OAAA,EAAgC,CAAC,EAAA;;wBAA1E,IAAI,GAAG,SAAmE;wBAC1E,KAAK,GAA2B;4BACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;4BACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,CAAC;gCACvB,KAAK,EAAE,GAAG,CAAC,KAAK;gCAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gCACpB,UAAU,EAAE,GAAG,CAAC,UAAU;gCAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;6BACnB,CAAC,EALsB,CAKtB,CAAC;yBACJ,CAAC;wBACF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;wBACnC,sBAAO,KAAK,CAAC,IAAI,EAAC;;;;KACnB;IAEa,6BAAM,GAApB,UAAqB,GAAgE;;;;;;wBAC7E,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,UAAG,GAAG,CAAC,KAAK,cAAI,GAAG,CAAC,OAAO,CAAE,CAAC;wBACzC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC7C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,eAAe,EAAE;4BACzE,sBAAO,MAAM,CAAC,QAAQ,EAAC;yBACxB;wBAEK,MAAM,GAAG,IAAA,0CAAqB,GAAE,CAAC;wBACjB,qBAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAA;;wBAA5E,aAAa,GAAG,SAA4D;wBAClF,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,kBAAkB,EAAE;4BAC5D,MAAM,IAAI,KAAK,CACb,uCAAgC,GAAG,CAAC,KAAK,uBAAa,GAAG,CAAC,OAAO,4BAAyB;gCACxF,UAAG,aAAa,CAAC,MAAM,wBAAc,YAAY,CAAC,kBAAkB,+BAAuB,CAC9F,CAAC;yBACH;wBAEK,QAAQ,GAAoB;4BAChC,KAAK,EAAE,GAAG,CAAC,KAAK;4BAChB,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;4BACxC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;yBACzC,CAAC;wBACF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,UAAA,EAAE,CAAC,CAAC;wBAClE,sBAAO,QAAQ,EAAC;;;;KACjB;IAEO,oCAAa,GAArB,UAAsB,IAAoC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAvB,CAAuB,CAAC,CAAC,IAAI,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAArB,CAAqB,CAAC,CAAC,CAAC,CAE/E,CAAC;IAChB,CAAC;IAEO,mCAAY,GAApB,UAAqB,KAAa;QAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YACvC,MAAM,IAAI,KAAK,CAAC,iEAA0D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAE,CAAC,CAAC;SACpG;IACH,CAAC;IAED;;;OAGG;IACW,+BAAQ,GAAtB;;;;;4BACiB,sFAAa,OAAO,QAAC;;wBAA5B,EAAE,GAAK,CAAA,SAAqB,CAAA,GAA1B;wBACsC,sFAAa,0CAA0C,QAAC;;wBAAhG,mCAAmC,GAAK,CAAA,SAAwD,CAAA,oCAA7D;wBACrC,EAAE,GAAG,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;wBACnD,OAAO,GAAG,mCAAmC,EAAE,CAAC;wBACtD,IAAI,CAAC,OAAO,EAAE;4BACZ,sBAAO,EAAE,EAAC;yBACX;wBAED,6EAA6E;wBAC7E,wDAAwD;wBACxD,sBAAO,IAAI,KAAK,CAAC,EAAE,EAAE;gCACnB,GAAG,YAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;oCAA1B,iBAOC;oCANC,IAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;oCAClD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE;wCAC/B,OAAO,KAAK,CAAC;qCACd;oCAED,OAAO;wCAAC,cAAc;6CAAd,UAAc,EAAd,qBAAc,EAAd,IAAc;4CAAd,yBAAc;;wCAAK,OAAA,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE;;wDAAY,qBAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAA;wDAA/B,sBAAA,SAA+B,EAAA;;iDAAA,CAAC;oCAArE,CAAqE,CAAC;gCACnG,CAAC;6BACF,CAA4B,EAAC;;;;KAC/B;IAEO,6BAAM,GAAd;QACE,IAAM,YAAY,GAAG,UAAiB,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE;YACjD,YAAY,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG;gBAC7C,SAAS,EAAE,IAAI,GAAG,EAAE;gBACpB,QAAQ,EAAE,IAAI,GAAG,EAAE;aACH,CAAC;SACpB;QAED,OAAO,YAAY,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IAEO,iCAAU,GAAlB,UAAmB,KAAa;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAlPD,kGAAkG;IAC1E,4BAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,AAAjB,CAAkB;IACzD,yFAAyF;IACjE,8BAAiB,GAAG,EAAE,GAAG,IAAI,AAAZ,CAAa;IAC9B,8BAAiB,GAAG,8BAA8B,AAAjC,CAAkC;IACnD,+BAAkB,GAAG,EAAE,AAAL,CAAM;IA8OlD,mBAAC;CAAA,AApPD,IAoPC;AApPY,oCAAY"}

package/dist/src/encryption/DbEncryptionConfig.d.ts

@@ -0,0 +1,62 @@
+import { Loadable } from '@proteinjs/reflection';
+import type { Table } from '../Table';
+import { MasterKeyProvider } from './MasterKeyProvider';
+/**
+ * A column-encryption configuration problem — a misdeclared column, a missing
+ * `DbEncryptionConfigFactory`, an unresolvable key owner. Always a dev-time/boot-time
+ * error class, never a data error.
+ */
+export declare class EncryptedColumnConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Deployment-level configuration for column encryption (`ColumnOptions.encrypted`).
+ * Registered once per app through a `DbEncryptionConfigFactory`; every encrypted read,
+ * write, and translated query resolves it through `getDbEncryptionConfig`.
+ */
+export interface DbEncryptionConfig {
+    /** The vault that wraps/unwraps per-user data keys (see `MasterKeyProvider`). */
+    masterKeyProvider: MasterKeyProvider;
+    /**
+     * Resolve the key-owner id whose data key encrypts a row being written — the row's
+     * permission-source scope owner. Return `undefined` to fall through to the framework
+     * default (the row's `scope` column value). Consumer layers with richer sharing models
+     * (e.g. permission-source trees) supply their scope→owner mapping here; the framework
+     * stays generic.
+     */
+    resolveKeyOwner?: (args: {
+        table: Table<any>;
+        record: any;
+    }) => Promise<string | undefined>;
+    /**
+     * The key owners whose rows the current caller can read — the caller's own id plus the
+     * (bounded) set of owners sharing rows into the caller's view. Search conditions on
+     * encrypted columns fingerprint the query once per accessible owner and OR the matches,
+     * so this powers shared-scope search. Required for any query that searches an encrypted
+     * column; without it such queries are rejected loudly.
+     */
+    getAccessibleKeyOwners?: (args: {
+        runAsSystem: boolean;
+    }) => Promise<string[]>;
+    /**
+     * When true, every text-holding column of every registered table MUST declare
+     * `encrypted` (`false` or a config object) — registration fails loudly otherwise
+     * (see `EncryptedColumns.validateDeclarations`). Ships default-OFF so existing schemas
+     * keep booting; the app-wide declaration sweep turns it on.
+     */
+    requireEncryptedDeclarations?: boolean;
+}
+/** Registers the app's `DbEncryptionConfig`. Implement as a Loadable so the framework finds it. */
+export interface DbEncryptionConfigFactory extends Loadable {
+    getConfig(): DbEncryptionConfig;
+}
+/**
+ * Set (or clear) the config without a Loadable factory — test harnesses and bootstrap
+ * contexts that run outside the source-repository graph.
+ */
+export declare const setDbEncryptionConfig: (config?: DbEncryptionConfig) => void;
+/** The registered config, or undefined when the deployment has none (a plaintext-only app). */
+export declare const findDbEncryptionConfig: () => DbEncryptionConfig | undefined;
+/** The registered config; throws a named error when encryption is used without one. */
+export declare const getDbEncryptionConfig: () => DbEncryptionConfig;
+//# sourceMappingURL=DbEncryptionConfig.d.ts.map

package/dist/src/encryption/DbEncryptionConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbEncryptionConfig.d.ts","sourceRoot":"","sources":["../../../src/encryption/DbEncryptionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAO5B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5F;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,mGAAmG;AACnG,MAAM,WAAW,yBAA0B,SAAQ,QAAQ;IACzD,SAAS,IAAI,kBAAkB,CAAC;CACjC;AAID;;;GAGG;AACH,eAAO,MAAM,qBAAqB,YAAa,kBAAkB,SAEhE,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,QAAO,kBAAkB,GAAG,SAS9D,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,QAAO,kBAWxC,CAAC"}

package/dist/src/encryption/DbEncryptionConfig.js

@@ -0,0 +1,67 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDbEncryptionConfig = exports.findDbEncryptionConfig = exports.setDbEncryptionConfig = exports.EncryptedColumnConfigError = void 0;
+var reflection_1 = require("@proteinjs/reflection");
+/**
+ * A column-encryption configuration problem — a misdeclared column, a missing
+ * `DbEncryptionConfigFactory`, an unresolvable key owner. Always a dev-time/boot-time
+ * error class, never a data error.
+ */
+var EncryptedColumnConfigError = /** @class */ (function (_super) {
+    __extends(EncryptedColumnConfigError, _super);
+    function EncryptedColumnConfigError(message) {
+        var _this = _super.call(this, message) || this;
+        _this.name = 'EncryptedColumnConfigError';
+        // ES5 down-leveled `extends Error` loses the subclass prototype — restore it so
+        // `instanceof` holds for catchers.
+        Object.setPrototypeOf(_this, EncryptedColumnConfigError.prototype);
+        return _this;
+    }
+    return EncryptedColumnConfigError;
+}(Error));
+exports.EncryptedColumnConfigError = EncryptedColumnConfigError;
+var configOverride;
+/**
+ * Set (or clear) the config without a Loadable factory — test harnesses and bootstrap
+ * contexts that run outside the source-repository graph.
+ */
+var setDbEncryptionConfig = function (config) {
+    configOverride = config;
+};
+exports.setDbEncryptionConfig = setDbEncryptionConfig;
+/** The registered config, or undefined when the deployment has none (a plaintext-only app). */
+var findDbEncryptionConfig = function () {
+    if (configOverride) {
+        return configOverride;
+    }
+    var factory = reflection_1.SourceRepository.get().object('@proteinjs/db/DbEncryptionConfigFactory');
+    return factory === null || factory === void 0 ? void 0 : factory.getConfig();
+};
+exports.findDbEncryptionConfig = findDbEncryptionConfig;
+/** The registered config; throws a named error when encryption is used without one. */
+var getDbEncryptionConfig = function () {
+    var config = (0, exports.findDbEncryptionConfig)();
+    if (!config) {
+        throw new EncryptedColumnConfigError("A column declares 'encrypted' but no DbEncryptionConfig is registered. Implement " +
+            "@proteinjs/db/DbEncryptionConfigFactory (or call setDbEncryptionConfig) with a " +
+            "masterKeyProvider before using encrypted columns.");
+    }
+    return config;
+};
+exports.getDbEncryptionConfig = getDbEncryptionConfig;
+//# sourceMappingURL=DbEncryptionConfig.js.map

package/dist/src/encryption/DbEncryptionConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbEncryptionConfig.js","sourceRoot":"","sources":["../../../src/encryption/DbEncryptionConfig.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,oDAAmE;AAInE;;;;GAIG;AACH;IAAgD,8CAAK;IACnD,oCAAY,OAAe;QAA3B,YACE,kBAAM,OAAO,CAAC,SAKf;QAJC,KAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,gFAAgF;QAChF,mCAAmC;QACnC,MAAM,CAAC,cAAc,CAAC,KAAI,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;;IACpE,CAAC;IACH,iCAAC;AAAD,CAAC,AARD,CAAgD,KAAK,GAQpD;AARY,gEAA0B;AAgDvC,IAAI,cAA8C,CAAC;AAEnD;;;GAGG;AACI,IAAM,qBAAqB,GAAG,UAAC,MAA2B;IAC/D,cAAc,GAAG,MAAM,CAAC;AAC1B,CAAC,CAAC;AAFW,QAAA,qBAAqB,yBAEhC;AAEF,+FAA+F;AACxF,IAAM,sBAAsB,GAAG;IACpC,IAAI,cAAc,EAAE;QAClB,OAAO,cAAc,CAAC;KACvB;IAED,IAAM,OAAO,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,yCAAyC,CAC1C,CAAC;IACF,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAC;AAC9B,CAAC,CAAC;AATW,QAAA,sBAAsB,0BASjC;AAEF,uFAAuF;AAChF,IAAM,qBAAqB,GAAG;IACnC,IAAM,MAAM,GAAG,IAAA,8BAAsB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE;QACX,MAAM,IAAI,0BAA0B,CAClC,mFAAmF;YACjF,iFAAiF;YACjF,mDAAmD,CACtD,CAAC;KACH;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC"}

package/dist/src/encryption/EncryptedColumnQueryError.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A query asked an encrypted column for a shape outside the compatibility contract
+ * (`EncryptionQueryTranslator`). Thrown at query-build time, before any statement runs —
+ * the message names the limitation and the sanctioned paths, so the limitation cannot be
+ * hit silently.
+ */
+export declare class EncryptedColumnQueryError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=EncryptedColumnQueryError.d.ts.map

package/dist/src/encryption/EncryptedColumnQueryError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptedColumnQueryError.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptedColumnQueryError.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAO5B"}

package/dist/src/encryption/EncryptedColumnQueryError.js

@@ -0,0 +1,38 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptedColumnQueryError = void 0;
+/**
+ * A query asked an encrypted column for a shape outside the compatibility contract
+ * (`EncryptionQueryTranslator`). Thrown at query-build time, before any statement runs —
+ * the message names the limitation and the sanctioned paths, so the limitation cannot be
+ * hit silently.
+ */
+var EncryptedColumnQueryError = /** @class */ (function (_super) {
+    __extends(EncryptedColumnQueryError, _super);
+    function EncryptedColumnQueryError(message) {
+        var _this = _super.call(this, message) || this;
+        _this.name = 'EncryptedColumnQueryError';
+        // ES5 down-leveled `extends Error` loses the subclass prototype — restore it so
+        // `instanceof` holds for catchers.
+        Object.setPrototypeOf(_this, EncryptedColumnQueryError.prototype);
+        return _this;
+    }
+    return EncryptedColumnQueryError;
+}(Error));
+exports.EncryptedColumnQueryError = EncryptedColumnQueryError;
+//# sourceMappingURL=EncryptedColumnQueryError.js.map

package/dist/src/encryption/EncryptedColumnQueryError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptedColumnQueryError.js","sourceRoot":"","sources":["../../../src/encryption/EncryptedColumnQueryError.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA;;;;;GAKG;AACH;IAA+C,6CAAK;IAClD,mCAAY,OAAe;QAA3B,YACE,kBAAM,OAAO,CAAC,SAKf;QAJC,KAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,gFAAgF;QAChF,mCAAmC;QACnC,MAAM,CAAC,cAAc,CAAC,KAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC;;IACnE,CAAC;IACH,gCAAC;AAAD,CAAC,AARD,CAA+C,KAAK,GAQnD;AARY,8DAAyB"}

package/dist/src/encryption/EncryptedColumnQueryTransform.d.ts

@@ -0,0 +1,52 @@
+import { Aggregate, ColumnQueryTransform, ColumnQueryTransformContext, Condition, SortCriteria } from '@proteinjs/db-query';
+import type { Column, ColumnQueryRuntime, EncryptedColumnConfig, Table } from '../Table';
+/**
+ * An encrypted column's `ColumnQueryTransform` — the query-side half of the column's
+ * encryption contract (`EncryptionRecordHooks` is the storage-side half). Attached to the
+ * column by `EncryptedColumns.ensureSchema` (derived from `ColumnOptions.encrypted`, never
+ * caller-declared) and applied by `QueryBuilder.applyColumnTransforms` on every query, so
+ * callers keep writing exactly what they write today:
+ *
+ * - **Equality** (`=`, `IN`) on a column declared `searchable: 'equality'` rewrites onto the
+ *   whole-value fingerprint companion — one indexed lookup, exact (fingerprints cover the
+ *   exact value), fingerprinted once per accessible key owner (shared-scope reads OR the
+ *   owners' fingerprints).
+ * - **Contains / prefix LIKE** on a column declared `searchable: 'contains'` resolves in two
+ *   index-bounded steps: (1) the token table answers a candidate id set — rows holding ALL
+ *   of the query's fragment fingerprints under some accessible owner key; (2) candidates
+ *   are verified against the decrypted value (the pg_trgm recheck semantics — no false
+ *   positive survives, no true match ≥3-chars-per-word is missed). The condition then
+ *   rewrites to the VERIFIED id set, so it composes exactly under any boolean structure,
+ *   ORDER BY, pagination, and COUNT.
+ * - **Out-of-contract shapes are REJECTED loudly at query-build time** — undeclared ORDER BY,
+ *   ranges, arbitrary LIKE patterns, aggregation over the value — each error naming the
+ *   sanctioned paths. A limitation a developer cannot hit silently is a contract; one they
+ *   discover in production is a bug.
+ */
+export declare class EncryptedColumnQueryTransform implements ColumnQueryTransform {
+    private table;
+    private prop;
+    private column;
+    private config;
+    private runtime;
+    private encryptedColumns;
+    private tokenizer;
+    constructor(table: Table<any>, prop: string, column: Column<any, any>, config: EncryptedColumnConfig, runtime: ColumnQueryRuntime);
+    transformCondition(condition: Condition<any>, context: ColumnQueryTransformContext): Promise<Condition<any> | undefined>;
+    transformSort(criteria: SortCriteria<any>): SortCriteria<any>;
+    transformAggregate(aggregate: Aggregate<any>): Aggregate<any> | undefined;
+    transformGroupByField(): string;
+    private equalityCondition;
+    private likeCondition;
+    /**
+     * The two index-bounded steps of contains search (class doc): token-cover candidates,
+     * then decrypt-and-verify. Returns the ids whose values TRULY match the pattern.
+     */
+    private verifiedCandidateIds;
+    /** Candidate ids: rows whose token rows cover ALL query fragments under SOME accessible key. */
+    private tokenCoverCandidates;
+    private matches;
+    private parseLikePattern;
+    private accessibleIndexKeys;
+}
+//# sourceMappingURL=EncryptedColumnQueryTransform.d.ts.map

package/dist/src/encryption/EncryptedColumnQueryTransform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptedColumnQueryTransform.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptedColumnQueryTransform.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,2BAA2B,EAC3B,SAAS,EAET,YAAY,EACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAYzF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,6BAA8B,YAAW,oBAAoB;IAKtE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IARjB,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,SAAS,CAAyB;gBAGhC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EACxB,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,kBAAkB;IAG/B,kBAAkB,CACtB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EACzB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IA2CtC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC;IAqB7D,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,SAAS;IAYzE,qBAAqB,IAAI,MAAM;YAQjB,iBAAiB;YA8CjB,aAAa;IAsB3B;;;OAGG;YACW,oBAAoB;IAoClC,gGAAgG;YAClF,oBAAoB;IA0DlC,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,gBAAgB;YA0CV,mBAAmB;CAalC"}