@syncular/client-plugin-encryption 0.0.1-60

package/dist/index.d.ts

@@ -0,0 +1,78 @@
+import type { SyncClientDb, SyncClientPlugin, SyncClientPluginContext, SyncEngine } from '@syncular/client';
+import { type Kysely } from 'kysely';
+export * from './key-sharing';
+type FieldDecryptionErrorMode = 'throw' | 'keepCiphertext';
+interface FieldEncryptionRule {
+    scope: string;
+    /**
+     * Optional table selector. Strongly recommended for correctness:
+     * - Push/incremental changes have a table name.
+     * - Snapshot rows often do not; if omitted, the plugin must be able to infer it.
+     */
+    table?: string;
+    /** Column names to encrypt/decrypt */
+    fields: string[];
+    /**
+     * Row id column in snapshot row objects (defaults to "id").
+     * Push/incremental changes use the protocol `row_id` and ignore this.
+     */
+    rowIdField?: string;
+}
+export interface FieldEncryptionKeys {
+    /**
+     * Resolve a 32-byte symmetric key for a given key id.
+     * Throws (or rejects) when the key is unavailable.
+     */
+    getKey: (kid: string) => Uint8Array | Promise<Uint8Array>;
+    /**
+     * Select which key id to use when encrypting new values.
+     * Defaults to "default".
+     */
+    getEncryptionKid?: (ctx: SyncClientPluginContext, args: {
+        scope: string;
+        table: string;
+        rowId: string;
+        field: string;
+    }) => string | Promise<string>;
+}
+interface FieldEncryptionPluginOptions {
+    name?: string;
+    rules: FieldEncryptionRule[];
+    keys: FieldEncryptionKeys;
+    /**
+     * Controls what happens when ciphertext is present but decryption fails
+     * (unknown key, bad AAD, corrupted data).
+     */
+    decryptionErrorMode?: FieldDecryptionErrorMode;
+    /**
+     * Envelope prefix written into the DB. Changing this breaks decryption
+     * for existing rows.
+     */
+    envelopePrefix?: string;
+}
+interface RefreshEncryptedFieldsTarget {
+    scope: string;
+    table: string;
+    fields?: string[];
+}
+export interface RefreshEncryptedFieldsResult {
+    tablesProcessed: number;
+    rowsScanned: number;
+    rowsUpdated: number;
+    fieldsUpdated: number;
+}
+export interface FieldEncryptionPluginRefreshRequest<DB extends SyncClientDb = SyncClientDb> {
+    db: Kysely<DB>;
+    engine?: Pick<SyncEngine<DB>, 'recordLocalMutations'>;
+    targets?: RefreshEncryptedFieldsTarget[];
+    ctx?: Partial<SyncClientPluginContext>;
+}
+export interface FieldEncryptionPlugin extends SyncClientPlugin {
+    refreshEncryptedFields: <DB extends SyncClientDb = SyncClientDb>(options: FieldEncryptionPluginRefreshRequest<DB>) => Promise<RefreshEncryptedFieldsResult>;
+}
+export declare function createStaticFieldEncryptionKeys(args: {
+    keys: Record<string, Uint8Array | string>;
+    encryptionKid?: string;
+}): FieldEncryptionKeys;
+export declare function createFieldEncryptionPlugin(pluginOptions: FieldEncryptionPluginOptions): FieldEncryptionPlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACX,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAG1C,cAAc,eAAe,CAAC;AAI9B,KAAK,wBAAwB,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAE3D,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KACjE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,4BAA4B;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,IAAI,EAAE,mBAAmB,CAAC;IAC1B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,4BAA4B;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,MAAM,WAAW,mCAAmC,CAClD,EAAE,SAAS,YAAY,GAAG,YAAY;IAEtC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,4BAA4B,EAAE,CAAC;IACzC,GAAG,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,sBAAsB,EAAE,CAAC,EAAE,SAAS,YAAY,GAAG,YAAY,EAC7D,OAAO,EAAE,mCAAmC,CAAC,EAAE,CAAC,KAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5C;AAgKD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,mBAAmB,CAiBtB;AAghBD,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,4BAA4B,GAC1C,qBAAqB,CA8LvB"}