@syncular/client-plugin-encryption 0.0.1-60

package/dist/index.js

@@ -0,0 +1,713 @@
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
+import { sql } from 'kysely';
+// Re-export key sharing utilities
+export * from './key-sharing';
+const DEFAULT_PREFIX = 'dgsync:e2ee:1:';
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+// Base64 lookup tables for universal encoding/decoding (works in all runtimes)
+const BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+const BASE64_LOOKUP = new Uint8Array(256);
+for (let i = 0; i < BASE64_CHARS.length; i++) {
+    BASE64_LOOKUP[BASE64_CHARS.charCodeAt(i)] = i;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function randomBytes(length) {
+    const cryptoObj = globalThis.crypto;
+    if (!cryptoObj?.getRandomValues) {
+        throw new Error('Secure random generator is not available (crypto.getRandomValues). ' +
+            'Ensure you are running in a secure context or polyfill crypto.');
+    }
+    const out = new Uint8Array(length);
+    cryptoObj.getRandomValues(out);
+    return out;
+}
+/**
+ * Universal base64 encoding that works in all JavaScript runtimes.
+ * Uses Buffer for Node/Bun (fast), lookup table for others (RN-compatible).
+ */
+function bytesToBase64(bytes) {
+    // Node/Bun fast path
+    if (typeof Buffer !== 'undefined') {
+        return Buffer.from(bytes).toString('base64');
+    }
+    // Universal fallback using lookup table (works in RN, browsers, etc.)
+    let result = '';
+    const len = bytes.length;
+    const remainder = len % 3;
+    // Process 3 bytes at a time
+    for (let i = 0; i < len - remainder; i += 3) {
+        const a = bytes[i];
+        const b = bytes[i + 1];
+        const c = bytes[i + 2];
+        result +=
+            BASE64_CHARS.charAt((a >> 2) & 0x3f) +
+                BASE64_CHARS.charAt(((a << 4) | (b >> 4)) & 0x3f) +
+                BASE64_CHARS.charAt(((b << 2) | (c >> 6)) & 0x3f) +
+                BASE64_CHARS.charAt(c & 0x3f);
+    }
+    // Handle remaining bytes
+    if (remainder === 1) {
+        const a = bytes[len - 1];
+        result +=
+            BASE64_CHARS.charAt((a >> 2) & 0x3f) +
+                BASE64_CHARS.charAt((a << 4) & 0x3f) +
+                '==';
+    }
+    else if (remainder === 2) {
+        const a = bytes[len - 2];
+        const b = bytes[len - 1];
+        result +=
+            BASE64_CHARS.charAt((a >> 2) & 0x3f) +
+                BASE64_CHARS.charAt(((a << 4) | (b >> 4)) & 0x3f) +
+                BASE64_CHARS.charAt((b << 2) & 0x3f) +
+                '=';
+    }
+    return result;
+}
+/**
+ * Universal base64 decoding that works in all JavaScript runtimes.
+ * Uses Buffer for Node/Bun (fast), lookup table for others (RN-compatible).
+ */
+function base64ToBytes(base64) {
+    // Node/Bun fast path
+    if (typeof Buffer !== 'undefined') {
+        return new Uint8Array(Buffer.from(base64, 'base64'));
+    }
+    // Universal fallback using lookup table (works in RN, browsers, etc.)
+    // Remove padding and calculate output length
+    const len = base64.length;
+    let padding = 0;
+    if (base64[len - 1] === '=')
+        padding++;
+    if (base64[len - 2] === '=')
+        padding++;
+    const outputLen = (len * 3) / 4 - padding;
+    const out = new Uint8Array(outputLen);
+    let outIdx = 0;
+    for (let i = 0; i < len; i += 4) {
+        const a = BASE64_LOOKUP[base64.charCodeAt(i)];
+        const b = BASE64_LOOKUP[base64.charCodeAt(i + 1)];
+        const c = BASE64_LOOKUP[base64.charCodeAt(i + 2)];
+        const d = BASE64_LOOKUP[base64.charCodeAt(i + 3)];
+        out[outIdx++] = (a << 2) | (b >> 4);
+        if (outIdx < outputLen)
+            out[outIdx++] = ((b << 4) | (c >> 2)) & 0xff;
+        if (outIdx < outputLen)
+            out[outIdx++] = ((c << 6) | d) & 0xff;
+    }
+    return out;
+}
+function bytesToBase64Url(bytes) {
+    return bytesToBase64(bytes)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/g, '');
+}
+function base64UrlToBytes(base64url) {
+    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '==='.slice((base64.length + 3) % 4);
+    return base64ToBytes(padded);
+}
+function hexToBytes(hex) {
+    const normalized = hex.trim().toLowerCase();
+    if (normalized.length % 2 !== 0) {
+        throw new Error('Invalid hex string (length must be even)');
+    }
+    const out = new Uint8Array(normalized.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        const byte = Number.parseInt(normalized.slice(i * 2, i * 2 + 2), 16);
+        if (!Number.isFinite(byte))
+            throw new Error('Invalid hex string');
+        out[i] = byte;
+    }
+    return out;
+}
+function decodeKeyMaterial(key) {
+    if (key instanceof Uint8Array)
+        return key;
+    const trimmed = key.trim();
+    if (trimmed.startsWith('hex:'))
+        return hexToBytes(trimmed.slice('hex:'.length));
+    if (trimmed.startsWith('base64:'))
+        return base64ToBytes(trimmed.slice('base64:'.length));
+    if (trimmed.startsWith('base64url:'))
+        return base64UrlToBytes(trimmed.slice('base64url:'.length));
+    // Heuristic: 64 hex chars → 32-byte key.
+    if (/^[0-9a-fA-F]{64}$/.test(trimmed))
+        return hexToBytes(trimmed);
+    return base64UrlToBytes(trimmed);
+}
+export function createStaticFieldEncryptionKeys(args) {
+    const cache = new Map();
+    return {
+        async getKey(kid) {
+            const cached = cache.get(kid);
+            if (cached)
+                return cached;
+            const raw = args.keys[kid];
+            if (!raw)
+                throw new Error(`Missing encryption key for kid "${kid}"`);
+            const decoded = decodeKeyMaterial(raw);
+            cache.set(kid, decoded);
+            return decoded;
+        },
+        getEncryptionKid() {
+            return args.encryptionKid ?? 'default';
+        },
+    };
+}
+function makeAadBytes(args) {
+    // Keep this stable; changing it breaks decryption.
+    const s = `${args.scope}\u001f${args.table}\u001f${args.rowId}\u001f${args.field}`;
+    return encoder.encode(s);
+}
+function encodeEnvelope(prefix, args) {
+    return `${prefix}${args.kid}:${bytesToBase64Url(args.nonce)}:${bytesToBase64Url(args.ciphertext)}`;
+}
+function decodeEnvelope(prefix, value) {
+    if (!value.startsWith(prefix))
+        return null;
+    const rest = value.slice(prefix.length);
+    const parts = rest.split(':');
+    if (parts.length !== 3)
+        return null;
+    const [kid, nonceB64, ctB64] = parts;
+    if (!kid || !nonceB64 || !ctB64)
+        return null;
+    return {
+        kid,
+        nonce: base64UrlToBytes(nonceB64),
+        ciphertext: base64UrlToBytes(ctB64),
+    };
+}
+async function getKeyOrThrow(keys, kid) {
+    const key = await keys.getKey(kid);
+    if (!(key instanceof Uint8Array)) {
+        throw new Error(`Encryption key for kid "${kid}" must be a Uint8Array`);
+    }
+    if (key.length !== 32) {
+        throw new Error(`Encryption key for kid "${kid}" must be 32 bytes (got ${key.length})`);
+    }
+    return key;
+}
+async function encryptValue(args) {
+    if (args.value === null || args.value === undefined)
+        return args.value;
+    if (typeof args.value === 'string') {
+        const parsed = decodeEnvelope(args.prefix, args.value);
+        if (parsed)
+            return args.value;
+    }
+    const kid = (await args.keys.getEncryptionKid?.(args.ctx, {
+        scope: args.scope,
+        table: args.table,
+        rowId: args.rowId,
+        field: args.field,
+    })) ?? 'default';
+    if (typeof kid !== 'string' || kid.length === 0) {
+        throw new Error('Encryption key id must be a non-empty string');
+    }
+    if (kid.includes(':')) {
+        throw new Error('Encryption key id must not contain ":"');
+    }
+    const key = await getKeyOrThrow(args.keys, kid);
+    const nonce = randomBytes(24); // XChaCha20-Poly1305 nonce size
+    const aad = makeAadBytes({
+        scope: args.scope,
+        table: args.table,
+        rowId: args.rowId,
+        field: args.field,
+    });
+    const plaintext = encoder.encode(JSON.stringify(args.value));
+    const aead = xchacha20poly1305(key, nonce, aad);
+    const ciphertext = aead.encrypt(plaintext);
+    return encodeEnvelope(args.prefix, { kid, nonce, ciphertext });
+}
+async function decryptValue(args) {
+    if (typeof args.value !== 'string')
+        return args.value;
+    const parsed = decodeEnvelope(args.prefix, args.value);
+    if (!parsed)
+        return args.value;
+    try {
+        const key = await getKeyOrThrow(args.keys, parsed.kid);
+        const aad = makeAadBytes({
+            scope: args.scope,
+            table: args.table,
+            rowId: args.rowId,
+            field: args.field,
+        });
+        const aead = xchacha20poly1305(key, parsed.nonce, aad);
+        const plaintext = aead.decrypt(parsed.ciphertext);
+        const json = decoder.decode(plaintext);
+        return JSON.parse(json);
+    }
+    catch (err) {
+        if (args.decryptionErrorMode === 'keepCiphertext')
+            return args.value;
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to decrypt ${args.scope}.${args.table}.${args.field} row=${args.rowId}: ${message}`);
+    }
+}
+function buildRuleIndex(rules) {
+    const byScopeTable = new Map();
+    const tablesByScope = new Map();
+    for (const rule of rules) {
+        const scope = rule.scope;
+        const table = rule.table ?? '*';
+        const key = `${scope}\u001f${table}`;
+        const rowIdField = rule.rowIdField ?? 'id';
+        const existing = byScopeTable.get(key);
+        if (existing) {
+            if (existing.rowIdField !== rowIdField) {
+                throw new Error(`Conflicting rowIdField for rule ${scope}/${table}: "${existing.rowIdField}" vs "${rowIdField}"`);
+            }
+            const merged = new Set(existing.fields);
+            for (const f of rule.fields)
+                merged.add(f);
+            byScopeTable.set(key, { fields: merged, rowIdField });
+        }
+        else {
+            byScopeTable.set(key, { fields: new Set(rule.fields), rowIdField });
+        }
+        if (table !== '*') {
+            const set = tablesByScope.get(scope) ?? new Set();
+            set.add(table);
+            tablesByScope.set(scope, set);
+        }
+    }
+    // Freeze sets to make accidental mutation harder.
+    for (const [k, v] of byScopeTable) {
+        byScopeTable.set(k, {
+            fields: new Set(v.fields),
+            rowIdField: v.rowIdField,
+        });
+    }
+    return { byScopeTable, tablesByScope };
+}
+function getRuleConfig(index, args) {
+    const exact = index.byScopeTable.get(`${args.scope}\u001f${args.table}`);
+    if (exact)
+        return exact;
+    const wildcard = index.byScopeTable.get(`${args.scope}\u001f*`);
+    return wildcard ?? null;
+}
+function inferSnapshotTable(args) {
+    if (isRecord(args.row)) {
+        const tn = args.row.table_name;
+        if (typeof tn === 'string' && tn.length > 0)
+            return tn;
+        const tt = args.row.__table;
+        if (typeof tt === 'string' && tt.length > 0)
+            return tt;
+    }
+    const tables = args.index.tablesByScope.get(args.scope);
+    if (tables && tables.size === 1)
+        return Array.from(tables)[0];
+    throw new Error(`Cannot infer table for snapshot row (scope="${args.scope}"). Provide FieldEncryptionRule.table or include "table_name"/"__table" in snapshot rows.`);
+}
+function getSnapshotRowId(args) {
+    if (!isRecord(args.row)) {
+        throw new Error(`Snapshot row for ${args.scope}/${args.table} must be an object`);
+    }
+    const raw = args.row[args.rowIdField];
+    const rowId = String(raw ?? '');
+    if (!rowId) {
+        throw new Error(`Snapshot row for ${args.scope}/${args.table} is missing row id field "${args.rowIdField}"`);
+    }
+    return rowId;
+}
+async function transformRecordFields(args) {
+    const config = getRuleConfig(args.index, {
+        scope: args.scope,
+        table: args.table,
+    });
+    if (!config || config.fields.size === 0)
+        return args.record;
+    let changed = false;
+    const next = { ...args.record };
+    for (const field of config.fields) {
+        if (!(field in next))
+            continue;
+        const value = next[field];
+        const transformed = args.mode === 'encrypt'
+            ? await encryptValue({
+                ctx: args.ctx,
+                keys: args.keys,
+                prefix: args.prefix,
+                scope: args.scope,
+                table: args.table,
+                rowId: args.rowId,
+                field,
+                value,
+            })
+            : await decryptValue({
+                keys: args.keys,
+                prefix: args.prefix,
+                decryptionErrorMode: args.decryptionErrorMode,
+                scope: args.scope,
+                table: args.table,
+                rowId: args.rowId,
+                field,
+                value,
+            });
+        if (transformed !== value) {
+            next[field] = transformed;
+            changed = true;
+        }
+    }
+    return changed ? next : args.record;
+}
+function parseRuleKey(key) {
+    const splitAt = key.indexOf('\u001f');
+    if (splitAt < 0)
+        return { scope: key, table: '*' };
+    return {
+        scope: key.slice(0, splitAt),
+        table: key.slice(splitAt + 1),
+    };
+}
+function coerceSqlValue(value) {
+    if (typeof value === 'boolean')
+        return value ? 1 : 0;
+    return value;
+}
+function resolveRefreshTargets(args) {
+    const merged = new Map();
+    if (!args.targets || args.targets.length === 0) {
+        for (const [key, config] of args.index.byScopeTable) {
+            const parsed = parseRuleKey(key);
+            if (parsed.table === '*')
+                continue;
+            const mergedKey = `${parsed.scope}\u001f${parsed.table}`;
+            const existing = merged.get(mergedKey);
+            if (existing) {
+                for (const field of config.fields)
+                    existing.fields.add(field);
+            }
+            else {
+                merged.set(mergedKey, {
+                    scope: parsed.scope,
+                    table: parsed.table,
+                    rowIdField: config.rowIdField,
+                    fields: new Set(config.fields),
+                });
+            }
+        }
+    }
+    else {
+        for (const target of args.targets) {
+            const config = getRuleConfig(args.index, {
+                scope: target.scope,
+                table: target.table,
+            });
+            if (!config) {
+                throw new Error(`No field encryption rule configured for ${target.scope}/${target.table}`);
+            }
+            const selectedFields = target.fields ?? Array.from(config.fields);
+            if (selectedFields.length === 0) {
+                throw new Error(`Refresh target ${target.scope}/${target.table} has no fields`);
+            }
+            for (const field of selectedFields) {
+                if (!config.fields.has(field)) {
+                    throw new Error(`Field "${field}" is not configured for encryption in ${target.scope}/${target.table}`);
+                }
+            }
+            const mergedKey = `${target.scope}\u001f${target.table}`;
+            const existing = merged.get(mergedKey);
+            if (existing) {
+                if (existing.rowIdField !== config.rowIdField) {
+                    throw new Error(`Conflicting rowIdField for ${target.scope}/${target.table}: "${existing.rowIdField}" vs "${config.rowIdField}"`);
+                }
+                for (const field of selectedFields)
+                    existing.fields.add(field);
+            }
+            else {
+                merged.set(mergedKey, {
+                    scope: target.scope,
+                    table: target.table,
+                    rowIdField: config.rowIdField,
+                    fields: new Set(selectedFields),
+                });
+            }
+        }
+    }
+    return Array.from(merged.values()).map((target) => ({
+        scope: target.scope,
+        table: target.table,
+        rowIdField: target.rowIdField,
+        fields: Array.from(target.fields),
+    }));
+}
+async function refreshEncryptedFields(options) {
+    const prefix = options.envelopePrefix ?? DEFAULT_PREFIX;
+    if (!prefix.endsWith(':')) {
+        throw new Error('RefreshEncryptedFieldsOptions.envelopePrefix must end with ":"');
+    }
+    const decryptionErrorMode = options.decryptionErrorMode ?? 'throw';
+    const index = buildRuleIndex(options.rules ?? []);
+    const targets = resolveRefreshTargets({
+        index,
+        targets: options.targets,
+    });
+    if (targets.length === 0) {
+        return {
+            tablesProcessed: 0,
+            rowsScanned: 0,
+            rowsUpdated: 0,
+            fieldsUpdated: 0,
+        };
+    }
+    const ctx = {
+        actorId: options.ctx?.actorId ?? 'local-refresh',
+        clientId: options.ctx?.clientId ?? 'local-refresh',
+    };
+    let rowsScanned = 0;
+    let rowsUpdated = 0;
+    let fieldsUpdated = 0;
+    const updatedRows = [];
+    await options.db.transaction().execute(async (trx) => {
+        for (const target of targets) {
+            const columns = [target.rowIdField, ...target.fields];
+            const rowsResult = await sql `
+        select ${sql.join(columns.map((column) => sql.ref(column)), sql `, `)}
+        from ${sql.table(target.table)}
+      `.execute(trx);
+            rowsScanned += rowsResult.rows.length;
+            for (const row of rowsResult.rows) {
+                if (!isRecord(row))
+                    continue;
+                const rowIdValue = row[target.rowIdField];
+                if (rowIdValue === null || rowIdValue === undefined)
+                    continue;
+                const rowId = String(rowIdValue);
+                if (!rowId)
+                    continue;
+                let hasCiphertext = false;
+                for (const field of target.fields) {
+                    const value = row[field];
+                    if (typeof value === 'string' && value.startsWith(prefix)) {
+                        hasCiphertext = true;
+                        break;
+                    }
+                }
+                if (!hasCiphertext)
+                    continue;
+                const nextRow = await transformRecordFields({
+                    ctx,
+                    index,
+                    keys: options.keys,
+                    prefix,
+                    decryptionErrorMode,
+                    mode: 'decrypt',
+                    scope: target.scope,
+                    table: target.table,
+                    rowId,
+                    record: row,
+                });
+                if (nextRow === row)
+                    continue;
+                const assignments = [];
+                let changedFields = 0;
+                for (const field of target.fields) {
+                    if (!(field in nextRow))
+                        continue;
+                    const previousValue = row[field];
+                    const nextValue = nextRow[field];
+                    if (nextValue === previousValue)
+                        continue;
+                    assignments.push(sql `${sql.ref(field)} = ${sql.val(coerceSqlValue(nextValue))}`);
+                    changedFields += 1;
+                }
+                if (assignments.length === 0)
+                    continue;
+                await sql `
+          update ${sql.table(target.table)}
+          set ${sql.join(assignments, sql `, `)}
+          where ${sql.ref(target.rowIdField)} = ${sql.val(coerceSqlValue(rowIdValue))}
+        `.execute(trx);
+                rowsUpdated += 1;
+                fieldsUpdated += changedFields;
+                updatedRows.push({ table: target.table, rowId });
+            }
+        }
+    });
+    if (updatedRows.length > 0 && options.engine) {
+        const deduped = new Map();
+        for (const row of updatedRows) {
+            deduped.set(`${row.table}\u001f${row.rowId}`, row);
+        }
+        options.engine.recordLocalMutations(Array.from(deduped.values()).map((row) => ({
+            table: row.table,
+            rowId: row.rowId,
+            op: 'upsert',
+        })));
+    }
+    return {
+        tablesProcessed: targets.length,
+        rowsScanned,
+        rowsUpdated,
+        fieldsUpdated,
+    };
+}
+export function createFieldEncryptionPlugin(pluginOptions) {
+    const name = pluginOptions.name ?? 'field-encryption';
+    const prefix = pluginOptions.envelopePrefix ?? DEFAULT_PREFIX;
+    const decryptionErrorMode = pluginOptions.decryptionErrorMode ?? 'throw';
+    if (!prefix.endsWith(':')) {
+        throw new Error('FieldEncryptionPluginOptions.envelopePrefix must end with ":"');
+    }
+    const index = buildRuleIndex(pluginOptions.rules ?? []);
+    return {
+        name,
+        refreshEncryptedFields: (options) => refreshEncryptedFields({
+            db: options.db,
+            engine: options.engine,
+            rules: pluginOptions.rules,
+            keys: pluginOptions.keys,
+            envelopePrefix: prefix,
+            decryptionErrorMode,
+            targets: options.targets,
+            ctx: options.ctx,
+        }),
+        async beforePush(ctx, request) {
+            if ((pluginOptions.rules?.length ?? 0) === 0)
+                return request;
+            if ((request.operations?.length ?? 0) === 0)
+                return request;
+            const nextOps = await Promise.all(request.operations.map(async (op) => {
+                if (op.op !== 'upsert')
+                    return op;
+                if (!op.payload)
+                    return op;
+                const payload = op.payload;
+                const nextPayload = await transformRecordFields({
+                    ctx,
+                    index,
+                    keys: pluginOptions.keys,
+                    prefix,
+                    decryptionErrorMode,
+                    mode: 'encrypt',
+                    scope: op.table,
+                    table: op.table,
+                    rowId: op.row_id,
+                    record: payload,
+                });
+                if (nextPayload === payload)
+                    return op;
+                return { ...op, payload: nextPayload };
+            }));
+            return { ...request, operations: nextOps };
+        },
+        async afterPush(ctx, args) {
+            const { request, response } = args;
+            if ((pluginOptions.rules?.length ?? 0) === 0)
+                return response;
+            if ((response.results?.length ?? 0) === 0)
+                return response;
+            const nextResults = await Promise.all(response.results.map(async (r) => {
+                if (r.status !== 'conflict' || !('server_row' in r))
+                    return r;
+                if (r.server_row == null)
+                    return r;
+                const op = request.operations[r.opIndex];
+                if (!op)
+                    return r;
+                if (!isRecord(r.server_row))
+                    return r;
+                const nextRow = await transformRecordFields({
+                    ctx,
+                    index,
+                    keys: pluginOptions.keys,
+                    prefix,
+                    decryptionErrorMode,
+                    mode: 'decrypt',
+                    scope: op.table,
+                    table: op.table,
+                    rowId: op.row_id,
+                    record: r.server_row,
+                });
+                if (nextRow === r.server_row)
+                    return r;
+                return { ...r, server_row: nextRow };
+            }));
+            return { ...response, results: nextResults };
+        },
+        async afterPull(ctx, args) {
+            const { response } = args;
+            if ((pluginOptions.rules?.length ?? 0) === 0)
+                return response;
+            const nextSubscriptions = await Promise.all(response.subscriptions.map(async (sub) => {
+                // Bootstrap snapshots
+                if (sub.bootstrap) {
+                    const nextSnapshots = await Promise.all((sub.snapshots ?? []).map(async (snapshot) => {
+                        const scope = snapshot.table;
+                        const rows = snapshot.rows ?? [];
+                        if (rows.length === 0)
+                            return snapshot;
+                        const nextRows = await Promise.all(rows.map(async (row) => {
+                            const table = inferSnapshotTable({ index, scope, row });
+                            const config = getRuleConfig(index, { scope, table });
+                            if (!config || config.fields.size === 0)
+                                return row;
+                            const rowId = getSnapshotRowId({
+                                row,
+                                rowIdField: config.rowIdField,
+                                scope,
+                                table,
+                            });
+                            if (!isRecord(row))
+                                return row;
+                            const nextRow = await transformRecordFields({
+                                ctx,
+                                index,
+                                keys: pluginOptions.keys,
+                                prefix,
+                                decryptionErrorMode,
+                                mode: 'decrypt',
+                                scope,
+                                table,
+                                rowId,
+                                record: row,
+                            });
+                            return nextRow;
+                        }));
+                        return { ...snapshot, rows: nextRows };
+                    }));
+                    return { ...sub, snapshots: nextSnapshots };
+                }
+                // Incremental commits
+                const nextCommits = await Promise.all((sub.commits ?? []).map(async (commit) => {
+                    const nextChanges = await Promise.all((commit.changes ?? []).map(async (change) => {
+                        if (change.op !== 'upsert')
+                            return change;
+                        if (!isRecord(change.row_json))
+                            return change;
+                        const nextRow = await transformRecordFields({
+                            ctx,
+                            index,
+                            keys: pluginOptions.keys,
+                            prefix,
+                            decryptionErrorMode,
+                            mode: 'decrypt',
+                            scope: change.table,
+                            table: change.table,
+                            rowId: change.row_id,
+                            record: change.row_json,
+                        });
+                        if (nextRow === change.row_json)
+                            return change;
+                        return { ...change, row_json: nextRow };
+                    }));
+                    return { ...commit, changes: nextChanges };
+                }));
+                return { ...sub, commits: nextCommits };
+            }));
+            return { ...response, subscriptions: nextSubscriptions };
+        },
+    };
+}
+//# sourceMappingURL=index.js.map