pecunia-root 0.0.9 → 0.1.1

package/dist/node_modules/.pnpm/mongodb@6.21.0/node_modules/mongodb/lib/client-side-encryption/client_encryption.mjs

@@ -0,0 +1,545 @@
+import { __commonJSMin } from "../../../../../../../_virtual/rolldown_runtime.mjs";
+import { require_bson } from "../bson.mjs";
+import { require_utils } from "../utils.mjs";
+import { require_timeout } from "../timeout.mjs";
+import { require_deps } from "../deps.mjs";
+import { require_crypto_callbacks } from "./crypto_callbacks.mjs";
+import { require_errors } from "./errors.mjs";
+import { require_providers } from "./providers/index.mjs";
+import { require_state_machine } from "./state_machine.mjs";
+
+//#region ../../node_modules/.pnpm/mongodb@6.21.0/node_modules/mongodb/lib/client-side-encryption/client_encryption.js
+var require_client_encryption = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.ClientEncryption = void 0;
+	exports.autoSelectSocketOptions = autoSelectSocketOptions;
+	const bson_1 = require_bson();
+	const deps_1 = require_deps();
+	const timeout_1 = require_timeout();
+	const utils_1 = require_utils();
+	const cryptoCallbacks = require_crypto_callbacks();
+	const errors_1 = require_errors();
+	const index_1 = require_providers();
+	const state_machine_1 = require_state_machine();
+	/**
+	* @public
+	* The public interface for explicit in-use encryption
+	*/
+	var ClientEncryption = class ClientEncryption {
+		/** @internal */
+		static getMongoCrypt() {
+			const encryption = (0, deps_1.getMongoDBClientEncryption)();
+			if ("kModuleError" in encryption) throw encryption.kModuleError;
+			return encryption.MongoCrypt;
+		}
+		/**
+		* Create a new encryption instance
+		*
+		* @example
+		* ```ts
+		* new ClientEncryption(mongoClient, {
+		*   keyVaultNamespace: 'client.encryption',
+		*   kmsProviders: {
+		*     local: {
+		*       key: masterKey // The master key used for encryption/decryption. A 96-byte long Buffer
+		*     }
+		*   }
+		* });
+		* ```
+		*
+		* @example
+		* ```ts
+		* new ClientEncryption(mongoClient, {
+		*   keyVaultNamespace: 'client.encryption',
+		*   kmsProviders: {
+		*     aws: {
+		*       accessKeyId: AWS_ACCESS_KEY,
+		*       secretAccessKey: AWS_SECRET_KEY
+		*     }
+		*   }
+		* });
+		* ```
+		*/
+		constructor(client, options) {
+			this._client = client;
+			this._proxyOptions = options.proxyOptions ?? {};
+			this._tlsOptions = options.tlsOptions ?? {};
+			this._kmsProviders = options.kmsProviders || {};
+			const { timeoutMS } = (0, utils_1.resolveTimeoutOptions)(client, options);
+			this._timeoutMS = timeoutMS;
+			this._credentialProviders = options.credentialProviders;
+			if (options.credentialProviders?.aws && !(0, index_1.isEmptyCredentials)("aws", this._kmsProviders)) throw new errors_1.MongoCryptInvalidArgumentError("Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching");
+			if (options.keyVaultNamespace == null) throw new errors_1.MongoCryptInvalidArgumentError("Missing required option `keyVaultNamespace`");
+			const mongoCryptOptions = {
+				...options,
+				cryptoCallbacks,
+				kmsProviders: !Buffer.isBuffer(this._kmsProviders) ? (0, bson_1.serialize)(this._kmsProviders) : this._kmsProviders
+			};
+			this._keyVaultNamespace = options.keyVaultNamespace;
+			this._keyVaultClient = options.keyVaultClient || client;
+			this._mongoCrypt = new (ClientEncryption.getMongoCrypt())(mongoCryptOptions);
+		}
+		/**
+		* Creates a data key used for explicit encryption and inserts it into the key vault namespace
+		*
+		* @example
+		* ```ts
+		* // Using async/await to create a local key
+		* const dataKeyId = await clientEncryption.createDataKey('local');
+		* ```
+		*
+		* @example
+		* ```ts
+		* // Using async/await to create an aws key
+		* const dataKeyId = await clientEncryption.createDataKey('aws', {
+		*   masterKey: {
+		*     region: 'us-east-1',
+		*     key: 'xxxxxxxxxxxxxx' // CMK ARN here
+		*   }
+		* });
+		* ```
+		*
+		* @example
+		* ```ts
+		* // Using async/await to create an aws key with a keyAltName
+		* const dataKeyId = await clientEncryption.createDataKey('aws', {
+		*   masterKey: {
+		*     region: 'us-east-1',
+		*     key: 'xxxxxxxxxxxxxx' // CMK ARN here
+		*   },
+		*   keyAltNames: [ 'mySpecialKey' ]
+		* });
+		* ```
+		*/
+		async createDataKey(provider, options = {}) {
+			if (options.keyAltNames && !Array.isArray(options.keyAltNames)) throw new errors_1.MongoCryptInvalidArgumentError(`Option "keyAltNames" must be an array of strings, but was of type ${typeof options.keyAltNames}.`);
+			let keyAltNames = void 0;
+			if (options.keyAltNames && options.keyAltNames.length > 0) keyAltNames = options.keyAltNames.map((keyAltName, i) => {
+				if (typeof keyAltName !== "string") throw new errors_1.MongoCryptInvalidArgumentError(`Option "keyAltNames" must be an array of strings, but item at index ${i} was of type ${typeof keyAltName}`);
+				return (0, bson_1.serialize)({ keyAltName });
+			});
+			let keyMaterial = void 0;
+			if (options.keyMaterial) keyMaterial = (0, bson_1.serialize)({ keyMaterial: options.keyMaterial });
+			const dataKeyBson = (0, bson_1.serialize)({
+				provider,
+				...options.masterKey
+			});
+			const context = this._mongoCrypt.makeDataKeyContext(dataKeyBson, {
+				keyAltNames,
+				keyMaterial
+			});
+			const stateMachine = new state_machine_1.StateMachine({
+				proxyOptions: this._proxyOptions,
+				tlsOptions: this._tlsOptions,
+				socketOptions: autoSelectSocketOptions(this._client.s.options)
+			});
+			const timeoutContext = options?.timeoutContext ?? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }));
+			const dataKey = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			const { insertedId } = await this._keyVaultClient.db(dbName).collection(collectionName).insertOne(dataKey, {
+				writeConcern: { w: "majority" },
+				timeoutMS: timeoutContext?.csotEnabled() ? timeoutContext?.getRemainingTimeMSOrThrow() : void 0
+			});
+			return insertedId;
+		}
+		/**
+		* Searches the keyvault for any data keys matching the provided filter.  If there are matches, rewrapManyDataKey then attempts to re-wrap the data keys using the provided options.
+		*
+		* If no matches are found, then no bulk write is performed.
+		*
+		* @example
+		* ```ts
+		* // rewrapping all data data keys (using a filter that matches all documents)
+		* const filter = {};
+		*
+		* const result = await clientEncryption.rewrapManyDataKey(filter);
+		* if (result.bulkWriteResult != null) {
+		*  // keys were re-wrapped, results will be available in the bulkWrite object.
+		* }
+		* ```
+		*
+		* @example
+		* ```ts
+		* // attempting to rewrap all data keys with no matches
+		* const filter = { _id: new Binary() } // assume _id matches no documents in the database
+		* const result = await clientEncryption.rewrapManyDataKey(filter);
+		*
+		* if (result.bulkWriteResult == null) {
+		*  // no keys matched, `bulkWriteResult` does not exist on the result object
+		* }
+		* ```
+		*/
+		async rewrapManyDataKey(filter, options) {
+			let keyEncryptionKeyBson = void 0;
+			if (options) {
+				const keyEncryptionKey = Object.assign({ provider: options.provider }, options.masterKey);
+				keyEncryptionKeyBson = (0, bson_1.serialize)(keyEncryptionKey);
+			}
+			const filterBson = (0, bson_1.serialize)(filter);
+			const context = this._mongoCrypt.makeRewrapManyDataKeyContext(filterBson, keyEncryptionKeyBson);
+			const stateMachine = new state_machine_1.StateMachine({
+				proxyOptions: this._proxyOptions,
+				tlsOptions: this._tlsOptions,
+				socketOptions: autoSelectSocketOptions(this._client.s.options)
+			});
+			const timeoutContext = timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }));
+			const { v: dataKeys } = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));
+			if (dataKeys.length === 0) return {};
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			const replacements = dataKeys.map((key) => ({ updateOne: {
+				filter: { _id: key._id },
+				update: {
+					$set: {
+						masterKey: key.masterKey,
+						keyMaterial: key.keyMaterial
+					},
+					$currentDate: { updateDate: true }
+				}
+			} }));
+			return { bulkWriteResult: await this._keyVaultClient.db(dbName).collection(collectionName).bulkWrite(replacements, {
+				writeConcern: { w: "majority" },
+				timeoutMS: timeoutContext.csotEnabled() ? timeoutContext?.remainingTimeMS : void 0
+			}) };
+		}
+		/**
+		* Deletes the key with the provided id from the keyvault, if it exists.
+		*
+		* @example
+		* ```ts
+		* // delete a key by _id
+		* const id = new Binary(); // id is a bson binary subtype 4 object
+		* const { deletedCount } = await clientEncryption.deleteKey(id);
+		*
+		* if (deletedCount != null && deletedCount > 0) {
+		*   // successful deletion
+		* }
+		* ```
+		*
+		*/
+		async deleteKey(_id) {
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			return await this._keyVaultClient.db(dbName).collection(collectionName).deleteOne({ _id }, {
+				writeConcern: { w: "majority" },
+				timeoutMS: this._timeoutMS
+			});
+		}
+		/**
+		* Finds all the keys currently stored in the keyvault.
+		*
+		* This method will not throw.
+		*
+		* @returns a FindCursor over all keys in the keyvault.
+		* @example
+		* ```ts
+		* // fetching all keys
+		* const keys = await clientEncryption.getKeys().toArray();
+		* ```
+		*/
+		getKeys() {
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			return this._keyVaultClient.db(dbName).collection(collectionName).find({}, {
+				readConcern: { level: "majority" },
+				timeoutMS: this._timeoutMS
+			});
+		}
+		/**
+		* Finds a key in the keyvault with the specified _id.
+		*
+		* Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents
+		* match the id.  The promise rejects with an error if an error is thrown.
+		* @example
+		* ```ts
+		* // getting a key by id
+		* const id = new Binary(); // id is a bson binary subtype 4 object
+		* const key = await clientEncryption.getKey(id);
+		* if (!key) {
+		*  // key is null if there was no matching key
+		* }
+		* ```
+		*/
+		async getKey(_id) {
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			return await this._keyVaultClient.db(dbName).collection(collectionName).findOne({ _id }, {
+				readConcern: { level: "majority" },
+				timeoutMS: this._timeoutMS
+			});
+		}
+		/**
+		* Finds a key in the keyvault which has the specified keyAltName.
+		*
+		* @param keyAltName - a keyAltName to search for a key
+		* @returns Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents
+		* match the keyAltName.  The promise rejects with an error if an error is thrown.
+		* @example
+		* ```ts
+		* // get a key by alt name
+		* const keyAltName = 'keyAltName';
+		* const key = await clientEncryption.getKeyByAltName(keyAltName);
+		* if (!key) {
+		*  // key is null if there is no matching key
+		* }
+		* ```
+		*/
+		async getKeyByAltName(keyAltName) {
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			return await this._keyVaultClient.db(dbName).collection(collectionName).findOne({ keyAltNames: keyAltName }, {
+				readConcern: { level: "majority" },
+				timeoutMS: this._timeoutMS
+			});
+		}
+		/**
+		* Adds a keyAltName to a key identified by the provided _id.
+		*
+		* This method resolves to/returns the *old* key value (prior to adding the new altKeyName).
+		*
+		* @param _id - The id of the document to update.
+		* @param keyAltName - a keyAltName to search for a key
+		* @returns Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents
+		* match the id.  The promise rejects with an error if an error is thrown.
+		* @example
+		* ```ts
+		* // adding an keyAltName to a data key
+		* const id = new Binary();  // id is a bson binary subtype 4 object
+		* const keyAltName = 'keyAltName';
+		* const oldKey = await clientEncryption.addKeyAltName(id, keyAltName);
+		* if (!oldKey) {
+		*  // null is returned if there is no matching document with an id matching the supplied id
+		* }
+		* ```
+		*/
+		async addKeyAltName(_id, keyAltName) {
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			return await this._keyVaultClient.db(dbName).collection(collectionName).findOneAndUpdate({ _id }, { $addToSet: { keyAltNames: keyAltName } }, {
+				writeConcern: { w: "majority" },
+				returnDocument: "before",
+				timeoutMS: this._timeoutMS
+			});
+		}
+		/**
+		* Adds a keyAltName to a key identified by the provided _id.
+		*
+		* This method resolves to/returns the *old* key value (prior to removing the new altKeyName).
+		*
+		* If the removed keyAltName is the last keyAltName for that key, the `altKeyNames` property is unset from the document.
+		*
+		* @param _id - The id of the document to update.
+		* @param keyAltName - a keyAltName to search for a key
+		* @returns Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents
+		* match the id.  The promise rejects with an error if an error is thrown.
+		* @example
+		* ```ts
+		* // removing a key alt name from a data key
+		* const id = new Binary();  // id is a bson binary subtype 4 object
+		* const keyAltName = 'keyAltName';
+		* const oldKey = await clientEncryption.removeKeyAltName(id, keyAltName);
+		*
+		* if (!oldKey) {
+		*  // null is returned if there is no matching document with an id matching the supplied id
+		* }
+		* ```
+		*/
+		async removeKeyAltName(_id, keyAltName) {
+			const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);
+			const pipeline = [{ $set: { keyAltNames: { $cond: [
+				{ $eq: ["$keyAltNames", [keyAltName]] },
+				"$$REMOVE",
+				{ $filter: {
+					input: "$keyAltNames",
+					cond: { $ne: ["$$this", keyAltName] }
+				} }
+			] } } }];
+			return await this._keyVaultClient.db(dbName).collection(collectionName).findOneAndUpdate({ _id }, pipeline, {
+				writeConcern: { w: "majority" },
+				returnDocument: "before",
+				timeoutMS: this._timeoutMS
+			});
+		}
+		/**
+		* A convenience method for creating an encrypted collection.
+		* This method will create data keys for any encryptedFields that do not have a `keyId` defined
+		* and then create a new collection with the full set of encryptedFields.
+		*
+		* @param db - A Node.js driver Db object with which to create the collection
+		* @param name - The name of the collection to be created
+		* @param options - Options for createDataKey and for createCollection
+		* @returns created collection and generated encryptedFields
+		* @throws MongoCryptCreateDataKeyError - If part way through the process a createDataKey invocation fails, an error will be rejected that has the partial `encryptedFields` that were created.
+		* @throws MongoCryptCreateEncryptedCollectionError - If creating the collection fails, an error will be rejected that has the entire `encryptedFields` that were created.
+		*/
+		async createEncryptedCollection(db, name, options) {
+			const { provider, masterKey, createCollectionOptions: { encryptedFields: { ...encryptedFields }, ...createCollectionOptions } } = options;
+			const timeoutContext = this._timeoutMS != null ? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS })) : void 0;
+			if (Array.isArray(encryptedFields.fields)) {
+				const createDataKeyPromises = encryptedFields.fields.map(async (field) => field == null || typeof field !== "object" || field.keyId != null ? field : {
+					...field,
+					keyId: await this.createDataKey(provider, {
+						masterKey,
+						timeoutContext: timeoutContext?.csotEnabled() ? timeoutContext?.clone() : void 0
+					})
+				});
+				const createDataKeyResolutions = await Promise.allSettled(createDataKeyPromises);
+				encryptedFields.fields = createDataKeyResolutions.map((resolution, index) => resolution.status === "fulfilled" ? resolution.value : encryptedFields.fields[index]);
+				const rejection = createDataKeyResolutions.find((result) => result.status === "rejected");
+				if (rejection != null) throw new errors_1.MongoCryptCreateDataKeyError(encryptedFields, { cause: rejection.reason });
+			}
+			try {
+				return {
+					collection: await db.createCollection(name, {
+						...createCollectionOptions,
+						encryptedFields,
+						timeoutMS: timeoutContext?.csotEnabled() ? timeoutContext?.getRemainingTimeMSOrThrow() : void 0
+					}),
+					encryptedFields
+				};
+			} catch (cause) {
+				throw new errors_1.MongoCryptCreateEncryptedCollectionError(encryptedFields, { cause });
+			}
+		}
+		/**
+		* Explicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must
+		* be specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.
+		*
+		* @param value - The value that you wish to serialize. Must be of a type that can be serialized into BSON
+		* @param options -
+		* @returns a Promise that either resolves with the encrypted value, or rejects with an error.
+		*
+		* @example
+		* ```ts
+		* // Encryption with async/await api
+		* async function encryptMyData(value) {
+		*   const keyId = await clientEncryption.createDataKey('local');
+		*   return clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
+		* }
+		* ```
+		*
+		* @example
+		* ```ts
+		* // Encryption using a keyAltName
+		* async function encryptMyData(value) {
+		*   await clientEncryption.createDataKey('local', { keyAltNames: 'mySpecialKey' });
+		*   return clientEncryption.encrypt(value, { keyAltName: 'mySpecialKey', algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
+		* }
+		* ```
+		*/
+		async encrypt(value, options) {
+			return await this._encrypt(value, false, options);
+		}
+		/**
+		* Encrypts a Match Expression or Aggregate Expression to query a range index.
+		*
+		* Only supported when queryType is "range" and algorithm is "Range".
+		*
+		* @param expression - a BSON document of one of the following forms:
+		*  1. A Match Expression of this form:
+		*      `{$and: [{<field>: {$gt: <value1>}}, {<field>: {$lt: <value2> }}]}`
+		*  2. An Aggregate Expression of this form:
+		*      `{$and: [{$gt: [<fieldpath>, <value1>]}, {$lt: [<fieldpath>, <value2>]}]}`
+		*
+		*    `$gt` may also be `$gte`. `$lt` may also be `$lte`.
+		*
+		* @param options -
+		* @returns Returns a Promise that either resolves with the encrypted value or rejects with an error.
+		*/
+		async encryptExpression(expression, options) {
+			return await this._encrypt(expression, true, options);
+		}
+		/**
+		* Explicitly decrypt a provided encrypted value
+		*
+		* @param value - An encrypted value
+		* @returns a Promise that either resolves with the decrypted value, or rejects with an error
+		*
+		* @example
+		* ```ts
+		* // Decrypting value with async/await API
+		* async function decryptMyValue(value) {
+		*   return clientEncryption.decrypt(value);
+		* }
+		* ```
+		*/
+		async decrypt(value) {
+			const valueBuffer = (0, bson_1.serialize)({ v: value });
+			const context = this._mongoCrypt.makeExplicitDecryptionContext(valueBuffer);
+			const stateMachine = new state_machine_1.StateMachine({
+				proxyOptions: this._proxyOptions,
+				tlsOptions: this._tlsOptions,
+				socketOptions: autoSelectSocketOptions(this._client.s.options)
+			});
+			const timeoutContext = this._timeoutMS != null ? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS })) : void 0;
+			const { v } = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));
+			return v;
+		}
+		/**
+		* @internal
+		* Ask the user for KMS credentials.
+		*
+		* This returns anything that looks like the kmsProviders original input
+		* option. It can be empty, and any provider specified here will override
+		* the original ones.
+		*/
+		async askForKMSCredentials() {
+			return await (0, index_1.refreshKMSCredentials)(this._kmsProviders, this._credentialProviders);
+		}
+		static get libmongocryptVersion() {
+			return ClientEncryption.getMongoCrypt().libmongocryptVersion;
+		}
+		/**
+		* @internal
+		* A helper that perform explicit encryption of values and expressions.
+		* Explicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must
+		* be specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.
+		*
+		* @param value - The value that you wish to encrypt. Must be of a type that can be serialized into BSON
+		* @param expressionMode - a boolean that indicates whether or not to encrypt the value as an expression
+		* @param options - options to pass to encrypt
+		* @returns the raw result of the call to stateMachine.execute().  When expressionMode is set to true, the return
+		*          value will be a bson document.  When false, the value will be a BSON Binary.
+		*
+		*/
+		async _encrypt(value, expressionMode, options) {
+			const { algorithm, keyId, keyAltName, contentionFactor, queryType, rangeOptions, textOptions } = options;
+			const contextOptions = {
+				expressionMode,
+				algorithm
+			};
+			if (keyId) contextOptions.keyId = keyId.buffer;
+			if (keyAltName) {
+				if (keyId) throw new errors_1.MongoCryptInvalidArgumentError(`"options" cannot contain both "keyId" and "keyAltName"`);
+				if (typeof keyAltName !== "string") throw new errors_1.MongoCryptInvalidArgumentError(`"options.keyAltName" must be of type string, but was of type ${typeof keyAltName}`);
+				contextOptions.keyAltName = (0, bson_1.serialize)({ keyAltName });
+			}
+			if (typeof contentionFactor === "number" || typeof contentionFactor === "bigint") contextOptions.contentionFactor = contentionFactor;
+			if (typeof queryType === "string") contextOptions.queryType = queryType;
+			if (typeof rangeOptions === "object") contextOptions.rangeOptions = (0, bson_1.serialize)(rangeOptions);
+			if (typeof textOptions === "object") contextOptions.textOptions = (0, bson_1.serialize)(textOptions);
+			const valueBuffer = (0, bson_1.serialize)({ v: value });
+			const stateMachine = new state_machine_1.StateMachine({
+				proxyOptions: this._proxyOptions,
+				tlsOptions: this._tlsOptions,
+				socketOptions: autoSelectSocketOptions(this._client.s.options)
+			});
+			const context = this._mongoCrypt.makeExplicitEncryptionContext(valueBuffer, contextOptions);
+			const timeoutContext = this._timeoutMS != null ? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS })) : void 0;
+			const { v } = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));
+			return v;
+		}
+	};
+	exports.ClientEncryption = ClientEncryption;
+	/**
+	* Get the socket options from the client.
+	* @param baseOptions - The mongo client options.
+	* @returns ClientEncryptionSocketOptions
+	*/
+	function autoSelectSocketOptions(baseOptions) {
+		const options = { autoSelectFamily: true };
+		if ("autoSelectFamily" in baseOptions) options.autoSelectFamily = baseOptions.autoSelectFamily;
+		if ("autoSelectFamilyAttemptTimeout" in baseOptions) options.autoSelectFamilyAttemptTimeout = baseOptions.autoSelectFamilyAttemptTimeout;
+		return options;
+	}
+}));
+
+//#endregion
+export default require_client_encryption();
+
+export { require_client_encryption };
+//# sourceMappingURL=client_encryption.mjs.map

package/dist/node_modules/.pnpm/mongodb@6.21.0/node_modules/mongodb/lib/client-side-encryption/client_encryption.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client_encryption.mjs","names":[],"sources":["../../../../../../../../../../node_modules/.pnpm/mongodb@6.21.0/node_modules/mongodb/lib/client-side-encryption/client_encryption.js"],"sourcesContent":["\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.ClientEncryption = void 0;\nexports.autoSelectSocketOptions = autoSelectSocketOptions;\nconst bson_1 = require(\"../bson\");\nconst deps_1 = require(\"../deps\");\nconst timeout_1 = require(\"../timeout\");\nconst utils_1 = require(\"../utils\");\nconst cryptoCallbacks = require(\"./crypto_callbacks\");\nconst errors_1 = require(\"./errors\");\nconst index_1 = require(\"./providers/index\");\nconst state_machine_1 = require(\"./state_machine\");\n/**\n * @public\n * The public interface for explicit in-use encryption\n */\nclass ClientEncryption {\n    /** @internal */\n    static getMongoCrypt() {\n        const encryption = (0, deps_1.getMongoDBClientEncryption)();\n        if ('kModuleError' in encryption) {\n            throw encryption.kModuleError;\n        }\n        return encryption.MongoCrypt;\n    }\n    /**\n     * Create a new encryption instance\n     *\n     * @example\n     * ```ts\n     * new ClientEncryption(mongoClient, {\n     *   keyVaultNamespace: 'client.encryption',\n     *   kmsProviders: {\n     *     local: {\n     *       key: masterKey // The master key used for encryption/decryption. A 96-byte long Buffer\n     *     }\n     *   }\n     * });\n     * ```\n     *\n     * @example\n     * ```ts\n     * new ClientEncryption(mongoClient, {\n     *   keyVaultNamespace: 'client.encryption',\n     *   kmsProviders: {\n     *     aws: {\n     *       accessKeyId: AWS_ACCESS_KEY,\n     *       secretAccessKey: AWS_SECRET_KEY\n     *     }\n     *   }\n     * });\n     * ```\n     */\n    constructor(client, options) {\n        this._client = client;\n        this._proxyOptions = options.proxyOptions ?? {};\n        this._tlsOptions = options.tlsOptions ?? {};\n        this._kmsProviders = options.kmsProviders || {};\n        const { timeoutMS } = (0, utils_1.resolveTimeoutOptions)(client, options);\n        this._timeoutMS = timeoutMS;\n        this._credentialProviders = options.credentialProviders;\n        if (options.credentialProviders?.aws && !(0, index_1.isEmptyCredentials)('aws', this._kmsProviders)) {\n            throw new errors_1.MongoCryptInvalidArgumentError('Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching');\n        }\n        if (options.keyVaultNamespace == null) {\n            throw new errors_1.MongoCryptInvalidArgumentError('Missing required option `keyVaultNamespace`');\n        }\n        const mongoCryptOptions = {\n            ...options,\n            cryptoCallbacks,\n            kmsProviders: !Buffer.isBuffer(this._kmsProviders)\n                ? (0, bson_1.serialize)(this._kmsProviders)\n                : this._kmsProviders\n        };\n        this._keyVaultNamespace = options.keyVaultNamespace;\n        this._keyVaultClient = options.keyVaultClient || client;\n        const MongoCrypt = ClientEncryption.getMongoCrypt();\n        this._mongoCrypt = new MongoCrypt(mongoCryptOptions);\n    }\n    /**\n     * Creates a data key used for explicit encryption and inserts it into the key vault namespace\n     *\n     * @example\n     * ```ts\n     * // Using async/await to create a local key\n     * const dataKeyId = await clientEncryption.createDataKey('local');\n     * ```\n     *\n     * @example\n     * ```ts\n     * // Using async/await to create an aws key\n     * const dataKeyId = await clientEncryption.createDataKey('aws', {\n     *   masterKey: {\n     *     region: 'us-east-1',\n     *     key: 'xxxxxxxxxxxxxx' // CMK ARN here\n     *   }\n     * });\n     * ```\n     *\n     * @example\n     * ```ts\n     * // Using async/await to create an aws key with a keyAltName\n     * const dataKeyId = await clientEncryption.createDataKey('aws', {\n     *   masterKey: {\n     *     region: 'us-east-1',\n     *     key: 'xxxxxxxxxxxxxx' // CMK ARN here\n     *   },\n     *   keyAltNames: [ 'mySpecialKey' ]\n     * });\n     * ```\n     */\n    async createDataKey(provider, options = {}) {\n        if (options.keyAltNames && !Array.isArray(options.keyAltNames)) {\n            throw new errors_1.MongoCryptInvalidArgumentError(`Option \"keyAltNames\" must be an array of strings, but was of type ${typeof options.keyAltNames}.`);\n        }\n        let keyAltNames = undefined;\n        if (options.keyAltNames && options.keyAltNames.length > 0) {\n            keyAltNames = options.keyAltNames.map((keyAltName, i) => {\n                if (typeof keyAltName !== 'string') {\n                    throw new errors_1.MongoCryptInvalidArgumentError(`Option \"keyAltNames\" must be an array of strings, but item at index ${i} was of type ${typeof keyAltName}`);\n                }\n                return (0, bson_1.serialize)({ keyAltName });\n            });\n        }\n        let keyMaterial = undefined;\n        if (options.keyMaterial) {\n            keyMaterial = (0, bson_1.serialize)({ keyMaterial: options.keyMaterial });\n        }\n        const dataKeyBson = (0, bson_1.serialize)({\n            provider,\n            ...options.masterKey\n        });\n        const context = this._mongoCrypt.makeDataKeyContext(dataKeyBson, {\n            keyAltNames,\n            keyMaterial\n        });\n        const stateMachine = new state_machine_1.StateMachine({\n            proxyOptions: this._proxyOptions,\n            tlsOptions: this._tlsOptions,\n            socketOptions: autoSelectSocketOptions(this._client.s.options)\n        });\n        const timeoutContext = options?.timeoutContext ??\n            timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }));\n        const dataKey = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        const { insertedId } = await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .insertOne(dataKey, {\n            writeConcern: { w: 'majority' },\n            timeoutMS: timeoutContext?.csotEnabled()\n                ? timeoutContext?.getRemainingTimeMSOrThrow()\n                : undefined\n        });\n        return insertedId;\n    }\n    /**\n     * Searches the keyvault for any data keys matching the provided filter.  If there are matches, rewrapManyDataKey then attempts to re-wrap the data keys using the provided options.\n     *\n     * If no matches are found, then no bulk write is performed.\n     *\n     * @example\n     * ```ts\n     * // rewrapping all data data keys (using a filter that matches all documents)\n     * const filter = {};\n     *\n     * const result = await clientEncryption.rewrapManyDataKey(filter);\n     * if (result.bulkWriteResult != null) {\n     *  // keys were re-wrapped, results will be available in the bulkWrite object.\n     * }\n     * ```\n     *\n     * @example\n     * ```ts\n     * // attempting to rewrap all data keys with no matches\n     * const filter = { _id: new Binary() } // assume _id matches no documents in the database\n     * const result = await clientEncryption.rewrapManyDataKey(filter);\n     *\n     * if (result.bulkWriteResult == null) {\n     *  // no keys matched, `bulkWriteResult` does not exist on the result object\n     * }\n     * ```\n     */\n    async rewrapManyDataKey(filter, options) {\n        let keyEncryptionKeyBson = undefined;\n        if (options) {\n            const keyEncryptionKey = Object.assign({ provider: options.provider }, options.masterKey);\n            keyEncryptionKeyBson = (0, bson_1.serialize)(keyEncryptionKey);\n        }\n        const filterBson = (0, bson_1.serialize)(filter);\n        const context = this._mongoCrypt.makeRewrapManyDataKeyContext(filterBson, keyEncryptionKeyBson);\n        const stateMachine = new state_machine_1.StateMachine({\n            proxyOptions: this._proxyOptions,\n            tlsOptions: this._tlsOptions,\n            socketOptions: autoSelectSocketOptions(this._client.s.options)\n        });\n        const timeoutContext = timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }));\n        const { v: dataKeys } = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));\n        if (dataKeys.length === 0) {\n            return {};\n        }\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        const replacements = dataKeys.map((key) => ({\n            updateOne: {\n                filter: { _id: key._id },\n                update: {\n                    $set: {\n                        masterKey: key.masterKey,\n                        keyMaterial: key.keyMaterial\n                    },\n                    $currentDate: {\n                        updateDate: true\n                    }\n                }\n            }\n        }));\n        const result = await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .bulkWrite(replacements, {\n            writeConcern: { w: 'majority' },\n            timeoutMS: timeoutContext.csotEnabled() ? timeoutContext?.remainingTimeMS : undefined\n        });\n        return { bulkWriteResult: result };\n    }\n    /**\n     * Deletes the key with the provided id from the keyvault, if it exists.\n     *\n     * @example\n     * ```ts\n     * // delete a key by _id\n     * const id = new Binary(); // id is a bson binary subtype 4 object\n     * const { deletedCount } = await clientEncryption.deleteKey(id);\n     *\n     * if (deletedCount != null && deletedCount > 0) {\n     *   // successful deletion\n     * }\n     * ```\n     *\n     */\n    async deleteKey(_id) {\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        return await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .deleteOne({ _id }, { writeConcern: { w: 'majority' }, timeoutMS: this._timeoutMS });\n    }\n    /**\n     * Finds all the keys currently stored in the keyvault.\n     *\n     * This method will not throw.\n     *\n     * @returns a FindCursor over all keys in the keyvault.\n     * @example\n     * ```ts\n     * // fetching all keys\n     * const keys = await clientEncryption.getKeys().toArray();\n     * ```\n     */\n    getKeys() {\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        return this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .find({}, { readConcern: { level: 'majority' }, timeoutMS: this._timeoutMS });\n    }\n    /**\n     * Finds a key in the keyvault with the specified _id.\n     *\n     * Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents\n     * match the id.  The promise rejects with an error if an error is thrown.\n     * @example\n     * ```ts\n     * // getting a key by id\n     * const id = new Binary(); // id is a bson binary subtype 4 object\n     * const key = await clientEncryption.getKey(id);\n     * if (!key) {\n     *  // key is null if there was no matching key\n     * }\n     * ```\n     */\n    async getKey(_id) {\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        return await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .findOne({ _id }, { readConcern: { level: 'majority' }, timeoutMS: this._timeoutMS });\n    }\n    /**\n     * Finds a key in the keyvault which has the specified keyAltName.\n     *\n     * @param keyAltName - a keyAltName to search for a key\n     * @returns Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents\n     * match the keyAltName.  The promise rejects with an error if an error is thrown.\n     * @example\n     * ```ts\n     * // get a key by alt name\n     * const keyAltName = 'keyAltName';\n     * const key = await clientEncryption.getKeyByAltName(keyAltName);\n     * if (!key) {\n     *  // key is null if there is no matching key\n     * }\n     * ```\n     */\n    async getKeyByAltName(keyAltName) {\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        return await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .findOne({ keyAltNames: keyAltName }, { readConcern: { level: 'majority' }, timeoutMS: this._timeoutMS });\n    }\n    /**\n     * Adds a keyAltName to a key identified by the provided _id.\n     *\n     * This method resolves to/returns the *old* key value (prior to adding the new altKeyName).\n     *\n     * @param _id - The id of the document to update.\n     * @param keyAltName - a keyAltName to search for a key\n     * @returns Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents\n     * match the id.  The promise rejects with an error if an error is thrown.\n     * @example\n     * ```ts\n     * // adding an keyAltName to a data key\n     * const id = new Binary();  // id is a bson binary subtype 4 object\n     * const keyAltName = 'keyAltName';\n     * const oldKey = await clientEncryption.addKeyAltName(id, keyAltName);\n     * if (!oldKey) {\n     *  // null is returned if there is no matching document with an id matching the supplied id\n     * }\n     * ```\n     */\n    async addKeyAltName(_id, keyAltName) {\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        const value = await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .findOneAndUpdate({ _id }, { $addToSet: { keyAltNames: keyAltName } }, { writeConcern: { w: 'majority' }, returnDocument: 'before', timeoutMS: this._timeoutMS });\n        return value;\n    }\n    /**\n     * Adds a keyAltName to a key identified by the provided _id.\n     *\n     * This method resolves to/returns the *old* key value (prior to removing the new altKeyName).\n     *\n     * If the removed keyAltName is the last keyAltName for that key, the `altKeyNames` property is unset from the document.\n     *\n     * @param _id - The id of the document to update.\n     * @param keyAltName - a keyAltName to search for a key\n     * @returns Returns a promise that either resolves to a {@link DataKey} if a document matches the key or null if no documents\n     * match the id.  The promise rejects with an error if an error is thrown.\n     * @example\n     * ```ts\n     * // removing a key alt name from a data key\n     * const id = new Binary();  // id is a bson binary subtype 4 object\n     * const keyAltName = 'keyAltName';\n     * const oldKey = await clientEncryption.removeKeyAltName(id, keyAltName);\n     *\n     * if (!oldKey) {\n     *  // null is returned if there is no matching document with an id matching the supplied id\n     * }\n     * ```\n     */\n    async removeKeyAltName(_id, keyAltName) {\n        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(this._keyVaultNamespace);\n        const pipeline = [\n            {\n                $set: {\n                    keyAltNames: {\n                        $cond: [\n                            {\n                                $eq: ['$keyAltNames', [keyAltName]]\n                            },\n                            '$$REMOVE',\n                            {\n                                $filter: {\n                                    input: '$keyAltNames',\n                                    cond: {\n                                        $ne: ['$$this', keyAltName]\n                                    }\n                                }\n                            }\n                        ]\n                    }\n                }\n            }\n        ];\n        const value = await this._keyVaultClient\n            .db(dbName)\n            .collection(collectionName)\n            .findOneAndUpdate({ _id }, pipeline, {\n            writeConcern: { w: 'majority' },\n            returnDocument: 'before',\n            timeoutMS: this._timeoutMS\n        });\n        return value;\n    }\n    /**\n     * A convenience method for creating an encrypted collection.\n     * This method will create data keys for any encryptedFields that do not have a `keyId` defined\n     * and then create a new collection with the full set of encryptedFields.\n     *\n     * @param db - A Node.js driver Db object with which to create the collection\n     * @param name - The name of the collection to be created\n     * @param options - Options for createDataKey and for createCollection\n     * @returns created collection and generated encryptedFields\n     * @throws MongoCryptCreateDataKeyError - If part way through the process a createDataKey invocation fails, an error will be rejected that has the partial `encryptedFields` that were created.\n     * @throws MongoCryptCreateEncryptedCollectionError - If creating the collection fails, an error will be rejected that has the entire `encryptedFields` that were created.\n     */\n    async createEncryptedCollection(db, name, options) {\n        const { provider, masterKey, createCollectionOptions: { encryptedFields: { ...encryptedFields }, ...createCollectionOptions } } = options;\n        const timeoutContext = this._timeoutMS != null\n            ? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }))\n            : undefined;\n        if (Array.isArray(encryptedFields.fields)) {\n            const createDataKeyPromises = encryptedFields.fields.map(async (field) => field == null || typeof field !== 'object' || field.keyId != null\n                ? field\n                : {\n                    ...field,\n                    keyId: await this.createDataKey(provider, {\n                        masterKey,\n                        // clone the timeoutContext\n                        // in order to avoid sharing the same timeout for server selection and connection checkout across different concurrent operations\n                        timeoutContext: timeoutContext?.csotEnabled() ? timeoutContext?.clone() : undefined\n                    })\n                });\n            const createDataKeyResolutions = await Promise.allSettled(createDataKeyPromises);\n            encryptedFields.fields = createDataKeyResolutions.map((resolution, index) => resolution.status === 'fulfilled' ? resolution.value : encryptedFields.fields[index]);\n            const rejection = createDataKeyResolutions.find((result) => result.status === 'rejected');\n            if (rejection != null) {\n                throw new errors_1.MongoCryptCreateDataKeyError(encryptedFields, { cause: rejection.reason });\n            }\n        }\n        try {\n            const collection = await db.createCollection(name, {\n                ...createCollectionOptions,\n                encryptedFields,\n                timeoutMS: timeoutContext?.csotEnabled()\n                    ? timeoutContext?.getRemainingTimeMSOrThrow()\n                    : undefined\n            });\n            return { collection, encryptedFields };\n        }\n        catch (cause) {\n            throw new errors_1.MongoCryptCreateEncryptedCollectionError(encryptedFields, { cause });\n        }\n    }\n    /**\n     * Explicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must\n     * be specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.\n     *\n     * @param value - The value that you wish to serialize. Must be of a type that can be serialized into BSON\n     * @param options -\n     * @returns a Promise that either resolves with the encrypted value, or rejects with an error.\n     *\n     * @example\n     * ```ts\n     * // Encryption with async/await api\n     * async function encryptMyData(value) {\n     *   const keyId = await clientEncryption.createDataKey('local');\n     *   return clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });\n     * }\n     * ```\n     *\n     * @example\n     * ```ts\n     * // Encryption using a keyAltName\n     * async function encryptMyData(value) {\n     *   await clientEncryption.createDataKey('local', { keyAltNames: 'mySpecialKey' });\n     *   return clientEncryption.encrypt(value, { keyAltName: 'mySpecialKey', algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });\n     * }\n     * ```\n     */\n    async encrypt(value, options) {\n        return await this._encrypt(value, false, options);\n    }\n    /**\n     * Encrypts a Match Expression or Aggregate Expression to query a range index.\n     *\n     * Only supported when queryType is \"range\" and algorithm is \"Range\".\n     *\n     * @param expression - a BSON document of one of the following forms:\n     *  1. A Match Expression of this form:\n     *      `{$and: [{<field>: {$gt: <value1>}}, {<field>: {$lt: <value2> }}]}`\n     *  2. An Aggregate Expression of this form:\n     *      `{$and: [{$gt: [<fieldpath>, <value1>]}, {$lt: [<fieldpath>, <value2>]}]}`\n     *\n     *    `$gt` may also be `$gte`. `$lt` may also be `$lte`.\n     *\n     * @param options -\n     * @returns Returns a Promise that either resolves with the encrypted value or rejects with an error.\n     */\n    async encryptExpression(expression, options) {\n        return await this._encrypt(expression, true, options);\n    }\n    /**\n     * Explicitly decrypt a provided encrypted value\n     *\n     * @param value - An encrypted value\n     * @returns a Promise that either resolves with the decrypted value, or rejects with an error\n     *\n     * @example\n     * ```ts\n     * // Decrypting value with async/await API\n     * async function decryptMyValue(value) {\n     *   return clientEncryption.decrypt(value);\n     * }\n     * ```\n     */\n    async decrypt(value) {\n        const valueBuffer = (0, bson_1.serialize)({ v: value });\n        const context = this._mongoCrypt.makeExplicitDecryptionContext(valueBuffer);\n        const stateMachine = new state_machine_1.StateMachine({\n            proxyOptions: this._proxyOptions,\n            tlsOptions: this._tlsOptions,\n            socketOptions: autoSelectSocketOptions(this._client.s.options)\n        });\n        const timeoutContext = this._timeoutMS != null\n            ? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }))\n            : undefined;\n        const { v } = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));\n        return v;\n    }\n    /**\n     * @internal\n     * Ask the user for KMS credentials.\n     *\n     * This returns anything that looks like the kmsProviders original input\n     * option. It can be empty, and any provider specified here will override\n     * the original ones.\n     */\n    async askForKMSCredentials() {\n        return await (0, index_1.refreshKMSCredentials)(this._kmsProviders, this._credentialProviders);\n    }\n    static get libmongocryptVersion() {\n        return ClientEncryption.getMongoCrypt().libmongocryptVersion;\n    }\n    /**\n     * @internal\n     * A helper that perform explicit encryption of values and expressions.\n     * Explicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must\n     * be specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.\n     *\n     * @param value - The value that you wish to encrypt. Must be of a type that can be serialized into BSON\n     * @param expressionMode - a boolean that indicates whether or not to encrypt the value as an expression\n     * @param options - options to pass to encrypt\n     * @returns the raw result of the call to stateMachine.execute().  When expressionMode is set to true, the return\n     *          value will be a bson document.  When false, the value will be a BSON Binary.\n     *\n     */\n    async _encrypt(value, expressionMode, options) {\n        const { algorithm, keyId, keyAltName, contentionFactor, queryType, rangeOptions, textOptions } = options;\n        const contextOptions = {\n            expressionMode,\n            algorithm\n        };\n        if (keyId) {\n            contextOptions.keyId = keyId.buffer;\n        }\n        if (keyAltName) {\n            if (keyId) {\n                throw new errors_1.MongoCryptInvalidArgumentError(`\"options\" cannot contain both \"keyId\" and \"keyAltName\"`);\n            }\n            if (typeof keyAltName !== 'string') {\n                throw new errors_1.MongoCryptInvalidArgumentError(`\"options.keyAltName\" must be of type string, but was of type ${typeof keyAltName}`);\n            }\n            contextOptions.keyAltName = (0, bson_1.serialize)({ keyAltName });\n        }\n        if (typeof contentionFactor === 'number' || typeof contentionFactor === 'bigint') {\n            contextOptions.contentionFactor = contentionFactor;\n        }\n        if (typeof queryType === 'string') {\n            contextOptions.queryType = queryType;\n        }\n        if (typeof rangeOptions === 'object') {\n            contextOptions.rangeOptions = (0, bson_1.serialize)(rangeOptions);\n        }\n        if (typeof textOptions === 'object') {\n            contextOptions.textOptions = (0, bson_1.serialize)(textOptions);\n        }\n        const valueBuffer = (0, bson_1.serialize)({ v: value });\n        const stateMachine = new state_machine_1.StateMachine({\n            proxyOptions: this._proxyOptions,\n            tlsOptions: this._tlsOptions,\n            socketOptions: autoSelectSocketOptions(this._client.s.options)\n        });\n        const context = this._mongoCrypt.makeExplicitEncryptionContext(valueBuffer, contextOptions);\n        const timeoutContext = this._timeoutMS != null\n            ? timeout_1.TimeoutContext.create((0, utils_1.resolveTimeoutOptions)(this._client, { timeoutMS: this._timeoutMS }))\n            : undefined;\n        const { v } = (0, bson_1.deserialize)(await stateMachine.execute(this, context, { timeoutContext }));\n        return v;\n    }\n}\nexports.ClientEncryption = ClientEncryption;\n/**\n * Get the socket options from the client.\n * @param baseOptions - The mongo client options.\n * @returns ClientEncryptionSocketOptions\n */\nfunction autoSelectSocketOptions(baseOptions) {\n    const options = { autoSelectFamily: true };\n    if ('autoSelectFamily' in baseOptions) {\n        options.autoSelectFamily = baseOptions.autoSelectFamily;\n    }\n    if ('autoSelectFamilyAttemptTimeout' in baseOptions) {\n        options.autoSelectFamilyAttemptTimeout = baseOptions.autoSelectFamilyAttemptTimeout;\n    }\n    return options;\n}\n//# sourceMappingURL=client_encryption.js.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;AACA,QAAO,eAAe,SAAS,cAAc,EAAE,OAAO,MAAM,CAAC;AAC7D,SAAQ,mBAAmB,KAAK;AAChC,SAAQ,0BAA0B;CAClC,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;CACN,MAAM;;;;;CAKN,IAAM,mBAAN,MAAM,iBAAiB;;EAEnB,OAAO,gBAAgB;GACnB,MAAM,cAAc,GAAG,OAAO,6BAA6B;AAC3D,OAAI,kBAAkB,WAClB,OAAM,WAAW;AAErB,UAAO,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8BtB,YAAY,QAAQ,SAAS;AACzB,QAAK,UAAU;AACf,QAAK,gBAAgB,QAAQ,gBAAgB,EAAE;AAC/C,QAAK,cAAc,QAAQ,cAAc,EAAE;AAC3C,QAAK,gBAAgB,QAAQ,gBAAgB,EAAE;GAC/C,MAAM,EAAE,eAAe,GAAG,QAAQ,uBAAuB,QAAQ,QAAQ;AACzE,QAAK,aAAa;AAClB,QAAK,uBAAuB,QAAQ;AACpC,OAAI,QAAQ,qBAAqB,OAAO,EAAE,GAAG,QAAQ,oBAAoB,OAAO,KAAK,cAAc,CAC/F,OAAM,IAAI,SAAS,+BAA+B,+HAA+H;AAErL,OAAI,QAAQ,qBAAqB,KAC7B,OAAM,IAAI,SAAS,+BAA+B,8CAA8C;GAEpG,MAAM,oBAAoB;IACtB,GAAG;IACH;IACA,cAAc,CAAC,OAAO,SAAS,KAAK,cAAc,IAC3C,GAAG,OAAO,WAAW,KAAK,cAAc,GACzC,KAAK;IACd;AACD,QAAK,qBAAqB,QAAQ;AAClC,QAAK,kBAAkB,QAAQ,kBAAkB;AAEjD,QAAK,cAAc,KADA,iBAAiB,eAAe,EACjB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxD,MAAM,cAAc,UAAU,UAAU,EAAE,EAAE;AACxC,OAAI,QAAQ,eAAe,CAAC,MAAM,QAAQ,QAAQ,YAAY,CAC1D,OAAM,IAAI,SAAS,+BAA+B,qEAAqE,OAAO,QAAQ,YAAY,GAAG;GAEzJ,IAAI,cAAc;AAClB,OAAI,QAAQ,eAAe,QAAQ,YAAY,SAAS,EACpD,eAAc,QAAQ,YAAY,KAAK,YAAY,MAAM;AACrD,QAAI,OAAO,eAAe,SACtB,OAAM,IAAI,SAAS,+BAA+B,uEAAuE,EAAE,eAAe,OAAO,aAAa;AAElK,YAAQ,GAAG,OAAO,WAAW,EAAE,YAAY,CAAC;KAC9C;GAEN,IAAI,cAAc;AAClB,OAAI,QAAQ,YACR,gBAAe,GAAG,OAAO,WAAW,EAAE,aAAa,QAAQ,aAAa,CAAC;GAE7E,MAAM,eAAe,GAAG,OAAO,WAAW;IACtC;IACA,GAAG,QAAQ;IACd,CAAC;GACF,MAAM,UAAU,KAAK,YAAY,mBAAmB,aAAa;IAC7D;IACA;IACH,CAAC;GACF,MAAM,eAAe,IAAI,gBAAgB,aAAa;IAClD,cAAc,KAAK;IACnB,YAAY,KAAK;IACjB,eAAe,wBAAwB,KAAK,QAAQ,EAAE,QAAQ;IACjE,CAAC;GACF,MAAM,iBAAiB,SAAS,kBAC5B,UAAU,eAAe,QAAQ,GAAG,QAAQ,uBAAuB,KAAK,SAAS,EAAE,WAAW,KAAK,YAAY,CAAC,CAAC;GACrH,MAAM,WAAW,GAAG,OAAO,aAAa,MAAM,aAAa,QAAQ,MAAM,SAAS,EAAE,gBAAgB,CAAC,CAAC;GACtG,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;GACzH,MAAM,EAAE,eAAe,MAAM,KAAK,gBAC7B,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,UAAU,SAAS;IACpB,cAAc,EAAE,GAAG,YAAY;IAC/B,WAAW,gBAAgB,aAAa,GAClC,gBAAgB,2BAA2B,GAC3C;IACT,CAAC;AACF,UAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BX,MAAM,kBAAkB,QAAQ,SAAS;GACrC,IAAI,uBAAuB;AAC3B,OAAI,SAAS;IACT,MAAM,mBAAmB,OAAO,OAAO,EAAE,UAAU,QAAQ,UAAU,EAAE,QAAQ,UAAU;AACzF,4BAAwB,GAAG,OAAO,WAAW,iBAAiB;;GAElE,MAAM,cAAc,GAAG,OAAO,WAAW,OAAO;GAChD,MAAM,UAAU,KAAK,YAAY,6BAA6B,YAAY,qBAAqB;GAC/F,MAAM,eAAe,IAAI,gBAAgB,aAAa;IAClD,cAAc,KAAK;IACnB,YAAY,KAAK;IACjB,eAAe,wBAAwB,KAAK,QAAQ,EAAE,QAAQ;IACjE,CAAC;GACF,MAAM,iBAAiB,UAAU,eAAe,QAAQ,GAAG,QAAQ,uBAAuB,KAAK,SAAS,EAAE,WAAW,KAAK,YAAY,CAAC,CAAC;GACxI,MAAM,EAAE,GAAG,cAAc,GAAG,OAAO,aAAa,MAAM,aAAa,QAAQ,MAAM,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAC9G,OAAI,SAAS,WAAW,EACpB,QAAO,EAAE;GAEb,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;GACzH,MAAM,eAAe,SAAS,KAAK,SAAS,EACxC,WAAW;IACP,QAAQ,EAAE,KAAK,IAAI,KAAK;IACxB,QAAQ;KACJ,MAAM;MACF,WAAW,IAAI;MACf,aAAa,IAAI;MACpB;KACD,cAAc,EACV,YAAY,MACf;KACJ;IACJ,EACJ,EAAE;AAQH,UAAO,EAAE,iBAPM,MAAM,KAAK,gBACrB,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,UAAU,cAAc;IACzB,cAAc,EAAE,GAAG,YAAY;IAC/B,WAAW,eAAe,aAAa,GAAG,gBAAgB,kBAAkB;IAC/E,CAAC,EACgC;;;;;;;;;;;;;;;;;EAiBtC,MAAM,UAAU,KAAK;GACjB,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;AACzH,UAAO,MAAM,KAAK,gBACb,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,UAAU,EAAE,KAAK,EAAE;IAAE,cAAc,EAAE,GAAG,YAAY;IAAE,WAAW,KAAK;IAAY,CAAC;;;;;;;;;;;;;;EAc5F,UAAU;GACN,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;AACzH,UAAO,KAAK,gBACP,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,KAAK,EAAE,EAAE;IAAE,aAAa,EAAE,OAAO,YAAY;IAAE,WAAW,KAAK;IAAY,CAAC;;;;;;;;;;;;;;;;;EAiBrF,MAAM,OAAO,KAAK;GACd,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;AACzH,UAAO,MAAM,KAAK,gBACb,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,QAAQ,EAAE,KAAK,EAAE;IAAE,aAAa,EAAE,OAAO,YAAY;IAAE,WAAW,KAAK;IAAY,CAAC;;;;;;;;;;;;;;;;;;EAkB7F,MAAM,gBAAgB,YAAY;GAC9B,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;AACzH,UAAO,MAAM,KAAK,gBACb,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,QAAQ,EAAE,aAAa,YAAY,EAAE;IAAE,aAAa,EAAE,OAAO,YAAY;IAAE,WAAW,KAAK;IAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;EAsBjH,MAAM,cAAc,KAAK,YAAY;GACjC,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;AAKzH,UAJc,MAAM,KAAK,gBACpB,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,iBAAiB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,YAAY,EAAE,EAAE;IAAE,cAAc,EAAE,GAAG,YAAY;IAAE,gBAAgB;IAAU,WAAW,KAAK;IAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;EA0BzK,MAAM,iBAAiB,KAAK,YAAY;GACpC,MAAM,EAAE,IAAI,QAAQ,YAAY,mBAAmB,QAAQ,2BAA2B,WAAW,KAAK,mBAAmB;GACzH,MAAM,WAAW,CACb,EACI,MAAM,EACF,aAAa,EACT,OAAO;IACH,EACI,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,EACtC;IACD;IACA,EACI,SAAS;KACL,OAAO;KACP,MAAM,EACF,KAAK,CAAC,UAAU,WAAW,EAC9B;KACJ,EACJ;IACJ,EACJ,EACJ,EACJ,CACJ;AASD,UARc,MAAM,KAAK,gBACpB,GAAG,OAAO,CACV,WAAW,eAAe,CAC1B,iBAAiB,EAAE,KAAK,EAAE,UAAU;IACrC,cAAc,EAAE,GAAG,YAAY;IAC/B,gBAAgB;IAChB,WAAW,KAAK;IACnB,CAAC;;;;;;;;;;;;;;EAeN,MAAM,0BAA0B,IAAI,MAAM,SAAS;GAC/C,MAAM,EAAE,UAAU,WAAW,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,GAAG,8BAA8B;GAClI,MAAM,iBAAiB,KAAK,cAAc,OACpC,UAAU,eAAe,QAAQ,GAAG,QAAQ,uBAAuB,KAAK,SAAS,EAAE,WAAW,KAAK,YAAY,CAAC,CAAC,GACjH;AACN,OAAI,MAAM,QAAQ,gBAAgB,OAAO,EAAE;IACvC,MAAM,wBAAwB,gBAAgB,OAAO,IAAI,OAAO,UAAU,SAAS,QAAQ,OAAO,UAAU,YAAY,MAAM,SAAS,OACjI,QACA;KACE,GAAG;KACH,OAAO,MAAM,KAAK,cAAc,UAAU;MACtC;MAGA,gBAAgB,gBAAgB,aAAa,GAAG,gBAAgB,OAAO,GAAG;MAC7E,CAAC;KACL,CAAC;IACN,MAAM,2BAA2B,MAAM,QAAQ,WAAW,sBAAsB;AAChF,oBAAgB,SAAS,yBAAyB,KAAK,YAAY,UAAU,WAAW,WAAW,cAAc,WAAW,QAAQ,gBAAgB,OAAO,OAAO;IAClK,MAAM,YAAY,yBAAyB,MAAM,WAAW,OAAO,WAAW,WAAW;AACzF,QAAI,aAAa,KACb,OAAM,IAAI,SAAS,6BAA6B,iBAAiB,EAAE,OAAO,UAAU,QAAQ,CAAC;;AAGrG,OAAI;AAQA,WAAO;KAAE,YAPU,MAAM,GAAG,iBAAiB,MAAM;MAC/C,GAAG;MACH;MACA,WAAW,gBAAgB,aAAa,GAClC,gBAAgB,2BAA2B,GAC3C;MACT,CAAC;KACmB;KAAiB;YAEnC,OAAO;AACV,UAAM,IAAI,SAAS,yCAAyC,iBAAiB,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6B/F,MAAM,QAAQ,OAAO,SAAS;AAC1B,UAAO,MAAM,KAAK,SAAS,OAAO,OAAO,QAAQ;;;;;;;;;;;;;;;;;;EAkBrD,MAAM,kBAAkB,YAAY,SAAS;AACzC,UAAO,MAAM,KAAK,SAAS,YAAY,MAAM,QAAQ;;;;;;;;;;;;;;;;EAgBzD,MAAM,QAAQ,OAAO;GACjB,MAAM,eAAe,GAAG,OAAO,WAAW,EAAE,GAAG,OAAO,CAAC;GACvD,MAAM,UAAU,KAAK,YAAY,8BAA8B,YAAY;GAC3E,MAAM,eAAe,IAAI,gBAAgB,aAAa;IAClD,cAAc,KAAK;IACnB,YAAY,KAAK;IACjB,eAAe,wBAAwB,KAAK,QAAQ,EAAE,QAAQ;IACjE,CAAC;GACF,MAAM,iBAAiB,KAAK,cAAc,OACpC,UAAU,eAAe,QAAQ,GAAG,QAAQ,uBAAuB,KAAK,SAAS,EAAE,WAAW,KAAK,YAAY,CAAC,CAAC,GACjH;GACN,MAAM,EAAE,OAAO,GAAG,OAAO,aAAa,MAAM,aAAa,QAAQ,MAAM,SAAS,EAAE,gBAAgB,CAAC,CAAC;AACpG,UAAO;;;;;;;;;;EAUX,MAAM,uBAAuB;AACzB,UAAO,OAAO,GAAG,QAAQ,uBAAuB,KAAK,eAAe,KAAK,qBAAqB;;EAElG,WAAW,uBAAuB;AAC9B,UAAO,iBAAiB,eAAe,CAAC;;;;;;;;;;;;;;;EAe5C,MAAM,SAAS,OAAO,gBAAgB,SAAS;GAC3C,MAAM,EAAE,WAAW,OAAO,YAAY,kBAAkB,WAAW,cAAc,gBAAgB;GACjG,MAAM,iBAAiB;IACnB;IACA;IACH;AACD,OAAI,MACA,gBAAe,QAAQ,MAAM;AAEjC,OAAI,YAAY;AACZ,QAAI,MACA,OAAM,IAAI,SAAS,+BAA+B,yDAAyD;AAE/G,QAAI,OAAO,eAAe,SACtB,OAAM,IAAI,SAAS,+BAA+B,gEAAgE,OAAO,aAAa;AAE1I,mBAAe,cAAc,GAAG,OAAO,WAAW,EAAE,YAAY,CAAC;;AAErE,OAAI,OAAO,qBAAqB,YAAY,OAAO,qBAAqB,SACpE,gBAAe,mBAAmB;AAEtC,OAAI,OAAO,cAAc,SACrB,gBAAe,YAAY;AAE/B,OAAI,OAAO,iBAAiB,SACxB,gBAAe,gBAAgB,GAAG,OAAO,WAAW,aAAa;AAErE,OAAI,OAAO,gBAAgB,SACvB,gBAAe,eAAe,GAAG,OAAO,WAAW,YAAY;GAEnE,MAAM,eAAe,GAAG,OAAO,WAAW,EAAE,GAAG,OAAO,CAAC;GACvD,MAAM,eAAe,IAAI,gBAAgB,aAAa;IAClD,cAAc,KAAK;IACnB,YAAY,KAAK;IACjB,eAAe,wBAAwB,KAAK,QAAQ,EAAE,QAAQ;IACjE,CAAC;GACF,MAAM,UAAU,KAAK,YAAY,8BAA8B,aAAa,eAAe;GAC3F,MAAM,iBAAiB,KAAK,cAAc,OACpC,UAAU,eAAe,QAAQ,GAAG,QAAQ,uBAAuB,KAAK,SAAS,EAAE,WAAW,KAAK,YAAY,CAAC,CAAC,GACjH;GACN,MAAM,EAAE,OAAO,GAAG,OAAO,aAAa,MAAM,aAAa,QAAQ,MAAM,SAAS,EAAE,gBAAgB,CAAC,CAAC;AACpG,UAAO;;;AAGf,SAAQ,mBAAmB;;;;;;CAM3B,SAAS,wBAAwB,aAAa;EAC1C,MAAM,UAAU,EAAE,kBAAkB,MAAM;AAC1C,MAAI,sBAAsB,YACtB,SAAQ,mBAAmB,YAAY;AAE3C,MAAI,oCAAoC,YACpC,SAAQ,iCAAiC,YAAY;AAEzD,SAAO"}