♻️ refactor: update DynamoDB package to use Encrypted type instead of…

… EncryptedPayload - Replace EncryptedPayload imports with Encrypted type across all DynamoDB operations - Update EQL payload structure in toItemWithEqlPayloads helper function - Simplify payload structure by removing unused fields (bf, hm, ob) - Update type annotations in decrypt operations and bulk operations - Add TODO comment for future ste_vec EQL type support
cipherstash · coderdan · Oct 29, 2025 · Oct 3, 2025 · Oct 7, 2025 · Oct 7, 2025
commit a6b94b11fceb44032f95324b8f715c0221f738a7
@@ -1,4 +1,4 @@
-import type { EncryptedPayload } from '@cipherstash/protect'
+import type { Encrypted } from '@cipherstash/protect'
 import type { ProtectDynamoDBError } from './types'
 export const ciphertextAttrSuffix = '__source'
 export const searchTermAttrSuffix = '__hmac'
@@ -83,7 +83,7 @@ export function toEncryptedDynamoItem(
         typeof attrValue === 'object' &&
         'c' in (attrValue as object))
     ) {
-      const encryptPayload = attrValue as EncryptedPayload
+      const encryptPayload = attrValue as Encrypted
       if (encryptPayload?.c) {
         const result: Record<string, unknown> = {}
         if (encryptPayload.hm) {
@@ -122,7 +122,7 @@ export function toEncryptedDynamoItem(
 }
 
 export function toItemWithEqlPayloads(
-  decrypted: Record<string, EncryptedPayload | unknown>,
+  decrypted: Record<string, Encrypted | unknown>,
   encryptedAttrs: string[],
 ): Record<string, unknown> {
   function processValue(
@@ -148,14 +148,13 @@ export function toItemWithEqlPayloads(
         isNested)
     ) {
       const baseName = attrName.slice(0, -ciphertextAttrSuffix.length)
+
+      // TODO: in order to support the ste_vec eql type, this needs to be updated
       return {
         [baseName]: {
           c: attrValue,
-          bf: null,
-          hm: null,
           i: { c: 'notUsed', t: 'notUsed' },
-          k: 'notUsed',
-          ob: null,
+          k: 'ct',
           v: 2,
         },
       }

@@ -1,5 +1,5 @@
 import type {
-  EncryptedPayload,
+  Encrypted,
   ProtectTable,
   ProtectTableColumn,
   SearchTerm,
@@ -42,7 +42,7 @@ export function protectDynamoDB(
     },
 
     decryptModel<T extends Record<string, unknown>>(
-      item: Record<string, EncryptedPayload | unknown>,
+      item: Record<string, Encrypted | unknown>,
       protectTable: ProtectTable<ProtectTableColumn>,
     ) {
       return new DecryptModelOperation<T>(
@@ -54,7 +54,7 @@ export function protectDynamoDB(
     },
 
     bulkDecryptModels<T extends Record<string, unknown>>(
-      items: Record<string, EncryptedPayload | unknown>[],
+      items: Record<string, Encrypted | unknown>[],
       protectTable: ProtectTable<ProtectTableColumn>,
     ) {
       return new BulkDecryptModelsOperation<T>(

@@ -1,7 +1,7 @@
 import { type Result, withResult } from '@byteslice/result'
 import type {
   Decrypted,
-  EncryptedPayload,
+  Encrypted,
   ProtectClient,
   ProtectTable,
   ProtectTableColumn,
@@ -17,12 +17,12 @@ export class BulkDecryptModelsOperation<
   T extends Record<string, unknown>,
 > extends DynamoDBOperation<Decrypted<T>[]> {
   private protectClient: ProtectClient
-  private items: Record<string, EncryptedPayload | unknown>[]
+  private items: Record<string, Encrypted | unknown>[]
   private protectTable: ProtectTable<ProtectTableColumn>
 
   constructor(
     protectClient: ProtectClient,
-    items: Record<string, EncryptedPayload | unknown>[],
+    items: Record<string, Encrypted | unknown>[],
     protectTable: ProtectTable<ProtectTableColumn>,
     options?: DynamoDBOperationOptions,
   ) {

@@ -1,7 +1,7 @@
 import { type Result, withResult } from '@byteslice/result'
 import type {
   Decrypted,
-  EncryptedPayload,
+  Encrypted,
   ProtectClient,
   ProtectTable,
   ProtectTableColumn,
@@ -17,12 +17,12 @@ export class DecryptModelOperation<
   T extends Record<string, unknown>,
 > extends DynamoDBOperation<Decrypted<T>> {
   private protectClient: ProtectClient
-  private item: Record<string, EncryptedPayload | unknown>
+  private item: Record<string, Encrypted | unknown>
   private protectTable: ProtectTable<ProtectTableColumn>
 
   constructor(
     protectClient: ProtectClient,
-    item: Record<string, EncryptedPayload | unknown>,
+    item: Record<string, Encrypted | unknown>,
     protectTable: ProtectTable<ProtectTableColumn>,
     options?: DynamoDBOperationOptions,
   ) {

@@ -1,7 +1,5 @@
-import type { Result } from '@byteslice/result'
 import type {
-  Decrypted,
-  EncryptedPayload,
+  Encrypted,
   ProtectClient,
   ProtectTable,
   ProtectTableColumn,
@@ -40,12 +38,12 @@ export interface ProtectDynamoDBInstance {
   ): BulkEncryptModelsOperation<T>
 
   decryptModel<T extends Record<string, unknown>>(
-    item: Record<string, EncryptedPayload | unknown>,
+    item: Record<string, Encrypted | unknown>,
     protectTable: ProtectTable<ProtectTableColumn>,
   ): DecryptModelOperation<T>
 
   bulkDecryptModels<T extends Record<string, unknown>>(
-    items: Record<string, EncryptedPayload | unknown>[],
+    items: Record<string, Encrypted | unknown>[],
     protectTable: ProtectTable<ProtectTableColumn>,
   ): BulkDecryptModelsOperation<T>