Directories
¶
| Path | Synopsis |
|---|---|
|
Package auth is the Go binding of the developer profile: the directory `stash auth login` writes (~/.cipherstash, or CS_CONFIG_PATH), read through the stack-profile crate running unmodified inside a WASI guest under wazero (CGO_ENABLED=0), so the on-disk layout is never re-derived by hand in Go.
|
Package auth is the Go binding of the developer profile: the directory `stash auth login` writes (~/.cipherstash, or CS_CONFIG_PATH), read through the stack-profile crate running unmodified inside a WASI guest under wazero (CGO_ENABLED=0), so the on-disk layout is never re-derived by hand in Go. |
|
cmd
|
|
|
stashgen
command
Command stashgen writes the encrypted type and its functions for a struct with stash tags.
|
Command stashgen writes the encrypted type and its functions for a struct with stash tags. |
|
Package encrypt is the Stack Encrypt Go SDK: searchable, field-level encryption under per-value ZeroKMS data keys, running the stack-encrypt Rust engine unmodified inside a WASI guest under wazero (CGO_ENABLED=0).
|
Package encrypt is the Stack Encrypt Go SDK: searchable, field-level encryption under per-value ZeroKMS data keys, running the stack-encrypt Rust engine unmodified inside a WASI guest under wazero (CGO_ENABLED=0). |
|
eql
Package eql holds the EQL types a program stores: one Go type per EQL type, each holding the EQL value as the JSON bytes PostgreSQL stores in the type's domain, and the query types that match them.
|
Package eql holds the EQL types a program stores: one Go type per EQL type, each holding the EQL value as the JSON bytes PostgreSQL stores in the type's domain, and the query types that match them. |
|
example
command
Command example encrypts a batch of users against real ZeroKMS, using the credentials `stash auth login` leaves in the developer profile (or the CS_* environment variables, which win), and reads them back.
|
Command example encrypts a batch of users against real ZeroKMS, using the credentials `stash auth login` leaves in the developer profile (or the CS_* environment variables, which win), and reads them back. |
|
gensupport
Package gensupport holds what only code written by stashgen calls.
|
Package gensupport holds what only code written by stashgen calls. |
|
internal/eqlguest
Package eqlguest is where package eql hands the guest build with the EQL types to package encrypt.
|
Package eqlguest is where package eql hands the guest build with the EQL types to package encrypt. |
|
internal/genmember
command
Command genmember writes testpolicy's generated file from a policy: the stashgen.Generate path, over testmember.Member, with the declaration testusers.User carries as tags.
|
Command genmember writes testpolicy's generated file from a policy: the stashgen.Generate path, over testmember.Member, with the declaration testusers.User carries as tags. |
|
internal/testmember
Package testmember holds a struct the encrypt tests encrypt through the two generator paths that take a type the program does not own: the `-for` flag (testusers declares the tags for Member in a struct of its own) and stashgen.Generate from a policy (genmember writes testpolicy).
|
Package testmember holds a struct the encrypt tests encrypt through the two generator paths that take a type the program does not own: the `-for` flag (testusers declares the tags for Member in a struct of its own) and stashgen.Generate from a policy (genmember writes testpolicy). |
|
internal/testpolicy
Package testpolicy holds the file stashgen.Generate writes for testmember.Member from a policy (see internal/genmember): the generated Encrypt, Decrypt and Fields over *testmember.Member, with the declaration testusers.User carries as tags.
|
Package testpolicy holds the file stashgen.Generate writes for testmember.Member from a policy (see internal/genmember): the generated Encrypt, Decrypt and Fields over *testmember.Member, with the declaration testusers.User carries as tags. |
|
internal/testusers
Package testusers holds the tagged structs the encrypt tests encrypt through the generated API: a record in separate columns, an opaque struct, and a probe struct with one field of each scalar type for the term ordering tests.
|
Package testusers holds the tagged structs the encrypt tests encrypt through the generated API: a record in separate columns, an opaque struct, and a probe struct with one field of each scalar type for the term ordering tests. |
|
policy
Package policy decides how a type that cannot carry stash tags is encrypted, from what its schema says about each field.
|
Package policy decides how a type that cannot carry stash tags is encrypted, from what its schema says about each field. |
|
policy/protosource
Package protosource reads the facts about a protobuf message's fields: each field's name, its Go name, its kind, and its options as annotations.
|
Package protosource reads the facts about a protobuf message's fields: each field's name, its Go name, its kind, and its options as annotations. |
|
policy/protosource/internal/testpb
Package testpb is protoc-gen-go output for the protosource tests: the two messages of docs/plans/2026-10-04-plan-builder/proto, where classification.data_categories is a repeated string field option.
|
Package testpb is protoc-gen-go output for the protosource tests: the two messages of docs/plans/2026-10-04-plan-builder/proto, where classification.data_categories is a repeated string field option. |
|
internal
|
|
|
guest
Package guest is what the Go packages over the WASI guests share and neither should own: the locked, non-dumpable memory a guest instance runs in; the status table every guest reports through, the errors it decodes to and the Diagnostic behind each; and the opaque client key one package reads and the other consumes.
|
Package guest is what the Go packages over the WASI guests share and neither should own: the locked, non-dumpable memory a guest instance runs in; the status table every guest reports through, the errors it decodes to and the Diagnostic behind each; and the opaque client key one package reads and the other consumes. |
|
guesttest
Package guesttest holds what the tests of the guest packages share: a hand-assembled probe module that exercises the memory allocator without a guest, the lock-limit machinery those tests need, and the skip rules for hosts that cannot run them.
|
Package guesttest holds what the tests of the guest packages share: a hand-assembled probe module that exercises the memory allocator without a guest, the lock-limit machinery those tests need, and the skip rules for hosts that cannot run them. |
|
record
Package record is the data form of a declaration as the engine reads it: the plan object the guest's se_encrypt_record, se_decrypt_record and se_plan_check parse, and the per-field outputs they return.
|
Package record is the data form of a declaration as the engine reads it: the plan object the guest's se_encrypt_record, se_decrypt_record and se_plan_check parse, and the per-field outputs they return. |
|
Package stashgen is the Stack Encrypt code generator for Go, as a library.
|
Package stashgen is the Stack Encrypt code generator for Go, as a library. |
|
enginetest
Package enginetest is a static stand-in for the Rust engine in the generator's tests.
|
Package enginetest is a static stand-in for the Rust engine in the generator's tests. |
Click to show internal directories.
Click to hide internal directories.