@cipherstash/protect-ffi 0.26.0 → 0.28.0

package/lib/eql-v3-types/TextOrdOre.d.ts

@@ -0,0 +1,17 @@
+import type { Ciphertext } from "./Ciphertext";
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.text_ord_ore` — ordering domain.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`.
+ */
+export type TextOrdOre = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    hm: Hmac256;
+    ob: OreBlock256;
+};

package/lib/eql-v3-types/TextOrdOre.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TextSearch.d.ts

@@ -0,0 +1,19 @@
+import type { BloomFilter } from "./BloomFilter";
+import type { Ciphertext } from "./Ciphertext";
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.text_search` — search domain.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `ob` `bf`.
+ */
+export type TextSearch = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    hm: Hmac256;
+    ob: OreBlock256;
+    bf: BloomFilter;
+};

package/lib/eql-v3-types/TextSearch.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/Timestamp.d.ts

@@ -0,0 +1,13 @@
+import type { Ciphertext } from "./Ciphertext";
+import type { Identifier } from "./Identifier";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.timestamp` — storage-only domain.
+ *
+ * Operators: none. Required keys: `v` `i` `c`.
+ */
+export type Timestamp = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+};

package/lib/eql-v3-types/Timestamp.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampEq.d.ts

@@ -0,0 +1,15 @@
+import type { Ciphertext } from "./Ciphertext";
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.timestamp_eq` — equality domain.
+ *
+ * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`.
+ */
+export type TimestampEq = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    hm: Hmac256;
+};

package/lib/eql-v3-types/TimestampEq.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampOrd.d.ts

@@ -0,0 +1,15 @@
+import type { Ciphertext } from "./Ciphertext";
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.timestamp_ord` — ordering domain.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.
+ */
+export type TimestampOrd = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    ob: OreBlock256;
+};

package/lib/eql-v3-types/TimestampOrd.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampOrdOpe.d.ts

@@ -0,0 +1,15 @@
+import type { Ciphertext } from "./Ciphertext";
+import type { Identifier } from "./Identifier";
+import type { OpeCllw } from "./OpeCllw";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.timestamp_ord_ope` — ordering domain.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `op`.
+ */
+export type TimestampOrdOpe = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    op: OpeCllw;
+};

package/lib/eql-v3-types/TimestampOrdOpe.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampOrdOre.d.ts

@@ -0,0 +1,15 @@
+import type { Ciphertext } from "./Ciphertext";
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.timestamp_ord_ore` — ordering domain.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.
+ */
+export type TimestampOrdOre = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    ob: OreBlock256;
+};

package/lib/eql-v3-types/TimestampOrdOre.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3.d.ts

@@ -0,0 +1,90 @@
+import type { Bigint } from './eql-v3-types/Bigint.js';
+import type { BigintEq } from './eql-v3-types/BigintEq.js';
+import type { BigintOrd } from './eql-v3-types/BigintOrd.js';
+import type { BigintOrdOpe } from './eql-v3-types/BigintOrdOpe.js';
+import type { BigintOrdOre } from './eql-v3-types/BigintOrdOre.js';
+import type { Boolean as EqlV3Boolean } from './eql-v3-types/Boolean.js';
+import type { Date as EqlV3Date } from './eql-v3-types/Date.js';
+import type { DateEq } from './eql-v3-types/DateEq.js';
+import type { DateOrd } from './eql-v3-types/DateOrd.js';
+import type { DateOrdOpe } from './eql-v3-types/DateOrdOpe.js';
+import type { DateOrdOre } from './eql-v3-types/DateOrdOre.js';
+import type { Double } from './eql-v3-types/Double.js';
+import type { DoubleEq } from './eql-v3-types/DoubleEq.js';
+import type { DoubleOrd } from './eql-v3-types/DoubleOrd.js';
+import type { DoubleOrdOpe } from './eql-v3-types/DoubleOrdOpe.js';
+import type { DoubleOrdOre } from './eql-v3-types/DoubleOrdOre.js';
+import type { Integer } from './eql-v3-types/Integer.js';
+import type { IntegerEq } from './eql-v3-types/IntegerEq.js';
+import type { IntegerOrd } from './eql-v3-types/IntegerOrd.js';
+import type { IntegerOrdOpe } from './eql-v3-types/IntegerOrdOpe.js';
+import type { IntegerOrdOre } from './eql-v3-types/IntegerOrdOre.js';
+import type { Numeric } from './eql-v3-types/Numeric.js';
+import type { NumericEq } from './eql-v3-types/NumericEq.js';
+import type { NumericOrd } from './eql-v3-types/NumericOrd.js';
+import type { NumericOrdOpe } from './eql-v3-types/NumericOrdOpe.js';
+import type { NumericOrdOre } from './eql-v3-types/NumericOrdOre.js';
+import type { Real } from './eql-v3-types/Real.js';
+import type { RealEq } from './eql-v3-types/RealEq.js';
+import type { RealOrd } from './eql-v3-types/RealOrd.js';
+import type { RealOrdOpe } from './eql-v3-types/RealOrdOpe.js';
+import type { RealOrdOre } from './eql-v3-types/RealOrdOre.js';
+import type { Smallint } from './eql-v3-types/Smallint.js';
+import type { SmallintEq } from './eql-v3-types/SmallintEq.js';
+import type { SmallintOrd } from './eql-v3-types/SmallintOrd.js';
+import type { SmallintOrdOpe } from './eql-v3-types/SmallintOrdOpe.js';
+import type { SmallintOrdOre } from './eql-v3-types/SmallintOrdOre.js';
+import type { SteVecDocument } from './eql-v3-types/SteVecDocument.js';
+import type { SteVecQuery } from './eql-v3-types/SteVecQuery.js';
+import type { Text } from './eql-v3-types/Text.js';
+import type { TextEq } from './eql-v3-types/TextEq.js';
+import type { TextMatch } from './eql-v3-types/TextMatch.js';
+import type { TextOrd } from './eql-v3-types/TextOrd.js';
+import type { TextOrdOpe } from './eql-v3-types/TextOrdOpe.js';
+import type { TextOrdOre } from './eql-v3-types/TextOrdOre.js';
+import type { TextSearch } from './eql-v3-types/TextSearch.js';
+import type { Timestamp } from './eql-v3-types/Timestamp.js';
+import type { TimestampEq } from './eql-v3-types/TimestampEq.js';
+import type { TimestampOrd } from './eql-v3-types/TimestampOrd.js';
+import type { TimestampOrdOpe } from './eql-v3-types/TimestampOrdOpe.js';
+import type { TimestampOrdOre } from './eql-v3-types/TimestampOrdOre.js';
+export type { BloomFilter } from './eql-v3-types/BloomFilter.js';
+export type { Ciphertext } from './eql-v3-types/Ciphertext.js';
+export type { Hmac256 } from './eql-v3-types/Hmac256.js';
+export type { Identifier as EqlV3Identifier } from './eql-v3-types/Identifier.js';
+export type { OpeCllw } from './eql-v3-types/OpeCllw.js';
+export type { OreBlock256 } from './eql-v3-types/OreBlock256.js';
+export type { OreCllw } from './eql-v3-types/OreCllw.js';
+export type { SchemaVersion } from './eql-v3-types/SchemaVersion.js';
+export type { Selector } from './eql-v3-types/Selector.js';
+export type { SteVecDocument } from './eql-v3-types/SteVecDocument.js';
+export type { SteVecEntry as EqlV3SteVecEntry } from './eql-v3-types/SteVecEntry.js';
+export type { SteVecForm } from './eql-v3-types/SteVecForm.js';
+export type { SteVecQuery } from './eql-v3-types/SteVecQuery.js';
+export type { SteVecQueryEntry } from './eql-v3-types/SteVecQueryEntry.js';
+export type { SteVecTerm } from './eql-v3-types/SteVecTerm.js';
+export type { Bigint, BigintEq, BigintOrd, BigintOrdOpe, BigintOrdOre, EqlV3Boolean, EqlV3Date, DateEq, DateOrd, DateOrdOpe, DateOrdOre, Double, DoubleEq, DoubleOrd, DoubleOrdOpe, DoubleOrdOre, Integer, IntegerEq, IntegerOrd, IntegerOrdOpe, IntegerOrdOre, Numeric, NumericEq, NumericOrd, NumericOrdOpe, NumericOrdOre, Real, RealEq, RealOrd, RealOrdOpe, RealOrdOre, Smallint, SmallintEq, SmallintOrd, SmallintOrdOpe, SmallintOrdOre, Text, TextEq, TextMatch, TextOrd, TextOrdOpe, TextOrdOre, TextSearch, Timestamp, TimestampEq, TimestampOrd, TimestampOrdOpe, TimestampOrdOre, };
+/**
+ * Every flat scalar EQL v3 storage payload (`{v: 3, i, c, <terms>}`, one
+ * struct per `eql_v3` scalar domain).
+ */
+export type EncryptedV3Scalar = Bigint | BigintEq | BigintOrd | BigintOrdOpe | BigintOrdOre | EqlV3Boolean | EqlV3Date | DateEq | DateOrd | DateOrdOpe | DateOrdOre | Double | DoubleEq | DoubleOrd | DoubleOrdOpe | DoubleOrdOre | Integer | IntegerEq | IntegerOrd | IntegerOrdOpe | IntegerOrdOre | Numeric | NumericEq | NumericOrd | NumericOrdOpe | NumericOrdOre | Real | RealEq | RealOrd | RealOrdOpe | RealOrdOre | Smallint | SmallintEq | SmallintOrd | SmallintOrdOpe | SmallintOrdOre | Text | TextEq | TextMatch | TextOrd | TextOrdOpe | TextOrdOre | TextSearch | Timestamp | TimestampEq | TimestampOrd | TimestampOrdOpe | TimestampOrdOre;
+/**
+ * EQL v3 **storage** payload — returned by `encrypt` / `encryptBulk` when the
+ * client was created with `eqlVersion: 3`.
+ *
+ * Scalars carry no `k` discriminator: they are flat
+ * (`{v: 3, i, c, <terms>}`, terms depending on the column's `eql_v3` domain).
+ * Encrypted JSONB is a {@link SteVecDocument}, which keeps the `k: "sv"`
+ * form discriminator (`{v: 3, k: "sv", i, sv: [...]}`).
+ * The record ciphertext lives at `c` on scalars and at `sv[0].c` on SteVec
+ * documents (`sv[0]` is always the decryption root).
+ */
+export type EncryptedV3 = EncryptedV3Scalar | SteVecDocument;
+/**
+ * EQL v3 **query** payload — returned by `encryptQuery` / `encryptQueryBulk`
+ * under `eqlVersion: 3`. Only JSONB containment queries are supported (the
+ * `eql_v3.jsonb_query` needle); scalar and selector query encryption throws
+ * until a v3 scalar query wire shape exists.
+ */
+export type EncryptedV3Query = SteVecQuery;

package/lib/eql-v3.js

@@ -0,0 +1,6 @@
+"use strict";
+// Hand-written barrel over the vendored (generated) EQL v3 payload types in
+// src/eql-v3-types/. Assembles the public unions and renames the few types
+// whose names would clash with the v2 exports in index.cts (`Identifier`,
+// `SteVecEntry`) or shadow a global (`Boolean`, `Date`).
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/errors.d.ts

@@ -0,0 +1,14 @@
+export type ProtectErrorCode = 'INVARIANT_VIOLATION' | 'UNKNOWN_QUERY_OP' | 'UNKNOWN_COLUMN' | 'MISSING_INDEX' | 'INVALID_QUERY_INPUT' | 'INVALID_JSON_PATH' | 'STE_VEC_REQUIRES_JSON_CAST_AS' | 'MATCH_REQUIRES_TEXT' | 'UNSUPPORTED_CONFIG_VERSION' | 'INVALID_EQL_VERSION' | 'EQL_V3_QUERY_UNSUPPORTED' | 'EQL_V3_UNSUPPORTED_COLUMN' | 'EQL_V3_CONVERSION_FAILED' | 'INVALID_CIPHERTEXT' | 'UNKNOWN';
+export declare class ProtectError extends Error {
+    code: ProtectErrorCode;
+    details?: unknown;
+    cause?: unknown;
+    constructor(opts: {
+        code: ProtectErrorCode;
+        message: string;
+        details?: unknown;
+        cause?: unknown;
+    });
+}
+export declare function inferErrorCode(message: string): ProtectErrorCode;
+export declare function normalizeError(err: unknown): unknown;

package/lib/errors.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProtectError = void 0;
+exports.inferErrorCode = inferErrorCode;
+exports.normalizeError = normalizeError;
+class ProtectError extends Error {
+    code;
+    details;
+    cause;
+    constructor(opts) {
+        super(opts.message);
+        this.name = 'ProtectError';
+        this.code = opts.code;
+        this.details = opts.details;
+        this.cause = opts.cause;
+    }
+}
+exports.ProtectError = ProtectError;
+function inferErrorCode(message) {
+    if (message.startsWith('protect-ffi invariant violation:')) {
+        return 'INVARIANT_VIOLATION';
+    }
+    if (message.startsWith('Unknown query operation:')) {
+        return 'UNKNOWN_QUERY_OP';
+    }
+    if (message.startsWith('Invalid query input for')) {
+        return 'INVALID_QUERY_INPUT';
+    }
+    if (message.startsWith('Invalid JSON path')) {
+        return 'INVALID_JSON_PATH';
+    }
+    if (message.includes(' not found in Encrypt config')) {
+        return 'UNKNOWN_COLUMN';
+    }
+    if (message.includes(' index configured')) {
+        return 'MISSING_INDEX';
+    }
+    if (message.includes('requires plaintext_type: json')) {
+        return 'STE_VEC_REQUIRES_JSON_CAST_AS';
+    }
+    if (message.includes('requires plaintext_type: text')) {
+        return 'MATCH_REQUIRES_TEXT';
+    }
+    if (message.includes('unsupported config version')) {
+        return 'UNSUPPORTED_CONFIG_VERSION';
+    }
+    if (message.startsWith('Invalid eqlVersion')) {
+        return 'INVALID_EQL_VERSION';
+    }
+    if (message.startsWith('EQL v3 scalar query') ||
+        message.startsWith('EQL v3 selector query')) {
+        return 'EQL_V3_QUERY_UNSUPPORTED';
+    }
+    if (message.includes('cannot be represented in EQL v3')) {
+        return 'EQL_V3_UNSUPPORTED_COLUMN';
+    }
+    if (message.startsWith('EQL v3 conversion failed')) {
+        return 'EQL_V3_CONVERSION_FAILED';
+    }
+    if (message.startsWith('Invalid EQL ciphertext:')) {
+        return 'INVALID_CIPHERTEXT';
+    }
+    return 'UNKNOWN';
+}
+function normalizeError(err) {
+    if (err instanceof ProtectError) {
+        return err;
+    }
+    if (err && typeof err === 'object' && 'message' in err) {
+        const message = String(err.message ?? 'Unknown error');
+        const code = inferErrorCode(message);
+        if (code !== 'UNKNOWN') {
+            return new ProtectError({ code, message, cause: err });
+        }
+    }
+    return err;
+}

package/lib/index.cjs

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProtectError = exports.withEnvCredentials = void 0;
 exports.newClient = newClient;
@@ -45,73 +48,22 @@ exports.decryptBulkFallible = decryptBulkFallible;
 exports.encryptQuery = encryptQuery;
 exports.encryptQueryBulk = encryptQueryBulk;
 exports.ensureKeyset = ensureKeyset;
+const bigintWire_js_1 = require("./bigintWire.js");
 const credentials_js_1 = require("./credentials.js");
 const native = __importStar(require("./load.cjs"));
 const normalizeEncryptConfig_js_1 = require("./normalizeEncryptConfig.js");
 var credentials_js_2 = require("./credentials.js");
 Object.defineProperty(exports, "withEnvCredentials", { enumerable: true, get: function () { return credentials_js_2.withEnvCredentials; } });
-class ProtectError extends Error {
-    code;
-    details;
-    cause;
-    constructor(opts) {
-        super(opts.message);
-        this.name = 'ProtectError';
-        this.code = opts.code;
-        this.details = opts.details;
-        this.cause = opts.cause;
-    }
-}
-exports.ProtectError = ProtectError;
-function inferErrorCode(message) {
-    if (message.startsWith('protect-ffi invariant violation:')) {
-        return 'INVARIANT_VIOLATION';
-    }
-    if (message.startsWith('Unknown query operation:')) {
-        return 'UNKNOWN_QUERY_OP';
-    }
-    if (message.startsWith('Invalid query input for')) {
-        return 'INVALID_QUERY_INPUT';
-    }
-    if (message.startsWith('Invalid JSON path')) {
-        return 'INVALID_JSON_PATH';
-    }
-    if (message.includes(' not found in Encrypt config')) {
-        return 'UNKNOWN_COLUMN';
-    }
-    if (message.includes(' index configured')) {
-        return 'MISSING_INDEX';
-    }
-    if (message.includes('requires plaintext_type: json')) {
-        return 'STE_VEC_REQUIRES_JSON_CAST_AS';
-    }
-    if (message.includes('requires plaintext_type: text')) {
-        return 'MATCH_REQUIRES_TEXT';
-    }
-    if (message.includes('unsupported config version')) {
-        return 'UNSUPPORTED_CONFIG_VERSION';
-    }
-    return 'UNKNOWN';
-}
-function normalizeError(err) {
-    if (err instanceof ProtectError) {
-        return err;
-    }
-    if (err && typeof err === 'object' && 'message' in err) {
-        const message = String(err.message ?? 'Unknown error');
-        const code = inferErrorCode(message);
-        if (code !== 'UNKNOWN') {
-            return new ProtectError({ code, message, cause: err });
-        }
-    }
-    return err;
-}
+__exportStar(require("./eql-v3.js"), exports);
+const errors_js_1 = require("./errors.js");
+var errors_js_2 = require("./errors.js");
+Object.defineProperty(exports, "ProtectError", { enumerable: true, get: function () { return errors_js_2.ProtectError; } });
 async function wrapAsync(fn) {
     try {
         return await fn();
     }
     catch (err) {
-        throw normalizeError(err);
+        throw (0, errors_js_1.normalizeError)(err);
     }
 }
 function wrapSync(fn) {
@@ -119,26 +71,37 @@ function wrapSync(fn) {
         return fn();
     }
     catch (err) {
-        throw normalizeError(err);
+        throw (0, errors_js_1.normalizeError)(err);
     }
 }
 function newClient(opts) {
     return wrapAsync(() => native.newClient({
         encryptConfig: (0, normalizeEncryptConfig_js_1.normalizeEncryptConfig)(opts.encryptConfig),
         clientOpts: (0, credentials_js_1.withEnvCredentials)(opts.clientOpts),
+        eqlVersion: opts.eqlVersion,
     }, opts.strategy));
 }
 function encrypt(client, opts) {
-    return wrapAsync(() => native.encrypt(client, opts));
+    return wrapAsync(() => native.encrypt(client, (0, bigintWire_js_1.withEncodedPlaintext)(opts)));
 }
 function decrypt(client, opts) {
     return wrapAsync(() => native.decrypt(client, opts));
 }
+/**
+ * True when `encrypted` is a stored EQL payload in EITHER wire format:
+ * an EQL v2.3 payload (`k: "ct"` / `k: "sv"`) or an EQL v3 payload
+ * (`{v: 3, i, c}` scalar or `{v: 3, k: "sv", i, sv}` SteVec document).
+ * Query payloads (including the v3 containment needle) are not stored
+ * payloads and return false.
+ */
 function isEncrypted(encrypted) {
     return wrapSync(() => native.isEncrypted(encrypted));
 }
 function encryptBulk(client, opts) {
-    return wrapAsync(() => native.encryptBulk(client, opts));
+    return wrapAsync(() => {
+        const plaintexts = (0, bigintWire_js_1.withEncodedPlaintexts)(opts.plaintexts);
+        return native.encryptBulk(client, plaintexts === opts.plaintexts ? opts : { ...opts, plaintexts });
+    });
 }
 function decryptBulk(client, opts) {
     return wrapAsync(() => native.decryptBulk(client, opts));
@@ -147,16 +110,33 @@ async function decryptBulkFallible(client, opts) {
     const results = await wrapAsync(() => native.decryptBulkFallible(client, opts));
     return results.map((item) => {
         if ('error' in item && typeof item.error === 'string') {
-            return { ...item, code: inferErrorCode(item.error) };
+            return { ...item, code: (0, errors_js_1.inferErrorCode)(item.error) };
         }
         return item;
     });
 }
+/**
+ * Encrypt a query term.
+ *
+ * Under `eqlVersion: 2` (default) this returns the v2 shapes ({@link
+ * Encrypted} for JSON containment, {@link EncryptedQuery} otherwise).
+ *
+ * Under `eqlVersion: 3` only JSON containment queries are supported and
+ * return the `eql_v3.jsonb_query` needle ({@link EncryptedV3Query}). Scalar
+ * index queries (`unique` / `ore` / `ope` / `match`) and `ste_vec_selector`
+ * queries
+ * throw `EQL_V3_QUERY_UNSUPPORTED` — no EQL v3 scalar/selector query wire
+ * shape exists yet, so those queries require an `eqlVersion: 2` client.
+ */
 function encryptQuery(client, opts) {
-    return wrapAsync(() => native.encryptQuery(client, opts));
+    return wrapAsync(() => native.encryptQuery(client, (0, bigintWire_js_1.withEncodedPlaintext)(opts)));
 }
+/** Bulk variant of {@link encryptQuery} — same EQL v3 restrictions apply. */
 function encryptQueryBulk(client, opts) {
-    return wrapAsync(() => native.encryptQueryBulk(client, opts));
+    return wrapAsync(() => {
+        const queries = (0, bigintWire_js_1.withEncodedPlaintexts)(opts.queries);
+        return native.encryptQueryBulk(client, queries === opts.queries ? opts : { ...opts, queries });
+    });
 }
 /**
  * Test-only helper: ensures a keyset with the given name exists, creating it if necessary,