@cipherstash/protect-ffi 0.28.0 → 0.29.0

package/lib/eql-v3-types/TextOrdQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TextSearch.d.ts

@@ -2,18 +2,18 @@ import type { BloomFilter } from "./BloomFilter";
 import type { Ciphertext } from "./Ciphertext";
 import type { Hmac256 } from "./Hmac256";
 import type { Identifier } from "./Identifier";
-import type { OreBlock256 } from "./OreBlock256";
+import type { OpeCllw } from "./OpeCllw";
 import type { SchemaVersion } from "./SchemaVersion";
 /**
- * `eql_v3.text_search` — search domain.
+ * `public.eql_v3_text_search` — search domain.
  *
- * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `ob` `bf`.
+ * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `op` `bf`.
  */
 export type TextSearch = {
     v: SchemaVersion;
     i: Identifier;
     c: Ciphertext;
     hm: Hmac256;
-    ob: OreBlock256;
+    op: OpeCllw;
     bf: BloomFilter;
 };

package/lib/eql-v3-types/TextSearchOre.d.ts

@@ -0,0 +1,19 @@
+import type { BloomFilter } from "./BloomFilter";
+import type { Ciphertext } from "./Ciphertext";
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `public.eql_v3_text_search_ore` — search domain.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `ob` `bf`.
+ */
+export type TextSearchOre = {
+    v: SchemaVersion;
+    i: Identifier;
+    c: Ciphertext;
+    hm: Hmac256;
+    ob: OreBlock256;
+    bf: BloomFilter;
+};

package/lib/eql-v3-types/TextSearchOre.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TextSearchOreQuery.d.ts

@@ -0,0 +1,17 @@
+import type { BloomFilter } from "./BloomFilter";
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.query_text_search_ore` — search domain query operand.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `hm` `ob` `bf`.
+ */
+export type TextSearchOreQuery = {
+    v: SchemaVersion;
+    i: Identifier;
+    hm: Hmac256;
+    ob: OreBlock256;
+    bf: BloomFilter;
+};

package/lib/eql-v3-types/TextSearchOreQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TextSearchQuery.d.ts

@@ -0,0 +1,17 @@
+import type { BloomFilter } from "./BloomFilter";
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { OpeCllw } from "./OpeCllw";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.query_text_search` — search domain query operand.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `hm` `op` `bf`.
+ */
+export type TextSearchQuery = {
+    v: SchemaVersion;
+    i: Identifier;
+    hm: Hmac256;
+    op: OpeCllw;
+    bf: BloomFilter;
+};

package/lib/eql-v3-types/TextSearchQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/Timestamp.d.ts

@@ -2,7 +2,7 @@ import type { Ciphertext } from "./Ciphertext";
 import type { Identifier } from "./Identifier";
 import type { SchemaVersion } from "./SchemaVersion";
 /**
- * `eql_v3.timestamp` — storage-only domain.
+ * `public.eql_v3_timestamp` — storage-only domain.
  *
  * Operators: none. Required keys: `v` `i` `c`.
  */

package/lib/eql-v3-types/TimestampEq.d.ts

@@ -3,7 +3,7 @@ import type { Hmac256 } from "./Hmac256";
 import type { Identifier } from "./Identifier";
 import type { SchemaVersion } from "./SchemaVersion";
 /**
- * `eql_v3.timestamp_eq` — equality domain.
+ * `public.eql_v3_timestamp_eq` — equality domain.
  *
  * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`.
  */

package/lib/eql-v3-types/TimestampEqQuery.d.ts

@@ -0,0 +1,13 @@
+import type { Hmac256 } from "./Hmac256";
+import type { Identifier } from "./Identifier";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.query_timestamp_eq` — equality domain query operand.
+ *
+ * Operators: `=` `<>`. Required keys: `v` `i` `hm`.
+ */
+export type TimestampEqQuery = {
+    v: SchemaVersion;
+    i: Identifier;
+    hm: Hmac256;
+};

package/lib/eql-v3-types/TimestampEqQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampOrd.d.ts

@@ -1,15 +1,15 @@
 import type { Ciphertext } from "./Ciphertext";
 import type { Identifier } from "./Identifier";
-import type { OreBlock256 } from "./OreBlock256";
+import type { OpeCllw } from "./OpeCllw";
 import type { SchemaVersion } from "./SchemaVersion";
 /**
- * `eql_v3.timestamp_ord` — ordering domain.
+ * `public.eql_v3_timestamp_ord` — ordering domain.
  *
- * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `op`.
  */
 export type TimestampOrd = {
     v: SchemaVersion;
     i: Identifier;
     c: Ciphertext;
-    ob: OreBlock256;
+    op: OpeCllw;
 };

package/lib/eql-v3-types/TimestampOrdOpe.d.ts

@@ -3,7 +3,7 @@ import type { Identifier } from "./Identifier";
 import type { OpeCllw } from "./OpeCllw";
 import type { SchemaVersion } from "./SchemaVersion";
 /**
- * `eql_v3.timestamp_ord_ope` — ordering domain.
+ * `public.eql_v3_timestamp_ord_ope` — ordering domain.
  *
  * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `op`.
  */

package/lib/eql-v3-types/TimestampOrdOpeQuery.d.ts

@@ -0,0 +1,13 @@
+import type { Identifier } from "./Identifier";
+import type { OpeCllw } from "./OpeCllw";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.query_timestamp_ord_ope` — ordering domain query operand.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `op`.
+ */
+export type TimestampOrdOpeQuery = {
+    v: SchemaVersion;
+    i: Identifier;
+    op: OpeCllw;
+};

package/lib/eql-v3-types/TimestampOrdOpeQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampOrdOre.d.ts

@@ -3,7 +3,7 @@ import type { Identifier } from "./Identifier";
 import type { OreBlock256 } from "./OreBlock256";
 import type { SchemaVersion } from "./SchemaVersion";
 /**
- * `eql_v3.timestamp_ord_ore` — ordering domain.
+ * `public.eql_v3_timestamp_ord_ore` — ordering domain.
  *
  * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.
  */

package/lib/eql-v3-types/TimestampOrdOreQuery.d.ts

@@ -0,0 +1,13 @@
+import type { Identifier } from "./Identifier";
+import type { OreBlock256 } from "./OreBlock256";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.query_timestamp_ord_ore` — ordering domain query operand.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `ob`.
+ */
+export type TimestampOrdOreQuery = {
+    v: SchemaVersion;
+    i: Identifier;
+    ob: OreBlock256;
+};

package/lib/eql-v3-types/TimestampOrdOreQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3-types/TimestampOrdQuery.d.ts

@@ -0,0 +1,13 @@
+import type { Identifier } from "./Identifier";
+import type { OpeCllw } from "./OpeCllw";
+import type { SchemaVersion } from "./SchemaVersion";
+/**
+ * `eql_v3.query_timestamp_ord` — ordering domain query operand.
+ *
+ * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `op`.
+ */
+export type TimestampOrdQuery = {
+    v: SchemaVersion;
+    i: Identifier;
+    op: OpeCllw;
+};

package/lib/eql-v3-types/TimestampOrdQuery.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/eql-v3.d.ts

@@ -1,60 +1,100 @@
 import type { Bigint } from './eql-v3-types/Bigint.js';
 import type { BigintEq } from './eql-v3-types/BigintEq.js';
+import type { BigintEqQuery } from './eql-v3-types/BigintEqQuery.js';
 import type { BigintOrd } from './eql-v3-types/BigintOrd.js';
 import type { BigintOrdOpe } from './eql-v3-types/BigintOrdOpe.js';
+import type { BigintOrdOpeQuery } from './eql-v3-types/BigintOrdOpeQuery.js';
 import type { BigintOrdOre } from './eql-v3-types/BigintOrdOre.js';
+import type { BigintOrdOreQuery } from './eql-v3-types/BigintOrdOreQuery.js';
+import type { BigintOrdQuery } from './eql-v3-types/BigintOrdQuery.js';
 import type { Boolean as EqlV3Boolean } from './eql-v3-types/Boolean.js';
 import type { Date as EqlV3Date } from './eql-v3-types/Date.js';
 import type { DateEq } from './eql-v3-types/DateEq.js';
+import type { DateEqQuery } from './eql-v3-types/DateEqQuery.js';
 import type { DateOrd } from './eql-v3-types/DateOrd.js';
 import type { DateOrdOpe } from './eql-v3-types/DateOrdOpe.js';
+import type { DateOrdOpeQuery } from './eql-v3-types/DateOrdOpeQuery.js';
 import type { DateOrdOre } from './eql-v3-types/DateOrdOre.js';
+import type { DateOrdOreQuery } from './eql-v3-types/DateOrdOreQuery.js';
+import type { DateOrdQuery } from './eql-v3-types/DateOrdQuery.js';
 import type { Double } from './eql-v3-types/Double.js';
 import type { DoubleEq } from './eql-v3-types/DoubleEq.js';
+import type { DoubleEqQuery } from './eql-v3-types/DoubleEqQuery.js';
 import type { DoubleOrd } from './eql-v3-types/DoubleOrd.js';
 import type { DoubleOrdOpe } from './eql-v3-types/DoubleOrdOpe.js';
+import type { DoubleOrdOpeQuery } from './eql-v3-types/DoubleOrdOpeQuery.js';
 import type { DoubleOrdOre } from './eql-v3-types/DoubleOrdOre.js';
+import type { DoubleOrdOreQuery } from './eql-v3-types/DoubleOrdOreQuery.js';
+import type { DoubleOrdQuery } from './eql-v3-types/DoubleOrdQuery.js';
 import type { Integer } from './eql-v3-types/Integer.js';
 import type { IntegerEq } from './eql-v3-types/IntegerEq.js';
+import type { IntegerEqQuery } from './eql-v3-types/IntegerEqQuery.js';
 import type { IntegerOrd } from './eql-v3-types/IntegerOrd.js';
 import type { IntegerOrdOpe } from './eql-v3-types/IntegerOrdOpe.js';
+import type { IntegerOrdOpeQuery } from './eql-v3-types/IntegerOrdOpeQuery.js';
 import type { IntegerOrdOre } from './eql-v3-types/IntegerOrdOre.js';
+import type { IntegerOrdOreQuery } from './eql-v3-types/IntegerOrdOreQuery.js';
+import type { IntegerOrdQuery } from './eql-v3-types/IntegerOrdQuery.js';
 import type { Numeric } from './eql-v3-types/Numeric.js';
 import type { NumericEq } from './eql-v3-types/NumericEq.js';
+import type { NumericEqQuery } from './eql-v3-types/NumericEqQuery.js';
 import type { NumericOrd } from './eql-v3-types/NumericOrd.js';
 import type { NumericOrdOpe } from './eql-v3-types/NumericOrdOpe.js';
+import type { NumericOrdOpeQuery } from './eql-v3-types/NumericOrdOpeQuery.js';
 import type { NumericOrdOre } from './eql-v3-types/NumericOrdOre.js';
+import type { NumericOrdOreQuery } from './eql-v3-types/NumericOrdOreQuery.js';
+import type { NumericOrdQuery } from './eql-v3-types/NumericOrdQuery.js';
 import type { Real } from './eql-v3-types/Real.js';
 import type { RealEq } from './eql-v3-types/RealEq.js';
+import type { RealEqQuery } from './eql-v3-types/RealEqQuery.js';
 import type { RealOrd } from './eql-v3-types/RealOrd.js';
 import type { RealOrdOpe } from './eql-v3-types/RealOrdOpe.js';
+import type { RealOrdOpeQuery } from './eql-v3-types/RealOrdOpeQuery.js';
 import type { RealOrdOre } from './eql-v3-types/RealOrdOre.js';
+import type { RealOrdOreQuery } from './eql-v3-types/RealOrdOreQuery.js';
+import type { RealOrdQuery } from './eql-v3-types/RealOrdQuery.js';
+import type { Selector } from './eql-v3-types/Selector.js';
 import type { Smallint } from './eql-v3-types/Smallint.js';
 import type { SmallintEq } from './eql-v3-types/SmallintEq.js';
+import type { SmallintEqQuery } from './eql-v3-types/SmallintEqQuery.js';
 import type { SmallintOrd } from './eql-v3-types/SmallintOrd.js';
 import type { SmallintOrdOpe } from './eql-v3-types/SmallintOrdOpe.js';
+import type { SmallintOrdOpeQuery } from './eql-v3-types/SmallintOrdOpeQuery.js';
 import type { SmallintOrdOre } from './eql-v3-types/SmallintOrdOre.js';
+import type { SmallintOrdOreQuery } from './eql-v3-types/SmallintOrdOreQuery.js';
+import type { SmallintOrdQuery } from './eql-v3-types/SmallintOrdQuery.js';
 import type { SteVecDocument } from './eql-v3-types/SteVecDocument.js';
 import type { SteVecQuery } from './eql-v3-types/SteVecQuery.js';
 import type { Text } from './eql-v3-types/Text.js';
 import type { TextEq } from './eql-v3-types/TextEq.js';
+import type { TextEqQuery } from './eql-v3-types/TextEqQuery.js';
 import type { TextMatch } from './eql-v3-types/TextMatch.js';
+import type { TextMatchQuery } from './eql-v3-types/TextMatchQuery.js';
 import type { TextOrd } from './eql-v3-types/TextOrd.js';
 import type { TextOrdOpe } from './eql-v3-types/TextOrdOpe.js';
+import type { TextOrdOpeQuery } from './eql-v3-types/TextOrdOpeQuery.js';
 import type { TextOrdOre } from './eql-v3-types/TextOrdOre.js';
+import type { TextOrdOreQuery } from './eql-v3-types/TextOrdOreQuery.js';
+import type { TextOrdQuery } from './eql-v3-types/TextOrdQuery.js';
 import type { TextSearch } from './eql-v3-types/TextSearch.js';
+import type { TextSearchOre } from './eql-v3-types/TextSearchOre.js';
+import type { TextSearchOreQuery } from './eql-v3-types/TextSearchOreQuery.js';
+import type { TextSearchQuery } from './eql-v3-types/TextSearchQuery.js';
 import type { Timestamp } from './eql-v3-types/Timestamp.js';
 import type { TimestampEq } from './eql-v3-types/TimestampEq.js';
+import type { TimestampEqQuery } from './eql-v3-types/TimestampEqQuery.js';
 import type { TimestampOrd } from './eql-v3-types/TimestampOrd.js';
 import type { TimestampOrdOpe } from './eql-v3-types/TimestampOrdOpe.js';
+import type { TimestampOrdOpeQuery } from './eql-v3-types/TimestampOrdOpeQuery.js';
 import type { TimestampOrdOre } from './eql-v3-types/TimestampOrdOre.js';
+import type { TimestampOrdOreQuery } from './eql-v3-types/TimestampOrdOreQuery.js';
+import type { TimestampOrdQuery } from './eql-v3-types/TimestampOrdQuery.js';
 export type { BloomFilter } from './eql-v3-types/BloomFilter.js';
 export type { Ciphertext } from './eql-v3-types/Ciphertext.js';
 export type { Hmac256 } from './eql-v3-types/Hmac256.js';
 export type { Identifier as EqlV3Identifier } from './eql-v3-types/Identifier.js';
 export type { OpeCllw } from './eql-v3-types/OpeCllw.js';
 export type { OreBlock256 } from './eql-v3-types/OreBlock256.js';
-export type { OreCllw } from './eql-v3-types/OreCllw.js';
 export type { SchemaVersion } from './eql-v3-types/SchemaVersion.js';
 export type { Selector } from './eql-v3-types/Selector.js';
 export type { SteVecDocument } from './eql-v3-types/SteVecDocument.js';
@@ -63,12 +103,13 @@ export type { SteVecForm } from './eql-v3-types/SteVecForm.js';
 export type { SteVecQuery } from './eql-v3-types/SteVecQuery.js';
 export type { SteVecQueryEntry } from './eql-v3-types/SteVecQueryEntry.js';
 export type { SteVecTerm } from './eql-v3-types/SteVecTerm.js';
-export type { Bigint, BigintEq, BigintOrd, BigintOrdOpe, BigintOrdOre, EqlV3Boolean, EqlV3Date, DateEq, DateOrd, DateOrdOpe, DateOrdOre, Double, DoubleEq, DoubleOrd, DoubleOrdOpe, DoubleOrdOre, Integer, IntegerEq, IntegerOrd, IntegerOrdOpe, IntegerOrdOre, Numeric, NumericEq, NumericOrd, NumericOrdOpe, NumericOrdOre, Real, RealEq, RealOrd, RealOrdOpe, RealOrdOre, Smallint, SmallintEq, SmallintOrd, SmallintOrdOpe, SmallintOrdOre, Text, TextEq, TextMatch, TextOrd, TextOrdOpe, TextOrdOre, TextSearch, Timestamp, TimestampEq, TimestampOrd, TimestampOrdOpe, TimestampOrdOre, };
+export type { Bigint, BigintEq, BigintOrd, BigintOrdOpe, BigintOrdOre, EqlV3Boolean, EqlV3Date, DateEq, DateOrd, DateOrdOpe, DateOrdOre, Double, DoubleEq, DoubleOrd, DoubleOrdOpe, DoubleOrdOre, Integer, IntegerEq, IntegerOrd, IntegerOrdOpe, IntegerOrdOre, Numeric, NumericEq, NumericOrd, NumericOrdOpe, NumericOrdOre, Real, RealEq, RealOrd, RealOrdOpe, RealOrdOre, Smallint, SmallintEq, SmallintOrd, SmallintOrdOpe, SmallintOrdOre, Text, TextEq, TextMatch, TextOrd, TextOrdOpe, TextOrdOre, TextSearch, TextSearchOre, Timestamp, TimestampEq, TimestampOrd, TimestampOrdOpe, TimestampOrdOre, };
+export type { BigintEqQuery, BigintOrdOpeQuery, BigintOrdOreQuery, BigintOrdQuery, DateEqQuery, DateOrdOpeQuery, DateOrdOreQuery, DateOrdQuery, DoubleEqQuery, DoubleOrdOpeQuery, DoubleOrdOreQuery, DoubleOrdQuery, IntegerEqQuery, IntegerOrdOpeQuery, IntegerOrdOreQuery, IntegerOrdQuery, NumericEqQuery, NumericOrdOpeQuery, NumericOrdOreQuery, NumericOrdQuery, RealEqQuery, RealOrdOpeQuery, RealOrdOreQuery, RealOrdQuery, SmallintEqQuery, SmallintOrdOpeQuery, SmallintOrdOreQuery, SmallintOrdQuery, TextEqQuery, TextMatchQuery, TextOrdOpeQuery, TextOrdOreQuery, TextOrdQuery, TextSearchOreQuery, TextSearchQuery, TimestampEqQuery, TimestampOrdOpeQuery, TimestampOrdOreQuery, TimestampOrdQuery, };
 /**
  * Every flat scalar EQL v3 storage payload (`{v: 3, i, c, <terms>}`, one
  * struct per `eql_v3` scalar domain).
  */
-export type EncryptedV3Scalar = Bigint | BigintEq | BigintOrd | BigintOrdOpe | BigintOrdOre | EqlV3Boolean | EqlV3Date | DateEq | DateOrd | DateOrdOpe | DateOrdOre | Double | DoubleEq | DoubleOrd | DoubleOrdOpe | DoubleOrdOre | Integer | IntegerEq | IntegerOrd | IntegerOrdOpe | IntegerOrdOre | Numeric | NumericEq | NumericOrd | NumericOrdOpe | NumericOrdOre | Real | RealEq | RealOrd | RealOrdOpe | RealOrdOre | Smallint | SmallintEq | SmallintOrd | SmallintOrdOpe | SmallintOrdOre | Text | TextEq | TextMatch | TextOrd | TextOrdOpe | TextOrdOre | TextSearch | Timestamp | TimestampEq | TimestampOrd | TimestampOrdOpe | TimestampOrdOre;
+export type EncryptedV3Scalar = Bigint | BigintEq | BigintOrd | BigintOrdOpe | BigintOrdOre | EqlV3Boolean | EqlV3Date | DateEq | DateOrd | DateOrdOpe | DateOrdOre | Double | DoubleEq | DoubleOrd | DoubleOrdOpe | DoubleOrdOre | Integer | IntegerEq | IntegerOrd | IntegerOrdOpe | IntegerOrdOre | Numeric | NumericEq | NumericOrd | NumericOrdOpe | NumericOrdOre | Real | RealEq | RealOrd | RealOrdOpe | RealOrdOre | Smallint | SmallintEq | SmallintOrd | SmallintOrdOpe | SmallintOrdOre | Text | TextEq | TextMatch | TextOrd | TextOrdOpe | TextOrdOre | TextSearch | TextSearchOre | Timestamp | TimestampEq | TimestampOrd | TimestampOrdOpe | TimestampOrdOre;
 /**
  * EQL v3 **storage** payload — returned by `encrypt` / `encryptBulk` when the
  * client was created with `eqlVersion: 3`.
@@ -81,10 +122,25 @@ export type EncryptedV3Scalar = Bigint | BigintEq | BigintOrd | BigintOrdOpe | B
  * documents (`sv[0]` is always the decryption root).
  */
 export type EncryptedV3 = EncryptedV3Scalar | SteVecDocument;
+/**
+ * Every scalar EQL v3 query operand — the term-only twin
+ * (`{v: 3, i, <terms>}`, no `c`) of the column's storage domain, cast in SQL
+ * to `eql_v3.query_<name>`. The operand always carries ALL the column
+ * domain's terms regardless of the queried `indexType` (the SQL operators
+ * pair each column domain only with its same-name query twin).
+ */
+export type EncryptedV3ScalarQuery = BigintEqQuery | BigintOrdOpeQuery | BigintOrdOreQuery | BigintOrdQuery | DateEqQuery | DateOrdOpeQuery | DateOrdOreQuery | DateOrdQuery | DoubleEqQuery | DoubleOrdOpeQuery | DoubleOrdOreQuery | DoubleOrdQuery | IntegerEqQuery | IntegerOrdOpeQuery | IntegerOrdOreQuery | IntegerOrdQuery | NumericEqQuery | NumericOrdOpeQuery | NumericOrdOreQuery | NumericOrdQuery | RealEqQuery | RealOrdOpeQuery | RealOrdOreQuery | RealOrdQuery | SmallintEqQuery | SmallintOrdOpeQuery | SmallintOrdOreQuery | SmallintOrdQuery | TextEqQuery | TextMatchQuery | TextOrdOpeQuery | TextOrdOreQuery | TextOrdQuery | TextSearchOreQuery | TextSearchQuery | TimestampEqQuery | TimestampOrdOpeQuery | TimestampOrdOreQuery | TimestampOrdQuery;
 /**
  * EQL v3 **query** payload — returned by `encryptQuery` / `encryptQueryBulk`
- * under `eqlVersion: 3`. Only JSONB containment queries are supported (the
- * `eql_v3.jsonb_query` needle); scalar and selector query encryption throws
- * until a v3 scalar query wire shape exists.
+ * under `eqlVersion: 3`:
+ *
+ * - Scalar queries: an {@link EncryptedV3ScalarQuery} term-only operand —
+ *   bind it with `WHERE col = $1::jsonb::eql_v3.query_<name>` (or the
+ *   ordering / containment operator the domain supports).
+ * - JSONB containment queries: a {@link SteVecQuery} needle — bind it with
+ *   `WHERE doc @> $1::jsonb::eql_v3.query_jsonb`.
+ * - JSONB selector (path) queries: the bare {@link Selector} hash (a
+ *   string) — there is no encrypted-selector envelope in v3; bind it as the
+ *   `text` argument of `->` / `->>` (`SELECT doc -> $1`).
  */
-export type EncryptedV3Query = SteVecQuery;
+export type EncryptedV3Query = EncryptedV3ScalarQuery | SteVecQuery | Selector;

package/lib/errors.d.ts

@@ -1,4 +1,4 @@
-export type ProtectErrorCode = 'INVARIANT_VIOLATION' | 'UNKNOWN_QUERY_OP' | 'UNKNOWN_COLUMN' | 'MISSING_INDEX' | 'INVALID_QUERY_INPUT' | 'INVALID_JSON_PATH' | 'STE_VEC_REQUIRES_JSON_CAST_AS' | 'MATCH_REQUIRES_TEXT' | 'UNSUPPORTED_CONFIG_VERSION' | 'INVALID_EQL_VERSION' | 'EQL_V3_QUERY_UNSUPPORTED' | 'EQL_V3_UNSUPPORTED_COLUMN' | 'EQL_V3_CONVERSION_FAILED' | 'INVALID_CIPHERTEXT' | 'UNKNOWN';
+export type ProtectErrorCode = 'INVARIANT_VIOLATION' | 'UNKNOWN_QUERY_OP' | 'UNKNOWN_COLUMN' | 'MISSING_INDEX' | 'INVALID_QUERY_INPUT' | 'INVALID_JSON_PATH' | 'STE_VEC_REQUIRES_JSON_CAST_AS' | 'MATCH_REQUIRES_TEXT' | 'UNSUPPORTED_CONFIG_VERSION' | 'INVALID_EQL_VERSION' | 'EQL_V3_UNSUPPORTED_COLUMN' | 'EQL_V3_CONVERSION_FAILED' | 'INVALID_CIPHERTEXT' | 'UNKNOWN';
 export declare class ProtectError extends Error {
     code: ProtectErrorCode;
     details?: unknown;

package/lib/errors.js

@@ -47,10 +47,6 @@ function inferErrorCode(message) {
     if (message.startsWith('Invalid eqlVersion')) {
         return 'INVALID_EQL_VERSION';
     }
-    if (message.startsWith('EQL v3 scalar query') ||
-        message.startsWith('EQL v3 selector query')) {
-        return 'EQL_V3_QUERY_UNSUPPORTED';
-    }
     if (message.includes('cannot be represented in EQL v3')) {
         return 'EQL_V3_UNSUPPORTED_COLUMN';
     }

package/lib/index.cjs

@@ -121,17 +121,22 @@ async function decryptBulkFallible(client, opts) {
  * Under `eqlVersion: 2` (default) this returns the v2 shapes ({@link
  * Encrypted} for JSON containment, {@link EncryptedQuery} otherwise).
  *
- * Under `eqlVersion: 3` only JSON containment queries are supported and
- * return the `eql_v3.jsonb_query` needle ({@link EncryptedV3Query}). Scalar
- * index queries (`unique` / `ore` / `ope` / `match`) and `ste_vec_selector`
- * queries
- * throw `EQL_V3_QUERY_UNSUPPORTED` — no EQL v3 scalar/selector query wire
- * shape exists yet, so those queries require an `eqlVersion: 2` client.
+ * Under `eqlVersion: 3` this returns an {@link EncryptedV3Query}:
+ *
+ * - Scalar index queries (`unique` / `ore` / `ope` / `match`) produce the
+ *   term-only operand for the column domain's query twin (`{v, i, <terms>}`,
+ *   no `c` ciphertext) — bind with `col = $1::jsonb::eql_v3.query_<name>`.
+ *   The operand always carries ALL the column domain's terms, whichever
+ *   `indexType` was queried.
+ * - JSON containment queries produce the `eql_v3.query_jsonb` needle — bind
+ *   with `doc @> $1::jsonb::eql_v3.query_jsonb`.
+ * - `ste_vec_selector` queries produce the bare selector hash (a string) —
+ *   bind as the `text` argument of `->` / `->>`.
  */
 function encryptQuery(client, opts) {
     return wrapAsync(() => native.encryptQuery(client, (0, bigintWire_js_1.withEncodedPlaintext)(opts)));
 }
-/** Bulk variant of {@link encryptQuery} — same EQL v3 restrictions apply. */
+/** Bulk variant of {@link encryptQuery} — same EQL v3 shapes apply. */
 function encryptQueryBulk(client, opts) {
     return wrapAsync(() => {
         const queries = (0, bigintWire_js_1.withEncodedPlaintexts)(opts.queries);

package/lib/index.d.cts

@@ -47,15 +47,20 @@ export declare function decryptBulkFallible(client: Client, opts: DecryptBulkOpt
  * Under `eqlVersion: 2` (default) this returns the v2 shapes ({@link
  * Encrypted} for JSON containment, {@link EncryptedQuery} otherwise).
  *
- * Under `eqlVersion: 3` only JSON containment queries are supported and
- * return the `eql_v3.jsonb_query` needle ({@link EncryptedV3Query}). Scalar
- * index queries (`unique` / `ore` / `ope` / `match`) and `ste_vec_selector`
- * queries
- * throw `EQL_V3_QUERY_UNSUPPORTED` — no EQL v3 scalar/selector query wire
- * shape exists yet, so those queries require an `eqlVersion: 2` client.
+ * Under `eqlVersion: 3` this returns an {@link EncryptedV3Query}:
+ *
+ * - Scalar index queries (`unique` / `ore` / `ope` / `match`) produce the
+ *   term-only operand for the column domain's query twin (`{v, i, <terms>}`,
+ *   no `c` ciphertext) — bind with `col = $1::jsonb::eql_v3.query_<name>`.
+ *   The operand always carries ALL the column domain's terms, whichever
+ *   `indexType` was queried.
+ * - JSON containment queries produce the `eql_v3.query_jsonb` needle — bind
+ *   with `doc @> $1::jsonb::eql_v3.query_jsonb`.
+ * - `ste_vec_selector` queries produce the bare selector hash (a string) —
+ *   bind as the `text` argument of `->` / `->>`.
  */
 export declare function encryptQuery(client: Client, opts: EncryptQueryOptions): Promise<Encrypted | EncryptedQuery | EncryptedV3Query>;
-/** Bulk variant of {@link encryptQuery} — same EQL v3 restrictions apply. */
+/** Bulk variant of {@link encryptQuery} — same EQL v3 shapes apply. */
 export declare function encryptQueryBulk(client: Client, opts: EncryptQueryBulkOptions): Promise<(Encrypted | EncryptedQuery | EncryptedV3Query)[]>;
 /**
  * Test-only helper: ensures a keyset with the given name exists, creating it if necessary,
@@ -188,7 +193,9 @@ export type EncryptedSteVecSelector = {
  * One entry inside a SteVec payload (`k: "sv"`).
  *
  * Every element carries `s` (selector), `c` (entry ciphertext), and exactly one
- * per-element equality / ordering term (`hm` or `oc`).
+ * per-element equality / ordering term: `hm` for non-orderable leaves, and for
+ * orderable leaves either `op` (Compat mode, the default) or `oc` (Standard
+ * mode). EQL v3 accepts `hm` XOR `op` and rejects `oc`.
  */
 export type SteVecEntry = {
     /** Hex-encoded tokenized selector — deterministic per (path, key) */
@@ -199,7 +206,9 @@ export type SteVecEntry = {
     a?: boolean;
     /** Per-entry HMAC term for non-orderable leaves (objects, arrays, booleans, null) */
     hm?: string;
-    /** Per-entry CLLW ORE term for orderable leaves (strings, numbers) — Standard mode */
+    /** Per-entry CLLW OPE term for orderable leaves (strings, numbers) — Compat mode, the default */
+    op?: string;
+    /** Per-entry CLLW ORE term for orderable leaves (strings, numbers) — Standard mode, EQL v2 only */
     oc?: string;
 };
 /** @deprecated Use SteVecEntry instead */
@@ -249,9 +258,14 @@ export type ArrayIndexMode = 'all' | 'none' | {
 /**
  * Encoding mode for SteVec indexes.
  *
- * - `standard`: standard encoding (default).
- * - `compat`: backwards-compatible encoding. Set explicitly to preserve the
- *   pre-0.34.1-alpha.7 behaviour.
+ * - `compat`: CLLW-OPE ordering, emits `op` per entry. The default since
+ *   cipherstash-config 0.40.0, and the only mode EQL v3 accepts.
+ * - `standard`: CLLW-ORE ordering, emits `oc` per entry. The pre-0.40.0
+ *   default; EQL v2 only.
+ *
+ * The two orderings are not cross-comparable, so a column cannot change mode
+ * without re-encrypting. Pin `standard` on v2 JSON columns that already hold
+ * rows.
  */
 export type SteVecMode = 'compat' | 'standard';
 export type SteVecIndexOpts = {
@@ -284,25 +298,55 @@ export type NewClientOptions = {
      * `eql_v2_encrypted` payload format).
      *
      * With `3`, {@link encrypt} / {@link encryptBulk} return {@link
-     * EncryptedV3} payloads for the `eql_v3` per-capability domains
-     * (`eql_v3.text_eq`, `eql_v3.integer_ord_ore`, `eql_v3.json`, …), derived
-     * from each column's `cast_as` + indexes. {@link decrypt} accepts BOTH
-     * formats regardless of this setting.
-     *
-     * v3 limitation: {@link encryptQuery} supports only JSON containment
-     * queries — scalar-index and selector queries throw
-     * `EQL_V3_QUERY_UNSUPPORTED` until a v3 scalar query wire shape exists.
+     * EncryptedV3} payloads for the `eql_v3` per-capability column domains
+     * (`public.eql_v3_text_eq`, `public.eql_v3_integer_ord_ore`,
+     * `public.eql_v3_json`, …), derived
+     * from each column's `cast_as` + indexes, and {@link encryptQuery} /
+     * {@link encryptQueryBulk} return {@link EncryptedV3Query} operands:
+     * term-only scalar operands for the `eql_v3.query_<name>` twins, the
+     * `eql_v3.query_jsonb` containment needle, and bare selector-hash strings
+     * for path queries. {@link decrypt} accepts BOTH formats regardless of
+     * this setting.
      */
     eqlVersion?: 2 | 3;
 };
+/** The token payload the native side ultimately reads. */
+export type TokenResult = {
+    token: string;
+};
+/**
+ * A `@byteslice/result` `Result` envelope, as returned by
+ * `@cipherstash/auth` >= 0.41's `getToken()`.
+ */
+export type TokenResultEnvelope = {
+    data: TokenResult;
+    failure?: undefined;
+} | {
+    failure: {
+        type?: string;
+        error?: Error;
+    };
+    data?: undefined;
+};
 /**
  * Auth strategy shape compatible with `@cipherstash/auth` strategies (e.g.
- * `AccessKeyStrategy`). Only `getToken` is required.
+ * `AccessKeyStrategy`, `OidcFederationStrategy`). Only `getToken` is required.
+ *
+ * `getToken` may resolve either shape — the native and WASM clients accept both
+ * (see `crates/protect-ffi/src/lib.rs` and `crates/protect-ffi/src/wasm.rs`):
+ *
+ * - `{ token }` — the bare payload, used by `@cipherstash/auth` <= 0.40 and by
+ *   custom strategies.
+ * - `{ data: { token } }` / `{ failure }` — the `Result` envelope, used by
+ *   `@cipherstash/auth` >= 0.41. A `failure` is reconstructed into the
+ *   corresponding `AuthError`.
+ *
+ * Both have been accepted at runtime since 0.28.0; this type previously
+ * declared only the bare payload, so a real `@cipherstash/auth` >= 0.41
+ * strategy could not be assigned to it.
  */
 export type AuthStrategy = {
-    getToken: () => Promise<{
-        token: string;
-    }>;
+    getToken: () => Promise<TokenResult | TokenResultEnvelope>;
 };
 /** Options passed to the native `newClient` after vocabulary normalization. */
 type NativeNewClientOptions = {

package/lib/normalizeEncryptConfig.d.ts

@@ -24,6 +24,7 @@ export type NativeEncryptConfig = Omit<EncryptConfig, 'tables'> & {
  *   `'none'` — the library would otherwise default to `'all'`.
  *
  * `mode` is intentionally left untouched: an omitted `mode` follows the
- * library default (`standard`). The input config is never mutated.
+ * library default (`compat` since cipherstash-config 0.40.0). The input
+ * config is never mutated.
  */
 export declare function normalizeEncryptConfig(config: EncryptConfig): NativeEncryptConfig;

package/lib/normalizeEncryptConfig.js

@@ -20,7 +20,8 @@ const CAST_AS_REMAP = {
  *   `'none'` — the library would otherwise default to `'all'`.
  *
  * `mode` is intentionally left untouched: an omitted `mode` follows the
- * library default (`standard`). The input config is never mutated.
+ * library default (`compat` since cipherstash-config 0.40.0). The input
+ * config is never mutated.
  */
 function normalizeEncryptConfig(config) {
     const tables = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/protect-ffi",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cipherstash/protectjs-ffi.git"
@@ -103,11 +103,11 @@
     "vite": "^8.0.5"
   },
   "optionalDependencies": {
-    "@cipherstash/protect-ffi-darwin-x64": "0.28.0",
-    "@cipherstash/protect-ffi-darwin-arm64": "0.28.0",
-    "@cipherstash/protect-ffi-win32-x64-msvc": "0.28.0",
-    "@cipherstash/protect-ffi-linux-x64-gnu": "0.28.0",
-    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.28.0",
-    "@cipherstash/protect-ffi-linux-x64-musl": "0.28.0"
+    "@cipherstash/protect-ffi-darwin-x64": "0.29.0",
+    "@cipherstash/protect-ffi-darwin-arm64": "0.29.0",
+    "@cipherstash/protect-ffi-win32-x64-msvc": "0.29.0",
+    "@cipherstash/protect-ffi-linux-x64-gnu": "0.29.0",
+    "@cipherstash/protect-ffi-linux-arm64-gnu": "0.29.0",
+    "@cipherstash/protect-ffi-linux-x64-musl": "0.29.0"
   }
 }