@cipherstash/stack 0.1.0 → 0.2.0

package/dist/secrets/index.d.cts

@@ -1,4 +1,4 @@
-import { h as Encrypted } from '../types-public-BCj1L4fi.cjs';
+import { i as Encrypted } from '../types-public-Dfg-hkuQ.cjs';
 import { Result } from '@byteslice/result';
 import 'zod';
 import 'evlog';

package/dist/secrets/index.d.ts

@@ -1,4 +1,4 @@
-import { h as Encrypted } from '../types-public-BCj1L4fi.js';
+import { i as Encrypted } from '../types-public-Dfg-hkuQ.js';
 import { Result } from '@byteslice/result';
 import 'zod';
 import 'evlog';

package/dist/secrets/index.js

@@ -1,10 +1,10 @@
 import {
   Encryption
-} from "../chunk-2GZMIJFO.js";
+} from "../chunk-LHZ6KZIG.js";
 import {
   encryptedToPgComposite
 } from "../chunk-SUYMGQBY.js";
-import "../chunk-SJ7JO4ME.js";
+import "../chunk-5G4F4JJG.js";
 import {
   extractWorkspaceIdFromCrn
 } from "../chunk-5DCT6YU2.js";

package/dist/supabase/index.d.cts

@@ -1,6 +1,6 @@
-import { E as EncryptionClient, A as AuditConfig } from '../client-BxJG56Ey.cjs';
+import { E as EncryptionClient, A as AuditConfig } from '../client-D-ZH8SB2.cjs';
 import { a as EncryptionError, d as LockContext } from '../index-9-Ya3fDK.cjs';
-import { d as ProtectTable, f as ProtectTableColumn } from '../types-public-BCj1L4fi.cjs';
+import { d as ProtectTable, f as ProtectTableColumn } from '../types-public-Dfg-hkuQ.cjs';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
 import 'zod';

package/dist/supabase/index.d.ts

@@ -1,6 +1,6 @@
-import { E as EncryptionClient, A as AuditConfig } from '../client-DtGq9dJp.js';
+import { E as EncryptionClient, A as AuditConfig } from '../client-BV9pXC-d.js';
 import { a as EncryptionError, d as LockContext } from '../index-9-Ya3fDK.js';
-import { d as ProtectTable, f as ProtectTableColumn } from '../types-public-BCj1L4fi.js';
+import { d as ProtectTable, f as ProtectTableColumn } from '../types-public-Dfg-hkuQ.js';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
 import 'zod';

package/dist/{types-public-BCj1L4fi.d.ts → types-public-Dfg-hkuQ.d.cts}

@@ -92,6 +92,30 @@ type DecryptedFields<T> = {
 };
 /** Model with encrypted fields replaced by plaintext (decrypted) values */
 type Decrypted<T> = OtherFields<T> & DecryptedFields<T>;
+/**
+ * Maps a plaintext model type to its encrypted form using the table schema.
+ *
+ * Fields whose keys match columns defined in `S` become `Encrypted`;
+ * all other fields retain their original types from `T`.
+ *
+ * When `S` is the widened `ProtectTableColumn` (e.g. when a user passes an
+ * explicit `<User>` type argument without specifying `S`), the type degrades
+ * gracefully to `T` — preserving backward compatibility.
+ *
+ * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)
+ * @typeParam S - The table schema column definition, inferred from the `table` argument
+ *
+ * @example
+ * ```typescript
+ * type User = { id: string; email: string }
+ * // With a schema that defines `email`:
+ * type Encrypted = EncryptedFromSchema<User, { email: ProtectColumn }>
+ * // => { id: string; email: Encrypted }
+ * ```
+ */
+type EncryptedFromSchema<T, S extends ProtectTableColumn> = {
+    [K in keyof T]: [K] extends [keyof S] ? [S[K & keyof S]] extends [ProtectColumn | ProtectValue] ? Encrypted : T[K] : T[K];
+};
 type BulkEncryptPayload = Array<{
     id?: string;
     plaintext: JsPlaintext | null;
@@ -339,7 +363,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             prefix: string;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -354,6 +377,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -363,7 +387,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             prefix: string;
         } | undefined;
     }, {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -378,6 +401,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -390,7 +414,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
     indexes: {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -405,6 +428,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -417,7 +441,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
 }, {
     cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
     indexes?: {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -432,6 +455,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -528,7 +552,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 prefix: string;
             }>>;
         }, "strip", z.ZodTypeAny, {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -543,6 +566,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -552,7 +576,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 prefix: string;
             } | undefined;
         }, {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -567,6 +590,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -579,7 +603,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
         indexes: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -594,6 +617,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -606,7 +630,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     }, {
         cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
         indexes?: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -621,6 +644,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -636,7 +660,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     tables: Record<string, Record<string, {
         cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
         indexes: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -651,6 +674,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -666,7 +690,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     tables?: Record<string, Record<string, {
         cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
         indexes?: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -681,6 +704,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -1010,4 +1034,4 @@ declare function encryptedValue(valueName: string): ProtectValue;
 /** @internal */
 declare function buildEncryptConfig(...protectTables: Array<ProtectTable<ProtectTableColumn>>): EncryptConfig;
 
-export { type EncryptedSearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedFields as F, type OtherFields as G, type DecryptedFields as H, type InferPlaintext as I, type DecryptionResult as J, type KeysetIdentifier as K, type LoggingConfig as L, type MatchIndexOpts as M, queryTypes as N, type OreIndexOpts as O, ProtectColumn as P, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedValue as b, type InferEncrypted as c, ProtectTable as d, encryptedTable as e, type ProtectTableColumn as f, ProtectValue as g, type Encrypted as h, type EncryptedValue as i, type EncryptedQueryResult as j, type Client as k, type BulkDecryptPayload as l, type BulkEncryptedData as m, type BulkEncryptPayload as n, type EncryptOptions as o, type EncryptQueryOptions as p, type EncryptedReturnType as q, type EncryptConfig as r, castAsEnum as s, encryptConfigSchema as t, type SteVecIndexOpts as u, type ColumnSchema as v, buildEncryptConfig as w, type EncryptPayload as x, type ClientConfig as y, type SearchTerm as z };
+export { type SearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedSearchTerm as F, type EncryptedFields as G, type OtherFields as H, type InferPlaintext as I, type DecryptedFields as J, type KeysetIdentifier as K, type DecryptionResult as L, type MatchIndexOpts as M, type LoggingConfig as N, type OreIndexOpts as O, ProtectColumn as P, type QueryTypeName as Q, queryTypes as R, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedValue as b, type InferEncrypted as c, ProtectTable as d, encryptedTable as e, type ProtectTableColumn as f, ProtectValue as g, type EncryptedFromSchema as h, type Encrypted as i, type EncryptedValue as j, type EncryptedQueryResult as k, type Client as l, type BulkDecryptPayload as m, type BulkEncryptedData as n, type BulkEncryptPayload as o, type EncryptOptions as p, type EncryptQueryOptions as q, type EncryptedReturnType as r, type EncryptConfig as s, castAsEnum as t, encryptConfigSchema as u, type SteVecIndexOpts as v, type ColumnSchema as w, buildEncryptConfig as x, type EncryptPayload as y, type ClientConfig as z };

package/dist/{types-public-BCj1L4fi.d.cts → types-public-Dfg-hkuQ.d.ts}

@@ -92,6 +92,30 @@ type DecryptedFields<T> = {
 };
 /** Model with encrypted fields replaced by plaintext (decrypted) values */
 type Decrypted<T> = OtherFields<T> & DecryptedFields<T>;
+/**
+ * Maps a plaintext model type to its encrypted form using the table schema.
+ *
+ * Fields whose keys match columns defined in `S` become `Encrypted`;
+ * all other fields retain their original types from `T`.
+ *
+ * When `S` is the widened `ProtectTableColumn` (e.g. when a user passes an
+ * explicit `<User>` type argument without specifying `S`), the type degrades
+ * gracefully to `T` — preserving backward compatibility.
+ *
+ * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)
+ * @typeParam S - The table schema column definition, inferred from the `table` argument
+ *
+ * @example
+ * ```typescript
+ * type User = { id: string; email: string }
+ * // With a schema that defines `email`:
+ * type Encrypted = EncryptedFromSchema<User, { email: ProtectColumn }>
+ * // => { id: string; email: Encrypted }
+ * ```
+ */
+type EncryptedFromSchema<T, S extends ProtectTableColumn> = {
+    [K in keyof T]: [K] extends [keyof S] ? [S[K & keyof S]] extends [ProtectColumn | ProtectValue] ? Encrypted : T[K] : T[K];
+};
 type BulkEncryptPayload = Array<{
     id?: string;
     plaintext: JsPlaintext | null;
@@ -339,7 +363,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             prefix: string;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -354,6 +377,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -363,7 +387,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             prefix: string;
         } | undefined;
     }, {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -378,6 +401,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -390,7 +414,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
     indexes: {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -405,6 +428,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -417,7 +441,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
 }, {
     cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
     indexes?: {
-        ore?: {} | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -432,6 +455,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        ore?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -528,7 +552,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 prefix: string;
             }>>;
         }, "strip", z.ZodTypeAny, {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -543,6 +566,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -552,7 +576,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 prefix: string;
             } | undefined;
         }, {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -567,6 +590,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -579,7 +603,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
         indexes: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -594,6 +617,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -606,7 +630,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     }, {
         cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
         indexes?: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -621,6 +644,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -636,7 +660,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     tables: Record<string, Record<string, {
         cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
         indexes: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -651,6 +674,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -666,7 +690,6 @@ declare const encryptConfigSchema: z.ZodObject<{
     tables?: Record<string, Record<string, {
         cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
         indexes?: {
-            ore?: {} | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -681,6 +704,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            ore?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -1010,4 +1034,4 @@ declare function encryptedValue(valueName: string): ProtectValue;
 /** @internal */
 declare function buildEncryptConfig(...protectTables: Array<ProtectTable<ProtectTableColumn>>): EncryptConfig;
 
-export { type EncryptedSearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedFields as F, type OtherFields as G, type DecryptedFields as H, type InferPlaintext as I, type DecryptionResult as J, type KeysetIdentifier as K, type LoggingConfig as L, type MatchIndexOpts as M, queryTypes as N, type OreIndexOpts as O, ProtectColumn as P, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedValue as b, type InferEncrypted as c, ProtectTable as d, encryptedTable as e, type ProtectTableColumn as f, ProtectValue as g, type Encrypted as h, type EncryptedValue as i, type EncryptedQueryResult as j, type Client as k, type BulkDecryptPayload as l, type BulkEncryptedData as m, type BulkEncryptPayload as n, type EncryptOptions as o, type EncryptQueryOptions as p, type EncryptedReturnType as q, type EncryptConfig as r, castAsEnum as s, encryptConfigSchema as t, type SteVecIndexOpts as u, type ColumnSchema as v, buildEncryptConfig as w, type EncryptPayload as x, type ClientConfig as y, type SearchTerm as z };
+export { type SearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedSearchTerm as F, type EncryptedFields as G, type OtherFields as H, type InferPlaintext as I, type DecryptedFields as J, type KeysetIdentifier as K, type DecryptionResult as L, type MatchIndexOpts as M, type LoggingConfig as N, type OreIndexOpts as O, ProtectColumn as P, type QueryTypeName as Q, queryTypes as R, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedValue as b, type InferEncrypted as c, ProtectTable as d, encryptedTable as e, type ProtectTableColumn as f, ProtectValue as g, type EncryptedFromSchema as h, type Encrypted as i, type EncryptedValue as j, type EncryptedQueryResult as k, type Client as l, type BulkDecryptPayload as m, type BulkEncryptedData as n, type BulkEncryptPayload as o, type EncryptOptions as p, type EncryptQueryOptions as q, type EncryptedReturnType as r, type EncryptConfig as s, castAsEnum as t, encryptConfigSchema as u, type SteVecIndexOpts as v, type ColumnSchema as w, buildEncryptConfig as x, type EncryptPayload as y, type ClientConfig as z };

package/dist/types-public.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n  EncryptPayload,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Logging\nexport type { LoggingConfig } from '@/utils/logger'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  ProtectColumn,\n  ProtectTable,\n  ProtectTableColumn,\n  ProtectValue,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'> | null\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted | null\n\nexport type EncryptPayload = JsPlaintext | null\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<ProtectTable<ProtectTableColumn>>\n  config?: ClientConfig\n  logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\nexport type EncryptOptions = {\n  column: ProtectColumn | ProtectValue\n  table: ProtectTable<ProtectTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: ProtectColumn\n  table: ProtectTable<ProtectTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL, composite literal string, or null */\nexport type EncryptedQueryResult = Encrypted | string | null\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? K : never]: string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext | null\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: ProtectColumn\n  table: ProtectTable<ProtectTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext | null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0LO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}
+{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n  EncryptPayload,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Logging\nexport type { LoggingConfig } from '@/utils/logger'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  ProtectColumn,\n  ProtectTable,\n  ProtectTableColumn,\n  ProtectValue,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'> | null\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted | null\n\nexport type EncryptPayload = JsPlaintext | null\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<ProtectTable<ProtectTableColumn>>\n  config?: ClientConfig\n  logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\nexport type EncryptOptions = {\n  column: ProtectColumn | ProtectValue\n  table: ProtectTable<ProtectTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: ProtectColumn\n  table: ProtectTable<ProtectTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL, composite literal string, or null */\nexport type EncryptedQueryResult = Encrypted | string | null\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as T[K] extends Encrypted ? K : never]: string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `ProtectTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: ProtectColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<\n  T,\n  S extends ProtectTableColumn,\n> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [ProtectColumn | ProtectValue]\n      ? Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext | null\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: ProtectColumn\n  table: ProtectTable<ProtectTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext | null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}

package/dist/types-public.d.cts

@@ -1,4 +1,4 @@
-export { l as BulkDecryptPayload, B as BulkDecryptedData, n as BulkEncryptPayload, m as BulkEncryptedData, k as Client, y as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, o as EncryptOptions, x as EncryptPayload, p as EncryptQueryOptions, h as Encrypted, F as EncryptedFields, j as EncryptedQueryResult, q as EncryptedReturnType, A as EncryptedSearchTerm, i as EncryptedValue, E as EncryptionClientConfig, K as KeysetIdentifier, L as LoggingConfig, G as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, z as SearchTerm, N as queryTypes } from './types-public-BCj1L4fi.cjs';
+export { m as BulkDecryptPayload, B as BulkDecryptedData, o as BulkEncryptPayload, n as BulkEncryptedData, l as Client, z as ClientConfig, D as Decrypted, J as DecryptedFields, L as DecryptionResult, p as EncryptOptions, y as EncryptPayload, q as EncryptQueryOptions, i as Encrypted, G as EncryptedFields, k as EncryptedQueryResult, r as EncryptedReturnType, F as EncryptedSearchTerm, j as EncryptedValue, E as EncryptionClientConfig, K as KeysetIdentifier, N as LoggingConfig, H as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, A as SearchTerm, R as queryTypes } from './types-public-Dfg-hkuQ.cjs';
 import 'zod';
 import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/types-public.d.ts

@@ -1,4 +1,4 @@
-export { l as BulkDecryptPayload, B as BulkDecryptedData, n as BulkEncryptPayload, m as BulkEncryptedData, k as Client, y as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, o as EncryptOptions, x as EncryptPayload, p as EncryptQueryOptions, h as Encrypted, F as EncryptedFields, j as EncryptedQueryResult, q as EncryptedReturnType, A as EncryptedSearchTerm, i as EncryptedValue, E as EncryptionClientConfig, K as KeysetIdentifier, L as LoggingConfig, G as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, z as SearchTerm, N as queryTypes } from './types-public-BCj1L4fi.js';
+export { m as BulkDecryptPayload, B as BulkDecryptedData, o as BulkEncryptPayload, n as BulkEncryptedData, l as Client, z as ClientConfig, D as Decrypted, J as DecryptedFields, L as DecryptionResult, p as EncryptOptions, y as EncryptPayload, q as EncryptQueryOptions, i as Encrypted, G as EncryptedFields, k as EncryptedQueryResult, r as EncryptedReturnType, F as EncryptedSearchTerm, j as EncryptedValue, E as EncryptionClientConfig, K as KeysetIdentifier, N as LoggingConfig, H as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, A as SearchTerm, R as queryTypes } from './types-public-Dfg-hkuQ.js';
 import 'zod';
 import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/types-public.js

@@ -1,6 +1,6 @@
 import {
   queryTypes
-} from "./chunk-SJ7JO4ME.js";
+} from "./chunk-5G4F4JJG.js";
 export {
   queryTypes
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/stack",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "CipherStash Stack for TypeScript and JavaScript",
   "keywords": [
     "encrypted",