@cipherstash/stack 0.1.0 → 0.2.0

package/dist/drizzle/index.d.cts

@@ -1,7 +1,7 @@
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { PgTable } from 'drizzle-orm/pg-core';
-import { e as encryptedTable, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-BCj1L4fi.cjs';
-import { E as EncryptionClient } from '../client-BxJG56Ey.cjs';
+import { e as encryptedTable, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-Dfg-hkuQ.cjs';
+import { E as EncryptionClient } from '../client-D-ZH8SB2.cjs';
 import { SQLWrapper, SQL, exists, notExists, isNull, isNotNull, not, arrayContains, arrayContained, arrayOverlaps } from 'drizzle-orm';
 import 'zod';
 import 'evlog';

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { PgTable } from 'drizzle-orm/pg-core';
-import { e as encryptedTable, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-BCj1L4fi.js';
-import { E as EncryptionClient } from '../client-DtGq9dJp.js';
+import { e as encryptedTable, C as CastAs, M as MatchIndexOpts, T as TokenFilter } from '../types-public-Dfg-hkuQ.js';
+import { E as EncryptionClient } from '../client-BV9pXC-d.js';
 import { SQLWrapper, SQL, exists, notExists, isNull, isNotNull, not, arrayContains, arrayContained, arrayOverlaps } from 'drizzle-orm';
 import 'zod';
 import 'evlog';

package/dist/drizzle/index.js

@@ -1,6 +1,6 @@
 import {
   queryTypes
-} from "../chunk-SJ7JO4ME.js";
+} from "../chunk-5G4F4JJG.js";
 import {
   encryptedColumn,
   encryptedTable

package/dist/dynamodb/index.d.cts

@@ -1,5 +1,5 @@
-import { E as EncryptionClient } from '../client-BxJG56Ey.cjs';
-import { D as Decrypted, i as EncryptedValue, d as ProtectTable, f as ProtectTableColumn } from '../types-public-BCj1L4fi.cjs';
+import { E as EncryptionClient } from '../client-D-ZH8SB2.cjs';
+import { D as Decrypted, j as EncryptedValue, d as ProtectTable, f as ProtectTableColumn } from '../types-public-Dfg-hkuQ.cjs';
 import { ProtectErrorCode } from '@cipherstash/protect-ffi';
 import { Result } from '@byteslice/result';
 import '../index-9-Ya3fDK.cjs';

package/dist/dynamodb/index.d.ts

@@ -1,5 +1,5 @@
-import { E as EncryptionClient } from '../client-DtGq9dJp.js';
-import { D as Decrypted, i as EncryptedValue, d as ProtectTable, f as ProtectTableColumn } from '../types-public-BCj1L4fi.js';
+import { E as EncryptionClient } from '../client-BV9pXC-d.js';
+import { D as Decrypted, j as EncryptedValue, d as ProtectTable, f as ProtectTableColumn } from '../types-public-Dfg-hkuQ.js';
 import { ProtectErrorCode } from '@cipherstash/protect-ffi';
 import { Result } from '@byteslice/result';
 import '../index-9-Ya3fDK.js';

package/dist/index.cjs

@@ -2501,10 +2501,10 @@ var EncryptionClient = class {
         this.client = await (0, import_protect_ffi9.newClient)({
           encryptConfig: validated,
           clientOpts: {
-            workspaceCrn: config.workspaceCrn,
-            accessKey: config.accessKey,
-            clientId: config.clientId,
-            clientKey: config.clientKey,
+            workspaceCrn: config.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
+            accessKey: config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
+            clientId: config.clientId ?? process.env.CS_CLIENT_ID,
+            clientKey: config.clientKey ?? process.env.CS_CLIENT_KEY,
             keyset: toFfiKeysetIdentifier(config.keyset)
           }
         });
@@ -2654,10 +2654,16 @@ var EncryptionClient = class {
    * All other fields are passed through unchanged. Returns a thenable operation
    * that supports `.withLockContext()` for identity-aware encryption.
    *
+   * The return type is **schema-aware**: fields matching the table schema are
+   * typed as `Encrypted`, while other fields retain their original types. For
+   * best results, let TypeScript infer the type parameters from the arguments
+   * rather than providing an explicit type argument.
+   *
    * @param input - The model object with plaintext values to encrypt.
    * @param table - The table schema defining which fields to encrypt.
-   * @returns An `EncryptModelOperation<T>` that can be awaited to get a `Result`
-   *   containing the model with encrypted fields, or an `EncryptionError`.
+   * @returns An `EncryptModelOperation` that can be awaited to get a `Result`
+   *   containing the model with schema-defined fields typed as `Encrypted`,
+   *   or an `EncryptionError`.
    *
    * @example
    * ```typescript
@@ -2672,7 +2678,9 @@ var EncryptionClient = class {
    *
    * const client = await Encryption({ schemas: [usersSchema] })
    *
-   * const result = await client.encryptModel<User>(
+   * // Let TypeScript infer the return type from the schema.
+   * // result.data.email is typed as `Encrypted`, result.data.id stays `string`.
+   * const result = await client.encryptModel(
    *   { id: "user_123", email: "alice@example.com", createdAt: new Date() },
    *   usersSchema,
    * )
@@ -2680,8 +2688,8 @@ var EncryptionClient = class {
    * if (result.failure) {
    *   console.error(result.failure.message)
    * } else {
-   *   // result.data.id is unchanged, result.data.email is encrypted
-   *   console.log(result.data)
+   *   console.log(result.data.id)    // string
+   *   console.log(result.data.email) // Encrypted
    * }
    * ```
    */
@@ -2726,10 +2734,15 @@ var EncryptionClient = class {
    * while still using a unique key for each encrypted value. Only fields
    * matching the table schema are encrypted; other fields pass through unchanged.
    *
+   * The return type is **schema-aware**: fields matching the table schema are
+   * typed as `Encrypted`, while other fields retain their original types. For
+   * best results, let TypeScript infer the type parameters from the arguments.
+   *
    * @param input - An array of model objects with plaintext values to encrypt.
    * @param table - The table schema defining which fields to encrypt.
-   * @returns A `BulkEncryptModelsOperation<T>` that can be awaited to get a `Result`
-   *   containing an array of models with encrypted fields, or an `EncryptionError`.
+   * @returns A `BulkEncryptModelsOperation` that can be awaited to get a `Result`
+   *   containing an array of models with schema-defined fields typed as `Encrypted`,
+   *   or an `EncryptionError`.
    *
    * @example
    * ```typescript
@@ -2744,7 +2757,9 @@ var EncryptionClient = class {
    *
    * const client = await Encryption({ schemas: [usersSchema] })
    *
-   * const result = await client.bulkEncryptModels<User>(
+   * // Let TypeScript infer the return type from the schema.
+   * // Each item's email is typed as `Encrypted`, id stays `string`.
+   * const result = await client.bulkEncryptModels(
    *   [
    *     { id: "1", email: "alice@example.com" },
    *     { id: "2", email: "bob@example.com" },