@cipherstash/stack 0.1.0 → 0.2.0

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { E as EncryptionClient } from './client-BxJG56Ey.cjs';
-import { E as EncryptionClientConfig } from './types-public-BCj1L4fi.cjs';
-export { c as InferEncrypted, I as InferPlaintext, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from './types-public-BCj1L4fi.cjs';
+import { E as EncryptionClient } from './client-D-ZH8SB2.cjs';
+import { E as EncryptionClientConfig } from './types-public-Dfg-hkuQ.cjs';
+export { h as EncryptedFromSchema, c as InferEncrypted, I as InferPlaintext, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from './types-public-Dfg-hkuQ.cjs';
 export { C as ClientInitError, c as CtsTokenError, D as DecryptionOperationError, a as EncryptionError, E as EncryptionErrorTypes, b as EncryptionOperationError, L as LockContextError, S as StackError, g as getErrorMessage } from './index-9-Ya3fDK.cjs';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { E as EncryptionClient } from './client-DtGq9dJp.js';
-import { E as EncryptionClientConfig } from './types-public-BCj1L4fi.js';
-export { c as InferEncrypted, I as InferPlaintext, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from './types-public-BCj1L4fi.js';
+import { E as EncryptionClient } from './client-BV9pXC-d.js';
+import { E as EncryptionClientConfig } from './types-public-Dfg-hkuQ.js';
+export { h as EncryptedFromSchema, c as InferEncrypted, I as InferPlaintext, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from './types-public-Dfg-hkuQ.js';
 export { C as ClientInitError, c as CtsTokenError, D as DecryptionOperationError, a as EncryptionError, E as EncryptionErrorTypes, b as EncryptionOperationError, L as LockContextError, S as StackError, g as getErrorMessage } from './index-9-Ya3fDK.js';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';

package/dist/index.js

@@ -1,8 +1,8 @@
 import {
   Encryption
-} from "./chunk-2GZMIJFO.js";
+} from "./chunk-LHZ6KZIG.js";
 import "./chunk-SUYMGQBY.js";
-import "./chunk-SJ7JO4ME.js";
+import "./chunk-5G4F4JJG.js";
 import {
   EncryptionErrorTypes,
   getErrorMessage

package/dist/schema/index.d.cts

@@ -1,4 +1,4 @@
-export { C as CastAs, v as ColumnSchema, r as EncryptConfig, c as InferEncrypted, I as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, u as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, w as buildEncryptConfig, s as castAsEnum, t as encryptConfigSchema, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from '../types-public-BCj1L4fi.cjs';
+export { C as CastAs, w as ColumnSchema, s as EncryptConfig, c as InferEncrypted, I as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, v as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, x as buildEncryptConfig, t as castAsEnum, u as encryptConfigSchema, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from '../types-public-Dfg-hkuQ.cjs';
 import 'zod';
 import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/schema/index.d.ts

@@ -1,4 +1,4 @@
-export { C as CastAs, v as ColumnSchema, r as EncryptConfig, c as InferEncrypted, I as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, u as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, w as buildEncryptConfig, s as castAsEnum, t as encryptConfigSchema, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from '../types-public-BCj1L4fi.js';
+export { C as CastAs, w as ColumnSchema, s as EncryptConfig, c as InferEncrypted, I as InferPlaintext, M as MatchIndexOpts, O as OreIndexOpts, P as ProtectColumn, d as ProtectTable, f as ProtectTableColumn, g as ProtectValue, v as SteVecIndexOpts, T as TokenFilter, U as UniqueIndexOpts, x as buildEncryptConfig, t as castAsEnum, u as encryptConfigSchema, a as encryptedColumn, e as encryptedTable, b as encryptedValue } from '../types-public-Dfg-hkuQ.js';
 import 'zod';
 import 'evlog';
 import '@cipherstash/protect-ffi';

package/dist/secrets/index.cjs

@@ -2493,10 +2493,10 @@ var EncryptionClient = class {
         this.client = await (0, import_protect_ffi9.newClient)({
           encryptConfig: validated,
           clientOpts: {
-            workspaceCrn: config.workspaceCrn,
-            accessKey: config.accessKey,
-            clientId: config.clientId,
-            clientKey: config.clientKey,
+            workspaceCrn: config.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
+            accessKey: config.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
+            clientId: config.clientId ?? process.env.CS_CLIENT_ID,
+            clientKey: config.clientKey ?? process.env.CS_CLIENT_KEY,
             keyset: toFfiKeysetIdentifier(config.keyset)
           }
         });
@@ -2646,10 +2646,16 @@ var EncryptionClient = class {
    * All other fields are passed through unchanged. Returns a thenable operation
    * that supports `.withLockContext()` for identity-aware encryption.
    *
+   * The return type is **schema-aware**: fields matching the table schema are
+   * typed as `Encrypted`, while other fields retain their original types. For
+   * best results, let TypeScript infer the type parameters from the arguments
+   * rather than providing an explicit type argument.
+   *
    * @param input - The model object with plaintext values to encrypt.
    * @param table - The table schema defining which fields to encrypt.
-   * @returns An `EncryptModelOperation<T>` that can be awaited to get a `Result`
-   *   containing the model with encrypted fields, or an `EncryptionError`.
+   * @returns An `EncryptModelOperation` that can be awaited to get a `Result`
+   *   containing the model with schema-defined fields typed as `Encrypted`,
+   *   or an `EncryptionError`.
    *
    * @example
    * ```typescript
@@ -2664,7 +2670,9 @@ var EncryptionClient = class {
    *
    * const client = await Encryption({ schemas: [usersSchema] })
    *
-   * const result = await client.encryptModel<User>(
+   * // Let TypeScript infer the return type from the schema.
+   * // result.data.email is typed as `Encrypted`, result.data.id stays `string`.
+   * const result = await client.encryptModel(
    *   { id: "user_123", email: "alice@example.com", createdAt: new Date() },
    *   usersSchema,
    * )
@@ -2672,8 +2680,8 @@ var EncryptionClient = class {
    * if (result.failure) {
    *   console.error(result.failure.message)
    * } else {
-   *   // result.data.id is unchanged, result.data.email is encrypted
-   *   console.log(result.data)
+   *   console.log(result.data.id)    // string
+   *   console.log(result.data.email) // Encrypted
    * }
    * ```
    */
@@ -2718,10 +2726,15 @@ var EncryptionClient = class {
    * while still using a unique key for each encrypted value. Only fields
    * matching the table schema are encrypted; other fields pass through unchanged.
    *
+   * The return type is **schema-aware**: fields matching the table schema are
+   * typed as `Encrypted`, while other fields retain their original types. For
+   * best results, let TypeScript infer the type parameters from the arguments.
+   *
    * @param input - An array of model objects with plaintext values to encrypt.
    * @param table - The table schema defining which fields to encrypt.
-   * @returns A `BulkEncryptModelsOperation<T>` that can be awaited to get a `Result`
-   *   containing an array of models with encrypted fields, or an `EncryptionError`.
+   * @returns A `BulkEncryptModelsOperation` that can be awaited to get a `Result`
+   *   containing an array of models with schema-defined fields typed as `Encrypted`,
+   *   or an `EncryptionError`.
    *
    * @example
    * ```typescript
@@ -2736,7 +2749,9 @@ var EncryptionClient = class {
    *
    * const client = await Encryption({ schemas: [usersSchema] })
    *
-   * const result = await client.bulkEncryptModels<User>(
+   * // Let TypeScript infer the return type from the schema.
+   * // Each item's email is typed as `Encrypted`, id stays `string`.
+   * const result = await client.bulkEncryptModels(
    *   [
    *     { id: "1", email: "alice@example.com" },
    *     { id: "2", email: "bob@example.com" },