@cipherstash/stack 0.1.0

package/dist/types-public-BCj1L4fi.d.ts

@@ -0,0 +1,1013 @@
+import { z } from 'zod';
+import { LoggerConfig } from 'evlog';
+import { Encrypted as Encrypted$1, newClient, JsPlaintext } from '@cipherstash/protect-ffi';
+
+type LoggingConfig = {
+    enabled?: boolean;
+    pretty?: boolean;
+    drain?: LoggerConfig['drain'];
+};
+
+/** Brand symbol for nominal typing */
+declare const __brand: unique symbol;
+/** Creates a branded type that is structurally incompatible with the base type */
+type Brand<T, B extends string> = T & {
+    readonly [__brand]: B;
+};
+type Client = Awaited<ReturnType<typeof newClient>> | undefined;
+/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */
+type EncryptedValue = Brand<Encrypted$1, 'encrypted'> | null;
+/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */
+type Encrypted = Encrypted$1 | null;
+type EncryptPayload = JsPlaintext | null;
+type KeysetIdentifier = {
+    name: string;
+} | {
+    id: string;
+};
+type ClientConfig = {
+    /**
+     * The CipherStash workspace CRN (Cloud Resource Name).
+     * Format: `crn:<region>.aws:<workspace-id>`.
+     * Can also be set via the `CS_WORKSPACE_CRN` environment variable.
+     * If omitted, the SDK reads from the environment or TOML config files.
+     */
+    workspaceCrn?: string;
+    /**
+     * The API access key used for authenticating with the CipherStash API.
+     * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.
+     * Obtain this from the CipherStash dashboard after creating a workspace.
+     */
+    accessKey?: string;
+    /**
+     * The client identifier used to authenticate with CipherStash services.
+     * Can also be set via the `CS_CLIENT_ID` environment variable.
+     * Generated during workspace onboarding in the CipherStash dashboard.
+     */
+    clientId?: string;
+    /**
+     * The client key material used in combination with ZeroKMS for encryption operations.
+     * Can also be set via the `CS_CLIENT_KEY` environment variable.
+     * Generated during workspace onboarding in the CipherStash dashboard.
+     */
+    clientKey?: string;
+    /**
+     * An optional keyset identifier for multi-tenant encryption.
+     * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.
+     * Specify by name (`{ name: "tenant-a" }`) or UUID (`{ id: "..." }`).
+     * Keysets are created and managed in the CipherStash dashboard.
+     */
+    keyset?: KeysetIdentifier;
+};
+type AtLeastOneCsTable<T> = [T, ...T[]];
+type EncryptionClientConfig = {
+    schemas: AtLeastOneCsTable<ProtectTable<ProtectTableColumn>>;
+    config?: ClientConfig;
+    logging?: LoggingConfig;
+};
+type EncryptOptions = {
+    column: ProtectColumn | ProtectValue;
+    table: ProtectTable<ProtectTableColumn>;
+};
+/** Format for encrypted query/search term return values */
+type EncryptedReturnType = 'eql' | 'composite-literal' | 'escaped-composite-literal';
+type SearchTerm = {
+    value: JsPlaintext;
+    column: ProtectColumn;
+    table: ProtectTable<ProtectTableColumn>;
+    returnType?: EncryptedReturnType;
+};
+/** Encrypted search term result: EQL object or composite literal string */
+type EncryptedSearchTerm = Encrypted | string;
+/** Result of encryptQuery (single or batch): EQL, composite literal string, or null */
+type EncryptedQueryResult = Encrypted | string | null;
+type EncryptedFields<T> = {
+    [K in keyof T as T[K] extends Encrypted ? K : never]: T[K];
+};
+type OtherFields<T> = {
+    [K in keyof T as T[K] extends Encrypted ? never : K]: T[K];
+};
+type DecryptedFields<T> = {
+    [K in keyof T as T[K] extends Encrypted ? K : never]: string;
+};
+/** Model with encrypted fields replaced by plaintext (decrypted) values */
+type Decrypted<T> = OtherFields<T> & DecryptedFields<T>;
+type BulkEncryptPayload = Array<{
+    id?: string;
+    plaintext: JsPlaintext | null;
+}>;
+type BulkEncryptedData = Array<{
+    id?: string;
+    data: Encrypted;
+}>;
+type BulkDecryptPayload = Array<{
+    id?: string;
+    data: Encrypted;
+}>;
+type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>;
+type DecryptionSuccess<T> = {
+    error?: never;
+    data: T;
+    id?: string;
+};
+type DecryptionError<T> = {
+    error: T;
+    id?: string;
+    data?: never;
+};
+/**
+ * Result type for individual items in bulk decrypt operations.
+ * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations
+ * can have per-item failures.
+ */
+type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>;
+/**
+ * User-facing query type names for encrypting query values.
+ *
+ * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)
+ * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)
+ * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)
+ * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)
+ * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)
+ * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)
+ */
+type QueryTypeName = 'orderAndRange' | 'freeTextSearch' | 'equality' | 'steVecSelector' | 'steVecTerm' | 'searchableJson';
+declare const queryTypes: {
+    readonly orderAndRange: "orderAndRange";
+    readonly freeTextSearch: "freeTextSearch";
+    readonly equality: "equality";
+    readonly steVecSelector: "steVecSelector";
+    readonly steVecTerm: "steVecTerm";
+    readonly searchableJson: "searchableJson";
+};
+/** @internal */
+type QueryTermBase = {
+    column: ProtectColumn;
+    table: ProtectTable<ProtectTableColumn>;
+    queryType?: QueryTypeName;
+    returnType?: EncryptedReturnType;
+};
+type EncryptQueryOptions = QueryTermBase;
+type ScalarQueryTerm = QueryTermBase & {
+    value: JsPlaintext | null;
+};
+
+/**
+ * Allowed cast types for CipherStash schema fields.
+ *
+ * **Possible values:**
+ * - `"bigint"`
+ * - `"boolean"`
+ * - `"date"`
+ * - `"number"`
+ * - `"string"`
+ * - `"json"`
+ *
+ * @remarks
+ * This is a Zod enum used at runtime to validate schema definitions.
+ * Use {@link CastAs} when typing your own code.
+ *
+ * @internal
+ */
+declare const castAsEnum: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json"]>>;
+declare const tokenFilterSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"downcase">;
+}, "strip", z.ZodTypeAny, {
+    kind: "downcase";
+}, {
+    kind: "downcase";
+}>;
+declare const oreIndexOptsSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+declare const uniqueIndexOptsSchema: z.ZodObject<{
+    token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<"downcase">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "downcase";
+    }, {
+        kind: "downcase";
+    }>, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+}, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+}>;
+declare const matchIndexOptsSchema: z.ZodObject<{
+    tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"standard">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "standard";
+    }, {
+        kind: "standard";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"ngram">;
+        token_length: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        kind: "ngram";
+        token_length: number;
+    }, {
+        kind: "ngram";
+        token_length: number;
+    }>]>>>;
+    token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<"downcase">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "downcase";
+    }, {
+        kind: "downcase";
+    }>, "many">>>;
+    k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+    tokenizer?: {
+        kind: "standard";
+    } | {
+        kind: "ngram";
+        token_length: number;
+    } | undefined;
+    k?: number | undefined;
+    m?: number | undefined;
+    include_original?: boolean | undefined;
+}, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+    tokenizer?: {
+        kind: "standard";
+    } | {
+        kind: "ngram";
+        token_length: number;
+    } | undefined;
+    k?: number | undefined;
+    m?: number | undefined;
+    include_original?: boolean | undefined;
+}>;
+declare const steVecIndexOptsSchema: z.ZodObject<{
+    prefix: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    prefix: string;
+}, {
+    prefix: string;
+}>;
+declare const columnSchema: z.ZodDefault<z.ZodObject<{
+    cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json"]>>;
+    indexes: z.ZodDefault<z.ZodObject<{
+        ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        unique: z.ZodOptional<z.ZodObject<{
+            token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"downcase">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "downcase";
+            }, {
+                kind: "downcase";
+            }>, "many">>>;
+        }, "strip", z.ZodTypeAny, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        }, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        }>>;
+        match: z.ZodOptional<z.ZodObject<{
+            tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"standard">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "standard";
+            }, {
+                kind: "standard";
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"ngram">;
+                token_length: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "ngram";
+                token_length: number;
+            }, {
+                kind: "ngram";
+                token_length: number;
+            }>]>>>;
+            token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"downcase">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "downcase";
+            }, {
+                kind: "downcase";
+            }>, "many">>>;
+            k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, "strip", z.ZodTypeAny, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        }, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        }>>;
+        ste_vec: z.ZodOptional<z.ZodObject<{
+            prefix: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            prefix: string;
+        }, {
+            prefix: string;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        ore?: {} | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+        } | undefined;
+    }, {
+        ore?: {} | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+        } | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
+    indexes: {
+        ore?: {} | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+        } | undefined;
+    };
+}, {
+    cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
+    indexes?: {
+        ore?: {} | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+        } | undefined;
+    } | undefined;
+}>>;
+/** @internal */
+declare const encryptConfigSchema: z.ZodObject<{
+    v: z.ZodNumber;
+    tables: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodObject<{
+        cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json"]>>;
+        indexes: z.ZodDefault<z.ZodObject<{
+            ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+            unique: z.ZodOptional<z.ZodObject<{
+                token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    kind: z.ZodLiteral<"downcase">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "downcase";
+                }, {
+                    kind: "downcase";
+                }>, "many">>>;
+            }, "strip", z.ZodTypeAny, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            }, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            }>>;
+            match: z.ZodOptional<z.ZodObject<{
+                tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"standard">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "standard";
+                }, {
+                    kind: "standard";
+                }>, z.ZodObject<{
+                    kind: z.ZodLiteral<"ngram">;
+                    token_length: z.ZodNumber;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "ngram";
+                    token_length: number;
+                }, {
+                    kind: "ngram";
+                    token_length: number;
+                }>]>>>;
+                token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    kind: z.ZodLiteral<"downcase">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "downcase";
+                }, {
+                    kind: "downcase";
+                }>, "many">>>;
+                k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, "strip", z.ZodTypeAny, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            }, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            }>>;
+            ste_vec: z.ZodOptional<z.ZodObject<{
+                prefix: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                prefix: string;
+            }, {
+                prefix: string;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            ore?: {} | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+            } | undefined;
+        }, {
+            ore?: {} | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+            } | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
+        indexes: {
+            ore?: {} | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+            } | undefined;
+        };
+    }, {
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
+        indexes?: {
+            ore?: {} | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+            } | undefined;
+        } | undefined;
+    }>>>>>>;
+}, "strip", z.ZodTypeAny, {
+    v: number;
+    tables: Record<string, Record<string, {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
+        indexes: {
+            ore?: {} | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+            } | undefined;
+        };
+    }>>;
+}, {
+    v: number;
+    tables?: Record<string, Record<string, {
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | undefined;
+        indexes?: {
+            ore?: {} | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+            } | undefined;
+        } | undefined;
+    } | undefined> | undefined> | undefined;
+}>;
+/**
+ * Type-safe alias for {@link castAsEnum} used to specify the *unencrypted* data type of a column or value.
+ * This is important because once encrypted, all data is stored as binary blobs.
+ *
+ * @see {@link castAsEnum} for possible values.
+ */
+type CastAs = z.infer<typeof castAsEnum>;
+type TokenFilter = z.infer<typeof tokenFilterSchema>;
+type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>;
+type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>;
+type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>;
+type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>;
+type ColumnSchema = z.infer<typeof columnSchema>;
+type ProtectTableColumn = {
+    [key: string]: ProtectColumn | {
+        [key: string]: ProtectValue | {
+            [key: string]: ProtectValue | {
+                [key: string]: ProtectValue;
+            };
+        };
+    };
+};
+type EncryptConfig = z.infer<typeof encryptConfigSchema>;
+declare class ProtectValue {
+    private valueName;
+    private castAsValue;
+    constructor(valueName: string);
+    /**
+     * Set or override the plaintext data type for this value.
+     *
+     * By default all values are treated as `'string'`. Use this method to specify
+     * a different type so the encryption layer knows how to encode the plaintext
+     * before encrypting.
+     *
+     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+     * @returns This `ProtectValue` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedValue } from "@cipherstash/stack/schema"
+     *
+     * const age = encryptedValue("age").dataType("number")
+     * ```
+     */
+    dataType(castAs: CastAs): this;
+    build(): {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
+        indexes: {};
+    };
+    getName(): string;
+}
+declare class ProtectColumn {
+    private columnName;
+    private castAsValue;
+    private indexesValue;
+    constructor(columnName: string);
+    /**
+     * Set or override the plaintext data type for this column.
+     *
+     * By default all columns are treated as `'string'`. Use this method to specify
+     * a different type so the encryption layer knows how to encode the plaintext
+     * before encrypting.
+     *
+     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+     * @returns This `ProtectColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const dateOfBirth = encryptedColumn("date_of_birth").dataType("date")
+     * ```
+     */
+    dataType(castAs: CastAs): this;
+    /**
+     * Enable Order-Revealing Encryption (ORE) indexing on this column.
+     *
+     * ORE allows sorting, comparison, and range queries on encrypted data.
+     * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
+     *
+     * @returns This `ProtectColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").orderAndRange(),
+     * })
+     * ```
+     */
+    orderAndRange(): this;
+    /**
+     * Enable an exact-match (unique) index on this column.
+     *
+     * Allows equality queries on encrypted data. Use with `encryptQuery`
+     * and `queryType: 'equality'`.
+     *
+     * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
+     *   When omitted, no token filters are applied.
+     * @returns This `ProtectColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").equality(),
+     * })
+     * ```
+     */
+    equality(tokenFilters?: TokenFilter[]): this;
+    /**
+     * Enable a full-text / fuzzy search (match) index on this column.
+     *
+     * Uses n-gram tokenization by default for substring and fuzzy matching.
+     * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.
+     *
+     * @param opts - Optional match index configuration. Defaults to 3-character ngram
+     *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
+     * @returns This `ProtectColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").freeTextSearch(),
+     * })
+     *
+     * // With custom options
+     * const posts = encryptedTable("posts", {
+     *   body: encryptedColumn("body").freeTextSearch({
+     *     tokenizer: { kind: "ngram", token_length: 4 },
+     *     k: 8,
+     *     m: 4096,
+     *   }),
+     * })
+     * ```
+     */
+    freeTextSearch(opts?: MatchIndexOpts): this;
+    /**
+     * Configure this column for searchable encrypted JSON (STE-Vec).
+     *
+     * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and
+     * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the
+     * data type to `'json'`.
+     *
+     * When used with `encryptQuery`, the query operation is auto-inferred from
+     * the plaintext type: strings become selector queries, objects/arrays become
+     * containment queries.
+     *
+     * @returns This `ProtectColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const documents = encryptedTable("documents", {
+     *   metadata: encryptedColumn("metadata").searchableJson(),
+     * })
+     * ```
+     */
+    searchableJson(): this;
+    build(): {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json";
+        indexes: {
+            ore?: OreIndexOpts;
+            unique?: UniqueIndexOpts;
+            match?: Required<MatchIndexOpts>;
+            ste_vec?: SteVecIndexOpts;
+        };
+    };
+    getName(): string;
+}
+interface TableDefinition {
+    tableName: string;
+    columns: Record<string, ColumnSchema>;
+}
+declare class ProtectTable<T extends ProtectTableColumn> {
+    readonly tableName: string;
+    private readonly columnBuilders;
+    constructor(tableName: string, columnBuilders: T);
+    /**
+     * Compile this table schema into a `TableDefinition` used internally by the encryption client.
+     *
+     * Iterates over all column builders, calls `.build()` on each, and assembles
+     * the final `{ tableName, columns }` structure. For `searchableJson()` columns,
+     * the STE-Vec prefix is automatically set to `"<tableName>/<columnName>"`.
+     *
+     * @returns A `TableDefinition` containing the table name and built column configs.
+     *
+     * @example
+     * ```typescript
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").equality(),
+     * })
+     *
+     * const definition = users.build()
+     * // { tableName: "users", columns: { email: { cast_as: "string", indexes: { unique: ... } } } }
+     * ```
+     */
+    build(): TableDefinition;
+}
+/**
+ * Infer the plaintext (decrypted) type from a ProtectTable schema.
+ *
+ * @example
+ * ```typescript
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality(),
+ *   name: encryptedColumn("name"),
+ * })
+ *
+ * type UserPlaintext = InferPlaintext<typeof users>
+ * // => { email: string; name: string }
+ * ```
+ */
+type InferPlaintext<T extends ProtectTable<any>> = T extends ProtectTable<infer C> ? {
+    [K in keyof C as C[K] extends ProtectColumn | ProtectValue ? K : never]: string;
+} : never;
+/**
+ * Infer the encrypted type from a ProtectTable schema.
+ *
+ * @example
+ * ```typescript
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality(),
+ * })
+ *
+ * type UserEncrypted = InferEncrypted<typeof users>
+ * // => { email: Encrypted }
+ * ```
+ */
+type InferEncrypted<T extends ProtectTable<any>> = T extends ProtectTable<infer C> ? {
+    [K in keyof C as C[K] extends ProtectColumn | ProtectValue ? K : never]: Encrypted;
+} : never;
+/**
+ * Define an encrypted table schema.
+ *
+ * Creates a `ProtectTable` that maps a database table name to a set of encrypted
+ * column definitions. Pass the resulting object to `Encryption({ schemas: [...] })`
+ * when initializing the client.
+ *
+ * The returned object is also a proxy that exposes each column builder directly,
+ * so you can reference columns as `users.email` when calling `encrypt`, `decrypt`,
+ * and `encryptQuery`.
+ *
+ * @param tableName - The name of the database table this schema represents.
+ * @param columns - An object whose keys are logical column names and values are
+ *   `ProtectColumn` instances created with {@link encryptedColumn}.
+ * @returns A `ProtectTable<T> & T` that can be used as both a schema definition
+ *   and a column accessor.
+ *
+ * @example
+ * ```typescript
+ * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+ *
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality().freeTextSearch(),
+ *   address: encryptedColumn("address"),
+ * })
+ *
+ * // Use as schema
+ * const client = await Encryption({ schemas: [users] })
+ *
+ * // Use as column accessor
+ * await client.encrypt("hello@example.com", { column: users.email, table: users })
+ * ```
+ */
+declare function encryptedTable<T extends ProtectTableColumn>(tableName: string, columns: T): ProtectTable<T> & T;
+/**
+ * Define an encrypted column within a table schema.
+ *
+ * Creates a `ProtectColumn` builder for the given column name. Chain index
+ * methods (`.equality()`, `.freeTextSearch()`, `.orderAndRange()`,
+ * `.searchableJson()`) and/or `.dataType()` to configure searchable encryption
+ * and the plaintext data type.
+ *
+ * @param columnName - The name of the database column to encrypt.
+ * @returns A new `ProtectColumn` builder.
+ *
+ * @example
+ * ```typescript
+ * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+ *
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality().freeTextSearch().orderAndRange(),
+ * })
+ * ```
+ */
+declare function encryptedColumn(columnName: string): ProtectColumn;
+/**
+ * Define an encrypted value for use in nested or structured schemas.
+ *
+ * `encryptedValue` is similar to {@link encryptedColumn} but creates a `ProtectValue`
+ * intended for nested fields within a table schema. It supports `.dataType()`
+ * for specifying the plaintext type.
+ *
+ * @param valueName - The name of the value field.
+ * @returns A new `ProtectValue` builder.
+ *
+ * @example
+ * ```typescript
+ * import { encryptedTable, encryptedValue } from "@cipherstash/stack/schema"
+ *
+ * const orders = encryptedTable("orders", {
+ *   details: {
+ *     amount: encryptedValue("amount").dataType("number"),
+ *     currency: encryptedValue("currency"),
+ *   },
+ * })
+ * ```
+ */
+declare function encryptedValue(valueName: string): ProtectValue;
+/** @internal */
+declare function buildEncryptConfig(...protectTables: Array<ProtectTable<ProtectTableColumn>>): EncryptConfig;
+
+export { type EncryptedSearchTerm as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type EncryptionClientConfig as E, type EncryptedFields as F, type OtherFields as G, type DecryptedFields as H, type InferPlaintext as I, type DecryptionResult as J, type KeysetIdentifier as K, type LoggingConfig as L, type MatchIndexOpts as M, queryTypes as N, type OreIndexOpts as O, ProtectColumn as P, type QueryTypeName as Q, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, encryptedColumn as a, encryptedValue as b, type InferEncrypted as c, ProtectTable as d, encryptedTable as e, type ProtectTableColumn as f, ProtectValue as g, type Encrypted as h, type EncryptedValue as i, type EncryptedQueryResult as j, type Client as k, type BulkDecryptPayload as l, type BulkEncryptedData as m, type BulkEncryptPayload as n, type EncryptOptions as o, type EncryptQueryOptions as p, type EncryptedReturnType as q, type EncryptConfig as r, castAsEnum as s, encryptConfigSchema as t, type SteVecIndexOpts as u, type ColumnSchema as v, buildEncryptConfig as w, type EncryptPayload as x, type ClientConfig as y, type SearchTerm as z };