@cipherstash/stack 0.10.0 → 0.12.0

package/dist/{types-public-B5YxQhR6.d.cts → types-public-WADaA-TW.d.cts}

@@ -22,7 +22,6 @@ type ClientConfig = {
      * The CipherStash workspace CRN (Cloud Resource Name).
      * Format: `crn:<region>.aws:<workspace-id>`.
      * Can also be set via the `CS_WORKSPACE_CRN` environment variable.
-     * If omitted, the SDK reads from the environment or TOML config files.
      */
     workspaceCrn?: string;
     /**
@@ -288,10 +287,33 @@ declare const matchIndexOptsSchema: z.ZodObject<{
 }>;
 declare const steVecIndexOptsSchema: z.ZodObject<{
     prefix: z.ZodString;
+    array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+        item: z.ZodOptional<z.ZodBoolean>;
+        wildcard: z.ZodOptional<z.ZodBoolean>;
+        position: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    }, {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    }>]>>;
 }, "strip", z.ZodTypeAny, {
     prefix: string;
+    array_index_mode?: "all" | "none" | {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    } | undefined;
 }, {
     prefix: string;
+    array_index_mode?: "all" | "none" | {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    } | undefined;
 }>;
 declare const columnSchema: z.ZodDefault<z.ZodObject<{
     cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json", "text"]>>;
@@ -370,10 +392,33 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         }>>;
         ste_vec: z.ZodOptional<z.ZodObject<{
             prefix: z.ZodString;
+            array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                item: z.ZodOptional<z.ZodBoolean>;
+                wildcard: z.ZodOptional<z.ZodBoolean>;
+                position: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }>]>>;
         }, "strip", z.ZodTypeAny, {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         }, {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         match?: {
@@ -398,6 +443,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     }, {
         match?: {
@@ -422,6 +472,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
@@ -449,6 +504,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     };
 }, {
@@ -476,6 +536,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     } | undefined;
 }>>;
@@ -559,10 +624,33 @@ declare const encryptConfigSchema: z.ZodObject<{
             }>>;
             ste_vec: z.ZodOptional<z.ZodObject<{
                 prefix: z.ZodString;
+                array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                    item: z.ZodOptional<z.ZodBoolean>;
+                    wildcard: z.ZodOptional<z.ZodBoolean>;
+                    position: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }>]>>;
             }, "strip", z.ZodTypeAny, {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             }, {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             match?: {
@@ -587,6 +675,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         }, {
             match?: {
@@ -611,6 +704,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
@@ -638,6 +736,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         };
     }, {
@@ -665,6 +768,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         } | undefined;
     }>>>>>>;
@@ -695,6 +803,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         };
     }>>;
@@ -725,6 +838,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         } | undefined;
     } | undefined> | undefined> | undefined;

package/dist/{types-public-B5YxQhR6.d.ts → types-public-WADaA-TW.d.ts}

@@ -22,7 +22,6 @@ type ClientConfig = {
      * The CipherStash workspace CRN (Cloud Resource Name).
      * Format: `crn:<region>.aws:<workspace-id>`.
      * Can also be set via the `CS_WORKSPACE_CRN` environment variable.
-     * If omitted, the SDK reads from the environment or TOML config files.
      */
     workspaceCrn?: string;
     /**
@@ -288,10 +287,33 @@ declare const matchIndexOptsSchema: z.ZodObject<{
 }>;
 declare const steVecIndexOptsSchema: z.ZodObject<{
     prefix: z.ZodString;
+    array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+        item: z.ZodOptional<z.ZodBoolean>;
+        wildcard: z.ZodOptional<z.ZodBoolean>;
+        position: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    }, {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    }>]>>;
 }, "strip", z.ZodTypeAny, {
     prefix: string;
+    array_index_mode?: "all" | "none" | {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    } | undefined;
 }, {
     prefix: string;
+    array_index_mode?: "all" | "none" | {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    } | undefined;
 }>;
 declare const columnSchema: z.ZodDefault<z.ZodObject<{
     cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json", "text"]>>;
@@ -370,10 +392,33 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         }>>;
         ste_vec: z.ZodOptional<z.ZodObject<{
             prefix: z.ZodString;
+            array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                item: z.ZodOptional<z.ZodBoolean>;
+                wildcard: z.ZodOptional<z.ZodBoolean>;
+                position: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }>]>>;
         }, "strip", z.ZodTypeAny, {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         }, {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         match?: {
@@ -398,6 +443,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     }, {
         match?: {
@@ -422,6 +472,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
@@ -449,6 +504,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     };
 }, {
@@ -476,6 +536,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
         ste_vec?: {
             prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
         } | undefined;
     } | undefined;
 }>>;
@@ -559,10 +624,33 @@ declare const encryptConfigSchema: z.ZodObject<{
             }>>;
             ste_vec: z.ZodOptional<z.ZodObject<{
                 prefix: z.ZodString;
+                array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                    item: z.ZodOptional<z.ZodBoolean>;
+                    wildcard: z.ZodOptional<z.ZodBoolean>;
+                    position: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }>]>>;
             }, "strip", z.ZodTypeAny, {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             }, {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             match?: {
@@ -587,6 +675,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         }, {
             match?: {
@@ -611,6 +704,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
@@ -638,6 +736,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         };
     }, {
@@ -665,6 +768,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         } | undefined;
     }>>>>>>;
@@ -695,6 +803,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         };
     }>>;
@@ -725,6 +838,11 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
             ste_vec?: {
                 prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
             } | undefined;
         } | undefined;
     } | undefined> | undefined> | undefined;

package/dist/types-public.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC6NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}
+{"version":3,"sources":["../src/types-public.ts","../src/types.ts"],"sourcesContent":["/**\n * Public type re-exports for `@cipherstash/stack/types`.\n *\n * This module exposes only the public types from the internal types module.\n * Internal helpers (`queryTypeToFfi`, `queryTypeToQueryOp`, `FfiIndexTypeName`,\n * `QueryTermBase`) are excluded.\n */\n\n// Core types\nexport type {\n  Client,\n  EncryptedValue,\n  Encrypted,\n} from '@/types'\n\n// Client configuration\nexport type {\n  KeysetIdentifier,\n  ClientConfig,\n  EncryptionClientConfig,\n} from '@/types'\n\n// Encrypt / decrypt operation options and results\nexport type {\n  EncryptOptions,\n  EncryptedReturnType,\n  SearchTerm,\n  EncryptedSearchTerm,\n  EncryptedQueryResult,\n} from '@/types'\n\n// Model field types\nexport type {\n  EncryptedFields,\n  OtherFields,\n  DecryptedFields,\n  Decrypted,\n} from '@/types'\n\n// Bulk operations\nexport type {\n  BulkEncryptPayload,\n  BulkEncryptedData,\n  BulkDecryptPayload,\n  BulkDecryptedData,\n  DecryptionResult,\n} from '@/types'\n\n// Query types (public only)\nexport type {\n  QueryTypeName,\n  EncryptQueryOptions,\n  ScalarQueryTerm,\n} from '@/types'\n\n// Runtime values\nexport { queryTypes } from '@/types'\n","import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;","names":[]}

package/dist/types-public.d.cts

@@ -1,3 +1,3 @@
-export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-B5YxQhR6.cjs';
+export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-WADaA-TW.cjs';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/types-public.d.ts

@@ -1,3 +1,3 @@
-export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-B5YxQhR6.js';
+export { j as BulkDecryptPayload, B as BulkDecryptedData, l as BulkEncryptPayload, k as BulkEncryptedData, i as Client, G as ClientConfig, D as Decrypted, H as DecryptedFields, J as DecryptionResult, m as EncryptOptions, o as EncryptQueryOptions, E as Encrypted, L as EncryptedFields, h as EncryptedQueryResult, p as EncryptedReturnType, N as EncryptedSearchTerm, g as EncryptedValue, s as EncryptionClientConfig, K as KeysetIdentifier, P as OtherFields, Q as QueryTypeName, S as ScalarQueryTerm, R as SearchTerm, V as queryTypes } from './types-public-WADaA-TW.js';
 import 'zod';
 import '@cipherstash/protect-ffi';

package/dist/types-public.js

@@ -1,6 +1,6 @@
 import {
   queryTypes
-} from "./chunk-HCL75LXQ.js";
+} from "./chunk-46PDK2Z6.js";
 export {
   queryTypes
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/stack",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "CipherStash Stack for TypeScript and JavaScript",
   "keywords": [
     "encrypted",
@@ -199,10 +199,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@byteslice/result": "^0.2.0",
-    "@cipherstash/protect-ffi": "0.20.2",
-    "evlog": "^1.9.0",
-    "uuid": "^13.0.0",
+    "@byteslice/result": "0.2.0",
+    "@cipherstash/auth": "0.34.2",
+    "@cipherstash/protect-ffi": "0.21.0",
+    "evlog": "1.9.0",
+    "uuid": "13.0.0",
     "zod": "3.24.2"
   },
   "peerDependencies": {