@cipherstash/stack 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cipherstash/stack
 
+## 0.14.0
+
+### Minor Changes
+
+- 1e0d4c1: Support CipherStash rebrand with new docs links.
+
+## 0.13.0
+
+### Minor Changes
+
+- 068f820: Release the consolidated CipherStash CLI npm package.
+
 ## 0.12.0
 
 ### Minor Changes

package/README.md

@@ -47,7 +47,7 @@ pnpm add @cipherstash/stack
 ### 1. Initialize and authenticate your project
 
 ```bash
-npx stash init
+npx @cipherstash/cli init
 ```
 
 The wizard will authenticate you, walk you through choosing a database connection method, build an encryption schema, and install the required dependencies.
@@ -438,25 +438,25 @@ await secrets.delete("DATABASE_URL")
 
 ## CLI Reference
 
-The `stash` CLI is bundled with the package and available after install.
+The CLI is available via `npx @cipherstash/cli` after install.
 
-### `stash auth`
+### `npx @cipherstash/cli auth`
 
 Authenticate with CipherStash.
 
 ```bash
-npx stash auth login
+npx @cipherstash/cli auth login
 ```
 
 This runs the device code flow: it opens your browser, you confirm the code, and a token is saved to `~/.cipherstash/auth.json`. No environment variables or credentials files are needed for local development.
 
-### `stash init`
+### `npx @cipherstash/cli init`
 
 Initialize CipherStash for your project with an interactive wizard.
 
 ```bash
-npx stash init
-npx stash init --supabase
+npx @cipherstash/cli init
+npx @cipherstash/cli init --supabase
 ```
 
 The wizard will:
@@ -464,31 +464,31 @@ The wizard will:
 2. Bind your device to the default Keyset
 3. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
 4. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
-5. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
+5. Install `@cipherstash/cli` as a dev dependency for database tooling
 
-After `stash init`, run `npx stash-forge setup` to configure your database.
+After init, run `npx @cipherstash/cli db setup` to configure your database.
 
 | Flag | Description |
 |------|-------------|
 | `--supabase` | Use Supabase-specific setup flow |
 
-### `stash secrets`
+### `npx @cipherstash/cli secrets`
 
 Manage encrypted secrets from the terminal.
 
 ```bash
-npx stash secrets set  -name DATABASE_URL -value "postgres://..." -environment production
-npx stash secrets get  -name DATABASE_URL -environment production
-npx stash secrets list -environment production
-npx stash secrets delete -name DATABASE_URL -environment production
+npx @cipherstash/cli secrets set  -name DATABASE_URL -value "postgres://..." -environment production
+npx @cipherstash/cli secrets get  -name DATABASE_URL -environment production
+npx @cipherstash/cli secrets list -environment production
+npx @cipherstash/cli secrets delete -name DATABASE_URL -environment production
 ```
 
 | Command | Flags | Aliases | Description |
 |-----|----|-----|-------|
-| `stash secrets set` | `-name`, `-value`, `-environment` | `-n`, `-V`, `-e` | Encrypt and store a secret |
-| `stash secrets get` | `-name`, `-environment` | `-n`, `-e` | Retrieve and decrypt a secret |
-| `stash secrets list` | `-environment` | `-e` | List all secret names in an environment |
-| `stash secrets delete` | `-name`, `-environment`, `-yes` | `-n`, `-e`, `-y` | Delete a secret (prompts for confirmation unless `-yes`) |
+| `npx @cipherstash/cli secrets set` | `-name`, `-value`, `-environment` | `-n`, `-V`, `-e` | Encrypt and store a secret |
+| `npx @cipherstash/cli secrets get` | `-name`, `-environment` | `-n`, `-e` | Retrieve and decrypt a secret |
+| `npx @cipherstash/cli secrets list` | `-environment` | `-e` | List all secret names in an environment |
+| `npx @cipherstash/cli secrets delete` | `-name`, `-environment`, `-yes` | `-n`, `-e`, `-y` | Delete a secret (prompts for confirmation unless `-yes`) |
 
 ## Configuration
 
@@ -507,7 +507,7 @@ For production, CI/CD, and deployed environments, you'll need to set up machine
 | `CS_CLIENT_KEY` | Client key material used with ZeroKMS for encryption |
 | `CS_CLIENT_ACCESS_KEY` | API key for authenticating with the CipherStash API |
 
-See the [Going to Production](https://cipherstash.com/docs/stack/going-to-production) guide for full details on creating machine clients, setting up access keys, and configuring CI/CD pipelines.
+See the [Going to Production](https://cipherstash.com/docs/stack/deploy/going-to-production) guide for full details on creating machine clients, setting up access keys, and configuring CI/CD pipelines.
 
 ### Programmatic Config
 
@@ -676,7 +676,7 @@ If you are migrating from `@cipherstash/protect`, the following table maps the o
 | `csColumn(name)` | `encryptedColumn(name)` | `@cipherstash/stack/schema` |
 | `import { LockContext } from "@cipherstash/protect/identify"` | `import { LockContext } from "@cipherstash/stack/identity"` | `@cipherstash/stack/identity` |
 | N/A | `Secrets` class | `@cipherstash/stack/secrets` |
-| N/A | `stash` CLI | `npx stash` |
+| N/A | CLI | `npx @cipherstash/cli` |
 
 All method signatures on the encryption client (`encrypt`, `decrypt`, `encryptModel`, etc.) remain the same. The `Result` pattern (`data` / `failure`) is unchanged.
 

package/dist/{chunk-46PDK2Z6.js → chunk-MD6742R6.js}

@@ -25,4 +25,4 @@ export {
   queryTypeToFfi,
   queryTypeToQueryOp
 };
-//# sourceMappingURL=chunk-46PDK2Z6.js.map
+//# sourceMappingURL=chunk-MD6742R6.js.map

package/dist/{chunk-46PDK2Z6.js.map → chunk-MD6742R6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";AA4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";AA4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}

package/dist/{chunk-EHDOOLWU.js → chunk-XTKLRDGJ.js}

@@ -1,6 +1,6 @@
 import {
   Encryption
-} from "./chunk-O4MBO4DJ.js";
+} from "./chunk-YPAPL3IC.js";
 import {
   encryptedToPgComposite
 } from "./chunk-4RNBI3UH.js";
@@ -354,4 +354,4 @@ var Secrets = class {
 export {
   Secrets
 };
-//# sourceMappingURL=chunk-EHDOOLWU.js.map
+//# sourceMappingURL=chunk-XTKLRDGJ.js.map

package/dist/{chunk-O4MBO4DJ.js → chunk-YPAPL3IC.js}

@@ -10,7 +10,7 @@ import {
 import {
   queryTypeToFfi,
   queryTypeToQueryOp
-} from "./chunk-46PDK2Z6.js";
+} from "./chunk-MD6742R6.js";
 import {
   createRequestLogger,
   logger
@@ -2325,4 +2325,4 @@ export {
   EncryptionClient,
   Encryption
 };
-//# sourceMappingURL=chunk-O4MBO4DJ.js.map
+//# sourceMappingURL=chunk-YPAPL3IC.js.map

package/dist/{client-bW-5wG9Y.d.cts → client-DQyqn0oT.d.cts}

@@ -1,4 +1,4 @@
-import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-WADaA-TW.cjs';
+import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-DX3mGqoi.cjs';
 import { EncryptionError } from './errors/index.cjs';
 import { Result } from '@byteslice/result';
 import { JsPlaintext } from '@cipherstash/protect-ffi';

package/dist/{client-CZLBiToT.d.ts → client-Dv60lAyy.d.ts}

@@ -1,4 +1,4 @@
-import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-WADaA-TW.js';
+import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-DX3mGqoi.js';
 import { EncryptionError } from './errors/index.js';
 import { Result } from '@byteslice/result';
 import { JsPlaintext } from '@cipherstash/protect-ffi';

package/dist/client.d.cts

@@ -1,5 +1,5 @@
-export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-WADaA-TW.cjs';
-export { a as EncryptionClient } from './client-bW-5wG9Y.cjs';
+export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-DX3mGqoi.cjs';
+export { a as EncryptionClient } from './client-DQyqn0oT.cjs';
 import 'zod';
 import '@cipherstash/protect-ffi';
 import './errors/index.cjs';

package/dist/client.d.ts

@@ -1,5 +1,5 @@
-export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-WADaA-TW.js';
-export { a as EncryptionClient } from './client-CZLBiToT.js';
+export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-DX3mGqoi.js';
+export { a as EncryptionClient } from './client-Dv60lAyy.js';
 import 'zod';
 import '@cipherstash/protect-ffi';
 import './errors/index.js';