@cipherstash/stack 0.15.3 → 0.18.0

package/dist/supabase/index.js

@@ -1,13 +1,13 @@
 import {
   bulkModelsToEncryptedPgComposites,
   modelToEncryptedPgComposites
-} from "../chunk-4RNBI3UH.js";
+} from "../chunk-XWPGAHBZ.js";
 import {
   EncryptedColumn
-} from "../chunk-GNLU3I27.js";
+} from "../chunk-YWQXTZ5M.js";
 import {
   logger
-} from "../chunk-6FD7OBGM.js";
+} from "../chunk-LLCCNKDL.js";
 
 // src/supabase/helpers.ts
 function getEncryptedColumnNames(schema) {

package/dist/{types-public-DX3mGqoi.d.ts → types-public-BTxqjmtv.d.cts}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { Encrypted as Encrypted$1, newClient, JsPlaintext } from '@cipherstash/protect-ffi';
+import { Encrypted as Encrypted$1, newClient, EncryptedQuery as EncryptedQuery$1, JsPlaintext } from '@cipherstash/protect-ffi';
 
 /** Brand symbol for nominal typing */
 declare const __brand: unique symbol;
@@ -10,8 +10,18 @@ type Brand<T, B extends string> = T & {
 type Client = Awaited<ReturnType<typeof newClient>> | undefined;
 /** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */
 type EncryptedValue = Brand<Encrypted$1, 'encrypted'>;
-/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */
+/** Structural type representing encrypted data stored in the database. Always
+ * carries a ciphertext. See also `EncryptedValue` for branded nominal typing,
+ * and {@link EncryptedQuery} for the search-term shape returned by
+ * `encryptQuery`. */
 type Encrypted = Encrypted$1;
+/** Structural type representing an encrypted query term (search needle)
+ * returned by `encryptQuery` / `encryptQueryBulk` for scalar
+ * (`unique` / `match` / `ore`) lookups and `ste_vec_selector` JSON path
+ * queries. Carries no ciphertext — matched against stored values, never
+ * decrypted. JSON containment queries (`ste_vec_term`) return a
+ * storage-shaped {@link Encrypted} payload instead. */
+type EncryptedQuery = EncryptedQuery$1;
 type KeysetIdentifier = {
     name: string;
 } | {
@@ -73,10 +83,15 @@ type SearchTerm = {
     table: EncryptedTable<EncryptedTableColumn>;
     returnType?: EncryptedReturnType;
 };
-/** Encrypted search term result: EQL object or composite literal string */
-type EncryptedSearchTerm = Encrypted | string;
-/** Result of encryptQuery (single or batch): EQL or composite literal string */
-type EncryptedQueryResult = Encrypted | string;
+/** Encrypted search term result. `eql` return type yields either a storage
+ * payload (`Encrypted`, for `ste_vec_term`) or a query-only term
+ * (`EncryptedQuery`, for scalar lookups and `ste_vec_selector`); the
+ * `composite-literal` return types yield a string. */
+type EncryptedSearchTerm = Encrypted | EncryptedQuery | string;
+/** Result of encryptQuery (single or batch). `eql` return type yields either a
+ * storage payload (`Encrypted`) or a query-only term (`EncryptedQuery`); the
+ * `composite-literal` return types yield a string. */
+type EncryptedQueryResult = Encrypted | EncryptedQuery | string | null;
 type EncryptedFields<T> = {
     [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K];
 };
@@ -114,17 +129,17 @@ type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {
 };
 type BulkEncryptPayload = Array<{
     id?: string;
-    plaintext: JsPlaintext;
+    plaintext: JsPlaintext | null;
 }>;
 type BulkEncryptedData = Array<{
     id?: string;
-    data: Encrypted;
+    data: Encrypted | null;
 }>;
 type BulkDecryptPayload = Array<{
     id?: string;
-    data: Encrypted;
+    data: Encrypted | null;
 }>;
-type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>;
+type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>;
 type DecryptionSuccess<T> = {
     error?: never;
     data: T;
@@ -421,6 +436,12 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -435,12 +456,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
-        ore?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -450,6 +465,12 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             } | undefined;
         } | undefined;
     }, {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -464,12 +485,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
-        ore?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -480,8 +495,14 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    cast_as: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json";
+    cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
     indexes: {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -496,12 +517,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
-        ore?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -512,8 +527,14 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
         } | undefined;
     };
 }, {
-    cast_as?: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json" | undefined;
+    cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text" | undefined;
     indexes?: {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -528,12 +549,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
-        ore?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -653,6 +668,12 @@ declare const encryptConfigSchema: z.ZodObject<{
                 } | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -667,12 +688,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
-            ore?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -682,6 +697,12 @@ declare const encryptConfigSchema: z.ZodObject<{
                 } | undefined;
             } | undefined;
         }, {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -696,12 +717,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
-            ore?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -712,8 +727,14 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
         indexes: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -728,12 +749,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
-            ore?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -744,8 +759,14 @@ declare const encryptConfigSchema: z.ZodObject<{
             } | undefined;
         };
     }, {
-        cast_as?: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json" | undefined;
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text" | undefined;
         indexes?: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -760,12 +781,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
-            ore?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -779,8 +794,14 @@ declare const encryptConfigSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     v: number;
     tables: Record<string, Record<string, {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
         indexes: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -795,12 +816,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
-            ore?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -814,8 +829,14 @@ declare const encryptConfigSchema: z.ZodObject<{
 }, {
     v: number;
     tables?: Record<string, Record<string, {
-        cast_as?: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json" | undefined;
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text" | undefined;
         indexes?: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -830,12 +851,6 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
-            ore?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -903,7 +918,7 @@ declare class EncryptedField {
      */
     dataType(castAs: CastAs): this;
     build(): {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
         indexes: {};
     };
     getName(): string;
@@ -1022,7 +1037,7 @@ declare class EncryptedColumn {
      */
     searchableJson(): this;
     build(): {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "text" | "date" | "json";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
         indexes: {
             ore?: OreIndexOpts;
             unique?: UniqueIndexOpts;
@@ -1038,7 +1053,7 @@ interface TableDefinition {
 }
 declare class EncryptedTable<T extends EncryptedTableColumn> {
     readonly tableName: string;
-    private readonly columnBuilders;
+    readonly columnBuilders: T;
     /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
     readonly _columnType: T;
     constructor(tableName: string, columnBuilders: T);
@@ -1178,7 +1193,7 @@ declare function encryptedField(valueName: string): EncryptedField;
 /**
  * Build an encrypt config from a list of encrypted tables.
  *
- * @param ...tables - The list of encrypted tables to build the config from.
+ * @param protectTables - The list of encrypted tables to build the config from.
  * @returns An encrypt config object.
  *
  * @example
@@ -1199,4 +1214,4 @@ declare function encryptedField(valueName: string): EncryptedField;
  */
 declare function buildEncryptConfig(...protectTables: Array<EncryptedTable<EncryptedTableColumn>>): EncryptConfig;
 
-export { eqlCastAsEnum as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type Encrypted as E, toEqlCastAs as F, type ClientConfig as G, type DecryptedFields as H, type InferEncrypted as I, type DecryptionResult as J, type KeysetIdentifier as K, type EncryptedFields as L, type MatchIndexOpts as M, type EncryptedSearchTerm as N, type OreIndexOpts as O, type OtherFields as P, type QueryTypeName as Q, type SearchTerm as R, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, queryTypes as V, encryptedField as a, encryptedTable as b, EncryptedTable as c, type EncryptedTableColumn as d, encryptedColumn as e, EncryptedColumn as f, type EncryptedValue as g, type EncryptedQueryResult as h, type Client as i, type BulkDecryptPayload as j, type BulkEncryptedData as k, type BulkEncryptPayload as l, type EncryptOptions as m, EncryptedField as n, type EncryptQueryOptions as o, type EncryptedReturnType as p, type EncryptConfig as q, type EncryptedFromSchema as r, type EncryptionClientConfig as s, type InferPlaintext as t, type ColumnSchema as u, type EqlCastAs as v, type SteVecIndexOpts as w, buildEncryptConfig as x, castAsEnum as y, encryptConfigSchema as z };
+export { eqlCastAsEnum as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type Encrypted as E, toEqlCastAs as F, type ClientConfig as G, type DecryptedFields as H, type InferEncrypted as I, type DecryptionResult as J, type KeysetIdentifier as K, type EncryptedFields as L, type MatchIndexOpts as M, type EncryptedQuery as N, type OreIndexOpts as O, type EncryptedSearchTerm as P, type QueryTypeName as Q, type OtherFields as R, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, type SearchTerm as V, queryTypes as W, encryptedField as a, encryptedTable as b, EncryptedTable as c, type EncryptedTableColumn as d, encryptedColumn as e, EncryptedColumn as f, type EncryptedValue as g, type EncryptedQueryResult as h, type Client as i, type BulkDecryptPayload as j, type BulkEncryptedData as k, type BulkEncryptPayload as l, type EncryptOptions as m, EncryptedField as n, type EncryptQueryOptions as o, type EncryptedReturnType as p, type EncryptConfig as q, type EncryptedFromSchema as r, type EncryptionClientConfig as s, type InferPlaintext as t, type ColumnSchema as u, type EqlCastAs as v, type SteVecIndexOpts as w, buildEncryptConfig as x, castAsEnum as y, encryptConfigSchema as z };