@cipherstash/stack 0.16.0 → 0.18.0

package/dist/{client-C_7TF8EL.d.cts → client-Dt98Rugc.d.cts}

@@ -1,4 +1,4 @@
-import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-Dv-r6Ik0.cjs';
+import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-BTxqjmtv.cjs';
 import { EncryptionError } from './errors/index.cjs';
 import { Result } from '@byteslice/result';
 import { JsPlaintext } from '@cipherstash/protect-ffi';
@@ -32,9 +32,6 @@ declare abstract class EncryptionOperation<T> {
     then<TResult1 = Result<T, EncryptionError>, TResult2 = never>(onfulfilled?: ((value: Result<T, EncryptionError>) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): Promise<TResult1 | TResult2>;
 }
 
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} with array input instead.
- */
 declare class BatchEncryptQueryOperation extends EncryptionOperation<EncryptedQueryResult[]> {
     private client;
     private terms;
@@ -42,9 +39,6 @@ declare class BatchEncryptQueryOperation extends EncryptionOperation<EncryptedQu
     withLockContext(lockContext: LockContext): BatchEncryptQueryOperationWithLockContext;
     execute(): Promise<Result<EncryptedQueryResult[], EncryptionError>>;
 }
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} with array input and `.withLockContext()` instead.
- */
 declare class BatchEncryptQueryOperationWithLockContext extends EncryptionOperation<EncryptedQueryResult[]> {
     private client;
     private terms;
@@ -138,12 +132,12 @@ declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string,
 declare class DecryptOperation extends EncryptionOperation<JsPlaintext> {
     private client;
     private encryptedData;
-    constructor(client: Client, encryptedData: Encrypted);
+    constructor(client: Client, encryptedData: Encrypted | null);
     withLockContext(lockContext: LockContext): DecryptOperationWithLockContext;
     execute(): Promise<Result<JsPlaintext, EncryptionError>>;
     getOperation(): {
         client: Client;
-        encryptedData: Encrypted;
+        encryptedData: Encrypted | null;
         auditData?: Record<string, unknown>;
     };
 }
@@ -177,12 +171,12 @@ declare class EncryptOperation extends EncryptionOperation<Encrypted> {
     private plaintext;
     private column;
     private table;
-    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptOptions);
+    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptOptions);
     withLockContext(lockContext: LockContext): EncryptOperationWithLockContext;
     execute(): Promise<Result<Encrypted, EncryptionError>>;
     getOperation(): {
         client: Client;
-        plaintext: JsPlaintext;
+        plaintext: JsPlaintext | null;
         column: EncryptedColumn | EncryptedField;
         table: EncryptedTable<EncryptedTableColumn>;
     };
@@ -214,14 +208,11 @@ declare class EncryptModelOperationWithLockContext<T extends Record<string, unkn
     execute(): Promise<Result<T, EncryptionError>>;
 }
 
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} instead.
- */
 declare class EncryptQueryOperation extends EncryptionOperation<EncryptedQueryResult> {
     private client;
     private plaintext;
     private opts;
-    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions);
+    constructor(client: Client, plaintext: JsPlaintext | null | undefined, opts: EncryptQueryOptions);
     withLockContext(lockContext: LockContext): EncryptQueryOperationWithLockContext;
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
     getOperation(): {
@@ -230,18 +221,15 @@ declare class EncryptQueryOperation extends EncryptionOperation<EncryptedQueryRe
         queryType?: QueryTypeName;
         returnType?: EncryptedReturnType;
         client: Client;
-        plaintext: JsPlaintext;
+        plaintext: JsPlaintext | null | undefined;
     };
 }
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} with `.withLockContext()` instead.
- */
 declare class EncryptQueryOperationWithLockContext extends EncryptionOperation<EncryptedQueryResult> {
     private client;
     private plaintext;
     private opts;
     private lockContext;
-    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
+    constructor(client: Client, plaintext: JsPlaintext | null | undefined, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
 }
 
@@ -432,6 +420,13 @@ declare class EncryptionClient {
      *      .withLockContext(lockContext)
      * ```
      *
+     * @remarks
+     * The public input type rejects null, but at runtime `decrypt` will
+     * short-circuit and return null when given a null ciphertext
+     * (defense in depth for legacy / manually-NULLed DB rows reached via
+     * casts or dynamic field walking). The narrow return type holds for
+     * any caller that respects the input contract.
+     *
      * @see {@link LockContext}
      * @see {@link DecryptOperation}
      */
@@ -676,7 +671,7 @@ declare class EncryptionClient {
  *   {@link EncryptionClient.encrypt}, {@link EncryptionClient.decrypt}, and related operations.
  *
  * @throws Throws if `schemas` is empty, or if a keyset `id` is supplied but is not a valid UUID.
- *   Also throws if {@link EncryptionClient.init} fails (e.g. invalid credentials or config).
+ *   Also throws if the client fails to initialize (e.g. invalid credentials or config).
  *
  * @example
  * ```typescript
@@ -694,4 +689,4 @@ declare class EncryptionClient {
  */
 declare const Encryption: (config: EncryptionClientConfig) => Promise<EncryptionClient>;
 
-export { type AuditConfig as A, Encryption as E, EncryptionClient as a, noClientError as n };
+export { type AuditConfig as A, BatchEncryptQueryOperation as B, DecryptModelOperation as D, Encryption as E, EncryptionClient as a, BulkDecryptModelsOperation as b, BulkDecryptOperation as c, BulkEncryptModelsOperation as d, BulkEncryptOperation as e, DecryptOperation as f, EncryptModelOperation as g, EncryptOperation as h, EncryptQueryOperation as i, noClientError as n };

package/dist/client.cjs

@@ -289,6 +289,8 @@ var EncryptedTable = class {
     this.tableName = tableName;
     this.columnBuilders = columnBuilders;
   }
+  tableName;
+  columnBuilders;
   /**
    * Compile this table schema into a `TableDefinition` used internally by the encryption client.
    *

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/schema/index.ts"],"sourcesContent":["/**\n * Client-safe exports for `@cipherstash/stack`.\n *\n * This entry point exports types and utilities that can be used in client-side code\n * without requiring the `@cipherstash/protect-ffi` native module.\n *\n * Use this import path: `@cipherstash/stack/client`\n *\n * `EncryptionClient` is exported as a **type-only** export for use in function\n * signatures without pulling in the native FFI dependency.\n */\n\n// Schema types and utilities - client-safe\nexport { encryptedTable, encryptedColumn, encryptedField } from '@/schema'\nexport type {\n  EncryptedColumn,\n  EncryptedTable,\n  EncryptedTableColumn,\n  EncryptedField,\n  InferPlaintext,\n  InferEncrypted,\n} from '@/schema'\nexport type { EncryptionClient } from '@/encryption'\n","import type { Encrypted } from '@/types'\nimport { z } from 'zod'\n\n// ------------------------\n// Zod schemas\n// ------------------------\n\n/**\n * Allowed cast types for CipherStash schema fields.\n *\n * **Possible values:**\n * - `\"bigint\"`\n * - `\"boolean\"`\n * - `\"date\"`\n * - `\"number\"`\n * - `\"string\"`\n * - `\"json\"`\n * - `\"text\"`\n *\n * @remarks\n * This is a Zod enum used at runtime to validate schema definitions.\n * Use {@link CastAs} when typing your own code.\n *\n * @internal\n */\n/**\n * EQL cast types — the PostgreSQL-aligned types that EQL actually accepts.\n * These are stored in the `cast_as` field of the EncryptConfig.\n */\nexport const eqlCastAsEnum = z\n  .enum([\n    'text',\n    'int',\n    'small_int',\n    'big_int',\n    'real',\n    'double',\n    'boolean',\n    'date',\n    'jsonb',\n  ])\n  .default('text')\n\n/**\n * SDK-facing data types — developer-friendly aliases accepted by `dataType()`.\n */\nexport const castAsEnum = z\n  .enum(['bigint', 'boolean', 'date', 'number', 'string', 'json', 'text'])\n  .default('text')\n\n/**\n * Map SDK-facing data types to EQL `cast_as` values.\n *\n * The SDK accepts developer-friendly types like `'string'` and `'number'`,\n * but EQL expects PostgreSQL-aligned types like `'text'` and `'double'`.\n */\nexport function toEqlCastAs(value: CastAs): EqlCastAs {\n  switch (value) {\n    case 'string':\n      return 'text'\n    case 'text':\n      return 'text'\n    case 'number':\n      return 'double'\n    case 'bigint':\n      return 'big_int'\n    case 'boolean':\n      return 'boolean'\n    case 'date':\n      return 'date'\n    case 'json':\n      return 'jsonb'\n  }\n}\n\nconst tokenFilterSchema = z.object({\n  kind: z.literal('downcase'),\n})\n\nconst tokenizerSchema = z\n  .union([\n    z.object({\n      kind: z.literal('standard'),\n    }),\n    z.object({\n      kind: z.literal('ngram'),\n      token_length: z.number(),\n    }),\n  ])\n  .default({ kind: 'ngram', token_length: 3 })\n  .optional()\n\nconst oreIndexOptsSchema = z.object({})\n\nconst uniqueIndexOptsSchema = z.object({\n  token_filters: z.array(tokenFilterSchema).default([]).optional(),\n})\n\nconst matchIndexOptsSchema = z.object({\n  tokenizer: tokenizerSchema,\n  token_filters: z.array(tokenFilterSchema).default([]).optional(),\n  k: z.number().default(6).optional(),\n  m: z.number().default(2048).optional(),\n  include_original: z.boolean().default(false).optional(),\n})\n\nconst arrayIndexModeSchema = z.union([\n  z.literal('all'),\n  z.literal('none'),\n  z.object({\n    item: z.boolean().optional(),\n    wildcard: z.boolean().optional(),\n    position: z.boolean().optional(),\n  }),\n])\n\nconst steVecIndexOptsSchema = z.object({\n  prefix: z.string(),\n  array_index_mode: arrayIndexModeSchema.optional(),\n})\n\nconst indexesSchema = z\n  .object({\n    ore: oreIndexOptsSchema.optional(),\n    unique: uniqueIndexOptsSchema.optional(),\n    match: matchIndexOptsSchema.optional(),\n    ste_vec: steVecIndexOptsSchema.optional(),\n  })\n  .default({})\n\nconst columnSchema = z\n  .object({\n    cast_as: castAsEnum,\n    indexes: indexesSchema,\n  })\n  .default({})\n\nconst tableSchema = z.record(columnSchema).default({})\n\nconst tablesSchema = z.record(tableSchema).default({})\n\n/** @internal */\nexport const encryptConfigSchema = z.object({\n  v: z.number(),\n  tables: tablesSchema,\n})\n\n// ------------------------\n// Type definitions\n// ------------------------\n\n/**\n * Type-safe alias for {@link castAsEnum} used to specify the *unencrypted* data type of a column or value.\n * This is important because once encrypted, all data is stored as binary blobs.\n *\n * @see {@link castAsEnum} for possible values.\n */\nexport type CastAs = z.infer<typeof castAsEnum>\nexport type EqlCastAs = z.infer<typeof eqlCastAsEnum>\nexport type TokenFilter = z.infer<typeof tokenFilterSchema>\nexport type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>\nexport type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>\nexport type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>\nexport type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>\nexport type ColumnSchema = z.infer<typeof columnSchema>\n\n/**\n * Shape of table columns: either top-level {@link EncryptedColumn} or nested\n * objects whose leaves are {@link EncryptedField}. Used with {@link encryptedTable}.\n */\nexport type EncryptedTableColumn = {\n  [key: string]:\n    | EncryptedColumn\n    | {\n        [key: string]:\n          | EncryptedField\n          | {\n              [key: string]:\n                | EncryptedField\n                | {\n                    [key: string]: EncryptedField\n                  }\n            }\n      }\n}\nexport type EncryptConfig = z.infer<typeof encryptConfigSchema>\n\n// ------------------------\n// Interface definitions\n// ------------------------\n\n/**\n * Builder for a nested encrypted field (encrypted but not searchable).\n * Create with {@link encryptedField}. Use inside nested objects in {@link encryptedTable};\n * supports `.dataType()` for plaintext type. No index methods (equality, orderAndRange, etc.).\n */\nexport class EncryptedField {\n  private valueName: string\n  private castAsValue: CastAs\n\n  constructor(valueName: string) {\n    this.valueName = valueName\n    this.castAsValue = 'string'\n  }\n\n  /**\n   * Set or override the plaintext data type for this field.\n   *\n   * By default all values are treated as `'string'`. Use this method to specify\n   * a different type so the encryption layer knows how to encode the plaintext\n   * before encrypting.\n   *\n   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.\n   * @returns This `EncryptedField` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedField } from \"@cipherstash/stack/schema\"\n   *\n   * const age = encryptedField(\"age\").dataType(\"number\")\n   * ```\n   */\n  dataType(castAs: CastAs) {\n    this.castAsValue = castAs\n    return this\n  }\n\n  build() {\n    return {\n      cast_as: this.castAsValue,\n      indexes: {},\n    }\n  }\n\n  getName() {\n    return this.valueName\n  }\n}\n\nexport class EncryptedColumn {\n  private columnName: string\n  private castAsValue: CastAs\n  private indexesValue: {\n    ore?: OreIndexOpts\n    unique?: UniqueIndexOpts\n    match?: Required<MatchIndexOpts>\n    ste_vec?: SteVecIndexOpts\n  } = {}\n\n  constructor(columnName: string) {\n    this.columnName = columnName\n    this.castAsValue = 'string'\n  }\n\n  /**\n   * Set or override the plaintext data type for this column.\n   *\n   * By default all columns are treated as `'string'`. Use this method to specify\n   * a different type so the encryption layer knows how to encode the plaintext\n   * before encrypting.\n   *\n   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const dateOfBirth = encryptedColumn(\"date_of_birth\").dataType(\"date\")\n   * ```\n   */\n  dataType(castAs: CastAs) {\n    this.castAsValue = castAs\n    return this\n  }\n\n  /**\n   * Enable Order-Revealing Encryption (ORE) indexing on this column.\n   *\n   * ORE allows sorting, comparison, and range queries on encrypted data.\n   * Use with `encryptQuery` and `queryType: 'orderAndRange'`.\n   *\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").orderAndRange(),\n   * })\n   * ```\n   */\n  orderAndRange() {\n    this.indexesValue.ore = {}\n    return this\n  }\n\n  /**\n   * Enable an exact-match (unique) index on this column.\n   *\n   * Allows equality queries on encrypted data. Use with `encryptQuery`\n   * and `queryType: 'equality'`.\n   *\n   * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).\n   *   When omitted, no token filters are applied.\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").equality(),\n   * })\n   * ```\n   */\n  equality(tokenFilters?: TokenFilter[]) {\n    this.indexesValue.unique = {\n      token_filters: tokenFilters ?? [],\n    }\n    return this\n  }\n\n  /**\n   * Enable a full-text / fuzzy search (match) index on this column.\n   *\n   * Uses n-gram tokenization by default for substring and fuzzy matching.\n   * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.\n   *\n   * @param opts - Optional match index configuration. Defaults to 3-character ngram\n   *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").freeTextSearch(),\n   * })\n   *\n   * // With custom options\n   * const posts = encryptedTable(\"posts\", {\n   *   body: encryptedColumn(\"body\").freeTextSearch({\n   *     tokenizer: { kind: \"ngram\", token_length: 4 },\n   *     k: 8,\n   *     m: 4096,\n   *   }),\n   * })\n   * ```\n   */\n  freeTextSearch(opts?: MatchIndexOpts) {\n    // Provide defaults\n    this.indexesValue.match = {\n      tokenizer: opts?.tokenizer ?? { kind: 'ngram', token_length: 3 },\n      token_filters: opts?.token_filters ?? [\n        {\n          kind: 'downcase',\n        },\n      ],\n      k: opts?.k ?? 6,\n      m: opts?.m ?? 2048,\n      include_original: opts?.include_original ?? true,\n    }\n    return this\n  }\n\n  /**\n   * Configure this column for searchable encrypted JSON (STE-Vec).\n   *\n   * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and\n   * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the\n   * data type to `'json'`.\n   *\n   * When used with `encryptQuery`, the query operation is auto-inferred from\n   * the plaintext type: strings become selector queries, objects/arrays become\n   * containment queries.\n   *\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const documents = encryptedTable(\"documents\", {\n   *   metadata: encryptedColumn(\"metadata\").searchableJson(),\n   * })\n   * ```\n   */\n  searchableJson() {\n    this.castAsValue = 'json'\n    this.indexesValue.ste_vec = { prefix: 'enabled', array_index_mode: 'all' }\n    return this\n  }\n\n  build() {\n    return {\n      cast_as: this.castAsValue,\n      indexes: this.indexesValue,\n    }\n  }\n\n  getName() {\n    return this.columnName\n  }\n}\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\nexport class EncryptedTable<T extends EncryptedTableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  /**\n   * Compile this table schema into a `TableDefinition` used internally by the encryption client.\n   *\n   * Iterates over all column builders, calls `.build()` on each, and assembles\n   * the final `{ tableName, columns }` structure. For `searchableJson()` columns,\n   * the STE-Vec prefix is automatically set to `\"<tableName>/<columnName>\"`.\n   *\n   * @returns A `TableDefinition` containing the table name and built column configs.\n   *\n   * @example\n   * ```typescript\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").equality(),\n   * })\n   *\n   * const definition = users.build()\n   * // { tableName: \"users\", columns: { email: { cast_as: \"string\", indexes: { unique: ... } } } }\n   * ```\n   */\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n\n    const processColumn = (\n      builder:\n        | EncryptedColumn\n        | Record<\n            string,\n            | EncryptedField\n            | Record<\n                string,\n                | EncryptedField\n                | Record<\n                    string,\n                    EncryptedField | Record<string, EncryptedField>\n                  >\n              >\n          >,\n      colName: string,\n    ) => {\n      if (builder instanceof EncryptedColumn) {\n        const builtColumn = builder.build()\n\n        // Hanlde building the ste_vec index for JSON columns so users don't have to pass the prefix.\n        if (\n          builtColumn.cast_as === 'json' &&\n          builtColumn.indexes.ste_vec?.prefix === 'enabled'\n        ) {\n          builtColumns[colName] = {\n            ...builtColumn,\n            indexes: {\n              ...builtColumn.indexes,\n              ste_vec: {\n                ...builtColumn.indexes.ste_vec,\n                prefix: `${this.tableName}/${colName}`,\n              },\n            },\n          }\n        } else {\n          builtColumns[colName] = builtColumn\n        }\n      } else {\n        for (const [key, value] of Object.entries(builder)) {\n          if (value instanceof EncryptedField) {\n            builtColumns[value.getName()] = value.build()\n          } else {\n            processColumn(value, key)\n          }\n        }\n      }\n    }\n\n    for (const [colName, builder] of Object.entries(this.columnBuilders)) {\n      processColumn(builder, colName)\n    }\n\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n}\n\n// ------------------------\n// Schema type inference helpers\n// ------------------------\n\n/**\n * Infer the plaintext (decrypted) type from a EncryptedTable schema.\n *\n * @example\n * ```typescript\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n *   name: encryptedColumn(\"name\"),\n * })\n *\n * type UserPlaintext = InferPlaintext<typeof users>\n * // => { email: string; name: string }\n * ```\n */\nexport type InferPlaintext<T extends EncryptedTable<any>> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C as C[K] extends EncryptedColumn | EncryptedField\n          ? K\n          : never]: string\n      }\n    : never\n\n/**\n * Infer the encrypted type from a EncryptedTable schema.\n *\n * @example\n * ```typescript\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * type UserEncrypted = InferEncrypted<typeof users>\n * // => { email: Encrypted }\n * ```\n */\nexport type InferEncrypted<T extends EncryptedTable<any>> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C as C[K] extends EncryptedColumn | EncryptedField\n          ? K\n          : never]: Encrypted\n      }\n    : never\n\n// ------------------------\n// User facing functions\n// ------------------------\n\n/**\n * Define an encrypted table schema.\n *\n * Creates a `EncryptedTable` that maps a database table name to a set of encrypted\n * column definitions. Pass the resulting object to `Encryption({ schemas: [...] })`\n * when initializing the client.\n *\n * The returned object is also a proxy that exposes each column builder directly,\n * so you can reference columns as `users.email` when calling `encrypt`, `decrypt`,\n * and `encryptQuery`.\n *\n * @param tableName - The name of the database table this schema represents.\n * @param columns - An object whose keys are logical column names and values are\n *   {@link EncryptedColumn} from {@link encryptedColumn}, or nested objects whose\n *   leaves are {@link EncryptedField} from {@link encryptedField}.\n * @returns A `EncryptedTable<T> & T` that can be used as both a schema definition\n *   and a column accessor.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality().freeTextSearch(),\n *   address: encryptedColumn(\"address\"),\n * })\n *\n * // Use as schema\n * const client = await Encryption({ schemas: [users] })\n *\n * // Use as column accessor\n * await client.encrypt(\"hello@example.com\", { column: users.email, table: users })\n * ```\n */\nexport function encryptedTable<T extends EncryptedTableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    ;(tableBuilder as EncryptedTableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Define an encrypted column within a table schema.\n *\n * Creates a `EncryptedColumn` builder for the given column name. Chain index\n * methods (`.equality()`, `.freeTextSearch()`, `.orderAndRange()`,\n * `.searchableJson()`) and/or `.dataType()` to configure searchable encryption\n * and the plaintext data type.\n *\n * @param columnName - The name of the database column to encrypt.\n * @returns A new `EncryptedColumn` builder.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality().freeTextSearch().orderAndRange(),\n * })\n * ```\n */\nexport function encryptedColumn(columnName: string) {\n  return new EncryptedColumn(columnName)\n}\n\n/**\n * Define an encrypted field for use in nested or structured schemas.\n *\n * `encryptedField` is similar to {@link encryptedColumn} but creates an {@link EncryptedField}\n * for nested fields that are encrypted but not searchable (no indexes). Use `.dataType()`\n * to specify the plaintext type.\n *\n * @param valueName - The name of the value field.\n * @returns A new `EncryptedField` builder.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedField } from \"@cipherstash/stack/schema\"\n *\n * const orders = encryptedTable(\"orders\", {\n *   details: {\n *     amount: encryptedField(\"amount\").dataType(\"number\"),\n *     currency: encryptedField(\"currency\"),\n *   },\n * })\n * ```\n */\nexport function encryptedField(valueName: string) {\n  return new EncryptedField(valueName)\n}\n\n/**\n * Build an encrypt config from a list of encrypted tables.\n *\n * @param ...tables - The list of encrypted tables to build the config from.\n * @returns An encrypt config object.\n *\n * @example\n * ```typescript\n * import { buildEncryptConfig } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * const orders = encryptedTable(\"orders\", {\n *   amount: encryptedColumn(\"amount\").dataType(\"number\"),\n * })\n *\n * const config = buildEncryptConfig(users, orders)\n * console.log(config)\n * ```\n */\nexport function buildEncryptConfig(\n  ...protectTables: Array<EncryptedTable<EncryptedTableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 2,\n    tables: {},\n  }\n\n  for (const tb of protectTables) {\n    const tableDef = tb.build()\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,iBAAkB;AA4BX,IAAM,gBAAgB,aAC1B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,MAAM;AAKV,IAAM,aAAa,aACvB,KAAK,CAAC,UAAU,WAAW,QAAQ,UAAU,UAAU,QAAQ,MAAM,CAAC,EACtE,QAAQ,MAAM;AA2BjB,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACjC,MAAM,aAAE,QAAQ,UAAU;AAC5B,CAAC;AAED,IAAM,kBAAkB,aACrB,MAAM;AAAA,EACL,aAAE,OAAO;AAAA,IACP,MAAM,aAAE,QAAQ,UAAU;AAAA,EAC5B,CAAC;AAAA,EACD,aAAE,OAAO;AAAA,IACP,MAAM,aAAE,QAAQ,OAAO;AAAA,IACvB,cAAc,aAAE,OAAO;AAAA,EACzB,CAAC;AACH,CAAC,EACA,QAAQ,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC,EAC1C,SAAS;AAEZ,IAAM,qBAAqB,aAAE,OAAO,CAAC,CAAC;AAEtC,IAAM,wBAAwB,aAAE,OAAO;AAAA,EACrC,eAAe,aAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AACjE,CAAC;AAED,IAAM,uBAAuB,aAAE,OAAO;AAAA,EACpC,WAAW;AAAA,EACX,eAAe,aAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,EAC/D,GAAG,aAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClC,GAAG,aAAE,OAAO,EAAE,QAAQ,IAAI,EAAE,SAAS;AAAA,EACrC,kBAAkB,aAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,SAAS;AACxD,CAAC;AAED,IAAM,uBAAuB,aAAE,MAAM;AAAA,EACnC,aAAE,QAAQ,KAAK;AAAA,EACf,aAAE,QAAQ,MAAM;AAAA,EAChB,aAAE,OAAO;AAAA,IACP,MAAM,aAAE,QAAQ,EAAE,SAAS;AAAA,IAC3B,UAAU,aAAE,QAAQ,EAAE,SAAS;AAAA,IAC/B,UAAU,aAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AAED,IAAM,wBAAwB,aAAE,OAAO;AAAA,EACrC,QAAQ,aAAE,OAAO;AAAA,EACjB,kBAAkB,qBAAqB,SAAS;AAClD,CAAC;AAED,IAAM,gBAAgB,aACnB,OAAO;AAAA,EACN,KAAK,mBAAmB,SAAS;AAAA,EACjC,QAAQ,sBAAsB,SAAS;AAAA,EACvC,OAAO,qBAAqB,SAAS;AAAA,EACrC,SAAS,sBAAsB,SAAS;AAC1C,CAAC,EACA,QAAQ,CAAC,CAAC;AAEb,IAAM,eAAe,aAClB,OAAO;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AACX,CAAC,EACA,QAAQ,CAAC,CAAC;AAEb,IAAM,cAAc,aAAE,OAAO,YAAY,EAAE,QAAQ,CAAC,CAAC;AAErD,IAAM,eAAe,aAAE,OAAO,WAAW,EAAE,QAAQ,CAAC,CAAC;AAG9C,IAAM,sBAAsB,aAAE,OAAO;AAAA,EAC1C,GAAG,aAAE,OAAO;AAAA,EACZ,QAAQ;AACV,CAAC;AAmDM,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EACA;AAAA,EAER,YAAY,WAAmB;AAC7B,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,QAAgB;AACvB,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,SAAS,CAAC;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,UAAU;AACR,WAAO,KAAK;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,eAKJ,CAAC;AAAA,EAEL,YAAY,YAAoB;AAC9B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,QAAgB;AACvB,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,gBAAgB;AACd,SAAK,aAAa,MAAM,CAAC;AACzB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,SAAS,cAA8B;AACrC,SAAK,aAAa,SAAS;AAAA,MACzB,eAAe,gBAAgB,CAAC;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,eAAe,MAAuB;AAEpC,SAAK,aAAa,QAAQ;AAAA,MACxB,WAAW,MAAM,aAAa,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,MAC/D,eAAe,MAAM,iBAAiB;AAAA,QACpC;AAAA,UACE,MAAM;AAAA,QACR;AAAA,MACF;AAAA,MACA,GAAG,MAAM,KAAK;AAAA,MACd,GAAG,MAAM,KAAK;AAAA,MACd,kBAAkB,MAAM,oBAAoB;AAAA,IAC9C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,iBAAiB;AACf,SAAK,cAAc;AACnB,SAAK,aAAa,UAAU,EAAE,QAAQ,WAAW,kBAAkB,MAAM;AACzE,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,UAAU;AACR,WAAO,KAAK;AAAA,EACd;AACF;AAOO,IAAM,iBAAN,MAAqD;AAAA,EAI1D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBH,QAAyB;AACvB,UAAM,eAA6C,CAAC;AAEpD,UAAM,gBAAgB,CACpB,SAcA,YACG;AACH,UAAI,mBAAmB,iBAAiB;AACtC,cAAM,cAAc,QAAQ,MAAM;AAGlC,YACE,YAAY,YAAY,UACxB,YAAY,QAAQ,SAAS,WAAW,WACxC;AACA,uBAAa,OAAO,IAAI;AAAA,YACtB,GAAG;AAAA,YACH,SAAS;AAAA,cACP,GAAG,YAAY;AAAA,cACf,SAAS;AAAA,gBACP,GAAG,YAAY,QAAQ;AAAA,gBACvB,QAAQ,GAAG,KAAK,SAAS,IAAI,OAAO;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AACL,uBAAa,OAAO,IAAI;AAAA,QAC1B;AAAA,MACF,OAAO;AACL,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,cAAI,iBAAiB,gBAAgB;AACnC,yBAAa,MAAM,QAAQ,CAAC,IAAI,MAAM,MAAM;AAAA,UAC9C,OAAO;AACL,0BAAc,OAAO,GAAG;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACpE,oBAAc,SAAS,OAAO;AAAA,IAChC;AAEA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAyFO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D;AAAC,IAAC,aAAsC,OAAO,IAAI;AAAA,EACrD;AAEA,SAAO;AACT;AAsBO,SAAS,gBAAgB,YAAoB;AAClD,SAAO,IAAI,gBAAgB,UAAU;AACvC;AAwBO,SAAS,eAAe,WAAmB;AAChD,SAAO,IAAI,eAAe,SAAS;AACrC;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/schema/index.ts"],"sourcesContent":["/**\n * Client-safe exports for `@cipherstash/stack`.\n *\n * This entry point exports types and utilities that can be used in client-side code\n * without requiring the `@cipherstash/protect-ffi` native module.\n *\n * Use this import path: `@cipherstash/stack/client`\n *\n * `EncryptionClient` is exported as a **type-only** export for use in function\n * signatures without pulling in the native FFI dependency.\n */\n\n// Schema types and utilities - client-safe\nexport { encryptedTable, encryptedColumn, encryptedField } from '@/schema'\nexport type {\n  EncryptedColumn,\n  EncryptedTable,\n  EncryptedTableColumn,\n  EncryptedField,\n  InferPlaintext,\n  InferEncrypted,\n} from '@/schema'\nexport type { EncryptionClient } from '@/encryption'\n","import type { Encrypted } from '@/types'\nimport { z } from 'zod'\n\n// ------------------------\n// Zod schemas\n// ------------------------\n\n/**\n * Allowed cast types for CipherStash schema fields.\n *\n * **Possible values:**\n * - `\"bigint\"`\n * - `\"boolean\"`\n * - `\"date\"`\n * - `\"number\"`\n * - `\"string\"`\n * - `\"json\"`\n * - `\"text\"`\n *\n * @remarks\n * This is a Zod enum used at runtime to validate schema definitions.\n * Use {@link CastAs} when typing your own code.\n *\n * @internal\n */\n/**\n * EQL cast types — the PostgreSQL-aligned types that EQL actually accepts.\n * These are stored in the `cast_as` field of the EncryptConfig.\n */\nexport const eqlCastAsEnum = z\n  .enum([\n    'text',\n    'int',\n    'small_int',\n    'big_int',\n    'real',\n    'double',\n    'boolean',\n    'date',\n    'jsonb',\n  ])\n  .default('text')\n\n/**\n * SDK-facing data types — developer-friendly aliases accepted by `dataType()`.\n */\nexport const castAsEnum = z\n  .enum(['bigint', 'boolean', 'date', 'number', 'string', 'json', 'text'])\n  .default('text')\n\n/**\n * Map SDK-facing data types to EQL `cast_as` values.\n *\n * The SDK accepts developer-friendly types like `'string'` and `'number'`,\n * but EQL expects PostgreSQL-aligned types like `'text'` and `'double'`.\n */\nexport function toEqlCastAs(value: CastAs): EqlCastAs {\n  switch (value) {\n    case 'string':\n      return 'text'\n    case 'text':\n      return 'text'\n    case 'number':\n      return 'double'\n    case 'bigint':\n      return 'big_int'\n    case 'boolean':\n      return 'boolean'\n    case 'date':\n      return 'date'\n    case 'json':\n      return 'jsonb'\n  }\n}\n\nconst tokenFilterSchema = z.object({\n  kind: z.literal('downcase'),\n})\n\nconst tokenizerSchema = z\n  .union([\n    z.object({\n      kind: z.literal('standard'),\n    }),\n    z.object({\n      kind: z.literal('ngram'),\n      token_length: z.number(),\n    }),\n  ])\n  .default({ kind: 'ngram', token_length: 3 })\n  .optional()\n\nconst oreIndexOptsSchema = z.object({})\n\nconst uniqueIndexOptsSchema = z.object({\n  token_filters: z.array(tokenFilterSchema).default([]).optional(),\n})\n\nconst matchIndexOptsSchema = z.object({\n  tokenizer: tokenizerSchema,\n  token_filters: z.array(tokenFilterSchema).default([]).optional(),\n  k: z.number().default(6).optional(),\n  m: z.number().default(2048).optional(),\n  include_original: z.boolean().default(false).optional(),\n})\n\nconst arrayIndexModeSchema = z.union([\n  z.literal('all'),\n  z.literal('none'),\n  z.object({\n    item: z.boolean().optional(),\n    wildcard: z.boolean().optional(),\n    position: z.boolean().optional(),\n  }),\n])\n\nconst steVecIndexOptsSchema = z.object({\n  prefix: z.string(),\n  array_index_mode: arrayIndexModeSchema.optional(),\n})\n\nconst indexesSchema = z\n  .object({\n    ore: oreIndexOptsSchema.optional(),\n    unique: uniqueIndexOptsSchema.optional(),\n    match: matchIndexOptsSchema.optional(),\n    ste_vec: steVecIndexOptsSchema.optional(),\n  })\n  .default({})\n\nconst columnSchema = z\n  .object({\n    cast_as: castAsEnum,\n    indexes: indexesSchema,\n  })\n  .default({})\n\nconst tableSchema = z.record(columnSchema).default({})\n\nconst tablesSchema = z.record(tableSchema).default({})\n\n/** @internal */\nexport const encryptConfigSchema = z.object({\n  v: z.number(),\n  tables: tablesSchema,\n})\n\n// ------------------------\n// Type definitions\n// ------------------------\n\n/**\n * Type-safe alias for {@link castAsEnum} used to specify the *unencrypted* data type of a column or value.\n * This is important because once encrypted, all data is stored as binary blobs.\n *\n * @see {@link castAsEnum} for possible values.\n */\nexport type CastAs = z.infer<typeof castAsEnum>\nexport type EqlCastAs = z.infer<typeof eqlCastAsEnum>\nexport type TokenFilter = z.infer<typeof tokenFilterSchema>\nexport type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>\nexport type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>\nexport type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>\nexport type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>\nexport type ColumnSchema = z.infer<typeof columnSchema>\n\n/**\n * Shape of table columns: either top-level {@link EncryptedColumn} or nested\n * objects whose leaves are {@link EncryptedField}. Used with {@link encryptedTable}.\n */\nexport type EncryptedTableColumn = {\n  [key: string]:\n    | EncryptedColumn\n    | {\n        [key: string]:\n          | EncryptedField\n          | {\n              [key: string]:\n                | EncryptedField\n                | {\n                    [key: string]: EncryptedField\n                  }\n            }\n      }\n}\nexport type EncryptConfig = z.infer<typeof encryptConfigSchema>\n\n// ------------------------\n// Interface definitions\n// ------------------------\n\n/**\n * Builder for a nested encrypted field (encrypted but not searchable).\n * Create with {@link encryptedField}. Use inside nested objects in {@link encryptedTable};\n * supports `.dataType()` for plaintext type. No index methods (equality, orderAndRange, etc.).\n */\nexport class EncryptedField {\n  private valueName: string\n  private castAsValue: CastAs\n\n  constructor(valueName: string) {\n    this.valueName = valueName\n    this.castAsValue = 'string'\n  }\n\n  /**\n   * Set or override the plaintext data type for this field.\n   *\n   * By default all values are treated as `'string'`. Use this method to specify\n   * a different type so the encryption layer knows how to encode the plaintext\n   * before encrypting.\n   *\n   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.\n   * @returns This `EncryptedField` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedField } from \"@cipherstash/stack/schema\"\n   *\n   * const age = encryptedField(\"age\").dataType(\"number\")\n   * ```\n   */\n  dataType(castAs: CastAs) {\n    this.castAsValue = castAs\n    return this\n  }\n\n  build() {\n    return {\n      cast_as: this.castAsValue,\n      indexes: {},\n    }\n  }\n\n  getName() {\n    return this.valueName\n  }\n}\n\nexport class EncryptedColumn {\n  private columnName: string\n  private castAsValue: CastAs\n  private indexesValue: {\n    ore?: OreIndexOpts\n    unique?: UniqueIndexOpts\n    match?: Required<MatchIndexOpts>\n    ste_vec?: SteVecIndexOpts\n  } = {}\n\n  constructor(columnName: string) {\n    this.columnName = columnName\n    this.castAsValue = 'string'\n  }\n\n  /**\n   * Set or override the plaintext data type for this column.\n   *\n   * By default all columns are treated as `'string'`. Use this method to specify\n   * a different type so the encryption layer knows how to encode the plaintext\n   * before encrypting.\n   *\n   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const dateOfBirth = encryptedColumn(\"date_of_birth\").dataType(\"date\")\n   * ```\n   */\n  dataType(castAs: CastAs) {\n    this.castAsValue = castAs\n    return this\n  }\n\n  /**\n   * Enable Order-Revealing Encryption (ORE) indexing on this column.\n   *\n   * ORE allows sorting, comparison, and range queries on encrypted data.\n   * Use with `encryptQuery` and `queryType: 'orderAndRange'`.\n   *\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").orderAndRange(),\n   * })\n   * ```\n   */\n  orderAndRange() {\n    this.indexesValue.ore = {}\n    return this\n  }\n\n  /**\n   * Enable an exact-match (unique) index on this column.\n   *\n   * Allows equality queries on encrypted data. Use with `encryptQuery`\n   * and `queryType: 'equality'`.\n   *\n   * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).\n   *   When omitted, no token filters are applied.\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").equality(),\n   * })\n   * ```\n   */\n  equality(tokenFilters?: TokenFilter[]) {\n    this.indexesValue.unique = {\n      token_filters: tokenFilters ?? [],\n    }\n    return this\n  }\n\n  /**\n   * Enable a full-text / fuzzy search (match) index on this column.\n   *\n   * Uses n-gram tokenization by default for substring and fuzzy matching.\n   * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.\n   *\n   * @param opts - Optional match index configuration. Defaults to 3-character ngram\n   *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").freeTextSearch(),\n   * })\n   *\n   * // With custom options\n   * const posts = encryptedTable(\"posts\", {\n   *   body: encryptedColumn(\"body\").freeTextSearch({\n   *     tokenizer: { kind: \"ngram\", token_length: 4 },\n   *     k: 8,\n   *     m: 4096,\n   *   }),\n   * })\n   * ```\n   */\n  freeTextSearch(opts?: MatchIndexOpts) {\n    // Provide defaults\n    this.indexesValue.match = {\n      tokenizer: opts?.tokenizer ?? { kind: 'ngram', token_length: 3 },\n      token_filters: opts?.token_filters ?? [\n        {\n          kind: 'downcase',\n        },\n      ],\n      k: opts?.k ?? 6,\n      m: opts?.m ?? 2048,\n      include_original: opts?.include_original ?? true,\n    }\n    return this\n  }\n\n  /**\n   * Configure this column for searchable encrypted JSON (STE-Vec).\n   *\n   * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and\n   * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the\n   * data type to `'json'`.\n   *\n   * When used with `encryptQuery`, the query operation is auto-inferred from\n   * the plaintext type: strings become selector queries, objects/arrays become\n   * containment queries.\n   *\n   * @returns This `EncryptedColumn` instance for method chaining.\n   *\n   * @example\n   * ```typescript\n   * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n   *\n   * const documents = encryptedTable(\"documents\", {\n   *   metadata: encryptedColumn(\"metadata\").searchableJson(),\n   * })\n   * ```\n   */\n  searchableJson() {\n    this.castAsValue = 'json'\n    this.indexesValue.ste_vec = { prefix: 'enabled', array_index_mode: 'all' }\n    return this\n  }\n\n  build() {\n    return {\n      cast_as: this.castAsValue,\n      indexes: this.indexesValue,\n    }\n  }\n\n  getName() {\n    return this.columnName\n  }\n}\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\nexport class EncryptedTable<T extends EncryptedTableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  /**\n   * Compile this table schema into a `TableDefinition` used internally by the encryption client.\n   *\n   * Iterates over all column builders, calls `.build()` on each, and assembles\n   * the final `{ tableName, columns }` structure. For `searchableJson()` columns,\n   * the STE-Vec prefix is automatically set to `\"<tableName>/<columnName>\"`.\n   *\n   * @returns A `TableDefinition` containing the table name and built column configs.\n   *\n   * @example\n   * ```typescript\n   * const users = encryptedTable(\"users\", {\n   *   email: encryptedColumn(\"email\").equality(),\n   * })\n   *\n   * const definition = users.build()\n   * // { tableName: \"users\", columns: { email: { cast_as: \"string\", indexes: { unique: ... } } } }\n   * ```\n   */\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n\n    const processColumn = (\n      builder:\n        | EncryptedColumn\n        | Record<\n            string,\n            | EncryptedField\n            | Record<\n                string,\n                | EncryptedField\n                | Record<\n                    string,\n                    EncryptedField | Record<string, EncryptedField>\n                  >\n              >\n          >,\n      colName: string,\n    ) => {\n      if (builder instanceof EncryptedColumn) {\n        const builtColumn = builder.build()\n\n        // Hanlde building the ste_vec index for JSON columns so users don't have to pass the prefix.\n        if (\n          builtColumn.cast_as === 'json' &&\n          builtColumn.indexes.ste_vec?.prefix === 'enabled'\n        ) {\n          builtColumns[colName] = {\n            ...builtColumn,\n            indexes: {\n              ...builtColumn.indexes,\n              ste_vec: {\n                ...builtColumn.indexes.ste_vec,\n                prefix: `${this.tableName}/${colName}`,\n              },\n            },\n          }\n        } else {\n          builtColumns[colName] = builtColumn\n        }\n      } else {\n        for (const [key, value] of Object.entries(builder)) {\n          if (value instanceof EncryptedField) {\n            builtColumns[value.getName()] = value.build()\n          } else {\n            processColumn(value, key)\n          }\n        }\n      }\n    }\n\n    for (const [colName, builder] of Object.entries(this.columnBuilders)) {\n      processColumn(builder, colName)\n    }\n\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n}\n\n// ------------------------\n// Schema type inference helpers\n// ------------------------\n\n/**\n * Infer the plaintext (decrypted) type from a EncryptedTable schema.\n *\n * @example\n * ```typescript\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n *   name: encryptedColumn(\"name\"),\n * })\n *\n * type UserPlaintext = InferPlaintext<typeof users>\n * // => { email: string; name: string }\n * ```\n */\nexport type InferPlaintext<T extends EncryptedTable<any>> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C as C[K] extends EncryptedColumn | EncryptedField\n          ? K\n          : never]: string\n      }\n    : never\n\n/**\n * Infer the encrypted type from a EncryptedTable schema.\n *\n * @example\n * ```typescript\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * type UserEncrypted = InferEncrypted<typeof users>\n * // => { email: Encrypted }\n * ```\n */\nexport type InferEncrypted<T extends EncryptedTable<any>> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C as C[K] extends EncryptedColumn | EncryptedField\n          ? K\n          : never]: Encrypted\n      }\n    : never\n\n// ------------------------\n// User facing functions\n// ------------------------\n\n/**\n * Define an encrypted table schema.\n *\n * Creates a `EncryptedTable` that maps a database table name to a set of encrypted\n * column definitions. Pass the resulting object to `Encryption({ schemas: [...] })`\n * when initializing the client.\n *\n * The returned object is also a proxy that exposes each column builder directly,\n * so you can reference columns as `users.email` when calling `encrypt`, `decrypt`,\n * and `encryptQuery`.\n *\n * @param tableName - The name of the database table this schema represents.\n * @param columns - An object whose keys are logical column names and values are\n *   {@link EncryptedColumn} from {@link encryptedColumn}, or nested objects whose\n *   leaves are {@link EncryptedField} from {@link encryptedField}.\n * @returns A `EncryptedTable<T> & T` that can be used as both a schema definition\n *   and a column accessor.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality().freeTextSearch(),\n *   address: encryptedColumn(\"address\"),\n * })\n *\n * // Use as schema\n * const client = await Encryption({ schemas: [users] })\n *\n * // Use as column accessor\n * await client.encrypt(\"hello@example.com\", { column: users.email, table: users })\n * ```\n */\nexport function encryptedTable<T extends EncryptedTableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    ;(tableBuilder as EncryptedTableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Define an encrypted column within a table schema.\n *\n * Creates a `EncryptedColumn` builder for the given column name. Chain index\n * methods (`.equality()`, `.freeTextSearch()`, `.orderAndRange()`,\n * `.searchableJson()`) and/or `.dataType()` to configure searchable encryption\n * and the plaintext data type.\n *\n * @param columnName - The name of the database column to encrypt.\n * @returns A new `EncryptedColumn` builder.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedColumn } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality().freeTextSearch().orderAndRange(),\n * })\n * ```\n */\nexport function encryptedColumn(columnName: string) {\n  return new EncryptedColumn(columnName)\n}\n\n/**\n * Define an encrypted field for use in nested or structured schemas.\n *\n * `encryptedField` is similar to {@link encryptedColumn} but creates an {@link EncryptedField}\n * for nested fields that are encrypted but not searchable (no indexes). Use `.dataType()`\n * to specify the plaintext type.\n *\n * @param valueName - The name of the value field.\n * @returns A new `EncryptedField` builder.\n *\n * @example\n * ```typescript\n * import { encryptedTable, encryptedField } from \"@cipherstash/stack/schema\"\n *\n * const orders = encryptedTable(\"orders\", {\n *   details: {\n *     amount: encryptedField(\"amount\").dataType(\"number\"),\n *     currency: encryptedField(\"currency\"),\n *   },\n * })\n * ```\n */\nexport function encryptedField(valueName: string) {\n  return new EncryptedField(valueName)\n}\n\n/**\n * Build an encrypt config from a list of encrypted tables.\n *\n * @param protectTables - The list of encrypted tables to build the config from.\n * @returns An encrypt config object.\n *\n * @example\n * ```typescript\n * import { buildEncryptConfig } from \"@cipherstash/stack/schema\"\n *\n * const users = encryptedTable(\"users\", {\n *   email: encryptedColumn(\"email\").equality(),\n * })\n *\n * const orders = encryptedTable(\"orders\", {\n *   amount: encryptedColumn(\"amount\").dataType(\"number\"),\n * })\n *\n * const config = buildEncryptConfig(users, orders)\n * console.log(config)\n * ```\n */\nexport function buildEncryptConfig(\n  ...protectTables: Array<EncryptedTable<EncryptedTableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 1,\n    tables: {},\n  }\n\n  for (const tb of protectTables) {\n    const tableDef = tb.build()\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCA,iBAAkB;AA4BX,IAAM,gBAAgB,aAC1B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,MAAM;AAKV,IAAM,aAAa,aACvB,KAAK,CAAC,UAAU,WAAW,QAAQ,UAAU,UAAU,QAAQ,MAAM,CAAC,EACtE,QAAQ,MAAM;AA2BjB,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACjC,MAAM,aAAE,QAAQ,UAAU;AAC5B,CAAC;AAED,IAAM,kBAAkB,aACrB,MAAM;AAAA,EACL,aAAE,OAAO;AAAA,IACP,MAAM,aAAE,QAAQ,UAAU;AAAA,EAC5B,CAAC;AAAA,EACD,aAAE,OAAO;AAAA,IACP,MAAM,aAAE,QAAQ,OAAO;AAAA,IACvB,cAAc,aAAE,OAAO;AAAA,EACzB,CAAC;AACH,CAAC,EACA,QAAQ,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC,EAC1C,SAAS;AAEZ,IAAM,qBAAqB,aAAE,OAAO,CAAC,CAAC;AAEtC,IAAM,wBAAwB,aAAE,OAAO;AAAA,EACrC,eAAe,aAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AACjE,CAAC;AAED,IAAM,uBAAuB,aAAE,OAAO;AAAA,EACpC,WAAW;AAAA,EACX,eAAe,aAAE,MAAM,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS;AAAA,EAC/D,GAAG,aAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClC,GAAG,aAAE,OAAO,EAAE,QAAQ,IAAI,EAAE,SAAS;AAAA,EACrC,kBAAkB,aAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,SAAS;AACxD,CAAC;AAED,IAAM,uBAAuB,aAAE,MAAM;AAAA,EACnC,aAAE,QAAQ,KAAK;AAAA,EACf,aAAE,QAAQ,MAAM;AAAA,EAChB,aAAE,OAAO;AAAA,IACP,MAAM,aAAE,QAAQ,EAAE,SAAS;AAAA,IAC3B,UAAU,aAAE,QAAQ,EAAE,SAAS;AAAA,IAC/B,UAAU,aAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AAED,IAAM,wBAAwB,aAAE,OAAO;AAAA,EACrC,QAAQ,aAAE,OAAO;AAAA,EACjB,kBAAkB,qBAAqB,SAAS;AAClD,CAAC;AAED,IAAM,gBAAgB,aACnB,OAAO;AAAA,EACN,KAAK,mBAAmB,SAAS;AAAA,EACjC,QAAQ,sBAAsB,SAAS;AAAA,EACvC,OAAO,qBAAqB,SAAS;AAAA,EACrC,SAAS,sBAAsB,SAAS;AAC1C,CAAC,EACA,QAAQ,CAAC,CAAC;AAEb,IAAM,eAAe,aAClB,OAAO;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AACX,CAAC,EACA,QAAQ,CAAC,CAAC;AAEb,IAAM,cAAc,aAAE,OAAO,YAAY,EAAE,QAAQ,CAAC,CAAC;AAErD,IAAM,eAAe,aAAE,OAAO,WAAW,EAAE,QAAQ,CAAC,CAAC;AAG9C,IAAM,sBAAsB,aAAE,OAAO;AAAA,EAC1C,GAAG,aAAE,OAAO;AAAA,EACZ,QAAQ;AACV,CAAC;AAmDM,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EACA;AAAA,EAER,YAAY,WAAmB;AAC7B,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,QAAgB;AACvB,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,SAAS,CAAC;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,UAAU;AACR,WAAO,KAAK;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,eAKJ,CAAC;AAAA,EAEL,YAAY,YAAoB;AAC9B,SAAK,aAAa;AAClB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,SAAS,QAAgB;AACvB,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,gBAAgB;AACd,SAAK,aAAa,MAAM,CAAC;AACzB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,SAAS,cAA8B;AACrC,SAAK,aAAa,SAAS;AAAA,MACzB,eAAe,gBAAgB,CAAC;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,eAAe,MAAuB;AAEpC,SAAK,aAAa,QAAQ;AAAA,MACxB,WAAW,MAAM,aAAa,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,MAC/D,eAAe,MAAM,iBAAiB;AAAA,QACpC;AAAA,UACE,MAAM;AAAA,QACR;AAAA,MACF;AAAA,MACA,GAAG,MAAM,KAAK;AAAA,MACd,GAAG,MAAM,KAAK;AAAA,MACd,kBAAkB,MAAM,oBAAoB;AAAA,IAC9C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,iBAAiB;AACf,SAAK,cAAc;AACnB,SAAK,aAAa,UAAU,EAAE,QAAQ,WAAW,kBAAkB,MAAM;AACzE,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,UAAU;AACR,WAAO,KAAK;AAAA,EACd;AACF;AAOO,IAAM,iBAAN,MAAqD;AAAA,EAI1D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBlB,QAAyB;AACvB,UAAM,eAA6C,CAAC;AAEpD,UAAM,gBAAgB,CACpB,SAcA,YACG;AACH,UAAI,mBAAmB,iBAAiB;AACtC,cAAM,cAAc,QAAQ,MAAM;AAGlC,YACE,YAAY,YAAY,UACxB,YAAY,QAAQ,SAAS,WAAW,WACxC;AACA,uBAAa,OAAO,IAAI;AAAA,YACtB,GAAG;AAAA,YACH,SAAS;AAAA,cACP,GAAG,YAAY;AAAA,cACf,SAAS;AAAA,gBACP,GAAG,YAAY,QAAQ;AAAA,gBACvB,QAAQ,GAAG,KAAK,SAAS,IAAI,OAAO;AAAA,cACtC;AAAA,YACF;AAAA,UACF;AAAA,QACF,OAAO;AACL,uBAAa,OAAO,IAAI;AAAA,QAC1B;AAAA,MACF,OAAO;AACL,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,cAAI,iBAAiB,gBAAgB;AACnC,yBAAa,MAAM,QAAQ,CAAC,IAAI,MAAM,MAAM;AAAA,UAC9C,OAAO;AACL,0BAAc,OAAO,GAAG;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,CAAC,SAAS,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACpE,oBAAc,SAAS,OAAO;AAAA,IAChC;AAEA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAyFO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D;AAAC,IAAC,aAAsC,OAAO,IAAI;AAAA,EACrD;AAEA,SAAO;AACT;AAsBO,SAAS,gBAAgB,YAAoB;AAClD,SAAO,IAAI,gBAAgB,UAAU;AACvC;AAwBO,SAAS,eAAe,WAAmB;AAChD,SAAO,IAAI,eAAe,SAAS;AACrC;","names":[]}

package/dist/client.d.cts

@@ -1,5 +1,5 @@
-export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-Dv-r6Ik0.cjs';
-export { a as EncryptionClient } from './client-C_7TF8EL.cjs';
+export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-BTxqjmtv.cjs';
+export { a as EncryptionClient } from './client-Dt98Rugc.cjs';
 import 'zod';
 import '@cipherstash/protect-ffi';
 import './errors/index.cjs';

package/dist/client.d.ts

@@ -1,5 +1,5 @@
-export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-Dv-r6Ik0.js';
-export { a as EncryptionClient } from './client-BLbA6aFD.js';
+export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-BTxqjmtv.js';
+export { a as EncryptionClient } from './client-CIsfZ2zg.js';
 import 'zod';
 import '@cipherstash/protect-ffi';
 import './errors/index.js';

package/dist/client.js

@@ -2,7 +2,7 @@ import {
   encryptedColumn,
   encryptedField,
   encryptedTable
-} from "./chunk-JDZ2QUUF.js";
+} from "./chunk-YWQXTZ5M.js";
 export {
   encryptedColumn,
   encryptedField,

package/dist/drizzle/index.cjs

@@ -293,6 +293,8 @@ var EncryptedTable = class {
     this.tableName = tableName;
     this.columnBuilders = columnBuilders;
   }
+  tableName;
+  columnBuilders;
   /**
    * Compile this table schema into a `TableDefinition` used internally by the encryption client.
    *
@@ -367,7 +369,7 @@ function encryptedColumn(columnName) {
 
 // src/drizzle/schema-extraction.ts
 function extractEncryptionSchema(table) {
-  const tableName = table[Symbol.for("drizzle:Name")];
+  const tableName = table[/* @__PURE__ */ Symbol.for("drizzle:Name")];
   if (!tableName) {
     throw new Error(
       "Unable to extract table name from Drizzle table. Ensure you are using a table created with pgTable()."
@@ -438,7 +440,7 @@ function isSQLWrapper(value) {
   return typeof value === "object" && value !== null && "sql" in value && typeof value.sql !== "undefined";
 }
 function isPgTable(value) {
-  return typeof value === "object" && value !== null && Symbol.for("drizzle:Name") in value;
+  return typeof value === "object" && value !== null && /* @__PURE__ */ Symbol.for("drizzle:Name") in value;
 }
 var EncryptionOperatorError = class extends Error {
   constructor(message, context) {
@@ -446,6 +448,7 @@ var EncryptionOperatorError = class extends Error {
     this.context = context;
     this.name = "EncryptionOperatorError";
   }
+  context;
 };
 var EncryptionConfigError = class extends EncryptionOperatorError {
   constructor(message, context) {
@@ -458,7 +461,7 @@ function getDrizzleTableName(drizzleTable) {
     return void 0;
   }
   const tableWithSymbol = drizzleTable;
-  return tableWithSymbol[Symbol.for("drizzle:Name")];
+  return tableWithSymbol[/* @__PURE__ */ Symbol.for("drizzle:Name")];
 }
 function getDrizzleTableFromColumn(drizzleColumn) {
   const column = drizzleColumn;