@cipherstash/stack 0.16.0 → 0.19.0

package/dist/{chunk-CY5B4LIF.js → chunk-36AA7IBJ.js}

@@ -1,26 +1,31 @@
+import {
+  resolveLockContext
+} from "./chunk-OFQ555AX.js";
 import {
   formatEncryptedResult,
   isEncryptedPayload,
   toFfiKeysetIdentifier
-} from "./chunk-4RNBI3UH.js";
+} from "./chunk-BNO32ZMV.js";
 import {
   buildEncryptConfig,
   encryptConfigSchema
-} from "./chunk-JDZ2QUUF.js";
+} from "./chunk-MP3SSDNN.js";
 import {
   queryTypeToFfi,
   queryTypeToQueryOp
-} from "./chunk-MD6742R6.js";
+} from "./chunk-4AVL4VZD.js";
+import {
+  withResult
+} from "./chunk-JSG2AMDI.js";
 import {
   createRequestLogger,
   logger
-} from "./chunk-6FD7OBGM.js";
+} from "./chunk-HQANMV7R.js";
 import {
   EncryptionErrorTypes
 } from "./chunk-LBMC4D6D.js";
 
 // src/encryption/index.ts
-import { withResult as withResult11 } from "@byteslice/result";
 import { newClient } from "@cipherstash/protect-ffi";
 
 // ../../node_modules/.pnpm/uuid@14.0.0/node_modules/uuid/dist-node/regex.js
@@ -37,6 +42,11 @@ function isScalarQueryTermArray(value) {
   return Array.isArray(value) && value.length > 0 && typeof value[0] === "object" && value[0] !== null && "column" in value[0] && "table" in value[0];
 }
 
+// src/encryption/operations/batch-encrypt-query.ts
+import {
+  encryptQueryBulk as ffiEncryptQueryBulk
+} from "@cipherstash/protect-ffi";
+
 // src/encryption/helpers/error-code.ts
 import {
   ProtectError as FfiProtectError
@@ -45,12 +55,6 @@ function getErrorCode(error) {
   return error instanceof FfiProtectError ? error.code : void 0;
 }
 
-// src/encryption/operations/batch-encrypt-query.ts
-import { withResult } from "@byteslice/result";
-import {
-  encryptQueryBulk as ffiEncryptQueryBulk
-} from "@cipherstash/protect-ffi";
-
 // src/encryption/helpers/infer-index-type.ts
 function inferIndexType(column) {
   const config = column.build();
@@ -70,7 +74,7 @@ function inferQueryOpFromPlaintext(plaintext) {
   if (typeof plaintext === "string") {
     return "ste_vec_selector";
   }
-  if (typeof plaintext === "object" || typeof plaintext === "number" || typeof plaintext === "boolean" || typeof plaintext === "bigint") {
+  if (typeof plaintext === "object" || typeof plaintext === "number" || typeof plaintext === "boolean") {
     return "ste_vec_term";
   }
   return "ste_vec_term";
@@ -90,9 +94,18 @@ function validateIndexType(column, indexType) {
     );
   }
 }
+function resolvesEqualityViaOre(column) {
+  if (!("getQueryCapabilities" in column)) return false;
+  if (!column.getQueryCapabilities().equality) return false;
+  const indexes = column.build().indexes ?? {};
+  return !indexes.unique && !!indexes.ore;
+}
 function resolveIndexType(column, queryType, plaintext) {
   const indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
   if (queryType) {
+    if (queryType === "equality" && resolvesEqualityViaOre(column)) {
+      return { indexType: "ore" };
+    }
     validateIndexType(column, indexType);
     if (queryType === "searchableJson") {
       if (plaintext === void 0 || plaintext === null) {
@@ -176,6 +189,15 @@ var EncryptionOperation = class {
 };
 
 // src/encryption/operations/batch-encrypt-query.ts
+function filterNullTerms(terms) {
+  const nonNullTerms = [];
+  terms.forEach((term, index) => {
+    if (term.value !== null && term.value !== void 0) {
+      nonNullTerms.push({ term, originalIndex: index });
+    }
+  });
+  return { nonNullTerms };
+}
 function buildQueryPayload(term, lockContext) {
   assertValidNumericValue(term.value);
   const { indexType, queryOp } = resolveIndexType(
@@ -196,10 +218,15 @@ function buildQueryPayload(term, lockContext) {
   }
   return payload;
 }
-function assembleResults(terms, encryptedValues) {
-  return terms.map(
-    (term, i) => formatEncryptedResult(encryptedValues[i], term.returnType)
-  );
+function assembleResults(totalLength, encryptedValues, nonNullTerms) {
+  const results = new Array(totalLength).fill(null);
+  nonNullTerms.forEach(({ term, originalIndex }, i) => {
+    results[originalIndex] = formatEncryptedResult(
+      encryptedValues[i],
+      term.returnType
+    );
+  });
+  return results;
 }
 var BatchEncryptQueryOperation = class extends EncryptionOperation {
   constructor(client, terms) {
@@ -207,6 +234,8 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
     this.client = client;
     this.terms = terms;
   }
+  client;
+  terms;
   withLockContext(lockContext) {
     return new BatchEncryptQueryOperationWithLockContext(
       this.client,
@@ -226,18 +255,23 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { data: [] };
     }
+    const { nonNullTerms } = filterNullTerms(this.terms);
+    if (nonNullTerms.length === 0) {
+      log.emit();
+      return { data: this.terms.map(() => null) };
+    }
     const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = this.terms.map(
-          (term) => buildQueryPayload(term)
+        const queries = nonNullTerms.map(
+          ({ term }) => buildQueryPayload(term)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms, encrypted);
+        return assembleResults(this.terms.length, encrypted, nonNullTerms);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -260,6 +294,9 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
     this.lockContext = lockContext;
     this.auditMetadata = auditMetadata;
   }
+  client;
+  terms;
+  lockContext;
   async execute() {
     const log = createRequestLogger();
     log.set({
@@ -271,25 +308,24 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: [] };
     }
-    const lockContextResult = await this.lockContext.getLockContext();
-    if (lockContextResult.failure) {
+    const { nonNullTerms } = filterNullTerms(this.terms);
+    if (nonNullTerms.length === 0) {
       log.emit();
-      return { failure: lockContextResult.failure };
+      return { data: this.terms.map(() => null) };
     }
-    const { ctsToken, context } = lockContextResult.data;
     const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
         const { metadata } = this.getAuditData();
-        const queries = this.terms.map(
-          (term) => buildQueryPayload(term, context)
+        const queries = nonNullTerms.map(
+          ({ term }) => buildQueryPayload(term, context)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
-          serviceToken: ctsToken,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms, encrypted);
+        return assembleResults(this.terms.length, encrypted, nonNullTerms);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -306,30 +342,34 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/bulk-decrypt.ts
-import { withResult as withResult2 } from "@byteslice/result";
 import {
   decryptBulkFallible
 } from "@cipherstash/protect-ffi";
 var createDecryptPayloads = (encryptedPayloads, lockContext) => {
-  return encryptedPayloads.map(({ id, data }) => ({
+  return encryptedPayloads.filter(({ data }) => data !== null).map(({ id, data }) => ({
     id,
     ciphertext: data,
     ...lockContext && { lockContext }
   }));
 };
+var createNullResult = (encryptedPayloads) => encryptedPayloads.map(({ id }) => ({ id, data: null }));
 var mapDecryptedDataToResult = (encryptedPayloads, decryptedData) => {
-  return decryptedData.map((decryptResult, i) => {
-    if ("error" in decryptResult) {
-      return {
-        id: encryptedPayloads[i].id,
-        error: decryptResult.error
-      };
+  const result = new Array(encryptedPayloads.length);
+  let decryptedIndex = 0;
+  for (let i = 0; i < encryptedPayloads.length; i++) {
+    if (encryptedPayloads[i].data === null) {
+      result[i] = { id: encryptedPayloads[i].id, data: null };
+    } else {
+      const decryptResult = decryptedData[decryptedIndex];
+      if ("error" in decryptResult) {
+        result[i] = { id: encryptedPayloads[i].id, error: decryptResult.error };
+      } else {
+        result[i] = { id: encryptedPayloads[i].id, data: decryptResult.data };
+      }
+      decryptedIndex++;
     }
-    return {
-      id: encryptedPayloads[i].id,
-      data: decryptResult.data
-    };
-  });
+  }
+  return result;
 };
 var BulkDecryptOperation = class extends EncryptionOperation {
   client;
@@ -349,15 +389,18 @@ var BulkDecryptOperation = class extends EncryptionOperation {
       count: this.encryptedPayloads?.length ?? 0,
       lockContext: false
     });
-    const result = await withResult2(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
           return [];
-        const payloads = createDecryptPayloads(this.encryptedPayloads);
+        const nonNullPayloads = createDecryptPayloads(this.encryptedPayloads);
+        if (nonNullPayloads.length === 0) {
+          return createNullResult(this.encryptedPayloads);
+        }
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(this.client, {
-          ciphertexts: payloads,
+          ciphertexts: nonNullPayloads,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(this.encryptedPayloads, decryptedData);
@@ -401,22 +444,21 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
       count: encryptedPayloads?.length ?? 0,
       lockContext: true
     });
-    const result = await withResult2(
+    const result = await withResult(
       async () => {
         if (!client) throw noClientError();
         if (!encryptedPayloads || encryptedPayloads.length === 0) return [];
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
-        const payloads = createDecryptPayloads(
+        const lockContext = resolveLockContext(this.lockContext);
+        const nonNullPayloads = createDecryptPayloads(
           encryptedPayloads,
-          context.data.context
+          lockContext
         );
+        if (nonNullPayloads.length === 0) {
+          return createNullResult(encryptedPayloads);
+        }
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(client, {
-          ciphertexts: payloads,
-          serviceToken: context.data.ctsToken,
+          ciphertexts: nonNullPayloads,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(encryptedPayloads, decryptedData);
@@ -435,9 +477,6 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/operations/bulk-decrypt-models.ts
-import { withResult as withResult3 } from "@byteslice/result";
-
 // src/encryption/helpers/model-helpers.ts
 import {
   decryptBulk,
@@ -519,6 +558,17 @@ function prepareFieldsForDecryption(model) {
   processNestedFields(model);
   return { otherFields, operationFields, keyMap, nullFields };
 }
+function resolveEncryptColumnMap(table) {
+  const keyMap = table.buildColumnKeyMap?.();
+  if (keyMap) {
+    return {
+      columnPaths: Object.keys(keyMap),
+      toColumnName: (path) => keyMap[path] ?? path
+    };
+  }
+  const columnPaths = Object.keys(table.build().columns);
+  return { columnPaths, toColumnName: (path) => path };
+}
 function prepareFieldsForEncryption(model, table) {
   const otherFields = { ...model };
   const operationFields = {};
@@ -554,7 +604,7 @@ function prepareFieldsForEncryption(model, table) {
       }
     }
   };
-  const columnPaths = Object.keys(table.build().columns);
+  const { columnPaths } = resolveEncryptColumnMap(table);
   processNestedFields(model, "", columnPaths);
   return { otherFields, operationFields, keyMap, nullFields };
 }
@@ -593,12 +643,13 @@ async function encryptModelFields(model, table, client, auditData) {
     throw new Error("Client not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareFieldsForEncryption(model, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = Object.entries(operationFields).map(
     ([key, value]) => ({
       id: key,
       plaintext: value,
       table: table.tableName,
-      column: key
+      column: toColumnName(key)
     })
   );
   const encryptedData = await handleSingleModelBulkOperation(
@@ -632,14 +683,13 @@ async function decryptModelFieldsWithLockContext(model, client, lockContext, aud
     ([key, value]) => ({
       id: key,
       ciphertext: value,
-      lockContext: lockContext.context
+      lockContext
     })
   );
   const decryptedFields = await handleSingleModelBulkOperation(
     bulkDecryptPayload,
     (items) => decryptBulk(client, {
       ciphertexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -663,20 +713,20 @@ async function encryptModelFieldsWithLockContext(model, table, client, lockConte
     throw new Error("Lock context is not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareFieldsForEncryption(model, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = Object.entries(operationFields).map(
     ([key, value]) => ({
       id: key,
       plaintext: value,
       table: table.tableName,
-      column: key,
-      lockContext: lockContext.context
+      column: toColumnName(key),
+      lockContext
     })
   );
   const encryptedData = await handleSingleModelBulkOperation(
     bulkEncryptPayload,
     (items) => encryptBulk(client, {
       plaintexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -733,7 +783,7 @@ function prepareBulkModelsForOperation(models, table) {
       }
     };
     if (table) {
-      const columnPaths = Object.keys(table.build().columns);
+      const { columnPaths } = resolveEncryptColumnMap(table);
       processNestedFields(model, "", columnPaths);
     } else {
       const processEncryptedFields = (obj, prefix = "", columnPaths = []) => {
@@ -771,6 +821,15 @@ function prepareBulkModelsForOperation(models, table) {
   }
   return { otherFields, operationFields, keyMap, nullFields };
 }
+function fieldsForModelIndex(fields, modelIndex) {
+  const result = {};
+  for (const [id, value] of Object.entries(fields)) {
+    const sep = id.indexOf("-");
+    if (Number.parseInt(id.slice(0, sep), 10) !== modelIndex) continue;
+    result[id.slice(sep + 1)] = value;
+  }
+  return result;
+}
 async function bulkEncryptModels(models, table, client, auditData) {
   if (!client) {
     throw new Error("Client not initialized");
@@ -779,12 +838,13 @@ async function bulkEncryptModels(models, table, client, auditData) {
     return [];
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareBulkModelsForOperation(models, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = operationFields.flatMap(
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       plaintext: value,
       table: table.tableName,
-      column: key
+      column: toColumnName(key)
     }))
   );
   const encryptedData = await handleMultiModelBulkOperation(
@@ -801,15 +861,7 @@ async function bulkEncryptModels(models, table, client, auditData) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(encryptedData).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(encryptedData, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -845,15 +897,7 @@ async function bulkDecryptModels(models, client, auditData) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(decryptedFields).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(decryptedFields, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -873,14 +917,13 @@ async function bulkDecryptModelsWithLockContext(models, client, lockContext, aud
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       ciphertext: value,
-      lockContext: lockContext.context
+      lockContext
     }))
   );
   const decryptedFields = await handleMultiModelBulkOperation(
     bulkDecryptPayload,
     (items) => decryptBulk(client, {
       ciphertexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -891,15 +934,7 @@ async function bulkDecryptModelsWithLockContext(models, client, lockContext, aud
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(decryptedFields).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(decryptedFields, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -915,20 +950,20 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
     throw new Error("Lock context is not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareBulkModelsForOperation(models, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = operationFields.flatMap(
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       plaintext: value,
       table: table.tableName,
-      column: key,
-      lockContext: lockContext.context
+      column: toColumnName(key),
+      lockContext
     }))
   );
   const encryptedData = await handleMultiModelBulkOperation(
     bulkEncryptPayload,
     (items) => encryptBulk(client, {
       plaintexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -939,15 +974,7 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(encryptedData).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(encryptedData, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -975,7 +1002,7 @@ var BulkDecryptModelsOperation = class extends EncryptionOperation {
       count: this.models.length,
       lockContext: false
     });
-    const result = await withResult3(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1022,20 +1049,17 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
       count: models.length,
       lockContext: true
     });
-    const result = await withResult3(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await bulkDecryptModelsWithLockContext(
           models,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1054,10 +1078,9 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/bulk-encrypt.ts
-import { withResult as withResult4 } from "@byteslice/result";
 import { encryptBulk as encryptBulk2 } from "@cipherstash/protect-ffi";
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.map(({ id, plaintext }) => ({
+  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
     id,
     plaintext,
     column: column.getName(),
@@ -1065,6 +1088,20 @@ var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
     ...lockContext && { lockContext }
   }));
 };
+var createNullResult2 = (plaintexts) => plaintexts.map(({ id }) => ({ id, data: null }));
+var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
+  const result = new Array(plaintexts.length);
+  let encryptedIndex = 0;
+  for (let i = 0; i < plaintexts.length; i++) {
+    if (plaintexts[i].plaintext === null) {
+      result[i] = { id: plaintexts[i].id, data: null };
+    } else {
+      result[i] = { id: plaintexts[i].id, data: encryptedData[encryptedIndex] };
+      encryptedIndex++;
+    }
+  }
+  return result;
+};
 var BulkEncryptOperation = class extends EncryptionOperation {
   client;
   plaintexts;
@@ -1089,7 +1126,7 @@ var BulkEncryptOperation = class extends EncryptionOperation {
       count: this.plaintexts?.length ?? 0,
       lockContext: false
     });
-    const result = await withResult4(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1097,20 +1134,20 @@ var BulkEncryptOperation = class extends EncryptionOperation {
         if (!this.plaintexts || this.plaintexts.length === 0) {
           return [];
         }
-        const payloads = createEncryptPayloads(
+        const nonNullPayloads = createEncryptPayloads(
           this.plaintexts,
           this.column,
           this.table
         );
+        if (nonNullPayloads.length === 0) {
+          return createNullResult2(this.plaintexts);
+        }
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(this.client, {
-          plaintexts: payloads,
+          plaintexts: nonNullPayloads,
           unverifiedContext: metadata
         });
-        return encryptedData.map((data, i) => ({
-          id: this.plaintexts[i].id,
-          data
-        }));
+        return mapEncryptedDataToResult(this.plaintexts, encryptedData);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1155,7 +1192,7 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
       count: plaintexts?.length ?? 0,
       lockContext: true
     });
-    const result = await withResult4(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
@@ -1163,26 +1200,22 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!plaintexts || plaintexts.length === 0) {
           return [];
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
-        const payloads = createEncryptPayloads(
+        const lockContext = resolveLockContext(this.lockContext);
+        const nonNullPayloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
-          context.data.context
+          lockContext
         );
+        if (nonNullPayloads.length === 0) {
+          return createNullResult2(plaintexts);
+        }
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(client, {
-          plaintexts: payloads,
-          serviceToken: context.data.ctsToken,
+          plaintexts: nonNullPayloads,
           unverifiedContext: metadata
         });
-        return encryptedData.map((data, i) => ({
-          id: plaintexts[i].id,
-          data
-        }));
+        return mapEncryptedDataToResult(plaintexts, encryptedData);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1199,7 +1232,6 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/bulk-encrypt-models.ts
-import { withResult as withResult5 } from "@byteslice/result";
 var BulkEncryptModelsOperation = class extends EncryptionOperation {
   client;
   models;
@@ -1221,7 +1253,7 @@ var BulkEncryptModelsOperation = class extends EncryptionOperation {
       count: this.models.length,
       lockContext: false
     });
-    const result = await withResult5(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1275,21 +1307,18 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
       count: models.length,
       lockContext: true
     });
-    const result = await withResult5(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await bulkEncryptModelsWithLockContext(
           models,
           table,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1308,12 +1337,15 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/decrypt.ts
-import { withResult as withResult6 } from "@byteslice/result";
 import {
   decrypt as ffiDecrypt
 } from "@cipherstash/protect-ffi";
 var DecryptOperation = class extends EncryptionOperation {
   client;
+  // Internally widened to allow null so the runtime guard below can
+  // short-circuit on legacy / manually-NULLed rows. The public
+  // `Encryption.decrypt()` signature still rejects null at the type
+  // layer; this is defense in depth for direct construction.
   encryptedData;
   constructor(client, encryptedData) {
     super();
@@ -1329,11 +1361,14 @@ var DecryptOperation = class extends EncryptionOperation {
       op: "decrypt",
       lockContext: false
     });
-    const result = await withResult6(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
         }
+        if (this.encryptedData === null) {
+          return null;
+        }
         const { metadata } = this.getAuditData();
         return await ffiDecrypt(this.client, {
           ciphertext: this.encryptedData,
@@ -1378,22 +1413,21 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
       op: "decrypt",
       lockContext: true
     });
-    const result = await withResult6(
+    const result = await withResult(
       async () => {
         const { client, encryptedData } = this.operation.getOperation();
         if (!client) {
           throw noClientError();
         }
-        const { metadata } = this.getAuditData();
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
+        if (encryptedData === null) {
+          return null;
         }
+        const { metadata } = this.getAuditData();
+        const lockContext = resolveLockContext(this.lockContext);
         return await ffiDecrypt(client, {
           ciphertext: encryptedData,
           unverifiedContext: metadata,
-          lockContext: context.data.context,
-          serviceToken: context.data.ctsToken
+          lockContext
         });
       },
       (error) => {
@@ -1411,7 +1445,6 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/decrypt-model.ts
-import { withResult as withResult7 } from "@byteslice/result";
 var DecryptModelOperation = class extends EncryptionOperation {
   client;
   model;
@@ -1429,7 +1462,7 @@ var DecryptModelOperation = class extends EncryptionOperation {
       op: "decryptModel",
       lockContext: false
     });
-    const result = await withResult7(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1474,21 +1507,18 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
       op: "decryptModel",
       lockContext: true
     });
-    const result = await withResult7(
+    const result = await withResult(
       async () => {
         const { client, model } = this.operation.getOperation();
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await decryptModelFieldsWithLockContext(
           model,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1507,12 +1537,15 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt.ts
-import { withResult as withResult8 } from "@byteslice/result";
 import {
   encrypt as ffiEncrypt
 } from "@cipherstash/protect-ffi";
 var EncryptOperation = class extends EncryptionOperation {
   client;
+  // Internally widened to allow null so the runtime guard below can
+  // short-circuit. The public `Encryption.encrypt()` signature still
+  // rejects null at the type layer; this is defense in depth for callers
+  // that reach this class through casts or dynamic field walking.
   plaintext;
   column;
   table;
@@ -1534,19 +1567,20 @@ var EncryptOperation = class extends EncryptionOperation {
       column: this.column.getName(),
       lockContext: false
     });
-    const result = await withResult8(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
         }
-        if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
-          throw new Error("[encryption]: Cannot encrypt NaN value");
-        }
-        if (typeof this.plaintext === "number" && !Number.isFinite(this.plaintext)) {
-          throw new Error("[encryption]: Cannot encrypt Infinity value");
+        if (this.plaintext === null) {
+          return null;
         }
+        assertValidNumericValue(this.plaintext);
         const { metadata } = this.getAuditData();
         return await ffiEncrypt(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream `JsPlaintext` input
+          // union is corrected to include it.
           plaintext: this.plaintext,
           column: this.column.getName(),
           table: this.table.tableName,
@@ -1595,22 +1629,22 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
       column: column.getName(),
       lockContext: true
     });
-    const result = await withResult8(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const { metadata } = this.getAuditData();
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
+        if (plaintext === null) {
+          return null;
         }
+        assertValidNumericValue(plaintext);
+        const { metadata } = this.getAuditData();
+        const lockContext = resolveLockContext(this.lockContext);
         return await ffiEncrypt(client, {
           plaintext,
           column: column.getName(),
           table: table.tableName,
-          lockContext: context.data.context,
-          serviceToken: context.data.ctsToken,
+          lockContext,
           unverifiedContext: metadata
         });
       },
@@ -1629,7 +1663,6 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt-model.ts
-import { withResult as withResult9 } from "@byteslice/result";
 var EncryptModelOperation = class extends EncryptionOperation {
   client;
   model;
@@ -1650,7 +1683,7 @@ var EncryptModelOperation = class extends EncryptionOperation {
       table: this.table.tableName,
       lockContext: false
     });
-    const result = await withResult9(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1703,21 +1736,18 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
       table: table.tableName,
       lockContext: true
     });
-    const result = await withResult9(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await encryptModelFieldsWithLockContext(
           model,
           table,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1736,7 +1766,6 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt-query.ts
-import { withResult as withResult10 } from "@byteslice/result";
 import {
   encryptQuery as ffiEncryptQuery
 } from "@cipherstash/protect-ffi";
@@ -1747,6 +1776,9 @@ var EncryptQueryOperation = class extends EncryptionOperation {
     this.plaintext = plaintext;
     this.opts = opts;
   }
+  client;
+  plaintext;
+  opts;
   withLockContext(lockContext) {
     return new EncryptQueryOperationWithLockContext(
       this.client,
@@ -1765,27 +1797,35 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: false
     });
-    const validationError = validateNumericValue(this.plaintext);
+    if (this.plaintext === null || this.plaintext === void 0) {
+      log.emit();
+      return { data: null };
+    }
+    const plaintext = this.plaintext;
+    const validationError = validateNumericValue(plaintext);
     if (validationError?.failure) {
       log.emit();
       return { failure: validationError.failure };
     }
-    const result = await withResult10(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
         const { indexType, queryOp } = resolveIndexType(
           this.opts.column,
           this.opts.queryType,
-          this.plaintext
+          plaintext
         );
         assertValueIndexCompatibility(
-          this.plaintext,
+          plaintext,
           indexType,
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
-          plaintext: this.plaintext,
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
+          plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
           indexType,
@@ -1819,6 +1859,10 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
     this.lockContext = lockContext;
     this.auditMetadata = auditMetadata;
   }
+  client;
+  plaintext;
+  opts;
+  lockContext;
   async execute() {
     const log = createRequestLogger();
     log.set({
@@ -1828,39 +1872,41 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: true
     });
-    const validationError = validateNumericValue(this.plaintext);
-    if (validationError?.failure) {
+    if (this.plaintext === null || this.plaintext === void 0) {
       log.emit();
-      return { failure: validationError.failure };
+      return { data: null };
     }
-    const lockContextResult = await this.lockContext.getLockContext();
-    if (lockContextResult.failure) {
+    const plaintext = this.plaintext;
+    const validationError = validateNumericValue(plaintext);
+    if (validationError?.failure) {
       log.emit();
-      return { failure: lockContextResult.failure };
+      return { failure: validationError.failure };
     }
-    const { ctsToken, context } = lockContextResult.data;
-    const result = await withResult10(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
         const { metadata } = this.getAuditData();
         const { indexType, queryOp } = resolveIndexType(
           this.opts.column,
           this.opts.queryType,
-          this.plaintext
+          plaintext
         );
         assertValueIndexCompatibility(
-          this.plaintext,
+          plaintext,
           indexType,
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
-          plaintext: this.plaintext,
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
+          plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
           indexType,
           queryOp,
           lockContext: context,
-          serviceToken: ctsToken,
           unverifiedContext: metadata
         });
         return formatEncryptedResult(encrypted, this.opts.returnType);
@@ -1883,6 +1929,20 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
 var noClientError = () => new Error(
   "The Encryption client has not been initialized. Please call init() before using the client."
 );
+function resolveEqlVersion(schemas, explicit) {
+  const v3Count = schemas.filter(
+    (schema) => typeof schema.buildColumnKeyMap === "function"
+  ).length;
+  if (v3Count > 0 && v3Count < schemas.length) {
+    throw new Error(
+      "[encryption]: cannot mix EQL v2 and EQL v3 tables in one client \u2014 one client emits exactly one wire format. Create separate clients for the v2 and v3 schemas."
+    );
+  }
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  return v3Count === 0 ? void 0 : 3;
+}
 var EncryptionClient = class {
   client;
   encryptConfig;
@@ -1893,7 +1953,7 @@ var EncryptionClient = class {
    * @returns A promise that resolves to a {@link Result} containing the initialized EncryptionClient or an {@link EncryptionError}.
    **/
   async init(config) {
-    return await withResult11(
+    return await withResult(
       async () => {
         const validated = encryptConfigSchema.parse(
           config.encryptConfig
@@ -1912,7 +1972,9 @@ var EncryptionClient = class {
             clientId: config.clientId,
             clientKey: config.clientKey,
             keyset: toFfiKeysetIdentifier(config.keyset)
-          }
+          },
+          strategy: config.authStrategy,
+          eqlVersion: config.eqlVersion
         });
         this.encryptConfig = validated;
         logger.debug("Successfully initialized the Encryption client.");
@@ -2003,7 +2065,7 @@ var EncryptionClient = class {
     return new EncryptOperation(this.client, plaintext, opts);
   }
   encryptQuery(plaintextOrTerms, opts) {
-    if (isScalarQueryTermArray(plaintextOrTerms)) {
+    if (!opts && isScalarQueryTermArray(plaintextOrTerms)) {
       return new BatchEncryptQueryOperation(this.client, plaintextOrTerms);
     }
     if (Array.isArray(plaintextOrTerms) && plaintextOrTerms.length === 0 && !opts) {
@@ -2050,6 +2112,13 @@ var EncryptionClient = class {
    *      .withLockContext(lockContext)
    * ```
    *
+   * @remarks
+   * The public input type rejects null, but at runtime `decrypt` will
+   * short-circuit and return null when given a null ciphertext
+   * (defense in depth for legacy / manually-NULLed DB rows reached via
+   * casts or dynamic field walking). The narrow return type holds for
+   * any caller that respects the input contract.
+   *
    * @see {@link LockContext}
    * @see {@link DecryptOperation}
    */
@@ -2304,6 +2373,17 @@ var EncryptionClient = class {
     return this.encryptConfig;
   }
 };
+var warnedStrategyDeprecated = false;
+function warnStrategyDeprecated() {
+  if (warnedStrategyDeprecated) return;
+  warnedStrategyDeprecated = true;
+  console.warn(
+    "[encryption]: `config.strategy` is deprecated and will be removed in a future release \u2014 use `config.authStrategy` instead."
+  );
+}
+function __resetStrategyDeprecationWarningForTests() {
+  warnedStrategyDeprecated = false;
+}
 var Encryption = async (config) => {
   const { schemas, config: clientConfig } = config;
   if (!schemas.length) {
@@ -2316,11 +2396,18 @@ var Encryption = async (config) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
+  if (clientConfig?.strategy) {
+    warnStrategyDeprecated();
+  }
+  const authStrategy = clientConfig?.authStrategy ?? clientConfig?.strategy;
   const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
+  const eqlVersion = resolveEqlVersion(schemas, clientConfig?.eqlVersion);
   const result = await client.init({
     encryptConfig,
-    ...clientConfig
+    ...clientConfig,
+    authStrategy,
+    eqlVersion
   });
   if (result.failure) {
     throw new Error(`[encryption]: ${result.failure.message}`);
@@ -2329,8 +2416,20 @@ var Encryption = async (config) => {
 };
 
 export {
+  BatchEncryptQueryOperation,
+  BulkDecryptOperation,
+  BulkDecryptModelsOperation,
+  BulkEncryptOperation,
+  BulkEncryptModelsOperation,
+  DecryptOperation,
+  DecryptModelOperation,
+  EncryptOperation,
+  EncryptModelOperation,
+  EncryptQueryOperation,
   noClientError,
+  resolveEqlVersion,
   EncryptionClient,
+  __resetStrategyDeprecationWarningForTests,
   Encryption
 };
-//# sourceMappingURL=chunk-CY5B4LIF.js.map
+//# sourceMappingURL=chunk-36AA7IBJ.js.map