@cipherstash/stack 0.16.0 → 0.19.0

package/dist/encryption/v3.d.cts

@@ -0,0 +1,100 @@
+import { Result } from '@byteslice/result';
+import { A as AnyV3Table, C as ColumnsOf, P as PlaintextForColumn, Q as QueryableColumnsOf, a as QueryTypesForColumn, V as V3ModelInput, b as V3EncryptedModel, c as V3DecryptedModel } from '../table-DihEAlxG.cjs';
+export { d as AnyEncryptedV3Column, E as EncryptedBooleanColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, g as EncryptedDateOrdColumn, h as EncryptedDateOrdOreColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, k as EncryptedDoubleOrdColumn, l as EncryptedDoubleOrdOreColumn, m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, o as EncryptedIntegerOrdColumn, p as EncryptedIntegerOrdOreColumn, q as EncryptedNumericColumn, r as EncryptedNumericEqColumn, s as EncryptedNumericOrdColumn, t as EncryptedNumericOrdOreColumn, u as EncryptedRealColumn, v as EncryptedRealEqColumn, w as EncryptedRealOrdColumn, x as EncryptedRealOrdOreColumn, y as EncryptedSmallintColumn, z as EncryptedSmallintEqColumn, B as EncryptedSmallintOrdColumn, D as EncryptedSmallintOrdOreColumn, F as EncryptedTable, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, J as EncryptedTextOrdColumn, K as EncryptedTextOrdOreColumn, L as EncryptedTextSearchColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, O as EncryptedTimestampOrdColumn, R as EncryptedTimestampOrdOreColumn, S as EncryptedV3TableColumn, T as EqlTypeForColumn, U as InferEncrypted, W as InferPlaintext, X as QueryCapabilities, Y as TEXT_SEARCH_EQL_TYPE, Z as buildEncryptConfig, _ as encryptedTable } from '../table-DihEAlxG.cjs';
+export { types } from '../eql/v3/index.cjs';
+import { EncryptionError } from '../errors/index.cjs';
+import { LockContextInput } from '../identity/index.cjs';
+import { C as ClientConfig, E as EncryptedReturnType, a as Encrypted, B as BulkEncryptPayload, b as EncryptOptions, c as BulkDecryptPayload } from '../types-public-CpS5KjwX.cjs';
+import { E as EncryptOperation, a as EncryptQueryOperation, b as EncryptModelOperation, B as BulkEncryptModelsOperation, D as DecryptOperation, c as BulkEncryptOperation, d as BulkDecryptOperation, e as EncryptionClient } from '../client-DSGHBN-g.cjs';
+import '@cipherstash/protect-ffi';
+import 'zod';
+
+/**
+ * A strongly-typed view over an {@link EncryptionClient} for EQL v3 schemas.
+ *
+ * Every method derives its types from the concrete `table` / `column` builder
+ * arguments (which carry their branded types at the call site), so:
+ * - `encrypt` / `encryptQuery` pin the plaintext to the column's domain type
+ *   (`text → string`, `timestamp → Date`, …);
+ * - `encryptQuery` additionally constrains `queryType` to the column's
+ *   capabilities and rejects storage-only columns outright;
+ * - `encryptModel` / `bulkEncryptModels` validate schema-column fields against
+ *   their inferred plaintext type (passthrough fields are untouched) and return
+ *   a precise encrypted model;
+ * - `decryptModel` / `bulkDecryptModels` return the precise plaintext model,
+ *   reconstructing `Date` values from the encrypt-config `cast_as`.
+ *
+ * @typeParam S - the tuple of registered v3 tables; `table` arguments must be a
+ *   member of this tuple.
+ */
+interface TypedEncryptionClient<S extends readonly AnyV3Table[]> {
+    encrypt<Table extends S[number], Col extends ColumnsOf<Table>>(plaintext: PlaintextForColumn<Col>, opts: {
+        table: Table;
+        column: Col;
+    }): EncryptOperation;
+    encryptQuery<Table extends S[number], Col extends QueryableColumnsOf<Table>, QT extends QueryTypesForColumn<Col> = QueryTypesForColumn<Col>>(plaintext: PlaintextForColumn<Col>, opts: {
+        table: Table;
+        column: Col;
+        queryType?: QT;
+        returnType?: EncryptedReturnType;
+    }): EncryptQueryOperation;
+    encryptModel<Table extends S[number], T extends Record<string, unknown>>(input: V3ModelInput<Table, T>, table: Table): EncryptModelOperation<V3EncryptedModel<Table, T>>;
+    bulkEncryptModels<Table extends S[number], T extends Record<string, unknown>>(input: Array<V3ModelInput<Table, T>>, table: Table): BulkEncryptModelsOperation<V3EncryptedModel<Table, T>>;
+    /**
+     * Decrypt a single value. Cannot be strongly typed — a lone ciphertext carries
+     * no column identity — so it resolves to the FFI plaintext union unchanged.
+     */
+    decrypt(encrypted: Encrypted): DecryptOperation;
+    /**
+     * Decrypt a model, returning the precise plaintext shape for `table`. `Date`
+     * columns are reconstructed from the encrypt-config `cast_as`.
+     *
+     * Pass `lockContext` to decrypt identity-bound data — the same context that
+     * was supplied at encrypt time must be provided here.
+     *
+     * Unlike the encrypt operations this returns a plain `Promise<Result<…>>`
+     * rather than a chainable operation, because it maps the resolved value.
+     */
+    decryptModel<Table extends S[number], T extends Record<string, unknown>>(input: T, table: Table, lockContext?: LockContextInput): Promise<Result<V3DecryptedModel<Table, T>, EncryptionError>>;
+    bulkDecryptModels<Table extends S[number], T extends Record<string, unknown>>(input: Array<T>, table: Table, lockContext?: LockContextInput): Promise<Result<Array<V3DecryptedModel<Table, T>>, EncryptionError>>;
+    bulkEncrypt(plaintexts: BulkEncryptPayload, opts: EncryptOptions): BulkEncryptOperation;
+    bulkDecrypt(payloads: BulkDecryptPayload): BulkDecryptOperation;
+    getEncryptConfig(): ReturnType<EncryptionClient['getEncryptConfig']>;
+}
+/**
+ * Wrap an already-built {@link EncryptionClient} in a {@link TypedEncryptionClient}
+ * for the given v3 schemas. Zero runtime cost for the encrypt/query paths (the
+ * underlying operations are returned unchanged); the decrypt-model paths add a
+ * per-column `Date` reconstruction step.
+ *
+ * The `schemas` are captured with a `const` type parameter so array-literal
+ * widening does not collapse per-table inference.
+ */
+declare function typedClient<const S extends readonly AnyV3Table[]>(client: EncryptionClient, ..._schemas: S): TypedEncryptionClient<S>;
+/**
+ * Build a {@link TypedEncryptionClient} for EQL v3 schemas — the strongly-typed
+ * counterpart to {@link Encryption}. Mirrors its config, then retypes the client
+ * against the provided v3 `schemas`.
+ *
+ * The underlying client is created with `eqlVersion: 3` (protect-ffi 0.27+),
+ * so `encrypt` / `encryptModel` emit EQL v3 wire payloads for the
+ * per-capability `eql_v3` domains. Pass an explicit `config.eqlVersion` to
+ * override — e.g. `2` to write v2-wire from a v3 schema set during a
+ * migration.
+ *
+ * @example
+ * ```typescript
+ * import { EncryptionV3, encryptedTable, types } from "@cipherstash/stack/v3"
+ *
+ * const users = encryptedTable("users", { email: types.TextSearch("email") })
+ * const client = await EncryptionV3({ schemas: [users] })
+ *
+ * await client.encrypt("a@b.com", { table: users, column: users.email })
+ * ```
+ */
+declare function EncryptionV3<const S extends readonly AnyV3Table[]>(config: {
+    schemas: S;
+    config?: ClientConfig;
+}): Promise<TypedEncryptionClient<S>>;
+
+export { AnyV3Table, ColumnsOf, EncryptionV3, PlaintextForColumn, QueryTypesForColumn, QueryableColumnsOf, type TypedEncryptionClient, V3DecryptedModel, V3EncryptedModel, V3ModelInput, typedClient };

package/dist/encryption/v3.d.ts

@@ -0,0 +1,100 @@
+import { Result } from '@byteslice/result';
+import { A as AnyV3Table, C as ColumnsOf, P as PlaintextForColumn, Q as QueryableColumnsOf, a as QueryTypesForColumn, V as V3ModelInput, b as V3EncryptedModel, c as V3DecryptedModel } from '../table-CIH7jZ2h.js';
+export { d as AnyEncryptedV3Column, E as EncryptedBooleanColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, g as EncryptedDateOrdColumn, h as EncryptedDateOrdOreColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, k as EncryptedDoubleOrdColumn, l as EncryptedDoubleOrdOreColumn, m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, o as EncryptedIntegerOrdColumn, p as EncryptedIntegerOrdOreColumn, q as EncryptedNumericColumn, r as EncryptedNumericEqColumn, s as EncryptedNumericOrdColumn, t as EncryptedNumericOrdOreColumn, u as EncryptedRealColumn, v as EncryptedRealEqColumn, w as EncryptedRealOrdColumn, x as EncryptedRealOrdOreColumn, y as EncryptedSmallintColumn, z as EncryptedSmallintEqColumn, B as EncryptedSmallintOrdColumn, D as EncryptedSmallintOrdOreColumn, F as EncryptedTable, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, J as EncryptedTextOrdColumn, K as EncryptedTextOrdOreColumn, L as EncryptedTextSearchColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, O as EncryptedTimestampOrdColumn, R as EncryptedTimestampOrdOreColumn, S as EncryptedV3TableColumn, T as EqlTypeForColumn, U as InferEncrypted, W as InferPlaintext, X as QueryCapabilities, Y as TEXT_SEARCH_EQL_TYPE, Z as buildEncryptConfig, _ as encryptedTable } from '../table-CIH7jZ2h.js';
+export { types } from '../eql/v3/index.js';
+import { EncryptionError } from '../errors/index.js';
+import { LockContextInput } from '../identity/index.js';
+import { C as ClientConfig, E as EncryptedReturnType, a as Encrypted, B as BulkEncryptPayload, b as EncryptOptions, c as BulkDecryptPayload } from '../types-public-CpS5KjwX.js';
+import { E as EncryptOperation, a as EncryptQueryOperation, b as EncryptModelOperation, B as BulkEncryptModelsOperation, D as DecryptOperation, c as BulkEncryptOperation, d as BulkDecryptOperation, e as EncryptionClient } from '../client-DfCrlHXh.js';
+import '@cipherstash/protect-ffi';
+import 'zod';
+
+/**
+ * A strongly-typed view over an {@link EncryptionClient} for EQL v3 schemas.
+ *
+ * Every method derives its types from the concrete `table` / `column` builder
+ * arguments (which carry their branded types at the call site), so:
+ * - `encrypt` / `encryptQuery` pin the plaintext to the column's domain type
+ *   (`text → string`, `timestamp → Date`, …);
+ * - `encryptQuery` additionally constrains `queryType` to the column's
+ *   capabilities and rejects storage-only columns outright;
+ * - `encryptModel` / `bulkEncryptModels` validate schema-column fields against
+ *   their inferred plaintext type (passthrough fields are untouched) and return
+ *   a precise encrypted model;
+ * - `decryptModel` / `bulkDecryptModels` return the precise plaintext model,
+ *   reconstructing `Date` values from the encrypt-config `cast_as`.
+ *
+ * @typeParam S - the tuple of registered v3 tables; `table` arguments must be a
+ *   member of this tuple.
+ */
+interface TypedEncryptionClient<S extends readonly AnyV3Table[]> {
+    encrypt<Table extends S[number], Col extends ColumnsOf<Table>>(plaintext: PlaintextForColumn<Col>, opts: {
+        table: Table;
+        column: Col;
+    }): EncryptOperation;
+    encryptQuery<Table extends S[number], Col extends QueryableColumnsOf<Table>, QT extends QueryTypesForColumn<Col> = QueryTypesForColumn<Col>>(plaintext: PlaintextForColumn<Col>, opts: {
+        table: Table;
+        column: Col;
+        queryType?: QT;
+        returnType?: EncryptedReturnType;
+    }): EncryptQueryOperation;
+    encryptModel<Table extends S[number], T extends Record<string, unknown>>(input: V3ModelInput<Table, T>, table: Table): EncryptModelOperation<V3EncryptedModel<Table, T>>;
+    bulkEncryptModels<Table extends S[number], T extends Record<string, unknown>>(input: Array<V3ModelInput<Table, T>>, table: Table): BulkEncryptModelsOperation<V3EncryptedModel<Table, T>>;
+    /**
+     * Decrypt a single value. Cannot be strongly typed — a lone ciphertext carries
+     * no column identity — so it resolves to the FFI plaintext union unchanged.
+     */
+    decrypt(encrypted: Encrypted): DecryptOperation;
+    /**
+     * Decrypt a model, returning the precise plaintext shape for `table`. `Date`
+     * columns are reconstructed from the encrypt-config `cast_as`.
+     *
+     * Pass `lockContext` to decrypt identity-bound data — the same context that
+     * was supplied at encrypt time must be provided here.
+     *
+     * Unlike the encrypt operations this returns a plain `Promise<Result<…>>`
+     * rather than a chainable operation, because it maps the resolved value.
+     */
+    decryptModel<Table extends S[number], T extends Record<string, unknown>>(input: T, table: Table, lockContext?: LockContextInput): Promise<Result<V3DecryptedModel<Table, T>, EncryptionError>>;
+    bulkDecryptModels<Table extends S[number], T extends Record<string, unknown>>(input: Array<T>, table: Table, lockContext?: LockContextInput): Promise<Result<Array<V3DecryptedModel<Table, T>>, EncryptionError>>;
+    bulkEncrypt(plaintexts: BulkEncryptPayload, opts: EncryptOptions): BulkEncryptOperation;
+    bulkDecrypt(payloads: BulkDecryptPayload): BulkDecryptOperation;
+    getEncryptConfig(): ReturnType<EncryptionClient['getEncryptConfig']>;
+}
+/**
+ * Wrap an already-built {@link EncryptionClient} in a {@link TypedEncryptionClient}
+ * for the given v3 schemas. Zero runtime cost for the encrypt/query paths (the
+ * underlying operations are returned unchanged); the decrypt-model paths add a
+ * per-column `Date` reconstruction step.
+ *
+ * The `schemas` are captured with a `const` type parameter so array-literal
+ * widening does not collapse per-table inference.
+ */
+declare function typedClient<const S extends readonly AnyV3Table[]>(client: EncryptionClient, ..._schemas: S): TypedEncryptionClient<S>;
+/**
+ * Build a {@link TypedEncryptionClient} for EQL v3 schemas — the strongly-typed
+ * counterpart to {@link Encryption}. Mirrors its config, then retypes the client
+ * against the provided v3 `schemas`.
+ *
+ * The underlying client is created with `eqlVersion: 3` (protect-ffi 0.27+),
+ * so `encrypt` / `encryptModel` emit EQL v3 wire payloads for the
+ * per-capability `eql_v3` domains. Pass an explicit `config.eqlVersion` to
+ * override — e.g. `2` to write v2-wire from a v3 schema set during a
+ * migration.
+ *
+ * @example
+ * ```typescript
+ * import { EncryptionV3, encryptedTable, types } from "@cipherstash/stack/v3"
+ *
+ * const users = encryptedTable("users", { email: types.TextSearch("email") })
+ * const client = await EncryptionV3({ schemas: [users] })
+ *
+ * await client.encrypt("a@b.com", { table: users, column: users.email })
+ * ```
+ */
+declare function EncryptionV3<const S extends readonly AnyV3Table[]>(config: {
+    schemas: S;
+    config?: ClientConfig;
+}): Promise<TypedEncryptionClient<S>>;
+
+export { AnyV3Table, ColumnsOf, EncryptionV3, PlaintextForColumn, QueryTypesForColumn, QueryableColumnsOf, type TypedEncryptionClient, V3DecryptedModel, V3EncryptedModel, V3ModelInput, typedClient };

package/dist/encryption/v3.js

@@ -0,0 +1,161 @@
+import {
+  EncryptedTable,
+  buildEncryptConfig,
+  encryptedTable,
+  types
+} from "../chunk-IBSK6P33.js";
+import {
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
+  TEXT_SEARCH_EQL_TYPE
+} from "../chunk-U66S7VIF.js";
+import {
+  Encryption
+} from "../chunk-36AA7IBJ.js";
+import "../chunk-OFQ555AX.js";
+import "../chunk-BNO32ZMV.js";
+import "../chunk-MP3SSDNN.js";
+import "../chunk-IADZCZEA.js";
+import "../chunk-4AVL4VZD.js";
+import "../chunk-JSG2AMDI.js";
+import "../chunk-HQANMV7R.js";
+import "../chunk-LBMC4D6D.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/encryption/v3.ts
+function rowReconstructor(table) {
+  const { columns } = table.build();
+  const propToDb = table.buildColumnKeyMap();
+  const dateProperties = Object.entries(propToDb).filter(([, dbName]) => {
+    const castAs = columns[dbName]?.cast_as;
+    return castAs === "date" || castAs === "timestamp";
+  }).map(([property]) => property);
+  return (row) => {
+    const out = { ...row };
+    for (const property of dateProperties) {
+      const value = out[property];
+      if (value == null) continue;
+      out[property] = new Date(value);
+    }
+    return out;
+  };
+}
+function typedClient(client, ..._schemas) {
+  return {
+    encrypt: (plaintext, opts) => client.encrypt(plaintext, opts),
+    encryptQuery: (plaintext, opts) => client.encryptQuery(plaintext, opts),
+    encryptModel: (input, table) => client.encryptModel(input, table),
+    bulkEncryptModels: (input, table) => client.bulkEncryptModels(input, table),
+    decrypt: (encrypted) => client.decrypt(encrypted),
+    decryptModel: async (input, table, lockContext) => {
+      const op = client.decryptModel(input);
+      const result = await (lockContext ? op.withLockContext(lockContext) : op);
+      if (result.failure) return result;
+      return { data: rowReconstructor(table)(result.data) };
+    },
+    bulkDecryptModels: async (input, table, lockContext) => {
+      const op = client.bulkDecryptModels(input);
+      const result = await (lockContext ? op.withLockContext(lockContext) : op);
+      if (result.failure) return result;
+      const reconstruct = rowReconstructor(table);
+      return {
+        data: result.data.map(
+          (row) => reconstruct(row)
+        )
+      };
+    },
+    bulkEncrypt: (plaintexts, opts) => client.bulkEncrypt(plaintexts, opts),
+    bulkDecrypt: (payloads) => client.bulkDecrypt(payloads),
+    getEncryptConfig: () => client.getEncryptConfig()
+  };
+}
+async function EncryptionV3(config) {
+  const client = await Encryption({
+    schemas: config.schemas,
+    // v3 schemas emit the EQL v3 wire format. Auto-detection in
+    // `Encryption` would resolve the same way (every v3 table carries the
+    // `buildColumnKeyMap` marker), but the version is set explicitly here
+    // so the contract doesn't hinge on duck-typing — while still honouring
+    // a caller's explicit override.
+    config: { ...config.config, eqlVersion: config.config?.eqlVersion ?? 3 }
+  });
+  return typedClient(client, ...config.schemas);
+}
+export {
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTable,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
+  EncryptionV3,
+  TEXT_SEARCH_EQL_TYPE,
+  buildEncryptConfig,
+  encryptedTable,
+  typedClient,
+  types
+};
+//# sourceMappingURL=v3.js.map

package/dist/encryption/v3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/encryption/v3.ts"],"sourcesContent":["import type { Result } from '@byteslice/result'\nimport type {\n  AnyV3Table,\n  ColumnsOf,\n  PlaintextForColumn,\n  QueryableColumnsOf,\n  QueryTypesForColumn,\n  V3DecryptedModel,\n  V3EncryptedModel,\n  V3ModelInput,\n} from '@/eql/v3'\nimport type { EncryptionError } from '@/errors'\nimport type { LockContextInput } from '@/identity'\nimport type {\n  BulkDecryptPayload,\n  BulkEncryptPayload,\n  ClientConfig,\n  Encrypted,\n  EncryptedReturnType,\n  EncryptOptions,\n} from '@/types'\nimport {\n  type BulkDecryptOperation,\n  type BulkEncryptModelsOperation,\n  type BulkEncryptOperation,\n  type DecryptOperation,\n  Encryption,\n  type EncryptionClient,\n  type EncryptModelOperation,\n  type EncryptOperation,\n  type EncryptQueryOperation,\n} from './index'\n\n/**\n * A strongly-typed view over an {@link EncryptionClient} for EQL v3 schemas.\n *\n * Every method derives its types from the concrete `table` / `column` builder\n * arguments (which carry their branded types at the call site), so:\n * - `encrypt` / `encryptQuery` pin the plaintext to the column's domain type\n *   (`text → string`, `timestamp → Date`, …);\n * - `encryptQuery` additionally constrains `queryType` to the column's\n *   capabilities and rejects storage-only columns outright;\n * - `encryptModel` / `bulkEncryptModels` validate schema-column fields against\n *   their inferred plaintext type (passthrough fields are untouched) and return\n *   a precise encrypted model;\n * - `decryptModel` / `bulkDecryptModels` return the precise plaintext model,\n *   reconstructing `Date` values from the encrypt-config `cast_as`.\n *\n * @typeParam S - the tuple of registered v3 tables; `table` arguments must be a\n *   member of this tuple.\n */\nexport interface TypedEncryptionClient<S extends readonly AnyV3Table[]> {\n  encrypt<Table extends S[number], Col extends ColumnsOf<Table>>(\n    plaintext: PlaintextForColumn<Col>,\n    opts: { table: Table; column: Col },\n  ): EncryptOperation\n\n  encryptQuery<\n    Table extends S[number],\n    Col extends QueryableColumnsOf<Table>,\n    QT extends QueryTypesForColumn<Col> = QueryTypesForColumn<Col>,\n  >(\n    plaintext: PlaintextForColumn<Col>,\n    opts: {\n      table: Table\n      column: Col\n      queryType?: QT\n      returnType?: EncryptedReturnType\n    },\n  ): EncryptQueryOperation\n\n  encryptModel<Table extends S[number], T extends Record<string, unknown>>(\n    input: V3ModelInput<Table, T>,\n    table: Table,\n  ): EncryptModelOperation<V3EncryptedModel<Table, T>>\n\n  bulkEncryptModels<Table extends S[number], T extends Record<string, unknown>>(\n    input: Array<V3ModelInput<Table, T>>,\n    table: Table,\n  ): BulkEncryptModelsOperation<V3EncryptedModel<Table, T>>\n\n  /**\n   * Decrypt a single value. Cannot be strongly typed — a lone ciphertext carries\n   * no column identity — so it resolves to the FFI plaintext union unchanged.\n   */\n  decrypt(encrypted: Encrypted): DecryptOperation\n\n  /**\n   * Decrypt a model, returning the precise plaintext shape for `table`. `Date`\n   * columns are reconstructed from the encrypt-config `cast_as`.\n   *\n   * Pass `lockContext` to decrypt identity-bound data — the same context that\n   * was supplied at encrypt time must be provided here.\n   *\n   * Unlike the encrypt operations this returns a plain `Promise<Result<…>>`\n   * rather than a chainable operation, because it maps the resolved value.\n   */\n  decryptModel<Table extends S[number], T extends Record<string, unknown>>(\n    input: T,\n    table: Table,\n    lockContext?: LockContextInput,\n  ): Promise<Result<V3DecryptedModel<Table, T>, EncryptionError>>\n\n  bulkDecryptModels<Table extends S[number], T extends Record<string, unknown>>(\n    input: Array<T>,\n    table: Table,\n    lockContext?: LockContextInput,\n  ): Promise<Result<Array<V3DecryptedModel<Table, T>>, EncryptionError>>\n\n  // Parity passthroughs — not v3-strengthened, delegated as-is.\n  bulkEncrypt(\n    plaintexts: BulkEncryptPayload,\n    opts: EncryptOptions,\n  ): BulkEncryptOperation\n  bulkDecrypt(payloads: BulkDecryptPayload): BulkDecryptOperation\n  getEncryptConfig(): ReturnType<EncryptionClient['getEncryptConfig']>\n}\n\n/**\n * Build a per-row reconstructor of `Date` values from the table's\n * encrypt-config `cast_as`. The FFI returns `JsPlaintext`\n * (string/number/boolean/…) with no `Date`, so those columns arrive as their\n * serialized form and are rebuilt here. Safe (idempotent) if the FFI ever\n * returns `Date` directly: `new Date(date)` is a no-op.\n *\n * A factory rather than a `(row, table)` function so the table config —\n * row-invariant, but non-trivial to build — is derived once per call site,\n * not once per row on the bulk path.\n *\n * NOTE: `bigint` reconstruction is intentionally absent — bigint domains are\n * omitted from the v3 SDK until the native FFI supports lossless bigint I/O.\n */\nfunction rowReconstructor(\n  table: AnyV3Table,\n): (row: Record<string, unknown>) => Record<string, unknown> {\n  // The decrypted row is keyed by JS property name, but `cast_as` lives on the\n  // config keyed by DB name — bridge the two via the table's property→DB map.\n  const { columns } = table.build()\n  const propToDb = table.buildColumnKeyMap()\n  // Only date/timestamp columns need per-row work; resolve them up front.\n  // Both kinds decrypt to a JS `Date` — 'timestamp' additionally preserves\n  // the time-of-day component through the FFI.\n  const dateProperties = Object.entries(propToDb)\n    .filter(([, dbName]) => {\n      const castAs = columns[dbName]?.cast_as\n      return castAs === 'date' || castAs === 'timestamp'\n    })\n    .map(([property]) => property)\n\n  return (row) => {\n    const out: Record<string, unknown> = { ...row }\n    for (const property of dateProperties) {\n      const value = out[property]\n      if (value == null) continue\n      out[property] = new Date(value as string | number | Date)\n    }\n    return out\n  }\n}\n\n/**\n * Wrap an already-built {@link EncryptionClient} in a {@link TypedEncryptionClient}\n * for the given v3 schemas. Zero runtime cost for the encrypt/query paths (the\n * underlying operations are returned unchanged); the decrypt-model paths add a\n * per-column `Date` reconstruction step.\n *\n * The `schemas` are captured with a `const` type parameter so array-literal\n * widening does not collapse per-table inference.\n */\nexport function typedClient<const S extends readonly AnyV3Table[]>(\n  client: EncryptionClient,\n  ..._schemas: S\n): TypedEncryptionClient<S> {\n  return {\n    encrypt: (plaintext, opts) =>\n      client.encrypt(plaintext as never, opts as never),\n    encryptQuery: (plaintext, opts) =>\n      client.encryptQuery(plaintext as never, opts as never),\n    encryptModel: (input, table) =>\n      client.encryptModel(input as never, table as never) as never,\n    bulkEncryptModels: (input, table) =>\n      client.bulkEncryptModels(input as never, table as never) as never,\n    decrypt: (encrypted) => client.decrypt(encrypted),\n    decryptModel: async (input, table, lockContext) => {\n      const op = client.decryptModel(input as never)\n      const result = await (lockContext ? op.withLockContext(lockContext) : op)\n      if (result.failure) return result as never\n      return { data: rowReconstructor(table)(result.data) } as never\n    },\n    bulkDecryptModels: async (input, table, lockContext) => {\n      const op = client.bulkDecryptModels(input as never)\n      const result = await (lockContext ? op.withLockContext(lockContext) : op)\n      if (result.failure) return result as never\n      const reconstruct = rowReconstructor(table)\n      return {\n        data: result.data.map((row) =>\n          reconstruct(row as Record<string, unknown>),\n        ),\n      } as never\n    },\n    bulkEncrypt: (plaintexts, opts) => client.bulkEncrypt(plaintexts, opts),\n    bulkDecrypt: (payloads) => client.bulkDecrypt(payloads),\n    getEncryptConfig: () => client.getEncryptConfig(),\n  } satisfies TypedEncryptionClient<S>\n}\n\n/**\n * Build a {@link TypedEncryptionClient} for EQL v3 schemas — the strongly-typed\n * counterpart to {@link Encryption}. Mirrors its config, then retypes the client\n * against the provided v3 `schemas`.\n *\n * The underlying client is created with `eqlVersion: 3` (protect-ffi 0.27+),\n * so `encrypt` / `encryptModel` emit EQL v3 wire payloads for the\n * per-capability `eql_v3` domains. Pass an explicit `config.eqlVersion` to\n * override — e.g. `2` to write v2-wire from a v3 schema set during a\n * migration.\n *\n * @example\n * ```typescript\n * import { EncryptionV3, encryptedTable, types } from \"@cipherstash/stack/v3\"\n *\n * const users = encryptedTable(\"users\", { email: types.TextSearch(\"email\") })\n * const client = await EncryptionV3({ schemas: [users] })\n *\n * await client.encrypt(\"a@b.com\", { table: users, column: users.email })\n * ```\n */\nexport async function EncryptionV3<\n  const S extends readonly AnyV3Table[],\n>(config: {\n  schemas: S\n  config?: ClientConfig\n}): Promise<TypedEncryptionClient<S>> {\n  const client = await Encryption({\n    schemas: config.schemas as unknown as Parameters<\n      typeof Encryption\n    >[0]['schemas'],\n    // v3 schemas emit the EQL v3 wire format. Auto-detection in\n    // `Encryption` would resolve the same way (every v3 table carries the\n    // `buildColumnKeyMap` marker), but the version is set explicitly here\n    // so the contract doesn't hinge on duck-typing — while still honouring\n    // a caller's explicit override.\n    config: { ...config.config, eqlVersion: config.config?.eqlVersion ?? 3 },\n  })\n  return typedClient(client, ...config.schemas)\n}\n\n// Single import surface: re-export the v3 `types` namespace + table API + type\n// helpers so `@cipherstash/stack/v3` provides everything needed to author and\n// use a schema.\nexport * from '@/eql/v3'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoIA,SAAS,iBACP,OAC2D;AAG3D,QAAM,EAAE,QAAQ,IAAI,MAAM,MAAM;AAChC,QAAM,WAAW,MAAM,kBAAkB;AAIzC,QAAM,iBAAiB,OAAO,QAAQ,QAAQ,EAC3C,OAAO,CAAC,CAAC,EAAE,MAAM,MAAM;AACtB,UAAM,SAAS,QAAQ,MAAM,GAAG;AAChC,WAAO,WAAW,UAAU,WAAW;AAAA,EACzC,CAAC,EACA,IAAI,CAAC,CAAC,QAAQ,MAAM,QAAQ;AAE/B,SAAO,CAAC,QAAQ;AACd,UAAM,MAA+B,EAAE,GAAG,IAAI;AAC9C,eAAW,YAAY,gBAAgB;AACrC,YAAM,QAAQ,IAAI,QAAQ;AAC1B,UAAI,SAAS,KAAM;AACnB,UAAI,QAAQ,IAAI,IAAI,KAAK,KAA+B;AAAA,IAC1D;AACA,WAAO;AAAA,EACT;AACF;AAWO,SAAS,YACd,WACG,UACuB;AAC1B,SAAO;AAAA,IACL,SAAS,CAAC,WAAW,SACnB,OAAO,QAAQ,WAAoB,IAAa;AAAA,IAClD,cAAc,CAAC,WAAW,SACxB,OAAO,aAAa,WAAoB,IAAa;AAAA,IACvD,cAAc,CAAC,OAAO,UACpB,OAAO,aAAa,OAAgB,KAAc;AAAA,IACpD,mBAAmB,CAAC,OAAO,UACzB,OAAO,kBAAkB,OAAgB,KAAc;AAAA,IACzD,SAAS,CAAC,cAAc,OAAO,QAAQ,SAAS;AAAA,IAChD,cAAc,OAAO,OAAO,OAAO,gBAAgB;AACjD,YAAM,KAAK,OAAO,aAAa,KAAc;AAC7C,YAAM,SAAS,OAAO,cAAc,GAAG,gBAAgB,WAAW,IAAI;AACtE,UAAI,OAAO,QAAS,QAAO;AAC3B,aAAO,EAAE,MAAM,iBAAiB,KAAK,EAAE,OAAO,IAAI,EAAE;AAAA,IACtD;AAAA,IACA,mBAAmB,OAAO,OAAO,OAAO,gBAAgB;AACtD,YAAM,KAAK,OAAO,kBAAkB,KAAc;AAClD,YAAM,SAAS,OAAO,cAAc,GAAG,gBAAgB,WAAW,IAAI;AACtE,UAAI,OAAO,QAAS,QAAO;AAC3B,YAAM,cAAc,iBAAiB,KAAK;AAC1C,aAAO;AAAA,QACL,MAAM,OAAO,KAAK;AAAA,UAAI,CAAC,QACrB,YAAY,GAA8B;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAAA,IACA,aAAa,CAAC,YAAY,SAAS,OAAO,YAAY,YAAY,IAAI;AAAA,IACtE,aAAa,CAAC,aAAa,OAAO,YAAY,QAAQ;AAAA,IACtD,kBAAkB,MAAM,OAAO,iBAAiB;AAAA,EAClD;AACF;AAuBA,eAAsB,aAEpB,QAGoC;AACpC,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B,SAAS,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQhB,QAAQ,EAAE,GAAG,OAAO,QAAQ,YAAY,OAAO,QAAQ,cAAc,EAAE;AAAA,EACzE,CAAC;AACD,SAAO,YAAY,QAAQ,GAAG,OAAO,OAAO;AAC9C;","names":[]}