@cipherstash/stack 0.16.0 → 0.19.0

package/dist/supabase/index.d.cts

@@ -1,7 +1,8 @@
-import { A as AuditConfig, a as EncryptionClient } from '../client-C_7TF8EL.cjs';
+import { A as AuditConfig, e as EncryptionClient } from '../client-DSGHBN-g.cjs';
+import { A as AnyV3Table, a as QueryTypesForColumn, W as InferPlaintext } from '../table-DihEAlxG.cjs';
 import { EncryptionError } from '../errors/index.cjs';
 import { LockContext } from '../identity/index.cjs';
-import { c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-Dv-r6Ik0.cjs';
+import { g as EncryptedTable, h as EncryptedTableColumn } from '../types-public-CpS5KjwX.cjs';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
 import 'zod';
@@ -13,6 +14,51 @@ type EncryptedSupabaseConfig = {
 interface EncryptedSupabaseInstance {
     from<T extends Record<string, unknown> = Record<string, unknown>>(tableName: string, schema: EncryptedTable<EncryptedTableColumn>): EncryptedQueryBuilder<T>;
 }
+type EncryptedSupabaseV3Config = {
+    encryptionClient: EncryptionClient;
+    supabaseClient: SupabaseClientLike;
+};
+/**
+ * The column builders declared on a v3 table, recovered from the table's
+ * type-level `_columnType` brand.
+ */
+type V3ColumnsOfTable<Table> = Table extends {
+    readonly _columnType: infer C;
+} ? C : never;
+/**
+ * JS property names of a v3 table's storage-only columns — those whose domain
+ * exposes no query capability (e.g. `types.Bool`, `types.Text`). Excluded from
+ * the filterable keys so a filter on one is a type error, matching the runtime
+ * guard in the v3 term encryption path.
+ */
+type NonQueryableV3Keys<Table extends AnyV3Table> = {
+    [K in Extract<keyof V3ColumnsOfTable<Table>, string>]: [
+        QueryTypesForColumn<V3ColumnsOfTable<Table>[K]>
+    ] extends [never] ? K : never;
+}[Extract<keyof V3ColumnsOfTable<Table>, string>];
+/**
+ * Row keys a v3 builder accepts in filter methods: every row key except the
+ * table's storage-only encrypted columns. Plaintext (non-schema) columns pass
+ * through untouched, exactly as in v2.
+ */
+type V3FilterableKeys<Table extends AnyV3Table, Row extends Record<string, unknown>> = Exclude<Extract<keyof Row, string>, NonQueryableV3Keys<Table>>;
+/**
+ * The v3 builder type: the shared {@link EncryptedQueryBuilder} surface with
+ * filter methods narrowed to {@link V3FilterableKeys}.
+ */
+type EncryptedQueryBuilderV3<Table extends AnyV3Table, Row extends Record<string, unknown>> = EncryptedQueryBuilder<Row, V3FilterableKeys<Table, Row> & StringKeyOf<Row>>;
+interface EncryptedSupabaseV3Instance {
+    /**
+     * `Row` defaults to exactly the table's inferred plaintext shape — NOT
+     * widened with an index signature. Widening would collapse
+     * {@link V3FilterableKeys} to `string` and silently disable the
+     * storage-only-column filter guard. The trade-off: with the default `Row`,
+     * plaintext passthrough columns (`id`, `created_at`, …) are not filterable
+     * or insertable at the type level — pass an explicit `Row` that includes
+     * them (`es.from<typeof users, UserRow>(…)`).
+     */
+    from<Table extends AnyV3Table, Row extends Record<string, unknown> = InferPlaintext<Table>>(tableName: string, table: Table): EncryptedQueryBuilderV3<Table, Row>;
+}
 type EncryptedSupabaseResponse<T> = {
     data: T | null;
     error: EncryptedSupabaseError | null;
@@ -39,71 +85,71 @@ interface SupabaseClientLike {
 
 /** Helper to extract string keys from T */
 type StringKeyOf<T> = Extract<keyof T, string>;
-interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<string, unknown>> extends PromiseLike<EncryptedSupabaseResponse<T[]>> {
+interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<string, unknown>, FK extends StringKeyOf<T> = StringKeyOf<T>> extends PromiseLike<EncryptedSupabaseResponse<T[]>> {
     select(columns: string, options?: {
         head?: boolean;
         count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     insert(data: Partial<T> | Partial<T>[], options?: {
         count?: 'exact' | 'planned' | 'estimated';
         defaultToNull?: boolean;
         onConflict?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     update(data: Partial<T>, options?: {
         count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     upsert(data: Partial<T> | Partial<T>[], options?: {
         count?: 'exact' | 'planned' | 'estimated';
         onConflict?: string;
         ignoreDuplicates?: boolean;
         defaultToNull?: boolean;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     delete(options?: {
         count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T>;
-    eq<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    neq<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    gt<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    gte<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    lt<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    lte<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    like<K extends StringKeyOf<T>>(column: K, pattern: string): EncryptedQueryBuilder<T>;
-    ilike<K extends StringKeyOf<T>>(column: K, pattern: string): EncryptedQueryBuilder<T>;
-    is<K extends StringKeyOf<T>>(column: K, value: null | boolean): EncryptedQueryBuilder<T>;
-    in<K extends StringKeyOf<T>>(column: K, values: T[K][]): EncryptedQueryBuilder<T>;
-    filter<K extends StringKeyOf<T>>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T>;
-    not<K extends StringKeyOf<T>>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
+    eq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    neq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    gt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    gte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    lt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    lte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    like<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
+    ilike<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
+    is<K extends FK>(column: K, value: null | boolean): EncryptedQueryBuilder<T, FK>;
+    in<K extends FK>(column: K, values: T[K][]): EncryptedQueryBuilder<T, FK>;
+    filter<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    not<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
     or(filters: string, options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     or(conditions: PendingOrCondition[], options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
-    match(query: Partial<T>): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
+    match(query: Partial<Pick<T, FK>>): EncryptedQueryBuilder<T, FK>;
     order<K extends StringKeyOf<T>>(column: K, options?: {
         ascending?: boolean;
         nullsFirst?: boolean;
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     limit(count: number, options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     range(from: number, to: number, options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
-    single(): EncryptedQueryBuilder<T>;
-    maybeSingle(): EncryptedQueryBuilder<T>;
-    csv(): EncryptedQueryBuilder<T>;
-    abortSignal(signal: AbortSignal): EncryptedQueryBuilder<T>;
-    throwOnError(): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
+    single(): EncryptedQueryBuilder<T, FK>;
+    maybeSingle(): EncryptedQueryBuilder<T, FK>;
+    csv(): EncryptedQueryBuilder<T, FK>;
+    abortSignal(signal: AbortSignal): EncryptedQueryBuilder<T, FK>;
+    throwOnError(): EncryptedQueryBuilder<T, FK>;
     returns<U extends Record<string, unknown>>(): EncryptedQueryBuilder<U>;
-    withLockContext(lockContext: LockContext): EncryptedQueryBuilder<T>;
-    audit(config: AuditConfig): EncryptedQueryBuilder<T>;
+    withLockContext(lockContext: LockContext): EncryptedQueryBuilder<T, FK>;
+    audit(config: AuditConfig): EncryptedQueryBuilder<T, FK>;
 }
 
 /**
@@ -140,5 +186,38 @@ interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<strin
  * ```
  */
 declare function encryptedSupabase(config: EncryptedSupabaseConfig): EncryptedSupabaseInstance;
+/**
+ * Create an encrypted Supabase wrapper for **EQL v3** schemas — tables
+ * authored with `@cipherstash/stack/eql/v3` whose columns are native
+ * `eql_v3.*` domains.
+ *
+ * The public surface and call shape are identical to {@link encryptedSupabase}
+ * (`.eq/.neq/.in/.gt/.gte/.lt/.lte/.like/.ilike/.match/.or/.not/.filter`,
+ * `withLockContext`, `audit`); only the schema type and the wire encoding
+ * differ. The same Supabase caveats carry over: the `eql_v3` schema must be
+ * added to the project's **Exposed schemas** and granted to the Supabase
+ * roles for the operators to resolve, and encrypted `ORDER BY` is
+ * unsupported (range *filtering* works).
+ *
+ * @example
+ * ```typescript
+ * import { Encryption } from '@cipherstash/stack'
+ * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
+ * import { encryptedSupabaseV3 } from '@cipherstash/stack/supabase'
+ *
+ * const users = encryptedTable('users', {
+ *   email:  types.TextSearch('email'),  // eql_v3.text_search
+ *   amount: types.IntegerOrd('amount'), // eql_v3.integer_ord
+ * })
+ *
+ * const client = await Encryption({ schemas: [users] })
+ * const es = encryptedSupabaseV3({ encryptionClient: client, supabaseClient: supabase })
+ *
+ * await es.from('users', users).insert({ email: 'a@b.com', amount: 30 })
+ * await es.from('users', users).select('id, email, amount').eq('email', 'a@b.com')
+ * await es.from('users', users).select('id, amount').gte('amount', 10).lte('amount', 100)
+ * ```
+ */
+declare function encryptedSupabaseV3(config: EncryptedSupabaseV3Config): EncryptedSupabaseV3Instance;
 
-export { type EncryptedQueryBuilder, type EncryptedSupabaseConfig, type EncryptedSupabaseError, type EncryptedSupabaseInstance, type EncryptedSupabaseResponse, type PendingOrCondition, type SupabaseClientLike, encryptedSupabase };
+export { type EncryptedQueryBuilder, type EncryptedQueryBuilderV3, type EncryptedSupabaseConfig, type EncryptedSupabaseError, type EncryptedSupabaseInstance, type EncryptedSupabaseResponse, type EncryptedSupabaseV3Config, type EncryptedSupabaseV3Instance, type PendingOrCondition, type SupabaseClientLike, type V3FilterableKeys, encryptedSupabase, encryptedSupabaseV3 };

package/dist/supabase/index.d.ts

@@ -1,7 +1,8 @@
-import { A as AuditConfig, a as EncryptionClient } from '../client-BLbA6aFD.js';
+import { A as AuditConfig, e as EncryptionClient } from '../client-DfCrlHXh.js';
+import { A as AnyV3Table, a as QueryTypesForColumn, W as InferPlaintext } from '../table-CIH7jZ2h.js';
 import { EncryptionError } from '../errors/index.js';
 import { LockContext } from '../identity/index.js';
-import { c as EncryptedTable, d as EncryptedTableColumn } from '../types-public-Dv-r6Ik0.js';
+import { g as EncryptedTable, h as EncryptedTableColumn } from '../types-public-CpS5KjwX.js';
 import '@byteslice/result';
 import '@cipherstash/protect-ffi';
 import 'zod';
@@ -13,6 +14,51 @@ type EncryptedSupabaseConfig = {
 interface EncryptedSupabaseInstance {
     from<T extends Record<string, unknown> = Record<string, unknown>>(tableName: string, schema: EncryptedTable<EncryptedTableColumn>): EncryptedQueryBuilder<T>;
 }
+type EncryptedSupabaseV3Config = {
+    encryptionClient: EncryptionClient;
+    supabaseClient: SupabaseClientLike;
+};
+/**
+ * The column builders declared on a v3 table, recovered from the table's
+ * type-level `_columnType` brand.
+ */
+type V3ColumnsOfTable<Table> = Table extends {
+    readonly _columnType: infer C;
+} ? C : never;
+/**
+ * JS property names of a v3 table's storage-only columns — those whose domain
+ * exposes no query capability (e.g. `types.Bool`, `types.Text`). Excluded from
+ * the filterable keys so a filter on one is a type error, matching the runtime
+ * guard in the v3 term encryption path.
+ */
+type NonQueryableV3Keys<Table extends AnyV3Table> = {
+    [K in Extract<keyof V3ColumnsOfTable<Table>, string>]: [
+        QueryTypesForColumn<V3ColumnsOfTable<Table>[K]>
+    ] extends [never] ? K : never;
+}[Extract<keyof V3ColumnsOfTable<Table>, string>];
+/**
+ * Row keys a v3 builder accepts in filter methods: every row key except the
+ * table's storage-only encrypted columns. Plaintext (non-schema) columns pass
+ * through untouched, exactly as in v2.
+ */
+type V3FilterableKeys<Table extends AnyV3Table, Row extends Record<string, unknown>> = Exclude<Extract<keyof Row, string>, NonQueryableV3Keys<Table>>;
+/**
+ * The v3 builder type: the shared {@link EncryptedQueryBuilder} surface with
+ * filter methods narrowed to {@link V3FilterableKeys}.
+ */
+type EncryptedQueryBuilderV3<Table extends AnyV3Table, Row extends Record<string, unknown>> = EncryptedQueryBuilder<Row, V3FilterableKeys<Table, Row> & StringKeyOf<Row>>;
+interface EncryptedSupabaseV3Instance {
+    /**
+     * `Row` defaults to exactly the table's inferred plaintext shape — NOT
+     * widened with an index signature. Widening would collapse
+     * {@link V3FilterableKeys} to `string` and silently disable the
+     * storage-only-column filter guard. The trade-off: with the default `Row`,
+     * plaintext passthrough columns (`id`, `created_at`, …) are not filterable
+     * or insertable at the type level — pass an explicit `Row` that includes
+     * them (`es.from<typeof users, UserRow>(…)`).
+     */
+    from<Table extends AnyV3Table, Row extends Record<string, unknown> = InferPlaintext<Table>>(tableName: string, table: Table): EncryptedQueryBuilderV3<Table, Row>;
+}
 type EncryptedSupabaseResponse<T> = {
     data: T | null;
     error: EncryptedSupabaseError | null;
@@ -39,71 +85,71 @@ interface SupabaseClientLike {
 
 /** Helper to extract string keys from T */
 type StringKeyOf<T> = Extract<keyof T, string>;
-interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<string, unknown>> extends PromiseLike<EncryptedSupabaseResponse<T[]>> {
+interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<string, unknown>, FK extends StringKeyOf<T> = StringKeyOf<T>> extends PromiseLike<EncryptedSupabaseResponse<T[]>> {
     select(columns: string, options?: {
         head?: boolean;
         count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     insert(data: Partial<T> | Partial<T>[], options?: {
         count?: 'exact' | 'planned' | 'estimated';
         defaultToNull?: boolean;
         onConflict?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     update(data: Partial<T>, options?: {
         count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     upsert(data: Partial<T> | Partial<T>[], options?: {
         count?: 'exact' | 'planned' | 'estimated';
         onConflict?: string;
         ignoreDuplicates?: boolean;
         defaultToNull?: boolean;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     delete(options?: {
         count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T>;
-    eq<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    neq<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    gt<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    gte<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    lt<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    lte<K extends StringKeyOf<T>>(column: K, value: T[K]): EncryptedQueryBuilder<T>;
-    like<K extends StringKeyOf<T>>(column: K, pattern: string): EncryptedQueryBuilder<T>;
-    ilike<K extends StringKeyOf<T>>(column: K, pattern: string): EncryptedQueryBuilder<T>;
-    is<K extends StringKeyOf<T>>(column: K, value: null | boolean): EncryptedQueryBuilder<T>;
-    in<K extends StringKeyOf<T>>(column: K, values: T[K][]): EncryptedQueryBuilder<T>;
-    filter<K extends StringKeyOf<T>>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T>;
-    not<K extends StringKeyOf<T>>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
+    eq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    neq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    gt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    gte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    lt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    lte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    like<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
+    ilike<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
+    is<K extends FK>(column: K, value: null | boolean): EncryptedQueryBuilder<T, FK>;
+    in<K extends FK>(column: K, values: T[K][]): EncryptedQueryBuilder<T, FK>;
+    filter<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
+    not<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
     or(filters: string, options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     or(conditions: PendingOrCondition[], options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
-    match(query: Partial<T>): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
+    match(query: Partial<Pick<T, FK>>): EncryptedQueryBuilder<T, FK>;
     order<K extends StringKeyOf<T>>(column: K, options?: {
         ascending?: boolean;
         nullsFirst?: boolean;
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     limit(count: number, options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
     range(from: number, to: number, options?: {
         referencedTable?: string;
         foreignTable?: string;
-    }): EncryptedQueryBuilder<T>;
-    single(): EncryptedQueryBuilder<T>;
-    maybeSingle(): EncryptedQueryBuilder<T>;
-    csv(): EncryptedQueryBuilder<T>;
-    abortSignal(signal: AbortSignal): EncryptedQueryBuilder<T>;
-    throwOnError(): EncryptedQueryBuilder<T>;
+    }): EncryptedQueryBuilder<T, FK>;
+    single(): EncryptedQueryBuilder<T, FK>;
+    maybeSingle(): EncryptedQueryBuilder<T, FK>;
+    csv(): EncryptedQueryBuilder<T, FK>;
+    abortSignal(signal: AbortSignal): EncryptedQueryBuilder<T, FK>;
+    throwOnError(): EncryptedQueryBuilder<T, FK>;
     returns<U extends Record<string, unknown>>(): EncryptedQueryBuilder<U>;
-    withLockContext(lockContext: LockContext): EncryptedQueryBuilder<T>;
-    audit(config: AuditConfig): EncryptedQueryBuilder<T>;
+    withLockContext(lockContext: LockContext): EncryptedQueryBuilder<T, FK>;
+    audit(config: AuditConfig): EncryptedQueryBuilder<T, FK>;
 }
 
 /**
@@ -140,5 +186,38 @@ interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<strin
  * ```
  */
 declare function encryptedSupabase(config: EncryptedSupabaseConfig): EncryptedSupabaseInstance;
+/**
+ * Create an encrypted Supabase wrapper for **EQL v3** schemas — tables
+ * authored with `@cipherstash/stack/eql/v3` whose columns are native
+ * `eql_v3.*` domains.
+ *
+ * The public surface and call shape are identical to {@link encryptedSupabase}
+ * (`.eq/.neq/.in/.gt/.gte/.lt/.lte/.like/.ilike/.match/.or/.not/.filter`,
+ * `withLockContext`, `audit`); only the schema type and the wire encoding
+ * differ. The same Supabase caveats carry over: the `eql_v3` schema must be
+ * added to the project's **Exposed schemas** and granted to the Supabase
+ * roles for the operators to resolve, and encrypted `ORDER BY` is
+ * unsupported (range *filtering* works).
+ *
+ * @example
+ * ```typescript
+ * import { Encryption } from '@cipherstash/stack'
+ * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
+ * import { encryptedSupabaseV3 } from '@cipherstash/stack/supabase'
+ *
+ * const users = encryptedTable('users', {
+ *   email:  types.TextSearch('email'),  // eql_v3.text_search
+ *   amount: types.IntegerOrd('amount'), // eql_v3.integer_ord
+ * })
+ *
+ * const client = await Encryption({ schemas: [users] })
+ * const es = encryptedSupabaseV3({ encryptionClient: client, supabaseClient: supabase })
+ *
+ * await es.from('users', users).insert({ email: 'a@b.com', amount: 30 })
+ * await es.from('users', users).select('id, email, amount').eq('email', 'a@b.com')
+ * await es.from('users', users).select('id, amount').gte('amount', 10).lte('amount', 100)
+ * ```
+ */
+declare function encryptedSupabaseV3(config: EncryptedSupabaseV3Config): EncryptedSupabaseV3Instance;
 
-export { type EncryptedQueryBuilder, type EncryptedSupabaseConfig, type EncryptedSupabaseError, type EncryptedSupabaseInstance, type EncryptedSupabaseResponse, type PendingOrCondition, type SupabaseClientLike, encryptedSupabase };
+export { type EncryptedQueryBuilder, type EncryptedQueryBuilderV3, type EncryptedSupabaseConfig, type EncryptedSupabaseError, type EncryptedSupabaseInstance, type EncryptedSupabaseResponse, type EncryptedSupabaseV3Config, type EncryptedSupabaseV3Instance, type PendingOrCondition, type SupabaseClientLike, type V3FilterableKeys, encryptedSupabase, encryptedSupabaseV3 };