@cipherstash/stack 0.16.0 → 0.19.0

package/dist/chunk-IADZCZEA.js

@@ -0,0 +1,23 @@
+// src/schema/match-defaults.ts
+function defaultMatchOpts() {
+  return {
+    tokenizer: { kind: "ngram", token_length: 3 },
+    token_filters: [{ kind: "downcase" }],
+    k: 6,
+    m: 2048,
+    include_original: true
+  };
+}
+function cloneMatchOpts(opts) {
+  return {
+    ...opts,
+    tokenizer: { ...opts.tokenizer },
+    token_filters: opts.token_filters.map((f) => ({ ...f }))
+  };
+}
+
+export {
+  defaultMatchOpts,
+  cloneMatchOpts
+};
+//# sourceMappingURL=chunk-IADZCZEA.js.map

package/dist/chunk-IADZCZEA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema/match-defaults.ts"],"sourcesContent":["import type { MatchIndexOpts } from './index'\n\n/**\n * Fully-resolved match-index options: every field present and non-`undefined`.\n *\n * `MatchIndexOpts` (the user-facing tuning input) has all fields optional —\n * each is `.default(...).optional()` in the zod schema, so its inferred type is\n * `T | undefined`. This type pins the BUILT/resolved shape explicitly via\n * `NonNullable<...>`, which states the non-null intent directly and is robust\n * regardless of `Required<>`'s subtle, `exactOptionalPropertyTypes`-dependent\n * stripping semantics.\n */\nexport type BuiltMatchIndexOpts = {\n  tokenizer: NonNullable<MatchIndexOpts['tokenizer']>\n  token_filters: NonNullable<MatchIndexOpts['token_filters']>\n  k: NonNullable<MatchIndexOpts['k']>\n  m: NonNullable<MatchIndexOpts['m']>\n  include_original: NonNullable<MatchIndexOpts['include_original']>\n}\n\n/**\n * Default match-index parameters — the single source of truth shared by the\n * v2 `freeTextSearch()` builder and the v3 domain builders (note\n * `include_original: true`, which is the v2 builder default rather than the\n * zod-schema default of `false`).\n *\n * This is a FACTORY (not a shared `const`) so every caller gets fresh, unaliased\n * nested objects (`tokenizer`, `token_filters` and the `{ kind: 'downcase' }`\n * inside it). A shared const would be shallow-copied by `{ ...DEFAULT }`, leaving\n * those nested objects aliased across every column — a caller mutating one built\n * config could then corrupt the defaults used by later columns.\n */\nexport function defaultMatchOpts(): BuiltMatchIndexOpts {\n  return {\n    tokenizer: { kind: 'ngram', token_length: 3 },\n    token_filters: [{ kind: 'downcase' }],\n    k: 6,\n    m: 2048,\n    include_original: true,\n  }\n}\n\n/**\n * Deep-clone a built match block (`tokenizer` and `token_filters` are its only\n * nested values) so no emitted config or stored builder state ever aliases\n * another's nested objects — a caller mutating one cannot corrupt the other.\n */\nexport function cloneMatchOpts(opts: BuiltMatchIndexOpts): BuiltMatchIndexOpts {\n  return {\n    ...opts,\n    tokenizer: { ...opts.tokenizer },\n    token_filters: opts.token_filters.map((f) => ({ ...f })),\n  }\n}\n"],"mappings":";AAgCO,SAAS,mBAAwC;AACtD,SAAO;AAAA,IACL,WAAW,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,IAC5C,eAAe,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,kBAAkB;AAAA,EACpB;AACF;AAOO,SAAS,eAAe,MAAgD;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,EAAE,GAAG,KAAK,UAAU;AAAA,IAC/B,eAAe,KAAK,cAAc,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,EACzD;AACF;","names":[]}

package/dist/chunk-IBSK6P33.js

@@ -0,0 +1,209 @@
+import {
+  BOOLEAN,
+  DATE,
+  DATE_EQ,
+  DATE_ORD,
+  DATE_ORD_ORE,
+  DOUBLE,
+  DOUBLE_EQ,
+  DOUBLE_ORD,
+  DOUBLE_ORD_ORE,
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
+  INTEGER,
+  INTEGER_EQ,
+  INTEGER_ORD,
+  INTEGER_ORD_ORE,
+  NUMERIC,
+  NUMERIC_EQ,
+  NUMERIC_ORD,
+  NUMERIC_ORD_ORE,
+  REAL,
+  REAL_EQ,
+  REAL_ORD,
+  REAL_ORD_ORE,
+  SMALLINT,
+  SMALLINT_EQ,
+  SMALLINT_ORD,
+  SMALLINT_ORD_ORE,
+  TEXT,
+  TEXT_EQ,
+  TEXT_MATCH,
+  TEXT_ORD,
+  TEXT_ORD_ORE,
+  TIMESTAMP,
+  TIMESTAMP_EQ,
+  TIMESTAMP_ORD,
+  TIMESTAMP_ORD_ORE
+} from "./chunk-U66S7VIF.js";
+
+// src/eql/v3/table.ts
+var EncryptedTable = class {
+  constructor(tableName, columnBuilders) {
+    this.tableName = tableName;
+    this.columnBuilders = columnBuilders;
+  }
+  tableName;
+  columnBuilders;
+  build() {
+    const builtColumns = {};
+    for (const builder of Object.values(this.columnBuilders)) {
+      const name = builder.getName();
+      if (Object.hasOwn(builtColumns, name)) {
+        throw new Error(
+          `[eql/v3]: duplicate column name "${name}" in table "${this.tableName}" \u2014 two columns resolve to the same DB name`
+        );
+      }
+      builtColumns[name] = builder.build();
+    }
+    return {
+      tableName: this.tableName,
+      columns: builtColumns
+    };
+  }
+  /**
+   * Map each column's JS property name to its DB column name (`getName()`).
+   * The model path matches user models by property name but must address the
+   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+   * the two only agree when property == name. This recovers the mapping that
+   * `build()` discards.
+   */
+  buildColumnKeyMap() {
+    const map = {};
+    for (const [property, builder] of Object.entries(this.columnBuilders)) {
+      map[property] = builder.getName();
+    }
+    return map;
+  }
+};
+var RESERVED_TABLE_KEYS = /* @__PURE__ */ new Set([
+  "tableName",
+  "columnBuilders",
+  "_columnType",
+  "build",
+  "buildColumnKeyMap"
+]);
+function isReservedTableKey(tableBuilder, colName) {
+  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder;
+}
+function encryptedTable(tableName, columns) {
+  const tableBuilder = new EncryptedTable(
+    tableName,
+    columns
+  );
+  for (const [colName, colBuilder] of Object.entries(columns)) {
+    if (isReservedTableKey(tableBuilder, colName)) {
+      throw new Error(
+        `Column name "${colName}" collides with a reserved EncryptedTable property`
+      );
+    }
+    ;
+    tableBuilder[colName] = colBuilder;
+  }
+  return tableBuilder;
+}
+function buildEncryptConfig(...tables) {
+  const config = {
+    v: 1,
+    tables: {}
+  };
+  for (const tb of tables) {
+    const tableDef = tb.build();
+    if (Object.hasOwn(config.tables, tableDef.tableName)) {
+      throw new Error(
+        `[eql/v3]: duplicate table name "${tableDef.tableName}" passed to buildEncryptConfig \u2014 each table must have a unique name`
+      );
+    }
+    config.tables[tableDef.tableName] = tableDef.columns;
+  }
+  return config;
+}
+
+// src/eql/v3/types.ts
+var types = {
+  // integer
+  Integer: (name) => new EncryptedIntegerColumn(name, INTEGER),
+  IntegerEq: (name) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),
+  IntegerOrdOre: (name) => new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),
+  IntegerOrd: (name) => new EncryptedIntegerOrdColumn(name, INTEGER_ORD),
+  // smallint
+  Smallint: (name) => new EncryptedSmallintColumn(name, SMALLINT),
+  SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
+  SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
+  SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
+  // date
+  Date: (name) => new EncryptedDateColumn(name, DATE),
+  DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
+  DateOrdOre: (name) => new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),
+  DateOrd: (name) => new EncryptedDateOrdColumn(name, DATE_ORD),
+  // timestamp
+  Timestamp: (name) => new EncryptedTimestampColumn(name, TIMESTAMP),
+  TimestampEq: (name) => new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),
+  TimestampOrdOre: (name) => new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),
+  TimestampOrd: (name) => new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),
+  // numeric
+  Numeric: (name) => new EncryptedNumericColumn(name, NUMERIC),
+  NumericEq: (name) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),
+  NumericOrdOre: (name) => new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),
+  NumericOrd: (name) => new EncryptedNumericOrdColumn(name, NUMERIC_ORD),
+  // text
+  Text: (name) => new EncryptedTextColumn(name, TEXT),
+  TextEq: (name) => new EncryptedTextEqColumn(name, TEXT_EQ),
+  TextMatch: (name) => new EncryptedTextMatchColumn(name, TEXT_MATCH),
+  TextOrdOre: (name) => new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),
+  TextOrd: (name) => new EncryptedTextOrdColumn(name, TEXT_ORD),
+  TextSearch: (name) => new EncryptedTextSearchColumn(name),
+  // boolean
+  Boolean: (name) => new EncryptedBooleanColumn(name, BOOLEAN),
+  // real
+  Real: (name) => new EncryptedRealColumn(name, REAL),
+  RealEq: (name) => new EncryptedRealEqColumn(name, REAL_EQ),
+  RealOrdOre: (name) => new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),
+  RealOrd: (name) => new EncryptedRealOrdColumn(name, REAL_ORD),
+  // double
+  Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
+  DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
+  DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
+  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD)
+};
+
+export {
+  EncryptedTable,
+  encryptedTable,
+  buildEncryptConfig,
+  types
+};
+//# sourceMappingURL=chunk-IBSK6P33.js.map

package/dist/chunk-IBSK6P33.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/eql/v3/table.ts","../src/eql/v3/types.ts"],"sourcesContent":["import type { ColumnSchema, EncryptConfig } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type {\n  EncryptedV3TableColumn,\n  PlaintextForColumn,\n  QueryTypesForColumn,\n} from './columns'\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\n/**\n * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3\n * column builders. Emits the same `{ tableName, columns }` definition shape.\n */\nexport class EncryptedTable<T extends EncryptedV3TableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n    for (const builder of Object.values(this.columnBuilders)) {\n      // Key by the column's DB name (`getName()`), NOT the JS property name.\n      // `encrypt`/`decrypt` look columns up in the config by `column.getName()`,\n      // so a camelCase JS key mapping to a snake_case DB column (e.g.\n      // `createdOn: types.Date('created_on')`) must register under\n      // `created_on` or the FFI reports \"column not found in Encrypt config\".\n      const name = builder.getName()\n      // Two JS properties resolving to the same DB name would silently overwrite\n      // here (later wins), dropping the first column's config. Fail loudly —\n      // matching the duplicate-tableName guard in buildEncryptConfig and the\n      // reserved-key guard in encryptedTable.\n      if (Object.hasOwn(builtColumns, name)) {\n        throw new Error(\n          `[eql/v3]: duplicate column name \"${name}\" in table \"${this.tableName}\" — two columns resolve to the same DB name`,\n        )\n      }\n      builtColumns[name] = builder.build()\n    }\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n\n  /**\n   * Map each column's JS property name to its DB column name (`getName()`).\n   * The model path matches user models by property name but must address the\n   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so\n   * the two only agree when property == name. This recovers the mapping that\n   * `build()` discards.\n   */\n  buildColumnKeyMap(): Record<string, string> {\n    const map: Record<string, string> = {}\n    for (const [property, builder] of Object.entries(this.columnBuilders)) {\n      map[property] = builder.getName()\n    }\n    return map\n  }\n}\n\n/**\n * Own instance members of {@link EncryptedTable} that a column name must not\n * shadow. Because {@link encryptedTable} copies column builders onto the\n * instance for accessor access (`users.email`), a column named e.g. `build`\n * would otherwise overwrite the method that {@link buildEncryptConfig} relies\n * on. `_columnType` is a type-only `declare` (no runtime property) so it is\n * listed explicitly here rather than caught by the `in` check below.\n */\nconst RESERVED_TABLE_KEYS = new Set([\n  'tableName',\n  'columnBuilders',\n  '_columnType',\n  'build',\n  'buildColumnKeyMap',\n])\n\n/**\n * Whether a column name would collide with a reserved property on the table\n * object — either an own member ({@link RESERVED_TABLE_KEYS}) or any inherited\n * `Object.prototype` member (`constructor`, `toString`, `valueOf`,\n * `hasOwnProperty`, …). The `in` check covers the prototype chain so assigning\n * the column as an own property can never shadow a prototype method/accessor.\n */\nfunction isReservedTableKey(tableBuilder: object, colName: string): boolean {\n  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder\n}\n\n/**\n * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`\n * name but lives on the `/eql/v3` subpath — the importer picks the model by\n * import path. The returned object is also a column accessor (`users.email`).\n */\nexport function encryptedTable<T extends EncryptedV3TableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    if (isReservedTableKey(tableBuilder, colName)) {\n      throw new Error(\n        `Column name \"${colName}\" collides with a reserved EncryptedTable property`,\n      )\n    }\n    ;(tableBuilder as EncryptedV3TableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same\n * shape as v2's `buildEncryptConfig`.\n */\nexport function buildEncryptConfig(\n  ...tables: Array<EncryptedTable<EncryptedV3TableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 1,\n    tables: {},\n  }\n\n  for (const tb of tables) {\n    const tableDef = tb.build()\n    // Config tables are keyed by name, so a duplicate would silently overwrite\n    // the earlier table. Fail loudly instead. (v3-only additive guard; v2's\n    // buildEncryptConfig keeps its existing silent-overwrite behavior.)\n    if (Object.hasOwn(config.tables, tableDef.tableName)) {\n      throw new Error(\n        `[eql/v3]: duplicate table name \"${tableDef.tableName}\" passed to buildEncryptConfig — each table must have a unique name`,\n      )\n    }\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n\n/**\n * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps\n * to the TypeScript type of its domain's `castAs` kind.\n */\nexport type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C>\n    ? { [K in keyof C]: PlaintextForColumn<C[K]> }\n    : never\n\n/**\n * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}\n * for why no key-remap filter is needed in the flat single-type model.\n */\nexport type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C> ? { [K in keyof C]: Encrypted } : never\n\n// ---------------------------------------------------------------------------\n// Typed-client surface helpers (@cipherstash/stack/v3)\n// ---------------------------------------------------------------------------\n\n/** Any v3 table, regardless of its column map. */\nexport type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>\n\n/** Union of the concrete column builders declared on a v3 table. */\nexport type ColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C> ? C[keyof C] : never\n\n/**\n * Union of the *queryable* column builders on a v3 table. Storage-only columns\n * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't\n * be passed to a query method.\n */\nexport type QueryableColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never]\n          ? never\n          : C[K]\n      }[keyof C]\n    : never\n\n/**\n * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.\n * `T` is inferred from the argument: keys that name a schema column are pinned to\n * the column's plaintext type (nullable if the field is nullable), so a wrong-typed\n * field fails assignability; all other keys pass through unchanged.\n */\nexport type V3ModelInput<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n\n/** The encrypted result model: schema columns become `Encrypted`, others pass through. */\nexport type V3EncryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? Encrypted | null\n      : Encrypted\n    : T[K]\n}\n\n/** The decrypted result model: schema columns become their plaintext type, others pass through. */\nexport type V3DecryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n","import {\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a factory that builds a concrete\n * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain\n * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So\n * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`\n * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the\n * only capability-bearing chain — every other domain is fully described by its\n * type). bigint domains are intentionally absent pending lossless FFI\n * round-tripping (see ./columns).\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n} as const\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,IAAM,iBAAN,MAAuD;AAAA,EAI5D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EAGlB,QAAyB;AACvB,UAAM,eAA6C,CAAC;AACpD,eAAW,WAAW,OAAO,OAAO,KAAK,cAAc,GAAG;AAMxD,YAAM,OAAO,QAAQ,QAAQ;AAK7B,UAAI,OAAO,OAAO,cAAc,IAAI,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,oCAAoC,IAAI,eAAe,KAAK,SAAS;AAAA,QACvE;AAAA,MACF;AACA,mBAAa,IAAI,IAAI,QAAQ,MAAM;AAAA,IACrC;AACA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oBAA4C;AAC1C,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACrE,UAAI,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AACF;AAUA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,mBAAmB,cAAsB,SAA0B;AAC1E,SAAO,oBAAoB,IAAI,OAAO,KAAK,WAAW;AACxD;AAOO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D,QAAI,mBAAmB,cAAc,OAAO,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF;AACA;AAAC,IAAC,aAAwC,OAAO,IAAI;AAAA,EACvD;AAEA,SAAO;AACT;AAMO,SAAS,sBACX,QACY;AACf,QAAM,SAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,QAAQ,CAAC;AAAA,EACX;AAEA,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,GAAG,MAAM;AAI1B,QAAI,OAAO,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,SAAS;AAAA,MACvD;AAAA,IACF;AACA,WAAO,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,EAC/C;AAEA,SAAO;AACT;;;ACjDO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA,EAGnD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAC5E;","names":[]}

package/dist/chunk-JSG2AMDI.js

@@ -0,0 +1,17 @@
+// ../../node_modules/.pnpm/@byteslice+result@0.2.0/node_modules/@byteslice/result/dist/result.mjs
+function ensureError(ex) {
+  return ex instanceof Error ? ex : new Error("Something went wrong");
+}
+async function withResult(operation, onError, hooks) {
+  try {
+    return { data: await operation() };
+  } catch (ex) {
+    const error = hooks?.onException?.(ex) ?? ensureError(ex);
+    return { failure: onError(error) };
+  }
+}
+
+export {
+  withResult
+};
+//# sourceMappingURL=chunk-JSG2AMDI.js.map

package/dist/chunk-JSG2AMDI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../node_modules/.pnpm/@byteslice+result@0.2.0/node_modules/@byteslice/result/dist/result.mjs"],"sourcesContent":["// src/result.ts\nfunction ensureError(ex) {\n  return ex instanceof Error ? ex : new Error(\"Something went wrong\");\n}\nasync function withResult(operation, onError, hooks) {\n  try {\n    return { data: await operation() };\n  } catch (ex) {\n    const error = hooks?.onException?.(ex) ?? ensureError(ex);\n    return { failure: onError(error) };\n  }\n}\nexport {\n  withResult\n};\n"],"mappings":";AACA,SAAS,YAAY,IAAI;AACvB,SAAO,cAAc,QAAQ,KAAK,IAAI,MAAM,sBAAsB;AACpE;AACA,eAAe,WAAW,WAAW,SAAS,OAAO;AACnD,MAAI;AACF,WAAO,EAAE,MAAM,MAAM,UAAU,EAAE;AAAA,EACnC,SAAS,IAAI;AACX,UAAM,QAAQ,OAAO,cAAc,EAAE,KAAK,YAAY,EAAE;AACxD,WAAO,EAAE,SAAS,QAAQ,KAAK,EAAE;AAAA,EACnC;AACF;","names":[]}