@cipherstash/stack 0.16.0 → 0.19.0

package/dist/wasm-inline.d.ts

@@ -0,0 +1,1269 @@
+import { AccessKeyStrategy, OidcFederationStrategy } from '@cipherstash/auth/wasm-inline';
+export { AccessKeyStrategy, OidcFederationStrategy } from '@cipherstash/auth/wasm-inline';
+import { z } from 'zod';
+import { EncryptedPayload } from '@cipherstash/protect-ffi';
+
+/** Structural type representing encrypted data stored in the database. Always
+ * carries a ciphertext. Covers BOTH wire formats: the EQL v2.3 payloads
+ * (`k: "ct"` / `k: "sv"`) and the EQL v3 payloads (flat `{v: 3, i, c, …}`
+ * scalars and `{v: 3, k: "sv", i, sv}` SteVec documents). Which format
+ * `encrypt` produces is selected by the client's
+ * {@link ClientConfig.eqlVersion}; `decrypt` accepts both regardless.
+ * v3 scalars carry no `k` discriminator, so narrow with `'k' in payload`
+ * before reading it. See also `EncryptedValue` for branded nominal typing,
+ * and {@link EncryptedQuery} for the search-term shape returned by
+ * `encryptQuery`. */
+type Encrypted = EncryptedPayload;
+/** Structural contract for a column builder the client can consume for STORAGE
+ *  (`encrypt`). Satisfied by v2 `EncryptedColumn` / `EncryptedField` AND v3
+ *  `EncryptedTextSearchColumn` — fields ARE encryptable, so this stays wide. */
+interface BuildableColumn {
+    getName(): string;
+    build(): ColumnSchema;
+}
+/** Structural contract for a table builder the client can consume. Satisfied by
+ *  v2 and v3 `EncryptedTable` alike. */
+interface BuildableTable {
+    tableName: string;
+    build(): {
+        tableName: string;
+        columns: Record<string, ColumnSchema>;
+    };
+    /**
+     * Optional map from a model field's JS property name to its encrypt-config
+     * column name (the DB name). Present when the two can differ — v3 tables key
+     * their config by DB name (`column.getName()`) while models are written with
+     * JS property keys, so the model path must match by property but address the
+     * FFI/config by DB name.
+     *
+     * Absent on v2 tables, whose `build()` already keys columns by the JS property
+     * name; the model path then matches and addresses by that same key.
+     */
+    buildColumnKeyMap?(): Record<string, string>;
+}
+/**
+ * Options for single-value encrypt operations.
+ * Use a column from your table schema (from {@link encryptedColumn}) or a nested
+ * field (from {@link encryptedField}) as the target for encryption.
+ */
+type EncryptOptions = {
+    /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */
+    column: BuildableColumn;
+    table: BuildableTable;
+};
+
+/**
+ * SDK-facing data types — developer-friendly aliases accepted by `dataType()`.
+ */
+declare const castAsEnum: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
+declare const tokenFilterSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"downcase">;
+}, "strip", z.ZodTypeAny, {
+    kind: "downcase";
+}, {
+    kind: "downcase";
+}>;
+declare const oreIndexOptsSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+declare const uniqueIndexOptsSchema: z.ZodObject<{
+    token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<"downcase">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "downcase";
+    }, {
+        kind: "downcase";
+    }>, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+}, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+}>;
+declare const matchIndexOptsSchema: z.ZodObject<{
+    tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"standard">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "standard";
+    }, {
+        kind: "standard";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"ngram">;
+        token_length: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        kind: "ngram";
+        token_length: number;
+    }, {
+        kind: "ngram";
+        token_length: number;
+    }>]>>>;
+    token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<"downcase">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "downcase";
+    }, {
+        kind: "downcase";
+    }>, "many">>>;
+    k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+    tokenizer?: {
+        kind: "standard";
+    } | {
+        kind: "ngram";
+        token_length: number;
+    } | undefined;
+    k?: number | undefined;
+    m?: number | undefined;
+    include_original?: boolean | undefined;
+}, {
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
+    tokenizer?: {
+        kind: "standard";
+    } | {
+        kind: "ngram";
+        token_length: number;
+    } | undefined;
+    k?: number | undefined;
+    m?: number | undefined;
+    include_original?: boolean | undefined;
+}>;
+declare const steVecIndexOptsSchema: z.ZodObject<{
+    prefix: z.ZodString;
+    array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+        item: z.ZodOptional<z.ZodBoolean>;
+        wildcard: z.ZodOptional<z.ZodBoolean>;
+        position: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    }, {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    }>]>>;
+}, "strip", z.ZodTypeAny, {
+    prefix: string;
+    array_index_mode?: "all" | "none" | {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    } | undefined;
+}, {
+    prefix: string;
+    array_index_mode?: "all" | "none" | {
+        item?: boolean | undefined;
+        wildcard?: boolean | undefined;
+        position?: boolean | undefined;
+    } | undefined;
+}>;
+declare const columnSchema: z.ZodDefault<z.ZodObject<{
+    cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
+    indexes: z.ZodDefault<z.ZodObject<{
+        ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        unique: z.ZodOptional<z.ZodObject<{
+            token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"downcase">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "downcase";
+            }, {
+                kind: "downcase";
+            }>, "many">>>;
+        }, "strip", z.ZodTypeAny, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        }, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        }>>;
+        match: z.ZodOptional<z.ZodObject<{
+            tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"standard">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "standard";
+            }, {
+                kind: "standard";
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"ngram">;
+                token_length: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "ngram";
+                token_length: number;
+            }, {
+                kind: "ngram";
+                token_length: number;
+            }>]>>>;
+            token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"downcase">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "downcase";
+            }, {
+                kind: "downcase";
+            }>, "many">>>;
+            k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, "strip", z.ZodTypeAny, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        }, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        }>>;
+        ste_vec: z.ZodOptional<z.ZodObject<{
+            prefix: z.ZodString;
+            array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                item: z.ZodOptional<z.ZodBoolean>;
+                wildcard: z.ZodOptional<z.ZodBoolean>;
+                position: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }>]>>;
+        }, "strip", z.ZodTypeAny, {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+        }, {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+        } | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+    indexes: {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+        } | undefined;
+    };
+}, {
+    cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
+    indexes?: {
+        ore?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
+}>>;
+/** @internal */
+declare const encryptConfigSchema: z.ZodObject<{
+    v: z.ZodNumber;
+    tables: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodObject<{
+        cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
+        indexes: z.ZodDefault<z.ZodObject<{
+            ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+            unique: z.ZodOptional<z.ZodObject<{
+                token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    kind: z.ZodLiteral<"downcase">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "downcase";
+                }, {
+                    kind: "downcase";
+                }>, "many">>>;
+            }, "strip", z.ZodTypeAny, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            }, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            }>>;
+            match: z.ZodOptional<z.ZodObject<{
+                tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"standard">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "standard";
+                }, {
+                    kind: "standard";
+                }>, z.ZodObject<{
+                    kind: z.ZodLiteral<"ngram">;
+                    token_length: z.ZodNumber;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "ngram";
+                    token_length: number;
+                }, {
+                    kind: "ngram";
+                    token_length: number;
+                }>]>>>;
+                token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    kind: z.ZodLiteral<"downcase">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "downcase";
+                }, {
+                    kind: "downcase";
+                }>, "many">>>;
+                k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, "strip", z.ZodTypeAny, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            }, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            }>>;
+            ste_vec: z.ZodOptional<z.ZodObject<{
+                prefix: z.ZodString;
+                array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                    item: z.ZodOptional<z.ZodBoolean>;
+                    wildcard: z.ZodOptional<z.ZodBoolean>;
+                    position: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }>]>>;
+            }, "strip", z.ZodTypeAny, {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            }, {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+        }, {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+        indexes: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+        };
+    }, {
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
+        indexes?: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }>>>>>>;
+}, "strip", z.ZodTypeAny, {
+    v: number;
+    tables: Record<string, Record<string, {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+        indexes: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+        };
+    }>>;
+}, {
+    v: number;
+    tables?: Record<string, Record<string, {
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
+        indexes?: {
+            ore?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined> | undefined> | undefined;
+}>;
+/**
+ * Type-safe alias for {@link castAsEnum} used to specify the *unencrypted* data type of a column or value.
+ * This is important because once encrypted, all data is stored as binary blobs.
+ *
+ * @see {@link castAsEnum} for possible values.
+ */
+type CastAs = z.infer<typeof castAsEnum>;
+type TokenFilter = z.infer<typeof tokenFilterSchema>;
+type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>;
+type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>;
+type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>;
+type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>;
+type ColumnSchema = z.infer<typeof columnSchema>;
+/**
+ * Shape of table columns: either top-level {@link EncryptedColumn} or nested
+ * objects whose leaves are {@link EncryptedField}. Used with {@link encryptedTable}.
+ */
+type EncryptedTableColumn = {
+    [key: string]: EncryptedColumn | {
+        [key: string]: EncryptedField | {
+            [key: string]: EncryptedField | {
+                [key: string]: EncryptedField;
+            };
+        };
+    };
+};
+type EncryptConfig = z.infer<typeof encryptConfigSchema>;
+/**
+ * Builder for a nested encrypted field (encrypted but not searchable).
+ * Create with {@link encryptedField}. Use inside nested objects in {@link encryptedTable};
+ * supports `.dataType()` for plaintext type. No index methods (equality, orderAndRange, etc.).
+ */
+declare class EncryptedField {
+    private valueName;
+    private castAsValue;
+    constructor(valueName: string);
+    /**
+     * Set or override the plaintext data type for this field.
+     *
+     * By default all values are treated as `'string'`. Use this method to specify
+     * a different type so the encryption layer knows how to encode the plaintext
+     * before encrypting.
+     *
+     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
+     * @returns This `EncryptedField` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedField } from "@cipherstash/stack/schema"
+     *
+     * const age = encryptedField("age").dataType("number")
+     * ```
+     */
+    dataType(castAs: CastAs): this;
+    build(): {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+        indexes: {};
+    };
+    getName(): string;
+}
+declare class EncryptedColumn {
+    private columnName;
+    private castAsValue;
+    private indexesValue;
+    constructor(columnName: string);
+    /**
+     * Set or override the plaintext data type for this column.
+     *
+     * By default all columns are treated as `'string'`. Use this method to specify
+     * a different type so the encryption layer knows how to encode the plaintext
+     * before encrypting.
+     *
+     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+     * @returns This `EncryptedColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const dateOfBirth = encryptedColumn("date_of_birth").dataType("date")
+     * ```
+     */
+    dataType(castAs: CastAs): this;
+    /**
+     * Enable Order-Revealing Encryption (ORE) indexing on this column.
+     *
+     * ORE allows sorting, comparison, and range queries on encrypted data.
+     * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
+     *
+     * @returns This `EncryptedColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").orderAndRange(),
+     * })
+     * ```
+     */
+    orderAndRange(): this;
+    /**
+     * Enable an exact-match (unique) index on this column.
+     *
+     * Allows equality queries on encrypted data. Use with `encryptQuery`
+     * and `queryType: 'equality'`.
+     *
+     * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
+     *   When omitted, no token filters are applied.
+     * @returns This `EncryptedColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").equality(),
+     * })
+     * ```
+     */
+    equality(tokenFilters?: TokenFilter[]): this;
+    /**
+     * Enable a full-text / fuzzy search (match) index on this column.
+     *
+     * Uses n-gram tokenization by default for substring and fuzzy matching.
+     * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.
+     *
+     * @param opts - Optional match index configuration. Defaults to 3-character ngram
+     *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
+     * @returns This `EncryptedColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").freeTextSearch(),
+     * })
+     *
+     * // With custom options
+     * const posts = encryptedTable("posts", {
+     *   body: encryptedColumn("body").freeTextSearch({
+     *     tokenizer: { kind: "ngram", token_length: 4 },
+     *     k: 8,
+     *     m: 4096,
+     *   }),
+     * })
+     * ```
+     */
+    freeTextSearch(opts?: MatchIndexOpts): this;
+    /**
+     * Configure this column for searchable encrypted JSON (STE-Vec).
+     *
+     * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and
+     * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the
+     * data type to `'json'`.
+     *
+     * When used with `encryptQuery`, the query operation is auto-inferred from
+     * the plaintext type: strings become selector queries, objects/arrays become
+     * containment queries.
+     *
+     * @returns This `EncryptedColumn` instance for method chaining.
+     *
+     * @example
+     * ```typescript
+     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+     *
+     * const documents = encryptedTable("documents", {
+     *   metadata: encryptedColumn("metadata").searchableJson(),
+     * })
+     * ```
+     */
+    searchableJson(): this;
+    build(): {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+        indexes: {
+            ore?: OreIndexOpts;
+            unique?: UniqueIndexOpts;
+            match?: Required<MatchIndexOpts>;
+            ste_vec?: SteVecIndexOpts;
+        };
+    };
+    getName(): string;
+}
+interface TableDefinition {
+    tableName: string;
+    columns: Record<string, ColumnSchema>;
+}
+declare class EncryptedTable<T extends EncryptedTableColumn> {
+    readonly tableName: string;
+    readonly columnBuilders: T;
+    /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
+    readonly _columnType: T;
+    constructor(tableName: string, columnBuilders: T);
+    /**
+     * Compile this table schema into a `TableDefinition` used internally by the encryption client.
+     *
+     * Iterates over all column builders, calls `.build()` on each, and assembles
+     * the final `{ tableName, columns }` structure. For `searchableJson()` columns,
+     * the STE-Vec prefix is automatically set to `"<tableName>/<columnName>"`.
+     *
+     * @returns A `TableDefinition` containing the table name and built column configs.
+     *
+     * @example
+     * ```typescript
+     * const users = encryptedTable("users", {
+     *   email: encryptedColumn("email").equality(),
+     * })
+     *
+     * const definition = users.build()
+     * // { tableName: "users", columns: { email: { cast_as: "string", indexes: { unique: ... } } } }
+     * ```
+     */
+    build(): TableDefinition;
+}
+/**
+ * Infer the plaintext (decrypted) type from a EncryptedTable schema.
+ *
+ * @example
+ * ```typescript
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality(),
+ *   name: encryptedColumn("name"),
+ * })
+ *
+ * type UserPlaintext = InferPlaintext<typeof users>
+ * // => { email: string; name: string }
+ * ```
+ */
+type InferPlaintext<T extends EncryptedTable<any>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C as C[K] extends EncryptedColumn | EncryptedField ? K : never]: string;
+} : never;
+/**
+ * Infer the encrypted type from a EncryptedTable schema.
+ *
+ * @example
+ * ```typescript
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality(),
+ * })
+ *
+ * type UserEncrypted = InferEncrypted<typeof users>
+ * // => { email: Encrypted }
+ * ```
+ */
+type InferEncrypted<T extends EncryptedTable<any>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C as C[K] extends EncryptedColumn | EncryptedField ? K : never]: Encrypted;
+} : never;
+/**
+ * Define an encrypted table schema.
+ *
+ * Creates a `EncryptedTable` that maps a database table name to a set of encrypted
+ * column definitions. Pass the resulting object to `Encryption({ schemas: [...] })`
+ * when initializing the client.
+ *
+ * The returned object is also a proxy that exposes each column builder directly,
+ * so you can reference columns as `users.email` when calling `encrypt`, `decrypt`,
+ * and `encryptQuery`.
+ *
+ * @param tableName - The name of the database table this schema represents.
+ * @param columns - An object whose keys are logical column names and values are
+ *   {@link EncryptedColumn} from {@link encryptedColumn}, or nested objects whose
+ *   leaves are {@link EncryptedField} from {@link encryptedField}.
+ * @returns A `EncryptedTable<T> & T` that can be used as both a schema definition
+ *   and a column accessor.
+ *
+ * @example
+ * ```typescript
+ * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+ *
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality().freeTextSearch(),
+ *   address: encryptedColumn("address"),
+ * })
+ *
+ * // Use as schema
+ * const client = await Encryption({ schemas: [users] })
+ *
+ * // Use as column accessor
+ * await client.encrypt("hello@example.com", { column: users.email, table: users })
+ * ```
+ */
+declare function encryptedTable<T extends EncryptedTableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
+/**
+ * Define an encrypted column within a table schema.
+ *
+ * Creates a `EncryptedColumn` builder for the given column name. Chain index
+ * methods (`.equality()`, `.freeTextSearch()`, `.orderAndRange()`,
+ * `.searchableJson()`) and/or `.dataType()` to configure searchable encryption
+ * and the plaintext data type.
+ *
+ * @param columnName - The name of the database column to encrypt.
+ * @returns A new `EncryptedColumn` builder.
+ *
+ * @example
+ * ```typescript
+ * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+ *
+ * const users = encryptedTable("users", {
+ *   email: encryptedColumn("email").equality().freeTextSearch().orderAndRange(),
+ * })
+ * ```
+ */
+declare function encryptedColumn(columnName: string): EncryptedColumn;
+/**
+ * Define an encrypted field for use in nested or structured schemas.
+ *
+ * `encryptedField` is similar to {@link encryptedColumn} but creates an {@link EncryptedField}
+ * for nested fields that are encrypted but not searchable (no indexes). Use `.dataType()`
+ * to specify the plaintext type.
+ *
+ * @param valueName - The name of the value field.
+ * @returns A new `EncryptedField` builder.
+ *
+ * @example
+ * ```typescript
+ * import { encryptedTable, encryptedField } from "@cipherstash/stack/schema"
+ *
+ * const orders = encryptedTable("orders", {
+ *   details: {
+ *     amount: encryptedField("amount").dataType("number"),
+ *     currency: encryptedField("currency"),
+ *   },
+ * })
+ * ```
+ */
+declare function encryptedField(valueName: string): EncryptedField;
+
+/**
+ * WASM-inline entry for `@cipherstash/stack` — for Deno, Bun, Cloudflare
+ * Workers, Supabase Edge Functions, and any runtime where the native
+ * `@cipherstash/protect-ffi` NAPI bindings are unavailable.
+ *
+ * Mirrors the protect-ffi / auth `/wasm-inline` pattern: the WASM module
+ * is inlined into the JS bundle as a base64 blob (no separate `.wasm`
+ * fetch / file read), so this entry works in environments that disallow
+ * `fs` or relative asset loading.
+ *
+ * Use this import path: `@cipherstash/stack/wasm-inline`
+ *
+ * @example
+ * ```ts
+ * import {
+ *   Encryption, encryptedTable, encryptedColumn,
+ * } from "@cipherstash/stack/wasm-inline"
+ *
+ * const users = encryptedTable("users", { email: encryptedColumn("email") })
+ *
+ * const client = await Encryption({
+ *   schemas: [users],
+ *   config: {
+ *     workspaceCrn: Deno.env.get("CS_WORKSPACE_CRN")!,
+ *     accessKey:    Deno.env.get("CS_CLIENT_ACCESS_KEY")!,
+ *     clientId:     Deno.env.get("CS_CLIENT_ID")!,
+ *     clientKey:    Deno.env.get("CS_CLIENT_KEY")!,
+ *   },
+ * })
+ *
+ * const enc = await client.encrypt("alice@example.com", {
+ *   column: users.email,
+ *   table: users,
+ * })
+ * const dec = await client.decrypt(enc)
+ * ```
+ *
+ * For per-user, identity-bound encryption on the edge, build an
+ * `OidcFederationStrategy` (federates an end user's OIDC JWT — Clerk,
+ * Supabase, … — into a CTS service token) and pass it via
+ * `config.authStrategy`:
+ *
+ * ```ts
+ * import { OidcFederationStrategy } from "@cipherstash/stack/wasm-inline"
+ * import { cookieStore } from "@cipherstash/auth/cookies"
+ *
+ * const authStrategy = OidcFederationStrategy.create(
+ *   "crn:ap-southeast-2.aws:my-workspace-id", () => getClerkSessionToken(req),
+ *   { store: cookieStore({ request: req, responseHeaders }) },
+ * )
+ * const client = await Encryption({ schemas, config: { authStrategy, clientId, clientKey } })
+ * ```
+ *
+ * For service-to-service / CI use with a custom token store, build an
+ * `AccessKeyStrategy.create(workspaceCrn, accessKey, { store })` the same
+ * way (it derives the region from the CRN). Both strategies are
+ * re-exported from this entry.
+ */
+
+/** Re-exported convenience predicate — same as the raw protect-ffi one. */
+declare function isEncrypted(value: unknown): boolean;
+/**
+ * The plaintext shape accepted by `encrypt` and returned by `decrypt`.
+ * Mirrors protect-ffi's `JsPlaintext` (recursive: arrays of any of
+ * these are valid). Re-defined here so the wasm-inline `.d.ts` doesn't
+ * pull in the Node-only protect-ffi types.
+ */
+type WasmPlaintext = string | number | boolean | null | Record<string, unknown> | WasmPlaintext[];
+/**
+ * Config for {@link Encryption} on the WASM entry point.
+ *
+ * The workspace CRN is the single source of truth for workspace
+ * identity and deployment region — matching the Node entry and
+ * protect-ffi 0.25+, which read `CS_WORKSPACE_CRN` and no longer
+ * consult a separate `CS_REGION`. The CRN is passed straight to the
+ * underlying `AccessKeyStrategy`, which derives the region from it, so
+ * there is no `region` field to keep in sync.
+ *
+ * For service-to-service / CI use, pass `accessKey` plus the workspace
+ * `clientId` / `clientKey` and we construct an `AccessKeyStrategy` for
+ * you. To plug in a custom token store (cookies on Supabase Edge, KV on
+ * Cloudflare Workers, …) or to bind encryption to an end user, build the
+ * strategy yourself — `AccessKeyStrategy` or `OidcFederationStrategy` —
+ * and hand it to `config.authStrategy` instead. A pre-built strategy
+ * already carries the CRN, so `workspaceCrn` is optional on that path.
+ *
+ * Mirrors the Node `ClientConfig`: `authStrategy` is the documented field,
+ * `strategy` is retained as a deprecated alias (see below).
+ */
+type WasmClientConfig = {
+    /** Workspace client identifier — required by the WASM client. */
+    clientId: string;
+    /** Workspace client key — required by the WASM client. */
+    clientKey: string;
+} & ({
+    /**
+     * CipherStash workspace CRN, e.g.
+     * `"crn:ap-southeast-2.aws:my-workspace-id"`. Required on the
+     * access-key path — it is the single source of truth for workspace
+     * identity and `AccessKeyStrategy` derives the region from it.
+     */
+    workspaceCrn: string;
+    accessKey: string;
+    authStrategy?: never;
+    strategy?: never;
+} | {
+    /**
+     * Optional on the strategy path. A pre-built `authStrategy` (e.g.
+     * `OidcFederationStrategy.create(workspaceCrn, …)`) already
+     * encapsulates the workspace CRN and region, so the SDK never reads
+     * this — supply it if convenient, omit it otherwise.
+     */
+    workspaceCrn?: string;
+    accessKey?: never;
+    /** A pre-built auth strategy for per-user or M2M authentication. */
+    authStrategy: WasmAuthStrategy;
+    /**
+     * @deprecated Renamed to `authStrategy`. Still honoured for backwards
+     * compatibility (it logs a deprecation warning at runtime) but will be
+     * removed in a future release.
+     */
+    strategy?: WasmAuthStrategy;
+} | {
+    workspaceCrn?: string;
+    accessKey?: never;
+    authStrategy?: never;
+    /**
+     * @deprecated Renamed to `authStrategy`. Still honoured for backwards
+     * compatibility (it logs a deprecation warning at runtime) but will be
+     * removed in a future release.
+     */
+    strategy: WasmAuthStrategy;
+});
+/**
+ * Any auth strategy accepted on the WASM path. Both expose
+ * `getToken(): Promise<Result<TokenResult, AuthFailure>>` — as of
+ * `@cipherstash/auth` 0.41 the token is wrapped in a `@byteslice/result`
+ * envelope. `@cipherstash/protect-ffi` 0.28+ unwraps that envelope (reading
+ * `.data.token`, surfacing `.failure`) inside its WASM `newClient`; 0.27 read
+ * `.token` off the envelope and saw `undefined`, so keep the ffi floor at 0.28.
+ *
+ * - {@link AccessKeyStrategy} — static M2M / CI access key.
+ * - {@link OidcFederationStrategy} — federates an end-user OIDC JWT into a
+ *   CTS service token, for per-user identity-bound encryption.
+ */
+type WasmAuthStrategy = AccessKeyStrategy | OidcFederationStrategy;
+type WasmEncryptionConfig = {
+    schemas: [
+        EncryptedTable<EncryptedTableColumn>,
+        ...EncryptedTable<EncryptedTableColumn>[]
+    ];
+    config: WasmClientConfig;
+};
+/**
+ * WASM encryption client. Returned by {@link Encryption}.
+ *
+ * Wraps an opaque `wasmNewClient` handle and exposes a minimal
+ * `encrypt` / `decrypt` surface. Larger surface (bulk, query, model
+ * helpers) lives on the Node entry — port lazily as Deno / edge
+ * consumers demand it.
+ *
+ * Construct via {@link Encryption} — the constructor is private to
+ * prevent callers from wrapping arbitrary objects in this type.
+ */
+declare class WasmEncryptionClient {
+    /** @internal */
+    private readonly client;
+    /**
+     * @internal Gated by the module-scoped {@link INTERNAL_CONSTRUCT}
+     * symbol: external callers can't obtain it, so {@link Encryption} is
+     * effectively the only constructor. (A `private` constructor would
+     * block {@link Encryption} too, since it lives outside the class.)
+     */
+    constructor(token: symbol, client: unknown);
+    encrypt(plaintext: WasmPlaintext, opts: EncryptOptions): Promise<Encrypted>;
+    decrypt(encrypted: Encrypted): Promise<WasmPlaintext>;
+    isEncrypted(value: unknown): boolean;
+}
+/**
+ * Initialize a WASM-backed encryption client.
+ *
+ * Mirrors the Node entry's {@link import('./encryption').Encryption}
+ * factory, but constructs the protect-ffi client via the WASM strategy
+ * API. Use from Deno / Edge / Workers / Bun.
+ */
+declare function Encryption(config: WasmEncryptionConfig): Promise<WasmEncryptionClient>;
+/**
+ * Convert SDK-facing `cast_as` values (`'string'`, `'number'`, …) to the
+ * EQL-native variants (`'text'`, `'double'`, …) that the WASM
+ * `newClient` accepts.
+ *
+ * The Node entry of protect-ffi performs this normalization internally
+ * via `normalizeEncryptConfig.js`; the WASM bindings do not. Without
+ * this, the WASM client rejects an `encryptedColumn('email')` (which
+ * defaults to `cast_as: 'string'`) with
+ * `unknown variant `string`, expected one of `big_int`, …`.
+ *
+ * `toEqlCastAs` is exhaustive over the current `CastAs` union; if a new
+ * SDK-facing variant is added without updating that switch, this
+ * function throws synchronously at startup with a clear message rather
+ * than handing `undefined` to the WASM serde (which surfaces as an
+ * opaque `unknown variant 'null'` error).
+ *
+ * @internal exported for unit-test coverage of the drift-guard branch.
+ */
+declare function normalizeCastAs(config: EncryptConfig): unknown;
+/**
+ * Resolve a column's name structurally. Accepts any column builder exposing
+ * `getName()` — v2 `EncryptedColumn` / `EncryptedField` AND v3 column builders
+ * (e.g. `EncryptedTextSearchColumn`) alike — matching the structural
+ * `BuildableColumn` contract that `EncryptOptions.column` was widened to.
+ *
+ * An `instanceof EncryptedColumn || EncryptedField` gate would type-check after
+ * the widening but throw at runtime for a v3 column, breaking the type promise;
+ * resolving the name structurally keeps the wasm-inline encrypt entry honest.
+ * The `typeof` check still fails loudly for plain JS callers passing a value
+ * that is not a column builder.
+ *
+ * @internal exported for unit-test coverage.
+ */
+declare function getColumnName(col: EncryptOptions['column']): string;
+/**
+ * Reset the once-per-process deprecation-warning latch. Test-only hook so
+ * suites can assert the warning fires deterministically, independent of test
+ * ordering.
+ * @internal
+ */
+declare function __resetStrategyDeprecationWarningForTests(): void;
+/**
+ * Resolve the auth strategy for the WASM client from its config: an explicit
+ * `config.authStrategy` (or the deprecated `config.strategy` alias), or — for
+ * the access-key path — an `AccessKeyStrategy` built from the workspace CRN
+ * (region derived from it inside `@cipherstash/auth`). An auth strategy and
+ * `accessKey` are mutually exclusive.
+ *
+ * @internal exported for offline unit coverage of the strategy wiring; the
+ * gated Deno e2e (`e2e/wasm/roundtrip.test.ts`) is the only other exercise of
+ * this path and it skips without real `CS_*` secrets.
+ */
+declare function resolveStrategy(cfg: WasmClientConfig): WasmAuthStrategy;
+
+export { type Encrypted, EncryptedColumn, EncryptedField, EncryptedTable, type EncryptedTableColumn, Encryption, type InferEncrypted, type InferPlaintext, type WasmAuthStrategy, type WasmClientConfig, WasmEncryptionClient, type WasmEncryptionConfig, type WasmPlaintext, __resetStrategyDeprecationWarningForTests, encryptedColumn, encryptedField, encryptedTable, getColumnName, isEncrypted, normalizeCastAs, resolveStrategy };