@cipherstash/stack 0.16.0 → 0.19.0

package/dist/chunk-OFQ555AX.js

@@ -0,0 +1,191 @@
+import {
+  withResult
+} from "./chunk-JSG2AMDI.js";
+import {
+  logger
+} from "./chunk-HQANMV7R.js";
+import {
+  EncryptionErrorTypes
+} from "./chunk-LBMC4D6D.js";
+
+// src/utils/config/index.ts
+import fs from "fs";
+import path from "path";
+function getWorkspaceCrn(tomlString) {
+  let currentSection = "";
+  let workspaceCrn;
+  const lines = tomlString.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmedLine = line.trim();
+    if (!trimmedLine || trimmedLine.startsWith("#")) {
+      continue;
+    }
+    const sectionMatch = trimmedLine.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      currentSection = sectionMatch[1];
+      continue;
+    }
+    const kvMatch = trimmedLine.match(/^(\w+)\s*=\s*"([^"]+)"$/);
+    if (kvMatch) {
+      const [_, key, value] = kvMatch;
+      if (currentSection === "auth" && key === "workspace_crn") {
+        workspaceCrn = value;
+        break;
+      }
+    }
+  }
+  return workspaceCrn;
+}
+function extractWorkspaceIdFromCrn(crn) {
+  const match = crn.match(/crn:[^:]+:([^:]+)$/);
+  if (!match) {
+    throw new Error("Invalid CRN format");
+  }
+  return match[1];
+}
+function loadWorkSpaceId(suppliedCrn) {
+  const configPath = path.join(process.cwd(), "cipherstash.toml");
+  if (suppliedCrn) {
+    return extractWorkspaceIdFromCrn(suppliedCrn);
+  }
+  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {
+    throw new Error(
+      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
+    );
+  }
+  if (process.env.CS_WORKSPACE_CRN) {
+    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN);
+  }
+  if (!fs.existsSync(configPath)) {
+    throw new Error(
+      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
+    );
+  }
+  const tomlString = fs.readFileSync(configPath, "utf8");
+  const workspaceCrn = getWorkspaceCrn(tomlString);
+  if (!workspaceCrn) {
+    throw new Error(
+      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
+    );
+  }
+  return extractWorkspaceIdFromCrn(workspaceCrn);
+}
+
+// src/identity/index.ts
+function resolveLockContext(input) {
+  return input instanceof LockContext || "identityContext" in input ? input.identityContext : input;
+}
+var LockContext = class {
+  ctsToken;
+  workspaceId;
+  context;
+  constructor({
+    context = { identityClaim: ["sub"] },
+    ctsToken
+  } = {}) {
+    const workspaceId = loadWorkSpaceId();
+    if (!workspaceId) {
+      throw new Error(
+        "You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable."
+      );
+    }
+    if (ctsToken) {
+      this.ctsToken = ctsToken;
+    }
+    this.workspaceId = workspaceId;
+    this.context = context;
+    logger.debug("Successfully initialized the EQL lock context.");
+  }
+  /**
+   * The identity-claim context this lock context binds to, e.g.
+   * `{ identityClaim: ['sub'] }`. Resolved synchronously — `.withLockContext()`
+   * uses this directly; no CTS token is required.
+   */
+  get identityContext() {
+    return this.context;
+  }
+  /**
+   * Exchange a user's JWT for a CTS token and bind it to this lock context.
+   *
+   * @deprecated Per-operation CTS tokens were removed in protect-ffi 0.25.
+   * Authenticate the client as the user with an `OidcFederationStrategy`
+   * (`config.authStrategy`) instead, and pass the claim to `.withLockContext()`.
+   * The token fetched here is no longer used by encryption operations. This
+   * method is kept for backwards compatibility and will be removed in a
+   * future major release.
+   *
+   * @param jwtToken - A valid OIDC / JWT token for the current user.
+   * @returns A `Result` containing this `LockContext` or an error.
+   */
+  async identify(jwtToken) {
+    const workspaceId = this.workspaceId;
+    const ctsEndpoint = process.env.CS_CTS_ENDPOINT || "https://ap-southeast-2.aws.auth.viturhosted.net";
+    const ctsFetchResult = await withResult(
+      () => fetch(`${ctsEndpoint}/api/authorize`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          workspaceId,
+          oidcToken: jwtToken
+        })
+      }),
+      (error) => ({
+        type: EncryptionErrorTypes.CtsTokenError,
+        message: error.message
+      })
+    );
+    if (ctsFetchResult.failure) {
+      return ctsFetchResult;
+    }
+    const identifiedLockContext = await withResult(
+      async () => {
+        const ctsToken = await ctsFetchResult.data.json();
+        if (!ctsToken.accessToken) {
+          throw new Error(
+            "The response from the CipherStash API did not contain an access token. Please contact support."
+          );
+        }
+        this.ctsToken = ctsToken;
+        return this;
+      },
+      (error) => ({
+        type: EncryptionErrorTypes.CtsTokenError,
+        message: error.message
+      })
+    );
+    return identifiedLockContext;
+  }
+  /**
+   * Retrieve the identity context (and CTS token, if one was set).
+   *
+   * @deprecated Encryption operations no longer consume a CTS token — they read
+   * the identity claim directly via {@link identityContext}. Pass the claim to
+   * `.withLockContext()` and authenticate the client with an
+   * `OidcFederationStrategy` instead. Kept for backwards compatibility; the
+   * returned `ctsToken` is `undefined` unless one was supplied to the
+   * constructor or {@link identify} was called.
+   */
+  getLockContext() {
+    return withResult(
+      () => ({
+        context: this.context,
+        // Only include `ctsToken` when one was actually set, so the
+        // returned shape matches the optional `ctsToken?` type rather
+        // than carrying an explicit `undefined`.
+        ...this.ctsToken ? { ctsToken: this.ctsToken } : {}
+      }),
+      (error) => ({
+        type: EncryptionErrorTypes.CtsTokenError,
+        message: error.message
+      })
+    );
+  }
+};
+
+export {
+  resolveLockContext,
+  LockContext
+};
+//# sourceMappingURL=chunk-OFQ555AX.js.map

package/dist/chunk-OFQ555AX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/config/index.ts","../src/identity/index.ts"],"sourcesContent":["import fs from 'node:fs'\nimport path from 'node:path'\n\n/**\n * A lightweight function that parses a TOML-like string\n * and returns the `workspace_crn` value found under `[auth]`.\n *\n * @param tomlString The contents of the TOML file as a string.\n * @returns The workspace_crn if found, otherwise undefined.\n */\nfunction getWorkspaceCrn(tomlString: string): string | undefined {\n  let currentSection = ''\n  let workspaceCrn: string | undefined\n\n  const lines = tomlString.split(/\\r?\\n/)\n\n  for (const line of lines) {\n    const trimmedLine = line.trim()\n\n    if (!trimmedLine || trimmedLine.startsWith('#')) {\n      continue\n    }\n\n    const sectionMatch = trimmedLine.match(/^\\[([^\\]]+)\\]$/)\n    if (sectionMatch) {\n      currentSection = sectionMatch[1]\n      continue\n    }\n\n    const kvMatch = trimmedLine.match(/^(\\w+)\\s*=\\s*\"([^\"]+)\"$/)\n    if (kvMatch) {\n      const [_, key, value] = kvMatch\n\n      if (currentSection === 'auth' && key === 'workspace_crn') {\n        workspaceCrn = value\n        break\n      }\n    }\n  }\n\n  return workspaceCrn\n}\n\n/**\n * Extracts the workspace ID from a CRN string.\n * CRN format: crn:region.aws:ID\n *\n * @param crn The CRN string to extract from\n * @returns The workspace ID portion of the CRN\n */\nexport function extractWorkspaceIdFromCrn(crn: string): string {\n  const match = crn.match(/crn:[^:]+:([^:]+)$/)\n  if (!match) {\n    throw new Error('Invalid CRN format')\n  }\n  return match[1]\n}\n\nexport function loadWorkSpaceId(suppliedCrn?: string): string {\n  const configPath = path.join(process.cwd(), 'cipherstash.toml')\n\n  if (suppliedCrn) {\n    return extractWorkspaceIdFromCrn(suppliedCrn)\n  }\n\n  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  // Environment variables take precedence over config files\n  if (process.env.CS_WORKSPACE_CRN) {\n    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN)\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  const tomlString = fs.readFileSync(configPath, 'utf8')\n  const workspaceCrn = getWorkspaceCrn(tomlString)\n\n  if (!workspaceCrn) {\n    throw new Error(\n      'You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable.',\n    )\n  }\n\n  return extractWorkspaceIdFromCrn(workspaceCrn)\n}\n","import { type Result, withResult } from '@byteslice/result'\nimport { type EncryptionError, EncryptionErrorTypes } from '@/errors'\nimport { loadWorkSpaceId } from '@/utils/config'\nimport { logger } from '@/utils/logger'\n\nexport type CtsRegions = 'ap-southeast-2'\n\nexport type IdentifyOptions = {\n  fetchFromCts?: boolean\n}\n\nexport type CtsToken = {\n  accessToken: string\n  expiry: number\n}\n\nexport type Context = {\n  identityClaim: string[]\n}\n\nexport type LockContextOptions = {\n  context?: Context\n  ctsToken?: CtsToken\n}\n\nexport type GetLockContextResponse = {\n  ctsToken?: CtsToken\n  context: Context\n}\n\n/**\n * The accepted argument to `.withLockContext()` — either a {@link LockContext}\n * or a plain identity-claim spec (e.g. `{ identityClaim: ['sub'] }`).\n */\nexport type LockContextInput = LockContext | Context\n\n/**\n * Resolve a {@link LockContextInput} to the {@link Context} (identity claim)\n * that protect-ffi expects. Synchronous — no token round-trip.\n */\nexport function resolveLockContext(input: LockContextInput): Context {\n  // Use a structural check as well as `instanceof` so a `LockContext`\n  // constructed in another realm (or from a duplicate module instance) is still\n  // resolved rather than slipping through as a raw `Context`.\n  return input instanceof LockContext || 'identityContext' in input\n    ? (input as LockContext).identityContext\n    : input\n}\n\n/**\n * Binds an encryption/decryption operation to a user's identity by selecting\n * which JWT claim(s) ZeroKMS bakes into the data key's tag (the *lock context*).\n *\n * The claim **value** is resolved by ZeroKMS from the token that authenticates\n * the request — so to bind to a real end user, authenticate the client as that\n * user with an `OidcFederationStrategy` (from `@cipherstash/auth`) and pass the\n * claim to `.withLockContext()`. The same context must be supplied to decrypt.\n *\n * You can pass a plain `{ identityClaim }` directly — constructing a\n * `LockContext` is optional.\n *\n * @example\n * ```typescript\n * import { Encryption } from \"@cipherstash/stack\"\n * import { OidcFederationStrategy } from \"@cipherstash/auth\"\n *\n * // Authenticate the client as the end user (replaces the old identify() flow).\n * const client = await Encryption({\n *   schemas,\n *   config: {\n *     authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getJwt()),\n *   },\n * })\n *\n * // Bind the key to the user's `sub` claim — no token, no identify().\n * const result = await client\n *   .encrypt(value, { column: users.email, table: users })\n *   .withLockContext({ identityClaim: [\"sub\"] })\n * ```\n */\nexport class LockContext {\n  private ctsToken: CtsToken | undefined\n  private workspaceId: string\n  private context: Context\n\n  constructor({\n    context = { identityClaim: ['sub'] },\n    ctsToken,\n  }: LockContextOptions = {}) {\n    const workspaceId = loadWorkSpaceId()\n\n    if (!workspaceId) {\n      throw new Error(\n        'You have not defined a workspace ID in your config file, or the CS_WORKSPACE_CRN environment variable.',\n      )\n    }\n\n    if (ctsToken) {\n      this.ctsToken = ctsToken\n    }\n\n    this.workspaceId = workspaceId\n    this.context = context\n    logger.debug('Successfully initialized the EQL lock context.')\n  }\n\n  /**\n   * The identity-claim context this lock context binds to, e.g.\n   * `{ identityClaim: ['sub'] }`. Resolved synchronously — `.withLockContext()`\n   * uses this directly; no CTS token is required.\n   */\n  get identityContext(): Context {\n    return this.context\n  }\n\n  /**\n   * Exchange a user's JWT for a CTS token and bind it to this lock context.\n   *\n   * @deprecated Per-operation CTS tokens were removed in protect-ffi 0.25.\n   * Authenticate the client as the user with an `OidcFederationStrategy`\n   * (`config.authStrategy`) instead, and pass the claim to `.withLockContext()`.\n   * The token fetched here is no longer used by encryption operations. This\n   * method is kept for backwards compatibility and will be removed in a\n   * future major release.\n   *\n   * @param jwtToken - A valid OIDC / JWT token for the current user.\n   * @returns A `Result` containing this `LockContext` or an error.\n   */\n  async identify(\n    jwtToken: string,\n  ): Promise<Result<LockContext, EncryptionError>> {\n    const workspaceId = this.workspaceId\n\n    const ctsEndpoint =\n      process.env.CS_CTS_ENDPOINT ||\n      'https://ap-southeast-2.aws.auth.viturhosted.net'\n\n    const ctsFetchResult = await withResult(\n      () =>\n        fetch(`${ctsEndpoint}/api/authorize`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n          },\n          body: JSON.stringify({\n            workspaceId,\n            oidcToken: jwtToken,\n          }),\n        }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    if (ctsFetchResult.failure) {\n      return ctsFetchResult\n    }\n\n    const identifiedLockContext = await withResult(\n      async () => {\n        const ctsToken = (await ctsFetchResult.data.json()) as CtsToken\n\n        if (!ctsToken.accessToken) {\n          throw new Error(\n            'The response from the CipherStash API did not contain an access token. Please contact support.',\n          )\n        }\n\n        this.ctsToken = ctsToken\n        return this\n      },\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n\n    return identifiedLockContext\n  }\n\n  /**\n   * Retrieve the identity context (and CTS token, if one was set).\n   *\n   * @deprecated Encryption operations no longer consume a CTS token — they read\n   * the identity claim directly via {@link identityContext}. Pass the claim to\n   * `.withLockContext()` and authenticate the client with an\n   * `OidcFederationStrategy` instead. Kept for backwards compatibility; the\n   * returned `ctsToken` is `undefined` unless one was supplied to the\n   * constructor or {@link identify} was called.\n   */\n  getLockContext(): Promise<Result<GetLockContextResponse, EncryptionError>> {\n    return withResult(\n      () => ({\n        context: this.context,\n        // Only include `ctsToken` when one was actually set, so the\n        // returned shape matches the optional `ctsToken?` type rather\n        // than carrying an explicit `undefined`.\n        ...(this.ctsToken ? { ctsToken: this.ctsToken } : {}),\n      }),\n      (error) => ({\n        type: EncryptionErrorTypes.CtsTokenError,\n        message: error.message,\n      }),\n    )\n  }\n}\n"],"mappings":";;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AASjB,SAAS,gBAAgB,YAAwC;AAC/D,MAAI,iBAAiB;AACrB,MAAI;AAEJ,QAAM,QAAQ,WAAW,MAAM,OAAO;AAEtC,aAAW,QAAQ,OAAO;AACxB,UAAM,cAAc,KAAK,KAAK;AAE9B,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG,GAAG;AAC/C;AAAA,IACF;AAEA,UAAM,eAAe,YAAY,MAAM,gBAAgB;AACvD,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,MAAM,yBAAyB;AAC3D,QAAI,SAAS;AACX,YAAM,CAAC,GAAG,KAAK,KAAK,IAAI;AAExB,UAAI,mBAAmB,UAAU,QAAQ,iBAAiB;AACxD,uBAAe;AACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,0BAA0B,KAAqB;AAC7D,QAAM,QAAQ,IAAI,MAAM,oBAAoB;AAC5C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,SAAO,MAAM,CAAC;AAChB;AAEO,SAAS,gBAAgB,aAA8B;AAC5D,QAAM,aAAa,KAAK,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAE9D,MAAI,aAAa;AACf,WAAO,0BAA0B,WAAW;AAAA,EAC9C;AAEA,MAAI,CAAC,GAAG,WAAW,UAAU,KAAK,CAAC,QAAQ,IAAI,kBAAkB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,IAAI,kBAAkB;AAChC,WAAO,0BAA0B,QAAQ,IAAI,gBAAgB;AAAA,EAC/D;AAEA,MAAI,CAAC,GAAG,WAAW,UAAU,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,GAAG,aAAa,YAAY,MAAM;AACrD,QAAM,eAAe,gBAAgB,UAAU;AAE/C,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,0BAA0B,YAAY;AAC/C;;;ACpDO,SAAS,mBAAmB,OAAkC;AAInE,SAAO,iBAAiB,eAAe,qBAAqB,QACvD,MAAsB,kBACvB;AACN;AAiCO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY;AAAA,IACV,UAAU,EAAE,eAAe,CAAC,KAAK,EAAE;AAAA,IACnC;AAAA,EACF,IAAwB,CAAC,GAAG;AAC1B,UAAM,cAAc,gBAAgB;AAEpC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,WAAK,WAAW;AAAA,IAClB;AAEA,SAAK,cAAc;AACnB,SAAK,UAAU;AACf,WAAO,MAAM,gDAAgD;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,kBAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,SACJ,UAC+C;AAC/C,UAAM,cAAc,KAAK;AAEzB,UAAM,cACJ,QAAQ,IAAI,mBACZ;AAEF,UAAM,iBAAiB,MAAM;AAAA,MAC3B,MACE,MAAM,GAAG,WAAW,kBAAkB;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,MACH,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AAEA,UAAM,wBAAwB,MAAM;AAAA,MAClC,YAAY;AACV,cAAM,WAAY,MAAM,eAAe,KAAK,KAAK;AAEjD,YAAI,CAAC,SAAS,aAAa;AACzB,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAEA,aAAK,WAAW;AAChB,eAAO;AAAA,MACT;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,iBAA2E;AACzE,WAAO;AAAA,MACL,OAAO;AAAA,QACL,SAAS,KAAK;AAAA;AAAA;AAAA;AAAA,QAId,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MACrD;AAAA,MACA,CAAC,WAAW;AAAA,QACV,MAAM,qBAAqB;AAAA,QAC3B,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-U66S7VIF.js

@@ -0,0 +1,435 @@
+import {
+  cloneMatchOpts,
+  defaultMatchOpts
+} from "./chunk-IADZCZEA.js";
+
+// src/eql/v3/columns.ts
+var STORAGE_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var EQUALITY_ONLY = {
+  equality: true,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var ORDER_AND_RANGE = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: false
+};
+var MATCH_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: true
+};
+var TEXT_SEARCH = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: true
+};
+var TEXT_SEARCH_EQL_TYPE = "eql_v3.text_search";
+var INTEGER = {
+  eqlType: "eql_v3.integer",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var INTEGER_EQ = {
+  eqlType: "eql_v3.integer_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var INTEGER_ORD_ORE = {
+  eqlType: "eql_v3.integer_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var INTEGER_ORD = {
+  eqlType: "eql_v3.integer_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT = {
+  eqlType: "eql_v3.smallint",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var SMALLINT_EQ = {
+  eqlType: "eql_v3.smallint_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var SMALLINT_ORD_ORE = {
+  eqlType: "eql_v3.smallint_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT_ORD = {
+  eqlType: "eql_v3.smallint_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE = {
+  eqlType: "eql_v3.date",
+  castAs: "date",
+  capabilities: STORAGE_ONLY
+};
+var DATE_EQ = {
+  eqlType: "eql_v3.date_eq",
+  castAs: "date",
+  capabilities: EQUALITY_ONLY
+};
+var DATE_ORD_ORE = {
+  eqlType: "eql_v3.date_ord_ore",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE_ORD = {
+  eqlType: "eql_v3.date_ord",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP = {
+  eqlType: "eql_v3.timestamp",
+  castAs: "timestamp",
+  capabilities: STORAGE_ONLY
+};
+var TIMESTAMP_EQ = {
+  eqlType: "eql_v3.timestamp_eq",
+  castAs: "timestamp",
+  capabilities: EQUALITY_ONLY
+};
+var TIMESTAMP_ORD_ORE = {
+  eqlType: "eql_v3.timestamp_ord_ore",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP_ORD = {
+  eqlType: "eql_v3.timestamp_ord",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC = {
+  eqlType: "eql_v3.numeric",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var NUMERIC_EQ = {
+  eqlType: "eql_v3.numeric_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var NUMERIC_ORD_ORE = {
+  eqlType: "eql_v3.numeric_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC_ORD = {
+  eqlType: "eql_v3.numeric_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT = {
+  eqlType: "eql_v3.text",
+  castAs: "string",
+  capabilities: STORAGE_ONLY
+};
+var TEXT_EQ = {
+  eqlType: "eql_v3.text_eq",
+  castAs: "string",
+  capabilities: EQUALITY_ONLY
+};
+var TEXT_MATCH = {
+  eqlType: "eql_v3.text_match",
+  castAs: "string",
+  capabilities: MATCH_ONLY
+};
+var TEXT_ORD_ORE = {
+  eqlType: "eql_v3.text_ord_ore",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT_ORD = {
+  eqlType: "eql_v3.text_ord",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var BOOLEAN = {
+  eqlType: "eql_v3.boolean",
+  castAs: "boolean",
+  capabilities: STORAGE_ONLY
+};
+var REAL = {
+  eqlType: "eql_v3.real",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var REAL_EQ = {
+  eqlType: "eql_v3.real_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var REAL_ORD_ORE = {
+  eqlType: "eql_v3.real_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var REAL_ORD = {
+  eqlType: "eql_v3.real_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE = {
+  eqlType: "eql_v3.double",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var DOUBLE_EQ = {
+  eqlType: "eql_v3.double_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var DOUBLE_ORD_ORE = {
+  eqlType: "eql_v3.double_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE_ORD = {
+  eqlType: "eql_v3.double_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+function indexesForCapabilities(capabilities, castAs) {
+  const indexes = {};
+  if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
+    indexes.unique = { token_filters: [] };
+  }
+  if (capabilities.orderAndRange) {
+    indexes.ore = {};
+  }
+  if (capabilities.freeTextSearch) {
+    indexes.match = defaultMatchOpts();
+  }
+  return indexes;
+}
+function isQueryableCapabilities(capabilities) {
+  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch;
+}
+var EncryptedV3Column = class {
+  constructor(columnName, definition) {
+    this.columnName = columnName;
+    this.definition = definition;
+  }
+  columnName;
+  definition;
+  getName() {
+    return this.columnName;
+  }
+  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+  getEqlType() {
+    return this.definition.eqlType;
+  }
+  /** The semantic query capabilities this domain exposes. Metadata only. */
+  getQueryCapabilities() {
+    return this.definition.capabilities;
+  }
+  /** `true` when this domain can produce at least one kind of query term. */
+  isQueryable() {
+    return isQueryableCapabilities(
+      this.definition.capabilities
+    );
+  }
+  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+  build() {
+    return {
+      cast_as: this.definition.castAs,
+      indexes: indexesForCapabilities(
+        this.definition.capabilities,
+        this.definition.castAs
+      )
+    };
+  }
+};
+var TEXT_SEARCH_DOMAIN = {
+  eqlType: TEXT_SEARCH_EQL_TYPE,
+  castAs: "string",
+  capabilities: TEXT_SEARCH
+};
+var EncryptedTextSearchColumn = class extends EncryptedV3Column {
+  matchOpts;
+  constructor(columnName) {
+    super(columnName, TEXT_SEARCH_DOMAIN);
+    this.matchOpts = defaultMatchOpts();
+  }
+  /**
+   * Tune the match index. Each provided key replaces its default; omitted
+   * keys keep the default. This NEVER enables a capability — match is always
+   * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.
+   */
+  freeTextSearch(opts) {
+    const defaults = defaultMatchOpts();
+    this.matchOpts = cloneMatchOpts({
+      tokenizer: opts?.tokenizer ?? defaults.tokenizer,
+      token_filters: opts?.token_filters ?? defaults.token_filters,
+      k: opts?.k ?? defaults.k,
+      m: opts?.m ?? defaults.m,
+      include_original: opts?.include_original ?? defaults.include_original
+    });
+    return this;
+  }
+  /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */
+  build() {
+    return {
+      cast_as: "string",
+      indexes: {
+        unique: { token_filters: [] },
+        ore: {},
+        match: cloneMatchOpts(this.matchOpts)
+      }
+    };
+  }
+};
+var EncryptedIntegerColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextMatchColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBooleanColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
+};
+
+export {
+  TEXT_SEARCH_EQL_TYPE,
+  INTEGER,
+  INTEGER_EQ,
+  INTEGER_ORD_ORE,
+  INTEGER_ORD,
+  SMALLINT,
+  SMALLINT_EQ,
+  SMALLINT_ORD_ORE,
+  SMALLINT_ORD,
+  DATE,
+  DATE_EQ,
+  DATE_ORD_ORE,
+  DATE_ORD,
+  TIMESTAMP,
+  TIMESTAMP_EQ,
+  TIMESTAMP_ORD_ORE,
+  TIMESTAMP_ORD,
+  NUMERIC,
+  NUMERIC_EQ,
+  NUMERIC_ORD_ORE,
+  NUMERIC_ORD,
+  TEXT,
+  TEXT_EQ,
+  TEXT_MATCH,
+  TEXT_ORD_ORE,
+  TEXT_ORD,
+  BOOLEAN,
+  REAL,
+  REAL_EQ,
+  REAL_ORD_ORE,
+  REAL_ORD,
+  DOUBLE,
+  DOUBLE_EQ,
+  DOUBLE_ORD_ORE,
+  DOUBLE_ORD,
+  EncryptedV3Column,
+  EncryptedTextSearchColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDateOrdColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdOreColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextOrdColumn,
+  EncryptedBooleanColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedRealOrdColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedDoubleOrdColumn
+};
+//# sourceMappingURL=chunk-U66S7VIF.js.map