@cipherstash/stack 0.16.0 → 0.19.0

package/dist/{client-BLbA6aFD.d.ts → client-DfCrlHXh.d.ts}

@@ -1,8 +1,8 @@
-import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-Dv-r6Ik0.js';
-import { EncryptionError } from './errors/index.js';
 import { Result } from '@byteslice/result';
-import { JsPlaintext } from '@cipherstash/protect-ffi';
-import { LockContext } from './identity/index.js';
+import { EncryptionError } from './errors/index.js';
+import { n as EncryptedQueryResult, o as Client, S as ScalarQueryTerm, p as BulkDecryptedData, c as BulkDecryptPayload, D as Decrypted, q as BulkEncryptedData, B as BulkEncryptPayload, b as EncryptOptions, r as BuildableColumn, s as BuildableTable, a as Encrypted, P as Plaintext, t as EncryptQueryOptions, u as BuildableQueryColumn, Q as QueryTypeName, E as EncryptedReturnType, j as EncryptConfig, K as KeysetIdentifier, v as EncryptedFromBuildableTable, w as EncryptionClientConfig } from './types-public-CpS5KjwX.js';
+import { LockContextInput } from './identity/index.js';
+import { JsPlaintext, AuthStrategy } from '@cipherstash/protect-ffi';
 
 type AuditConfig = {
     metadata?: Record<string, unknown>;
@@ -32,24 +32,18 @@ declare abstract class EncryptionOperation<T> {
     then<TResult1 = Result<T, EncryptionError>, TResult2 = never>(onfulfilled?: ((value: Result<T, EncryptionError>) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): Promise<TResult1 | TResult2>;
 }
 
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} with array input instead.
- */
 declare class BatchEncryptQueryOperation extends EncryptionOperation<EncryptedQueryResult[]> {
     private client;
     private terms;
     constructor(client: Client, terms: readonly ScalarQueryTerm[]);
-    withLockContext(lockContext: LockContext): BatchEncryptQueryOperationWithLockContext;
+    withLockContext(lockContext: LockContextInput): BatchEncryptQueryOperationWithLockContext;
     execute(): Promise<Result<EncryptedQueryResult[], EncryptionError>>;
 }
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} with array input and `.withLockContext()` instead.
- */
 declare class BatchEncryptQueryOperationWithLockContext extends EncryptionOperation<EncryptedQueryResult[]> {
     private client;
     private terms;
     private lockContext;
-    constructor(client: Client, terms: readonly ScalarQueryTerm[], lockContext: LockContext, auditMetadata?: Record<string, unknown>);
+    constructor(client: Client, terms: readonly ScalarQueryTerm[], lockContext: LockContextInput, auditMetadata?: Record<string, unknown>);
     execute(): Promise<Result<EncryptedQueryResult[], EncryptionError>>;
 }
 
@@ -57,7 +51,7 @@ declare class BulkDecryptOperation extends EncryptionOperation<BulkDecryptedData
     private client;
     private encryptedPayloads;
     constructor(client: Client, encryptedPayloads: BulkDecryptPayload);
-    withLockContext(lockContext: LockContext): BulkDecryptOperationWithLockContext;
+    withLockContext(lockContext: LockContextInput): BulkDecryptOperationWithLockContext;
     execute(): Promise<Result<BulkDecryptedData, EncryptionError>>;
     getOperation(): {
         client: Client;
@@ -67,7 +61,7 @@ declare class BulkDecryptOperation extends EncryptionOperation<BulkDecryptedData
 declare class BulkDecryptOperationWithLockContext extends EncryptionOperation<BulkDecryptedData> {
     private operation;
     private lockContext;
-    constructor(operation: BulkDecryptOperation, lockContext: LockContext);
+    constructor(operation: BulkDecryptOperation, lockContext: LockContextInput);
     execute(): Promise<Result<BulkDecryptedData, EncryptionError>>;
 }
 
@@ -75,7 +69,7 @@ declare class BulkDecryptModelsOperation<T extends Record<string, unknown>> exte
     private client;
     private models;
     constructor(client: Client, models: T[]);
-    withLockContext(lockContext: LockContext): BulkDecryptModelsOperationWithLockContext<T>;
+    withLockContext(lockContext: LockContextInput): BulkDecryptModelsOperationWithLockContext<T>;
     execute(): Promise<Result<Decrypted<T>[], EncryptionError>>;
     getOperation(): {
         client: Client;
@@ -85,7 +79,7 @@ declare class BulkDecryptModelsOperation<T extends Record<string, unknown>> exte
 declare class BulkDecryptModelsOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>[]> {
     private operation;
     private lockContext;
-    constructor(operation: BulkDecryptModelsOperation<T>, lockContext: LockContext);
+    constructor(operation: BulkDecryptModelsOperation<T>, lockContext: LockContextInput);
     execute(): Promise<Result<Decrypted<T>[], EncryptionError>>;
 }
 
@@ -95,19 +89,19 @@ declare class BulkEncryptOperation extends EncryptionOperation<BulkEncryptedData
     private column;
     private table;
     constructor(client: Client, plaintexts: BulkEncryptPayload, opts: EncryptOptions);
-    withLockContext(lockContext: LockContext): BulkEncryptOperationWithLockContext;
+    withLockContext(lockContext: LockContextInput): BulkEncryptOperationWithLockContext;
     execute(): Promise<Result<BulkEncryptedData, EncryptionError>>;
     getOperation(): {
         client: Client;
         plaintexts: BulkEncryptPayload;
-        column: EncryptedColumn | EncryptedField;
-        table: EncryptedTable<EncryptedTableColumn>;
+        column: BuildableColumn;
+        table: BuildableTable;
     };
 }
 declare class BulkEncryptOperationWithLockContext extends EncryptionOperation<BulkEncryptedData> {
     private operation;
     private lockContext;
-    constructor(operation: BulkEncryptOperation, lockContext: LockContext);
+    constructor(operation: BulkEncryptOperation, lockContext: LockContextInput);
     execute(): Promise<Result<BulkEncryptedData, EncryptionError>>;
 }
 
@@ -115,19 +109,19 @@ declare class BulkEncryptModelsOperation<T extends Record<string, unknown>> exte
     private client;
     private models;
     private table;
-    constructor(client: Client, models: Record<string, unknown>[], table: EncryptedTable<EncryptedTableColumn>);
-    withLockContext(lockContext: LockContext): BulkEncryptModelsOperationWithLockContext<T>;
+    constructor(client: Client, models: Record<string, unknown>[], table: BuildableTable);
+    withLockContext(lockContext: LockContextInput): BulkEncryptModelsOperationWithLockContext<T>;
     execute(): Promise<Result<T[], EncryptionError>>;
     getOperation(): {
         client: Client;
         models: Record<string, unknown>[];
-        table: EncryptedTable<EncryptedTableColumn>;
+        table: BuildableTable;
     };
 }
 declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T[]> {
     private operation;
     private lockContext;
-    constructor(operation: BulkEncryptModelsOperation<T>, lockContext: LockContext);
+    constructor(operation: BulkEncryptModelsOperation<T>, lockContext: LockContextInput);
     execute(): Promise<Result<T[], EncryptionError>>;
 }
 
@@ -138,19 +132,19 @@ declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string,
 declare class DecryptOperation extends EncryptionOperation<JsPlaintext> {
     private client;
     private encryptedData;
-    constructor(client: Client, encryptedData: Encrypted);
-    withLockContext(lockContext: LockContext): DecryptOperationWithLockContext;
+    constructor(client: Client, encryptedData: Encrypted | null);
+    withLockContext(lockContext: LockContextInput): DecryptOperationWithLockContext;
     execute(): Promise<Result<JsPlaintext, EncryptionError>>;
     getOperation(): {
         client: Client;
-        encryptedData: Encrypted;
+        encryptedData: Encrypted | null;
         auditData?: Record<string, unknown>;
     };
 }
 declare class DecryptOperationWithLockContext extends EncryptionOperation<JsPlaintext> {
     private operation;
     private lockContext;
-    constructor(operation: DecryptOperation, lockContext: LockContext);
+    constructor(operation: DecryptOperation, lockContext: LockContextInput);
     execute(): Promise<Result<JsPlaintext, EncryptionError>>;
 }
 
@@ -158,7 +152,7 @@ declare class DecryptModelOperation<T extends Record<string, unknown>> extends E
     private client;
     private model;
     constructor(client: Client, model: T);
-    withLockContext(lockContext: LockContext): DecryptModelOperationWithLockContext<T>;
+    withLockContext(lockContext: LockContextInput): DecryptModelOperationWithLockContext<T>;
     execute(): Promise<Result<Decrypted<T>, EncryptionError>>;
     getOperation(): {
         client: Client;
@@ -168,7 +162,7 @@ declare class DecryptModelOperation<T extends Record<string, unknown>> extends E
 declare class DecryptModelOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>> {
     private operation;
     private lockContext;
-    constructor(operation: DecryptModelOperation<T>, lockContext: LockContext);
+    constructor(operation: DecryptModelOperation<T>, lockContext: LockContextInput);
     execute(): Promise<Result<Decrypted<T>, EncryptionError>>;
 }
 
@@ -177,20 +171,20 @@ declare class EncryptOperation extends EncryptionOperation<Encrypted> {
     private plaintext;
     private column;
     private table;
-    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptOptions);
-    withLockContext(lockContext: LockContext): EncryptOperationWithLockContext;
+    constructor(client: Client, plaintext: Plaintext | null, opts: EncryptOptions);
+    withLockContext(lockContext: LockContextInput): EncryptOperationWithLockContext;
     execute(): Promise<Result<Encrypted, EncryptionError>>;
     getOperation(): {
         client: Client;
-        plaintext: JsPlaintext;
-        column: EncryptedColumn | EncryptedField;
-        table: EncryptedTable<EncryptedTableColumn>;
+        plaintext: Plaintext | null;
+        column: BuildableColumn;
+        table: BuildableTable;
     };
 }
 declare class EncryptOperationWithLockContext extends EncryptionOperation<Encrypted> {
     private operation;
     private lockContext;
-    constructor(operation: EncryptOperation, lockContext: LockContext);
+    constructor(operation: EncryptOperation, lockContext: LockContextInput);
     execute(): Promise<Result<Encrypted, EncryptionError>>;
 }
 
@@ -198,54 +192,69 @@ declare class EncryptModelOperation<T extends Record<string, unknown>> extends E
     private client;
     private model;
     private table;
-    constructor(client: Client, model: Record<string, unknown>, table: EncryptedTable<EncryptedTableColumn>);
-    withLockContext(lockContext: LockContext): EncryptModelOperationWithLockContext<T>;
+    constructor(client: Client, model: Record<string, unknown>, table: BuildableTable);
+    withLockContext(lockContext: LockContextInput): EncryptModelOperationWithLockContext<T>;
     execute(): Promise<Result<T, EncryptionError>>;
     getOperation(): {
         client: Client;
         model: Record<string, unknown>;
-        table: EncryptedTable<EncryptedTableColumn>;
+        table: BuildableTable;
     };
 }
 declare class EncryptModelOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T> {
     private operation;
     private lockContext;
-    constructor(operation: EncryptModelOperation<T>, lockContext: LockContext);
+    constructor(operation: EncryptModelOperation<T>, lockContext: LockContextInput);
     execute(): Promise<Result<T, EncryptionError>>;
 }
 
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} instead.
- */
 declare class EncryptQueryOperation extends EncryptionOperation<EncryptedQueryResult> {
     private client;
     private plaintext;
     private opts;
-    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions);
-    withLockContext(lockContext: LockContext): EncryptQueryOperationWithLockContext;
+    constructor(client: Client, plaintext: Plaintext | null | undefined, opts: EncryptQueryOptions);
+    withLockContext(lockContext: LockContextInput): EncryptQueryOperationWithLockContext;
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
     getOperation(): {
-        column: EncryptedColumn;
-        table: EncryptedTable<EncryptedTableColumn>;
+        column: BuildableQueryColumn;
+        table: BuildableTable;
         queryType?: QueryTypeName;
         returnType?: EncryptedReturnType;
         client: Client;
-        plaintext: JsPlaintext;
+        plaintext: Plaintext | null | undefined;
     };
 }
-/**
- * @internal Use {@link EncryptionClient.encryptQuery} with `.withLockContext()` instead.
- */
 declare class EncryptQueryOperationWithLockContext extends EncryptionOperation<EncryptedQueryResult> {
     private client;
     private plaintext;
     private opts;
     private lockContext;
-    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
+    constructor(client: Client, plaintext: Plaintext | null | undefined, opts: EncryptQueryOptions, lockContext: LockContextInput, auditMetadata?: Record<string, unknown>);
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
 }
 
 declare const noClientError: () => Error;
+/**
+ * Resolve the EQL wire version for a client from its schema set.
+ *
+ * One FFI client emits exactly one wire format, so the whole schema set must
+ * agree. EQL v3 tables (from `@cipherstash/stack/v3`) are detected by their
+ * `buildColumnKeyMap()` marker — v2 tables don't have one:
+ *
+ * - every schema is v3 → `3`;
+ * - no schema is v3 → `undefined`, leaving the FFI's v2 default (and its
+ *   byte-identical v2 output) untouched;
+ * - a mix of the two → throws: the v2 tables target `eql_v2_encrypted`
+ *   columns and the v3 tables target `eql_v3` domains, so no single wire
+ *   format serves both. Split them across two clients.
+ *
+ * An explicit `config.eqlVersion` bypasses detection (the wire format is
+ * then unambiguous — e.g. writing v2-wire from a v3 schema set during a
+ * migration), but a mixed schema set still throws.
+ *
+ * @internal exported for unit-test coverage of the detection matrix.
+ */
+declare function resolveEqlVersion(schemas: readonly BuildableTable[], explicit?: 2 | 3): 2 | 3 | undefined;
 /** The EncryptionClient is the main entry point for interacting with the CipherStash Encryption library.
  * It provides methods for encrypting and decrypting individual values, as well as models (objects) and bulk operations.
  *
@@ -267,6 +276,8 @@ declare class EncryptionClient {
         clientId?: string;
         clientKey?: string;
         keyset?: KeysetIdentifier;
+        authStrategy?: AuthStrategy;
+        eqlVersion?: 2 | 3;
     }): Promise<Result<EncryptionClient, EncryptionError>>;
     /**
      * Encrypt a value - returns a promise which resolves to an encrypted value.
@@ -343,7 +354,7 @@ declare class EncryptionClient {
      * @see {@link LockContext}
      * @see {@link EncryptOperation}
      */
-    encrypt(plaintext: JsPlaintext, opts: EncryptOptions): EncryptOperation;
+    encrypt(plaintext: Plaintext, opts: EncryptOptions): EncryptOperation;
     /**
      * Encrypt a query value - returns a promise which resolves to an encrypted query value.
      *
@@ -397,7 +408,7 @@ declare class EncryptionClient {
      * - String plaintext → `steVecSelector` (JSONPath queries like `'$.user.email'`)
      * - Object/Array plaintext → `steVecTerm` (containment queries like `{ role: 'admin' }`)
      */
-    encryptQuery(plaintext: JsPlaintext, opts: EncryptQueryOptions): EncryptQueryOperation;
+    encryptQuery(plaintext: Plaintext, opts: EncryptQueryOptions): EncryptQueryOperation;
     /**
      * Encrypt multiple values for use in queries (batch operation).
      * @param terms - Array of query terms to encrypt
@@ -432,6 +443,13 @@ declare class EncryptionClient {
      *      .withLockContext(lockContext)
      * ```
      *
+     * @remarks
+     * The public input type rejects null, but at runtime `decrypt` will
+     * short-circuit and return null when given a null ciphertext
+     * (defense in depth for legacy / manually-NULLed DB rows reached via
+     * casts or dynamic field walking). The narrow return type holds for
+     * any caller that respects the input contract.
+     *
      * @see {@link LockContext}
      * @see {@link DecryptOperation}
      */
@@ -482,7 +500,7 @@ declare class EncryptionClient {
      * }
      * ```
      */
-    encryptModel<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: T, table: EncryptedTable<S>): EncryptModelOperation<EncryptedFromSchema<T, S>>;
+    encryptModel<T extends Record<string, unknown>, Table extends BuildableTable>(input: T, table: Table): EncryptModelOperation<EncryptedFromBuildableTable<T, Table>>;
     /**
      * Decrypt a model (object) whose fields contain encrypted values.
      *
@@ -557,7 +575,7 @@ declare class EncryptionClient {
      * }
      * ```
      */
-    bulkEncryptModels<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: Array<T>, table: EncryptedTable<S>): BulkEncryptModelsOperation<EncryptedFromSchema<T, S>>;
+    bulkEncryptModels<T extends Record<string, unknown>, Table extends BuildableTable>(input: Array<T>, table: Table): BulkEncryptModelsOperation<EncryptedFromBuildableTable<T, Table>>;
     /**
      * Decrypt multiple models (objects) in a single bulk operation.
      *
@@ -662,36 +680,155 @@ declare class EncryptionClient {
      */
     getEncryptConfig(): EncryptConfig | undefined;
 }
+/**
+ * Reset the once-per-process deprecation-warning latch. Test-only hook so
+ * suites can assert the warning fires deterministically, independent of test
+ * ordering. Not re-exported from the package entry, so it stays off the public
+ * API surface.
+ * @internal
+ */
+declare function __resetStrategyDeprecationWarningForTests(): void;
 /**
  * Creates and initializes an Encryption client for encrypting and decrypting data with CipherStash.
  *
  * Provide at least one schema (from {@link encryptedTable}) so the client knows which tables and
- * columns to use. Credentials are read from the optional `config` or from the environment
- * (`CS_WORKSPACE_CRN`, `CS_CLIENT_ID`, `CS_CLIENT_KEY`, `CS_CLIENT_ACCESS_KEY`).
- *
- * @param config - Initialization options. Must include `schemas`; optionally include `config` for
- *   workspace/keys. Logging is configured via the `STASH_STACK_LOG` environment variable
- *   (`debug | info | error`, default: `error`).
- * @returns A Promise that resolves to an initialized {@link EncryptionClient} ready for
- *   {@link EncryptionClient.encrypt}, {@link EncryptionClient.decrypt}, and related operations.
+ * columns to use:
  *
- * @throws Throws if `schemas` is empty, or if a keyset `id` is supplied but is not a valid UUID.
- *   Also throws if {@link EncryptionClient.init} fails (e.g. invalid credentials or config).
- *
- * @example
  * ```typescript
  * import { Encryption, encryptedTable, encryptedColumn } from "@cipherstash/stack"
  *
- * const users = encryptedTable("users", {
- *   email: encryptedColumn("email"),
- * })
+ * const users = encryptedTable("users", { email: encryptedColumn("email") })
  * const client = await Encryption({ schemas: [users] })
  * const result = await client.encrypt("alice@example.com", { column: users.email, table: users })
  * ```
  *
+ * ## Authentication
+ *
+ * The snippets in this section reuse the `users` schema from the example above, and
+ * `workspaceCrn` / `accessKey` stand in for your own workspace credentials (from the
+ * [dashboard](https://dashboard.cipherstash.com) or the `CS_*` variables below).
+ *
+ * By default the client uses the `auto` auth strategy. `auto` first looks for the `CS_*`
+ * environment variables (see below) and, if they are not set, falls back to the local **dev
+ * profile** on your machine. The dev profile also supplies the client key, so during local
+ * development you generally don't need to set any environment variables at all.
+ *
+ * ### Local development — create a dev profile
+ *
+ * Log in once to create the dev profile that `auto` picks up automatically:
+ *
+ * ```bash
+ * npx stash auth login
+ * ```
+ *
+ * ### Production / CI — environment variables
+ *
+ * In production and CI you typically authenticate with the four `CS_*` environment variables
+ * instead of a dev profile. Developers can obtain these values from the
+ * [CipherStash dashboard](https://dashboard.cipherstash.com):
+ *
+ * | Environment variable   | Description                                                                    |
+ * | ---------------------- | ------------------------------------------------------------------------------ |
+ * | `CS_WORKSPACE_CRN`     | The workspace Cloud Resource Name (CRN) that identifies your workspace.         |
+ * | `CS_CLIENT_ID`         | The client identifier issued when you create an access key.                    |
+ * | `CS_CLIENT_KEY`        | The client key material combined with ZeroKMS to perform encryption.           |
+ * | `CS_CLIENT_ACCESS_KEY` | The API access key used to authenticate requests to CipherStash.               |
+ *
+ * When these are set, `auto` uses them in preference to the local dev profile.
+ *
+ * ### Custom auth strategies — `config.authStrategy`
+ *
+ * For finer control, pass an explicit strategy via `config.authStrategy` (from `@cipherstash/auth`,
+ * re-exported by `@cipherstash/stack`). See the `@cipherstash/auth` package for the full list. Two
+ * common choices:
+ *
+ * `AccessKeyStrategy` — like `auto`, but only ever uses an access key; it never falls back to the
+ * local dev profile. Ideal for services and CI:
+ *
+ * ```typescript
+ * import { Encryption, AccessKeyStrategy } from "@cipherstash/stack"
+ *
+ * const client = await Encryption({
+ *   schemas: [users],
+ *   config: {
+ *     authStrategy: AccessKeyStrategy.create(workspaceCrn, accessKey),
+ *   },
+ * })
+ * ```
+ *
+ * `OidcFederationStrategy` — authenticate end users through your own identity provider (Supabase,
+ * Clerk, Auth0 or Okta) by federating their OIDC JWT into a CipherStash token. Add the provider to
+ * your workspace first at
+ * [dashboard.cipherstash.com/workspaces/_/oidc-providers](https://dashboard.cipherstash.com/workspaces/_/oidc-providers)
+ * (the `_` in the URL resolves to whichever workspace you select):
+ *
+ * ```typescript
+ * import { Encryption, OidcFederationStrategy } from "@cipherstash/stack"
+ *
+ * // Authenticate every ZeroKMS request as the signed-in user.
+ * const client = await Encryption({
+ *   schemas: [users],
+ *   config: {
+ *     authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getUserJwt()),
+ *   },
+ * })
+ * ```
+ *
+ * ### Lock context (identity-bound encryption)
+ *
+ * Lock context is an **additional** capability layered on top of `OidcFederationStrategy`: it
+ * requires that strategy, but `OidcFederationStrategy` does not require lock context. It binds a
+ * value to a claim from the user's JWT (typically `sub`) so that only the user who encrypted a
+ * value can decrypt it:
+ *
+ * ```typescript
+ * // Bind the data key to the user's `sub` claim.
+ * const result = await client
+ *   .encrypt("alice@example.com", { column: users.email, table: users })
+ *   .withLockContext({ identityClaim: ["sub"] })
+ * ```
+ *
+ * Because the lock is tied to a specific end user's identity, `AccessKeyStrategy` (which
+ * authenticates a service, not a user) is not valid for lock context — there is no user `sub`
+ * claim to bind to.
+ *
+ * ## Keysets (multi-tenant isolation)
+ *
+ * Pass `config.keyset` to encrypt under a specific **keyset** — a named or UUID-identified keyspace
+ * that gives each tenant its own cryptographic isolation, so data encrypted under one keyset cannot
+ * be decrypted under another. Create and manage keysets in the
+ * [dashboard](https://dashboard.cipherstash.com/workspaces/_/keysets) (the `_` in the URL resolves
+ * to whichever workspace you select); omit `config.keyset` to use the workspace's default keyset.
+ *
+ * ```typescript
+ * // `users` is the schema from the first example above.
+ * const client = await Encryption({
+ *   schemas: [users],
+ *   config: {
+ *     keyset: { name: "tenant-a" }, // or { id: "<uuid>" }
+ *   },
+ * })
+ * ```
+ *
+ * A client is bound to a single keyset for its lifetime, so multi-tenant applications use **one
+ * `Encryption()` client per tenant**. Keysets are orthogonal to `authStrategy` and lock context —
+ * they isolate a whole tenant's *keyspace* (coarse, fixed per client), whereas lock context binds
+ * an individual value to a user's identity claim (fine-grained, per operation) — and can be
+ * combined with both.
+ *
+ * @param config - Initialization options. Must include `schemas`; optionally include `config` for
+ *   credentials and authentication. Logging is configured via the `STASH_STACK_LOG` environment
+ *   variable (`debug | info | error`, default: `error`).
+ * @returns A Promise that resolves to an initialized {@link EncryptionClient} ready for
+ *   {@link EncryptionClient.encrypt}, {@link EncryptionClient.decrypt}, and related operations.
+ *
+ * @throws Throws if `schemas` is empty, or if a keyset `id` is supplied but is not a valid UUID.
+ *   Also throws if the client fails to initialize (e.g. invalid credentials or config).
+ *
  * @see {@link EncryptionClientConfig} for full config options.
+ * @see {@link ClientConfig.authStrategy} for the auth strategy field.
  * @see {@link EncryptionClient} for available methods after initialization.
  */
 declare const Encryption: (config: EncryptionClientConfig) => Promise<EncryptionClient>;
 
-export { type AuditConfig as A, Encryption as E, EncryptionClient as a, noClientError as n };
+export { type AuditConfig as A, BulkEncryptModelsOperation as B, DecryptOperation as D, EncryptOperation as E, __resetStrategyDeprecationWarningForTests as _, EncryptQueryOperation as a, EncryptModelOperation as b, BulkEncryptOperation as c, BulkDecryptOperation as d, EncryptionClient as e, Encryption as f, BatchEncryptQueryOperation as g, BulkDecryptModelsOperation as h, DecryptModelOperation as i, noClientError as n, resolveEqlVersion as r };