@cipherstash/stack 0.18.0 → 0.19.0

package/dist/{chunk-ZYOZHZMJ.js → chunk-36AA7IBJ.js}

@@ -1,26 +1,31 @@
+import {
+  resolveLockContext
+} from "./chunk-OFQ555AX.js";
 import {
   formatEncryptedResult,
   isEncryptedPayload,
   toFfiKeysetIdentifier
-} from "./chunk-XWPGAHBZ.js";
+} from "./chunk-BNO32ZMV.js";
 import {
   buildEncryptConfig,
   encryptConfigSchema
-} from "./chunk-YWQXTZ5M.js";
+} from "./chunk-MP3SSDNN.js";
 import {
   queryTypeToFfi,
   queryTypeToQueryOp
-} from "./chunk-VPOTNP4K.js";
+} from "./chunk-4AVL4VZD.js";
+import {
+  withResult
+} from "./chunk-JSG2AMDI.js";
 import {
   createRequestLogger,
   logger
-} from "./chunk-LLCCNKDL.js";
+} from "./chunk-HQANMV7R.js";
 import {
   EncryptionErrorTypes
 } from "./chunk-LBMC4D6D.js";
 
 // src/encryption/index.ts
-import { withResult as withResult11 } from "@byteslice/result";
 import { newClient } from "@cipherstash/protect-ffi";
 
 // ../../node_modules/.pnpm/uuid@14.0.0/node_modules/uuid/dist-node/regex.js
@@ -37,6 +42,11 @@ function isScalarQueryTermArray(value) {
   return Array.isArray(value) && value.length > 0 && typeof value[0] === "object" && value[0] !== null && "column" in value[0] && "table" in value[0];
 }
 
+// src/encryption/operations/batch-encrypt-query.ts
+import {
+  encryptQueryBulk as ffiEncryptQueryBulk
+} from "@cipherstash/protect-ffi";
+
 // src/encryption/helpers/error-code.ts
 import {
   ProtectError as FfiProtectError
@@ -45,12 +55,6 @@ function getErrorCode(error) {
   return error instanceof FfiProtectError ? error.code : void 0;
 }
 
-// src/encryption/operations/batch-encrypt-query.ts
-import { withResult } from "@byteslice/result";
-import {
-  encryptQueryBulk as ffiEncryptQueryBulk
-} from "@cipherstash/protect-ffi";
-
 // src/encryption/helpers/infer-index-type.ts
 function inferIndexType(column) {
   const config = column.build();
@@ -70,7 +74,7 @@ function inferQueryOpFromPlaintext(plaintext) {
   if (typeof plaintext === "string") {
     return "ste_vec_selector";
   }
-  if (typeof plaintext === "object" || typeof plaintext === "number" || typeof plaintext === "boolean" || typeof plaintext === "bigint") {
+  if (typeof plaintext === "object" || typeof plaintext === "number" || typeof plaintext === "boolean") {
     return "ste_vec_term";
   }
   return "ste_vec_term";
@@ -90,9 +94,18 @@ function validateIndexType(column, indexType) {
     );
   }
 }
+function resolvesEqualityViaOre(column) {
+  if (!("getQueryCapabilities" in column)) return false;
+  if (!column.getQueryCapabilities().equality) return false;
+  const indexes = column.build().indexes ?? {};
+  return !indexes.unique && !!indexes.ore;
+}
 function resolveIndexType(column, queryType, plaintext) {
   const indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
   if (queryType) {
+    if (queryType === "equality" && resolvesEqualityViaOre(column)) {
+      return { indexType: "ore" };
+    }
     validateIndexType(column, indexType);
     if (queryType === "searchableJson") {
       if (plaintext === void 0 || plaintext === null) {
@@ -300,22 +313,16 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: this.terms.map(() => null) };
     }
-    const lockContextResult = await this.lockContext.getLockContext();
-    if (lockContextResult.failure) {
-      log.emit();
-      return { failure: lockContextResult.failure };
-    }
-    const { ctsToken, context } = lockContextResult.data;
     const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
         const { metadata } = this.getAuditData();
         const queries = nonNullTerms.map(
           ({ term }) => buildQueryPayload(term, context)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
-          serviceToken: ctsToken,
           unverifiedContext: metadata
         });
         return assembleResults(this.terms.length, encrypted, nonNullTerms);
@@ -335,7 +342,6 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/bulk-decrypt.ts
-import { withResult as withResult2 } from "@byteslice/result";
 import {
   decryptBulkFallible
 } from "@cipherstash/protect-ffi";
@@ -383,7 +389,7 @@ var BulkDecryptOperation = class extends EncryptionOperation {
       count: this.encryptedPayloads?.length ?? 0,
       lockContext: false
     });
-    const result = await withResult2(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
@@ -438,17 +444,14 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
       count: encryptedPayloads?.length ?? 0,
       lockContext: true
     });
-    const result = await withResult2(
+    const result = await withResult(
       async () => {
         if (!client) throw noClientError();
         if (!encryptedPayloads || encryptedPayloads.length === 0) return [];
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         const nonNullPayloads = createDecryptPayloads(
           encryptedPayloads,
-          context.data.context
+          lockContext
         );
         if (nonNullPayloads.length === 0) {
           return createNullResult(encryptedPayloads);
@@ -456,7 +459,6 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(client, {
           ciphertexts: nonNullPayloads,
-          serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(encryptedPayloads, decryptedData);
@@ -475,9 +477,6 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/operations/bulk-decrypt-models.ts
-import { withResult as withResult3 } from "@byteslice/result";
-
 // src/encryption/helpers/model-helpers.ts
 import {
   decryptBulk,
@@ -559,6 +558,17 @@ function prepareFieldsForDecryption(model) {
   processNestedFields(model);
   return { otherFields, operationFields, keyMap, nullFields };
 }
+function resolveEncryptColumnMap(table) {
+  const keyMap = table.buildColumnKeyMap?.();
+  if (keyMap) {
+    return {
+      columnPaths: Object.keys(keyMap),
+      toColumnName: (path) => keyMap[path] ?? path
+    };
+  }
+  const columnPaths = Object.keys(table.build().columns);
+  return { columnPaths, toColumnName: (path) => path };
+}
 function prepareFieldsForEncryption(model, table) {
   const otherFields = { ...model };
   const operationFields = {};
@@ -594,7 +604,7 @@ function prepareFieldsForEncryption(model, table) {
       }
     }
   };
-  const columnPaths = Object.keys(table.build().columns);
+  const { columnPaths } = resolveEncryptColumnMap(table);
   processNestedFields(model, "", columnPaths);
   return { otherFields, operationFields, keyMap, nullFields };
 }
@@ -633,12 +643,13 @@ async function encryptModelFields(model, table, client, auditData) {
     throw new Error("Client not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareFieldsForEncryption(model, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = Object.entries(operationFields).map(
     ([key, value]) => ({
       id: key,
       plaintext: value,
       table: table.tableName,
-      column: key
+      column: toColumnName(key)
     })
   );
   const encryptedData = await handleSingleModelBulkOperation(
@@ -672,14 +683,13 @@ async function decryptModelFieldsWithLockContext(model, client, lockContext, aud
     ([key, value]) => ({
       id: key,
       ciphertext: value,
-      lockContext: lockContext.context
+      lockContext
     })
   );
   const decryptedFields = await handleSingleModelBulkOperation(
     bulkDecryptPayload,
     (items) => decryptBulk(client, {
       ciphertexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -703,20 +713,20 @@ async function encryptModelFieldsWithLockContext(model, table, client, lockConte
     throw new Error("Lock context is not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareFieldsForEncryption(model, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = Object.entries(operationFields).map(
     ([key, value]) => ({
       id: key,
       plaintext: value,
       table: table.tableName,
-      column: key,
-      lockContext: lockContext.context
+      column: toColumnName(key),
+      lockContext
     })
   );
   const encryptedData = await handleSingleModelBulkOperation(
     bulkEncryptPayload,
     (items) => encryptBulk(client, {
       plaintexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -773,7 +783,7 @@ function prepareBulkModelsForOperation(models, table) {
       }
     };
     if (table) {
-      const columnPaths = Object.keys(table.build().columns);
+      const { columnPaths } = resolveEncryptColumnMap(table);
       processNestedFields(model, "", columnPaths);
     } else {
       const processEncryptedFields = (obj, prefix = "", columnPaths = []) => {
@@ -811,6 +821,15 @@ function prepareBulkModelsForOperation(models, table) {
   }
   return { otherFields, operationFields, keyMap, nullFields };
 }
+function fieldsForModelIndex(fields, modelIndex) {
+  const result = {};
+  for (const [id, value] of Object.entries(fields)) {
+    const sep = id.indexOf("-");
+    if (Number.parseInt(id.slice(0, sep), 10) !== modelIndex) continue;
+    result[id.slice(sep + 1)] = value;
+  }
+  return result;
+}
 async function bulkEncryptModels(models, table, client, auditData) {
   if (!client) {
     throw new Error("Client not initialized");
@@ -819,12 +838,13 @@ async function bulkEncryptModels(models, table, client, auditData) {
     return [];
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareBulkModelsForOperation(models, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = operationFields.flatMap(
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       plaintext: value,
       table: table.tableName,
-      column: key
+      column: toColumnName(key)
     }))
   );
   const encryptedData = await handleMultiModelBulkOperation(
@@ -841,15 +861,7 @@ async function bulkEncryptModels(models, table, client, auditData) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(encryptedData).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(encryptedData, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -885,15 +897,7 @@ async function bulkDecryptModels(models, client, auditData) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(decryptedFields).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(decryptedFields, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -913,14 +917,13 @@ async function bulkDecryptModelsWithLockContext(models, client, lockContext, aud
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       ciphertext: value,
-      lockContext: lockContext.context
+      lockContext
     }))
   );
   const decryptedFields = await handleMultiModelBulkOperation(
     bulkDecryptPayload,
     (items) => decryptBulk(client, {
       ciphertexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -931,15 +934,7 @@ async function bulkDecryptModelsWithLockContext(models, client, lockContext, aud
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(decryptedFields).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(decryptedFields, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -955,20 +950,20 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
     throw new Error("Lock context is not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareBulkModelsForOperation(models, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = operationFields.flatMap(
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       plaintext: value,
       table: table.tableName,
-      column: key,
-      lockContext: lockContext.context
+      column: toColumnName(key),
+      lockContext
     }))
   );
   const encryptedData = await handleMultiModelBulkOperation(
     bulkEncryptPayload,
     (items) => encryptBulk(client, {
       plaintexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -979,15 +974,7 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(encryptedData).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(encryptedData, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -1015,7 +1002,7 @@ var BulkDecryptModelsOperation = class extends EncryptionOperation {
       count: this.models.length,
       lockContext: false
     });
-    const result = await withResult3(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1062,20 +1049,17 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
       count: models.length,
       lockContext: true
     });
-    const result = await withResult3(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await bulkDecryptModelsWithLockContext(
           models,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1094,7 +1078,6 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/bulk-encrypt.ts
-import { withResult as withResult4 } from "@byteslice/result";
 import { encryptBulk as encryptBulk2 } from "@cipherstash/protect-ffi";
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
   return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
@@ -1143,7 +1126,7 @@ var BulkEncryptOperation = class extends EncryptionOperation {
       count: this.plaintexts?.length ?? 0,
       lockContext: false
     });
-    const result = await withResult4(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1209,7 +1192,7 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
       count: plaintexts?.length ?? 0,
       lockContext: true
     });
-    const result = await withResult4(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
@@ -1217,15 +1200,12 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!plaintexts || plaintexts.length === 0) {
           return [];
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         const nonNullPayloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
-          context.data.context
+          lockContext
         );
         if (nonNullPayloads.length === 0) {
           return createNullResult2(plaintexts);
@@ -1233,7 +1213,6 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(client, {
           plaintexts: nonNullPayloads,
-          serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
         return mapEncryptedDataToResult(plaintexts, encryptedData);
@@ -1253,7 +1232,6 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/bulk-encrypt-models.ts
-import { withResult as withResult5 } from "@byteslice/result";
 var BulkEncryptModelsOperation = class extends EncryptionOperation {
   client;
   models;
@@ -1275,7 +1253,7 @@ var BulkEncryptModelsOperation = class extends EncryptionOperation {
       count: this.models.length,
       lockContext: false
     });
-    const result = await withResult5(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1329,21 +1307,18 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
       count: models.length,
       lockContext: true
     });
-    const result = await withResult5(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await bulkEncryptModelsWithLockContext(
           models,
           table,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1362,7 +1337,6 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/decrypt.ts
-import { withResult as withResult6 } from "@byteslice/result";
 import {
   decrypt as ffiDecrypt
 } from "@cipherstash/protect-ffi";
@@ -1387,7 +1361,7 @@ var DecryptOperation = class extends EncryptionOperation {
       op: "decrypt",
       lockContext: false
     });
-    const result = await withResult6(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1439,7 +1413,7 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
       op: "decrypt",
       lockContext: true
     });
-    const result = await withResult6(
+    const result = await withResult(
       async () => {
         const { client, encryptedData } = this.operation.getOperation();
         if (!client) {
@@ -1449,15 +1423,11 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
           return null;
         }
         const { metadata } = this.getAuditData();
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         return await ffiDecrypt(client, {
           ciphertext: encryptedData,
           unverifiedContext: metadata,
-          lockContext: context.data.context,
-          serviceToken: context.data.ctsToken
+          lockContext
         });
       },
       (error) => {
@@ -1475,7 +1445,6 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/decrypt-model.ts
-import { withResult as withResult7 } from "@byteslice/result";
 var DecryptModelOperation = class extends EncryptionOperation {
   client;
   model;
@@ -1493,7 +1462,7 @@ var DecryptModelOperation = class extends EncryptionOperation {
       op: "decryptModel",
       lockContext: false
     });
-    const result = await withResult7(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1538,21 +1507,18 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
       op: "decryptModel",
       lockContext: true
     });
-    const result = await withResult7(
+    const result = await withResult(
       async () => {
         const { client, model } = this.operation.getOperation();
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await decryptModelFieldsWithLockContext(
           model,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1571,7 +1537,6 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt.ts
-import { withResult as withResult8 } from "@byteslice/result";
 import {
   encrypt as ffiEncrypt
 } from "@cipherstash/protect-ffi";
@@ -1602,7 +1567,7 @@ var EncryptOperation = class extends EncryptionOperation {
       column: this.column.getName(),
       lockContext: false
     });
-    const result = await withResult8(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1610,14 +1575,12 @@ var EncryptOperation = class extends EncryptionOperation {
         if (this.plaintext === null) {
           return null;
         }
-        if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
-          throw new Error("[encryption]: Cannot encrypt NaN value");
-        }
-        if (typeof this.plaintext === "number" && !Number.isFinite(this.plaintext)) {
-          throw new Error("[encryption]: Cannot encrypt Infinity value");
-        }
+        assertValidNumericValue(this.plaintext);
         const { metadata } = this.getAuditData();
         return await ffiEncrypt(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream `JsPlaintext` input
+          // union is corrected to include it.
           plaintext: this.plaintext,
           column: this.column.getName(),
           table: this.table.tableName,
@@ -1666,7 +1629,7 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
       column: column.getName(),
       lockContext: true
     });
-    const result = await withResult8(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
@@ -1674,17 +1637,14 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
         if (plaintext === null) {
           return null;
         }
+        assertValidNumericValue(plaintext);
         const { metadata } = this.getAuditData();
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         return await ffiEncrypt(client, {
           plaintext,
           column: column.getName(),
           table: table.tableName,
-          lockContext: context.data.context,
-          serviceToken: context.data.ctsToken,
+          lockContext,
           unverifiedContext: metadata
         });
       },
@@ -1703,7 +1663,6 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt-model.ts
-import { withResult as withResult9 } from "@byteslice/result";
 var EncryptModelOperation = class extends EncryptionOperation {
   client;
   model;
@@ -1724,7 +1683,7 @@ var EncryptModelOperation = class extends EncryptionOperation {
       table: this.table.tableName,
       lockContext: false
     });
-    const result = await withResult9(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1777,21 +1736,18 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
       table: table.tableName,
       lockContext: true
     });
-    const result = await withResult9(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await encryptModelFieldsWithLockContext(
           model,
           table,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1810,7 +1766,6 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt-query.ts
-import { withResult as withResult10 } from "@byteslice/result";
 import {
   encryptQuery as ffiEncryptQuery
 } from "@cipherstash/protect-ffi";
@@ -1852,7 +1807,7 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { failure: validationError.failure };
     }
-    const result = await withResult10(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
@@ -1867,6 +1822,9 @@ var EncryptQueryOperation = class extends EncryptionOperation {
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
           plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
@@ -1924,15 +1882,10 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       log.emit();
       return { failure: validationError.failure };
     }
-    const lockContextResult = await this.lockContext.getLockContext();
-    if (lockContextResult.failure) {
-      log.emit();
-      return { failure: lockContextResult.failure };
-    }
-    const { ctsToken, context } = lockContextResult.data;
-    const result = await withResult10(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
         const { metadata } = this.getAuditData();
         const { indexType, queryOp } = resolveIndexType(
           this.opts.column,
@@ -1945,13 +1898,15 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
           plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
           indexType,
           queryOp,
           lockContext: context,
-          serviceToken: ctsToken,
           unverifiedContext: metadata
         });
         return formatEncryptedResult(encrypted, this.opts.returnType);
@@ -1974,6 +1929,20 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
 var noClientError = () => new Error(
   "The Encryption client has not been initialized. Please call init() before using the client."
 );
+function resolveEqlVersion(schemas, explicit) {
+  const v3Count = schemas.filter(
+    (schema) => typeof schema.buildColumnKeyMap === "function"
+  ).length;
+  if (v3Count > 0 && v3Count < schemas.length) {
+    throw new Error(
+      "[encryption]: cannot mix EQL v2 and EQL v3 tables in one client \u2014 one client emits exactly one wire format. Create separate clients for the v2 and v3 schemas."
+    );
+  }
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  return v3Count === 0 ? void 0 : 3;
+}
 var EncryptionClient = class {
   client;
   encryptConfig;
@@ -1984,7 +1953,7 @@ var EncryptionClient = class {
    * @returns A promise that resolves to a {@link Result} containing the initialized EncryptionClient or an {@link EncryptionError}.
    **/
   async init(config) {
-    return await withResult11(
+    return await withResult(
       async () => {
         const validated = encryptConfigSchema.parse(
           config.encryptConfig
@@ -2003,7 +1972,9 @@ var EncryptionClient = class {
             clientId: config.clientId,
             clientKey: config.clientKey,
             keyset: toFfiKeysetIdentifier(config.keyset)
-          }
+          },
+          strategy: config.authStrategy,
+          eqlVersion: config.eqlVersion
         });
         this.encryptConfig = validated;
         logger.debug("Successfully initialized the Encryption client.");
@@ -2094,7 +2065,7 @@ var EncryptionClient = class {
     return new EncryptOperation(this.client, plaintext, opts);
   }
   encryptQuery(plaintextOrTerms, opts) {
-    if (isScalarQueryTermArray(plaintextOrTerms)) {
+    if (!opts && isScalarQueryTermArray(plaintextOrTerms)) {
       return new BatchEncryptQueryOperation(this.client, plaintextOrTerms);
     }
     if (Array.isArray(plaintextOrTerms) && plaintextOrTerms.length === 0 && !opts) {
@@ -2402,6 +2373,17 @@ var EncryptionClient = class {
     return this.encryptConfig;
   }
 };
+var warnedStrategyDeprecated = false;
+function warnStrategyDeprecated() {
+  if (warnedStrategyDeprecated) return;
+  warnedStrategyDeprecated = true;
+  console.warn(
+    "[encryption]: `config.strategy` is deprecated and will be removed in a future release \u2014 use `config.authStrategy` instead."
+  );
+}
+function __resetStrategyDeprecationWarningForTests() {
+  warnedStrategyDeprecated = false;
+}
 var Encryption = async (config) => {
   const { schemas, config: clientConfig } = config;
   if (!schemas.length) {
@@ -2414,11 +2396,18 @@ var Encryption = async (config) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
+  if (clientConfig?.strategy) {
+    warnStrategyDeprecated();
+  }
+  const authStrategy = clientConfig?.authStrategy ?? clientConfig?.strategy;
   const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
+  const eqlVersion = resolveEqlVersion(schemas, clientConfig?.eqlVersion);
   const result = await client.init({
     encryptConfig,
-    ...clientConfig
+    ...clientConfig,
+    authStrategy,
+    eqlVersion
   });
   if (result.failure) {
     throw new Error(`[encryption]: ${result.failure.message}`);
@@ -2438,7 +2427,9 @@ export {
   EncryptModelOperation,
   EncryptQueryOperation,
   noClientError,
+  resolveEqlVersion,
   EncryptionClient,
+  __resetStrategyDeprecationWarningForTests,
   Encryption
 };
-//# sourceMappingURL=chunk-ZYOZHZMJ.js.map
+//# sourceMappingURL=chunk-36AA7IBJ.js.map