@cipherstash/stack 0.18.0 → 0.19.0

package/dist/eql/v3/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/eql/v3/index.ts","../../../src/schema/match-defaults.ts","../../../src/eql/v3/columns.ts","../../../src/eql/v3/table.ts","../../../src/eql/v3/types.ts"],"sourcesContent":["// Public barrel for the EQL v3 authoring DSL (`@cipherstash/stack/eql/v3`).\n//\n// Curated on purpose: it re-exports the `types` namespace, the concrete column\n// classes (load-bearing for the `AnyEncryptedV3Column` union and nominal\n// typing), the table API, and the inference type aliases. It deliberately does\n// NOT re-export the per-domain literal consts (`INTEGER`, `TEXT_EQ`, …) — those are\n// internal building blocks for `types` — and there are no standalone\n// `encrypted<Domain>Column` factories any more: `types.*` is the single\n// authoring API.\n\nexport type {\n  AnyEncryptedV3Column,\n  EncryptedV3TableColumn,\n  EqlTypeForColumn,\n  PlaintextForColumn,\n  QueryCapabilities,\n  QueryTypesForColumn,\n} from './columns'\n\nexport {\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  TEXT_SEARCH_EQL_TYPE,\n} from './columns'\nexport type {\n  AnyV3Table,\n  ColumnsOf,\n  InferEncrypted,\n  InferPlaintext,\n  QueryableColumnsOf,\n  V3DecryptedModel,\n  V3EncryptedModel,\n  V3ModelInput,\n} from './table'\n\nexport { buildEncryptConfig, EncryptedTable, encryptedTable } from './table'\nexport { types } from './types'\n","import type { MatchIndexOpts } from './index'\n\n/**\n * Fully-resolved match-index options: every field present and non-`undefined`.\n *\n * `MatchIndexOpts` (the user-facing tuning input) has all fields optional —\n * each is `.default(...).optional()` in the zod schema, so its inferred type is\n * `T | undefined`. This type pins the BUILT/resolved shape explicitly via\n * `NonNullable<...>`, which states the non-null intent directly and is robust\n * regardless of `Required<>`'s subtle, `exactOptionalPropertyTypes`-dependent\n * stripping semantics.\n */\nexport type BuiltMatchIndexOpts = {\n  tokenizer: NonNullable<MatchIndexOpts['tokenizer']>\n  token_filters: NonNullable<MatchIndexOpts['token_filters']>\n  k: NonNullable<MatchIndexOpts['k']>\n  m: NonNullable<MatchIndexOpts['m']>\n  include_original: NonNullable<MatchIndexOpts['include_original']>\n}\n\n/**\n * Default match-index parameters — the single source of truth shared by the\n * v2 `freeTextSearch()` builder and the v3 domain builders (note\n * `include_original: true`, which is the v2 builder default rather than the\n * zod-schema default of `false`).\n *\n * This is a FACTORY (not a shared `const`) so every caller gets fresh, unaliased\n * nested objects (`tokenizer`, `token_filters` and the `{ kind: 'downcase' }`\n * inside it). A shared const would be shallow-copied by `{ ...DEFAULT }`, leaving\n * those nested objects aliased across every column — a caller mutating one built\n * config could then corrupt the defaults used by later columns.\n */\nexport function defaultMatchOpts(): BuiltMatchIndexOpts {\n  return {\n    tokenizer: { kind: 'ngram', token_length: 3 },\n    token_filters: [{ kind: 'downcase' }],\n    k: 6,\n    m: 2048,\n    include_original: true,\n  }\n}\n\n/**\n * Deep-clone a built match block (`tokenizer` and `token_filters` are its only\n * nested values) so no emitted config or stored builder state ever aliases\n * another's nested objects — a caller mutating one cannot corrupt the other.\n */\nexport function cloneMatchOpts(opts: BuiltMatchIndexOpts): BuiltMatchIndexOpts {\n  return {\n    ...opts,\n    tokenizer: { ...opts.tokenizer },\n    token_filters: opts.token_filters.map((f) => ({ ...f })),\n  }\n}\n","import type { ColumnSchema, MatchIndexOpts } from '@/schema'\nimport {\n  type BuiltMatchIndexOpts,\n  cloneMatchOpts,\n  defaultMatchOpts,\n} from '@/schema/match-defaults'\n\n/**\n * The query capabilities a v3 concrete domain exposes. These are SDK-facing\n * semantic flags describing what kinds of query terms a column can produce —\n * NOT the raw EQL index keys. They are metadata only and never emitted by\n * `build()`.\n *\n * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).\n * - `orderAndRange`: comparison / range lookups (EQL `ob`).\n * - `freeTextSearch`: tokenised substring match (EQL `bf`).\n */\nexport type QueryCapabilities = Readonly<{\n  equality: boolean\n  orderAndRange: boolean\n  freeTextSearch: boolean\n}>\n\n/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the\n * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */\ntype PlaintextKind = 'string' | 'number' | 'boolean' | 'date' | 'timestamp'\n\n/**\n * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:\n * the base column class carries a private field of this type so that every\n * concrete (otherwise-empty) subclass is discriminated by its literal\n * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT\n * nominal, so without this a storage-only `boolean` column would be assignable to\n * a storage-only `date` column and plaintext inference would collapse.\n */\ntype V3DomainDefinition = Readonly<{\n  eqlType: `eql_v3.${string}`\n  castAs: PlaintextKind\n  capabilities: QueryCapabilities\n}>\n\n/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a\n * storage-only domain (all capability flags `false`), `true` otherwise. */\ntype QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {\n  equality: false\n  orderAndRange: false\n  freeTextSearch: false\n}\n  ? false\n  : true\n\nconst STORAGE_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst EQUALITY_ONLY = {\n  equality: true,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst ORDER_AND_RANGE = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: false,\n} as const\n\nconst MATCH_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: true,\n} as const\n\nconst TEXT_SEARCH = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: true,\n} as const\n\n/**\n * The concrete EQL v3 domain name for a full-capability text column.\n * Recorded as metadata for future DDL / query-dialect increments; it is\n * intentionally absent from the emitted encrypt config.\n */\nexport const TEXT_SEARCH_EQL_TYPE = 'eql_v3.text_search'\n\n// Per-domain literal definitions. Each concrete column subclass is parameterised\n// by `typeof <CONST>`; the literal `eqlType`/`castAs`/`capabilities` on each is\n// what makes the otherwise-empty subclasses nominally distinct (see\n// V3DomainDefinition). Order mirrors eql-bindings `CATALOG` order.\n//\n// Exported for the `types` namespace factory (see ./types); they are internal\n// building blocks and are intentionally NOT re-exported from the public barrel.\nexport const INTEGER = {\n  eqlType: 'eql_v3.integer',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const INTEGER_EQ = {\n  eqlType: 'eql_v3.integer_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const INTEGER_ORD_ORE = {\n  eqlType: 'eql_v3.integer_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const INTEGER_ORD = {\n  eqlType: 'eql_v3.integer_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const SMALLINT = {\n  eqlType: 'eql_v3.smallint',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const SMALLINT_EQ = {\n  eqlType: 'eql_v3.smallint_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const SMALLINT_ORD_ORE = {\n  eqlType: 'eql_v3.smallint_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const SMALLINT_ORD = {\n  eqlType: 'eql_v3.smallint_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// NOTE: bigint (int8) domains are intentionally NOT defined yet. The native\n// protect-ffi build cannot round-trip a 64-bit int losslessly: a JS `bigint`\n// fails JSON serialization, and a `string` is rejected for a `big_int` column\n// (\"Cannot convert String to BigInt\"), while `number` loses precision above\n// 2^53. Re-add BIGINT/BIGINT_EQ/BIGINT_ORD_ORE/BIGINT_ORD and their builders once the\n// FFI accepts a lossless bigint on input and returns it on decrypt.\n\nexport const DATE = {\n  eqlType: 'eql_v3.date',\n  castAs: 'date',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DATE_EQ = {\n  eqlType: 'eql_v3.date_eq',\n  castAs: 'date',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DATE_ORD_ORE = {\n  eqlType: 'eql_v3.date_ord_ore',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DATE_ORD = {\n  eqlType: 'eql_v3.date_ord',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// Timestamp domains cast as 'timestamp' (not 'date') so decrypt preserves the\n// time-of-day component — the FFI's 'date' variant truncates to midnight.\n// Both kinds decrypt to a JS `Date`.\nexport const TIMESTAMP = {\n  eqlType: 'eql_v3.timestamp',\n  castAs: 'timestamp',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TIMESTAMP_EQ = {\n  eqlType: 'eql_v3.timestamp_eq',\n  castAs: 'timestamp',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TIMESTAMP_ORD_ORE = {\n  eqlType: 'eql_v3.timestamp_ord_ore',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TIMESTAMP_ORD = {\n  eqlType: 'eql_v3.timestamp_ord',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const NUMERIC = {\n  eqlType: 'eql_v3.numeric',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const NUMERIC_EQ = {\n  eqlType: 'eql_v3.numeric_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const NUMERIC_ORD_ORE = {\n  eqlType: 'eql_v3.numeric_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const NUMERIC_ORD = {\n  eqlType: 'eql_v3.numeric_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TEXT = {\n  eqlType: 'eql_v3.text',\n  castAs: 'string',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TEXT_EQ = {\n  eqlType: 'eql_v3.text_eq',\n  castAs: 'string',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TEXT_MATCH = {\n  eqlType: 'eql_v3.text_match',\n  castAs: 'string',\n  capabilities: MATCH_ONLY,\n} as const\nexport const TEXT_ORD_ORE = {\n  eqlType: 'eql_v3.text_ord_ore',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TEXT_ORD = {\n  eqlType: 'eql_v3.text_ord',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const BOOLEAN = {\n  eqlType: 'eql_v3.boolean',\n  castAs: 'boolean',\n  capabilities: STORAGE_ONLY,\n} as const\n\nexport const REAL = {\n  eqlType: 'eql_v3.real',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const REAL_EQ = {\n  eqlType: 'eql_v3.real_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const REAL_ORD_ORE = {\n  eqlType: 'eql_v3.real_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const REAL_ORD = {\n  eqlType: 'eql_v3.real_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DOUBLE = {\n  eqlType: 'eql_v3.double',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DOUBLE_EQ = {\n  eqlType: 'eql_v3.double_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DOUBLE_ORD_ORE = {\n  eqlType: 'eql_v3.double_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DOUBLE_ORD = {\n  eqlType: 'eql_v3.double_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n/**\n * Translate a domain's semantic {@link QueryCapabilities} (plus its plaintext\n * `castAs`, which decides how equality is answered) into the concrete EQL index\n * block emitted by `build()`.\n *\n * - `unique` (the `hm` HMAC index) whenever equality is answered via HMAC:\n *   equality-only domains of ANY type, AND text order domains. Text equality is\n *   HMAC-based — the `eql_v3.text_ord` / `eql_v3.text_ord_ore` SQL domains\n *   REQUIRE `hm` in the stored ciphertext (their `eql_v3.eq_term` extracts it).\n * - `ore` for any order/range domain (the `ob` term). For numeric/date order\n *   domains `ob` also answers equality (via the SQL `=` operator), so those emit\n *   `ore` ONLY — no `hm`. Text order domains emit BOTH `unique` and `ore`.\n * - `match` (the `bf` bloom-filter index) for free-text search, deep-cloned from\n *   the per-call defaults so no nested object is ever shared across columns.\n */\nfunction indexesForCapabilities(\n  capabilities: QueryCapabilities,\n  castAs: PlaintextKind,\n): ColumnSchema['indexes'] {\n  const indexes: ColumnSchema['indexes'] = {}\n\n  // Text equality is always HMAC-based, so a text order domain (`string` +\n  // order/range) still needs `unique`; numeric/date order domains answer\n  // equality via `ob` and must NOT emit `unique`.\n  if (\n    capabilities.equality &&\n    (!capabilities.orderAndRange || castAs === 'string')\n  ) {\n    indexes.unique = { token_filters: [] }\n  }\n\n  if (capabilities.orderAndRange) {\n    indexes.ore = {}\n  }\n\n  if (capabilities.freeTextSearch) {\n    // The factory returns fresh, unaliased nested objects per call, so no\n    // column's emitted match block ever shares state with another's.\n    indexes.match = defaultMatchOpts()\n  }\n\n  return indexes\n}\n\n/** Whether a domain's capabilities make it queryable at all (any flag set). */\nfunction isQueryableCapabilities(capabilities: QueryCapabilities): boolean {\n  return (\n    capabilities.equality ||\n    capabilities.orderAndRange ||\n    capabilities.freeTextSearch\n  )\n}\n\n/**\n * Shared base for every v3 concrete domain column. Parameterised by the FULL\n * literal {@link V3DomainDefinition} (not by capabilities alone): the private\n * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so\n * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and\n * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This\n * nominality is what keeps plaintext inference precise.\n */\nexport class EncryptedV3Column<D extends V3DomainDefinition> {\n  constructor(\n    private readonly columnName: string,\n    private readonly definition: D,\n  ) {}\n\n  getName(): string {\n    return this.columnName\n  }\n\n  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */\n  getEqlType(): D['eqlType'] {\n    return this.definition.eqlType\n  }\n\n  /** The semantic query capabilities this domain exposes. Metadata only. */\n  getQueryCapabilities(): D['capabilities'] {\n    return this.definition.capabilities\n  }\n\n  /** `true` when this domain can produce at least one kind of query term. */\n  isQueryable(): QueryableFlag<D> {\n    return isQueryableCapabilities(\n      this.definition.capabilities,\n    ) as QueryableFlag<D>\n  }\n\n  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */\n  build(): ColumnSchema {\n    return {\n      cast_as: this.definition.castAs,\n      indexes: indexesForCapabilities(\n        this.definition.capabilities,\n        this.definition.castAs,\n      ),\n    }\n  }\n}\n\nconst TEXT_SEARCH_DOMAIN = {\n  eqlType: TEXT_SEARCH_EQL_TYPE,\n  castAs: 'string',\n  capabilities: TEXT_SEARCH,\n} as const\n\n/**\n * Builder for an `eql_v3.text_search` column.\n *\n * The concrete type inherently enables equality + order/range + free-text\n * match — there are no capability-enabling methods. `.freeTextSearch(opts?)`\n * tunes the match index only.\n *\n * NOTE — querying: a `text_search` column emits all three indexes (`unique`,\n * `ore`, `match`), and the shared index-inference picks them by fixed priority\n * `unique > match > ore`. So `encryptQuery(value, { column, table })` with NO\n * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text\n * match — a substring like `'joh'` then matches nothing. To run a free-text\n * match query you MUST pass `queryType: 'freeTextSearch'`:\n *\n * ```typescript\n * // equality (default): exact value only\n * client.encryptQuery('john@example.com', { column: users.email, table: users })\n * // free-text match: substring/token search\n * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })\n * ```\n */\nexport class EncryptedTextSearchColumn extends EncryptedV3Column<\n  typeof TEXT_SEARCH_DOMAIN\n> {\n  private matchOpts: BuiltMatchIndexOpts\n\n  constructor(columnName: string) {\n    super(columnName, TEXT_SEARCH_DOMAIN)\n    this.matchOpts = defaultMatchOpts()\n  }\n\n  /**\n   * Tune the match index. Each provided key replaces its default; omitted\n   * keys keep the default. This NEVER enables a capability — match is always\n   * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.\n   */\n  freeTextSearch(opts?: MatchIndexOpts): this {\n    // A fresh defaults object per call supplies the `?? ` fallbacks, so no\n    // nested default object is ever shared into `this.matchOpts` by reference.\n    const defaults = defaultMatchOpts()\n    // Clone-on-write: deep-copy the nested tokenizer / token_filters when\n    // storing them so a caller mutating their own opts object between\n    // freeTextSearch(opts) and build() cannot leak into the emitted config.\n    this.matchOpts = cloneMatchOpts({\n      tokenizer: opts?.tokenizer ?? defaults.tokenizer,\n      token_filters: opts?.token_filters ?? defaults.token_filters,\n      k: opts?.k ?? defaults.k,\n      m: opts?.m ?? defaults.m,\n      include_original: opts?.include_original ?? defaults.include_original,\n    })\n    return this\n  }\n\n  /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */\n  override build(): ColumnSchema {\n    // Deep-clone the match block so the returned config NEVER aliases this\n    // builder's internal `matchOpts` (or any caller-supplied opts merged into\n    // it). A caller mutating the returned object cannot corrupt this builder's\n    // state or another column's defaults.\n    return {\n      cast_as: 'string',\n      indexes: {\n        unique: { token_filters: [] },\n        ore: {},\n        match: cloneMatchOpts(this.matchOpts),\n      },\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Concrete domain columns\n//\n// Every concrete class is an empty subclass parameterised by its literal domain\n// definition (see EncryptedV3Column). The `types` namespace (see ./types)\n// constructs these with the SAME literal constant so the instance's private\n// `definition` field carries full literal type data — that is what keeps\n// distinct domains nominally incompatible.\n// ---------------------------------------------------------------------------\n\n// integer\nexport class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {}\nexport class EncryptedIntegerEqColumn extends EncryptedV3Column<\n  typeof INTEGER_EQ\n> {}\nexport class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD_ORE\n> {}\nexport class EncryptedIntegerOrdColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD\n> {}\n\n// smallint\nexport class EncryptedSmallintColumn extends EncryptedV3Column<\n  typeof SMALLINT\n> {}\nexport class EncryptedSmallintEqColumn extends EncryptedV3Column<\n  typeof SMALLINT_EQ\n> {}\nexport class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD_ORE\n> {}\nexport class EncryptedSmallintOrdColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD\n> {}\n\n// bigint (int8) domain builders are intentionally omitted pending FFI support\n// for lossless bigint round-tripping — see the note by the INTEGER/DATE domain\n// definitions above.\n\n// date\nexport class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {}\nexport class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {}\nexport class EncryptedDateOrdOreColumn extends EncryptedV3Column<\n  typeof DATE_ORD_ORE\n> {}\nexport class EncryptedDateOrdColumn extends EncryptedV3Column<\n  typeof DATE_ORD\n> {}\n\n// timestamp\nexport class EncryptedTimestampColumn extends EncryptedV3Column<\n  typeof TIMESTAMP\n> {}\nexport class EncryptedTimestampEqColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_EQ\n> {}\nexport class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD_ORE\n> {}\nexport class EncryptedTimestampOrdColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD\n> {}\n\n// numeric\nexport class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {}\nexport class EncryptedNumericEqColumn extends EncryptedV3Column<\n  typeof NUMERIC_EQ\n> {}\nexport class EncryptedNumericOrdOreColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD_ORE\n> {}\nexport class EncryptedNumericOrdColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD\n> {}\n\n// text (text_search is defined above with its match-tuning override)\nexport class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {}\nexport class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {}\nexport class EncryptedTextMatchColumn extends EncryptedV3Column<\n  typeof TEXT_MATCH\n> {}\nexport class EncryptedTextOrdOreColumn extends EncryptedV3Column<\n  typeof TEXT_ORD_ORE\n> {}\nexport class EncryptedTextOrdColumn extends EncryptedV3Column<\n  typeof TEXT_ORD\n> {}\n\n// boolean\nexport class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {}\n\n// real\nexport class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {}\nexport class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {}\nexport class EncryptedRealOrdOreColumn extends EncryptedV3Column<\n  typeof REAL_ORD_ORE\n> {}\nexport class EncryptedRealOrdColumn extends EncryptedV3Column<\n  typeof REAL_ORD\n> {}\n\n// double\nexport class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {}\nexport class EncryptedDoubleEqColumn extends EncryptedV3Column<\n  typeof DOUBLE_EQ\n> {}\nexport class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD_ORE\n> {}\nexport class EncryptedDoubleOrdColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD\n> {}\n\n/**\n * Union of every v3 concrete column type. Used as the value type for v3 table\n * columns so a table may mix any generated domains.\n */\nexport type AnyEncryptedV3Column =\n  | EncryptedIntegerColumn\n  | EncryptedIntegerEqColumn\n  | EncryptedIntegerOrdOreColumn\n  | EncryptedIntegerOrdColumn\n  | EncryptedSmallintColumn\n  | EncryptedSmallintEqColumn\n  | EncryptedSmallintOrdOreColumn\n  | EncryptedSmallintOrdColumn\n  | EncryptedDateColumn\n  | EncryptedDateEqColumn\n  | EncryptedDateOrdOreColumn\n  | EncryptedDateOrdColumn\n  | EncryptedTimestampColumn\n  | EncryptedTimestampEqColumn\n  | EncryptedTimestampOrdOreColumn\n  | EncryptedTimestampOrdColumn\n  | EncryptedNumericColumn\n  | EncryptedNumericEqColumn\n  | EncryptedNumericOrdOreColumn\n  | EncryptedNumericOrdColumn\n  | EncryptedTextColumn\n  | EncryptedTextEqColumn\n  | EncryptedTextMatchColumn\n  | EncryptedTextOrdOreColumn\n  | EncryptedTextOrdColumn\n  | EncryptedTextSearchColumn\n  | EncryptedBooleanColumn\n  | EncryptedRealColumn\n  | EncryptedRealEqColumn\n  | EncryptedRealOrdOreColumn\n  | EncryptedRealOrdColumn\n  | EncryptedDoubleColumn\n  | EncryptedDoubleEqColumn\n  | EncryptedDoubleOrdOreColumn\n  | EncryptedDoubleOrdColumn\n\n/**\n * Shape of v3 table columns: every value is a v3 concrete column builder.\n * (Nested fields are deferred to later increments.)\n */\nexport type EncryptedV3TableColumn = {\n  [key: string]: AnyEncryptedV3Column\n}\n\n/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */\ntype PlaintextFromKind<K extends PlaintextKind> = K extends 'string'\n  ? string\n  : K extends 'number'\n    ? number\n    : K extends 'boolean'\n      ? boolean\n      : K extends 'date' | 'timestamp'\n        ? Date\n        : never\n\n/**\n * The plaintext type for a single v3 column, read from the literal domain\n * definition carried on the base class's private field. This is stable across\n * empty subclasses that share the same base generic — a subclass-name\n * conditional would collapse because those subclasses are structurally\n * assignable to one another.\n */\nexport type PlaintextForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never\n\n/**\n * The user-facing `queryType` names a v3 column supports, derived 1:1 from its\n * capability flags. Resolves to `never` for a storage-only column (all flags\n * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}\n * keys and the first three {@link import('@/types').QueryTypeName} members.\n */\nexport type QueryTypesForColumn<C> =\n  C extends EncryptedV3Column<infer D>\n    ?\n        | (D['capabilities']['equality'] extends true ? 'equality' : never)\n        | (D['capabilities']['orderAndRange'] extends true\n            ? 'orderAndRange'\n            : never)\n        | (D['capabilities']['freeTextSearch'] extends true\n            ? 'freeTextSearch'\n            : never)\n    : never\n\n/**\n * The concrete EQL v3 type string for a single column, read from the literal\n * domain definition carried on the base class's private field (mirrors\n * {@link PlaintextForColumn}). Distributes over a union of columns, so\n * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's\n * `eqlType` — the canonical, source-of-truth key set for a type-driven test\n * matrix keyed by domain.\n */\nexport type EqlTypeForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? D['eqlType'] : never\n","import type { ColumnSchema, EncryptConfig } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type {\n  EncryptedV3TableColumn,\n  PlaintextForColumn,\n  QueryTypesForColumn,\n} from './columns'\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\n/**\n * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3\n * column builders. Emits the same `{ tableName, columns }` definition shape.\n */\nexport class EncryptedTable<T extends EncryptedV3TableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n    for (const builder of Object.values(this.columnBuilders)) {\n      // Key by the column's DB name (`getName()`), NOT the JS property name.\n      // `encrypt`/`decrypt` look columns up in the config by `column.getName()`,\n      // so a camelCase JS key mapping to a snake_case DB column (e.g.\n      // `createdOn: types.Date('created_on')`) must register under\n      // `created_on` or the FFI reports \"column not found in Encrypt config\".\n      const name = builder.getName()\n      // Two JS properties resolving to the same DB name would silently overwrite\n      // here (later wins), dropping the first column's config. Fail loudly —\n      // matching the duplicate-tableName guard in buildEncryptConfig and the\n      // reserved-key guard in encryptedTable.\n      if (Object.hasOwn(builtColumns, name)) {\n        throw new Error(\n          `[eql/v3]: duplicate column name \"${name}\" in table \"${this.tableName}\" — two columns resolve to the same DB name`,\n        )\n      }\n      builtColumns[name] = builder.build()\n    }\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n\n  /**\n   * Map each column's JS property name to its DB column name (`getName()`).\n   * The model path matches user models by property name but must address the\n   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so\n   * the two only agree when property == name. This recovers the mapping that\n   * `build()` discards.\n   */\n  buildColumnKeyMap(): Record<string, string> {\n    const map: Record<string, string> = {}\n    for (const [property, builder] of Object.entries(this.columnBuilders)) {\n      map[property] = builder.getName()\n    }\n    return map\n  }\n}\n\n/**\n * Own instance members of {@link EncryptedTable} that a column name must not\n * shadow. Because {@link encryptedTable} copies column builders onto the\n * instance for accessor access (`users.email`), a column named e.g. `build`\n * would otherwise overwrite the method that {@link buildEncryptConfig} relies\n * on. `_columnType` is a type-only `declare` (no runtime property) so it is\n * listed explicitly here rather than caught by the `in` check below.\n */\nconst RESERVED_TABLE_KEYS = new Set([\n  'tableName',\n  'columnBuilders',\n  '_columnType',\n  'build',\n  'buildColumnKeyMap',\n])\n\n/**\n * Whether a column name would collide with a reserved property on the table\n * object — either an own member ({@link RESERVED_TABLE_KEYS}) or any inherited\n * `Object.prototype` member (`constructor`, `toString`, `valueOf`,\n * `hasOwnProperty`, …). The `in` check covers the prototype chain so assigning\n * the column as an own property can never shadow a prototype method/accessor.\n */\nfunction isReservedTableKey(tableBuilder: object, colName: string): boolean {\n  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder\n}\n\n/**\n * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`\n * name but lives on the `/eql/v3` subpath — the importer picks the model by\n * import path. The returned object is also a column accessor (`users.email`).\n */\nexport function encryptedTable<T extends EncryptedV3TableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    if (isReservedTableKey(tableBuilder, colName)) {\n      throw new Error(\n        `Column name \"${colName}\" collides with a reserved EncryptedTable property`,\n      )\n    }\n    ;(tableBuilder as EncryptedV3TableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same\n * shape as v2's `buildEncryptConfig`.\n */\nexport function buildEncryptConfig(\n  ...tables: Array<EncryptedTable<EncryptedV3TableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 1,\n    tables: {},\n  }\n\n  for (const tb of tables) {\n    const tableDef = tb.build()\n    // Config tables are keyed by name, so a duplicate would silently overwrite\n    // the earlier table. Fail loudly instead. (v3-only additive guard; v2's\n    // buildEncryptConfig keeps its existing silent-overwrite behavior.)\n    if (Object.hasOwn(config.tables, tableDef.tableName)) {\n      throw new Error(\n        `[eql/v3]: duplicate table name \"${tableDef.tableName}\" passed to buildEncryptConfig — each table must have a unique name`,\n      )\n    }\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n\n/**\n * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps\n * to the TypeScript type of its domain's `castAs` kind.\n */\nexport type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C>\n    ? { [K in keyof C]: PlaintextForColumn<C[K]> }\n    : never\n\n/**\n * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}\n * for why no key-remap filter is needed in the flat single-type model.\n */\nexport type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C> ? { [K in keyof C]: Encrypted } : never\n\n// ---------------------------------------------------------------------------\n// Typed-client surface helpers (@cipherstash/stack/v3)\n// ---------------------------------------------------------------------------\n\n/** Any v3 table, regardless of its column map. */\nexport type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>\n\n/** Union of the concrete column builders declared on a v3 table. */\nexport type ColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C> ? C[keyof C] : never\n\n/**\n * Union of the *queryable* column builders on a v3 table. Storage-only columns\n * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't\n * be passed to a query method.\n */\nexport type QueryableColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never]\n          ? never\n          : C[K]\n      }[keyof C]\n    : never\n\n/**\n * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.\n * `T` is inferred from the argument: keys that name a schema column are pinned to\n * the column's plaintext type (nullable if the field is nullable), so a wrong-typed\n * field fails assignability; all other keys pass through unchanged.\n */\nexport type V3ModelInput<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n\n/** The encrypted result model: schema columns become `Encrypted`, others pass through. */\nexport type V3EncryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? Encrypted | null\n      : Encrypted\n    : T[K]\n}\n\n/** The decrypted result model: schema columns become their plaintext type, others pass through. */\nexport type V3DecryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n","import {\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a factory that builds a concrete\n * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain\n * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So\n * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`\n * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the\n * only capability-bearing chain — every other domain is fully described by its\n * type). bigint domains are intentionally absent pending lossless FFI\n * round-tripping (see ./columns).\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n} as const\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgCO,SAAS,mBAAwC;AACtD,SAAO;AAAA,IACL,WAAW,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,IAC5C,eAAe,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,kBAAkB;AAAA,EACpB;AACF;AAOO,SAAS,eAAe,MAAgD;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,EAAE,GAAG,KAAK,UAAU;AAAA,IAC/B,eAAe,KAAK,cAAc,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,EACzD;AACF;;;ACFA,IAAM,eAAe;AAAA,EACnB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,kBAAkB;AAAA,EACtB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,aAAa;AAAA,EACjB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,cAAc;AAAA,EAClB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAOO,IAAM,uBAAuB;AAS7B,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AASO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAKO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,oBAAoB;AAAA,EAC/B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAiBA,SAAS,uBACP,cACA,QACyB;AACzB,QAAM,UAAmC,CAAC;AAK1C,MACE,aAAa,aACZ,CAAC,aAAa,iBAAiB,WAAW,WAC3C;AACA,YAAQ,SAAS,EAAE,eAAe,CAAC,EAAE;AAAA,EACvC;AAEA,MAAI,aAAa,eAAe;AAC9B,YAAQ,MAAM,CAAC;AAAA,EACjB;AAEA,MAAI,aAAa,gBAAgB;AAG/B,YAAQ,QAAQ,iBAAiB;AAAA,EACnC;AAEA,SAAO;AACT;AAGA,SAAS,wBAAwB,cAA0C;AACzE,SACE,aAAa,YACb,aAAa,iBACb,aAAa;AAEjB;AAUO,IAAM,oBAAN,MAAsD;AAAA,EAC3D,YACmB,YACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,UAAkB;AAChB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,aAA2B;AACzB,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,uBAA0C;AACxC,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,cAAgC;AAC9B,WAAO;AAAA,MACL,KAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,QAAsB;AACpB,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACP,KAAK,WAAW;AAAA,QAChB,KAAK,WAAW;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBO,IAAM,4BAAN,cAAwC,kBAE7C;AAAA,EACQ;AAAA,EAER,YAAY,YAAoB;AAC9B,UAAM,YAAY,kBAAkB;AACpC,SAAK,YAAY,iBAAiB;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,MAA6B;AAG1C,UAAM,WAAW,iBAAiB;AAIlC,SAAK,YAAY,eAAe;AAAA,MAC9B,WAAW,MAAM,aAAa,SAAS;AAAA,MACvC,eAAe,MAAM,iBAAiB,SAAS;AAAA,MAC/C,GAAG,MAAM,KAAK,SAAS;AAAA,MACvB,GAAG,MAAM,KAAK,SAAS;AAAA,MACvB,kBAAkB,MAAM,oBAAoB,SAAS;AAAA,IACvD,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGS,QAAsB;AAK7B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,QAAQ,EAAE,eAAe,CAAC,EAAE;AAAA,QAC5B,KAAK,CAAC;AAAA,QACN,OAAO,eAAe,KAAK,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACF;AAaO,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,gCAAN,cAA4C,kBAEjD;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AAOI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AACI,IAAM,iCAAN,cAA6C,kBAElD;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AAGxE,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;;;AC3iBI,IAAM,iBAAN,MAAuD;AAAA,EAI5D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EAGlB,QAAyB;AACvB,UAAM,eAA6C,CAAC;AACpD,eAAW,WAAW,OAAO,OAAO,KAAK,cAAc,GAAG;AAMxD,YAAM,OAAO,QAAQ,QAAQ;AAK7B,UAAI,OAAO,OAAO,cAAc,IAAI,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,oCAAoC,IAAI,eAAe,KAAK,SAAS;AAAA,QACvE;AAAA,MACF;AACA,mBAAa,IAAI,IAAI,QAAQ,MAAM;AAAA,IACrC;AACA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oBAA4C;AAC1C,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACrE,UAAI,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AACF;AAUA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,mBAAmB,cAAsB,SAA0B;AAC1E,SAAO,oBAAoB,IAAI,OAAO,KAAK,WAAW;AACxD;AAOO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D,QAAI,mBAAmB,cAAc,OAAO,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF;AACA;AAAC,IAAC,aAAwC,OAAO,IAAI;AAAA,EACvD;AAEA,SAAO;AACT;AAMO,SAAS,sBACX,QACY;AACf,QAAM,SAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,QAAQ,CAAC;AAAA,EACX;AAEA,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,GAAG,MAAM;AAI1B,QAAI,OAAO,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,SAAS;AAAA,MACvD;AAAA,IACF;AACA,WAAO,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,EAC/C;AAEA,SAAO;AACT;;;ACjDO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA,EAGnD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAC5E;","names":[]}

package/dist/eql/v3/index.d.cts

@@ -0,0 +1,71 @@
+import { m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, p as EncryptedIntegerOrdOreColumn, o as EncryptedIntegerOrdColumn, y as EncryptedSmallintColumn, z as EncryptedSmallintEqColumn, D as EncryptedSmallintOrdOreColumn, B as EncryptedSmallintOrdColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, h as EncryptedDateOrdOreColumn, g as EncryptedDateOrdColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, R as EncryptedTimestampOrdOreColumn, O as EncryptedTimestampOrdColumn, q as EncryptedNumericColumn, r as EncryptedNumericEqColumn, t as EncryptedNumericOrdOreColumn, s as EncryptedNumericOrdColumn, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, K as EncryptedTextOrdOreColumn, J as EncryptedTextOrdColumn, L as EncryptedTextSearchColumn, E as EncryptedBooleanColumn, u as EncryptedRealColumn, v as EncryptedRealEqColumn, x as EncryptedRealOrdOreColumn, w as EncryptedRealOrdColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, l as EncryptedDoubleOrdOreColumn, k as EncryptedDoubleOrdColumn } from '../../table-DihEAlxG.cjs';
+export { d as AnyEncryptedV3Column, A as AnyV3Table, C as ColumnsOf, F as EncryptedTable, S as EncryptedV3TableColumn, T as EqlTypeForColumn, U as InferEncrypted, W as InferPlaintext, P as PlaintextForColumn, X as QueryCapabilities, a as QueryTypesForColumn, Q as QueryableColumnsOf, Y as TEXT_SEARCH_EQL_TYPE, c as V3DecryptedModel, b as V3EncryptedModel, V as V3ModelInput, Z as buildEncryptConfig, _ as encryptedTable } from '../../table-DihEAlxG.cjs';
+import '../../types-public-CpS5KjwX.cjs';
+import '@cipherstash/protect-ffi';
+import 'zod';
+
+/**
+ * The v3 column-type namespace. Each member is a factory that builds a concrete
+ * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain
+ * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So
+ * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`
+ * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.
+ *
+ * Each factory returns the CONCRETE column class instance (never the widened
+ * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference
+ * stays precise.
+ *
+ * ```ts
+ * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
+ *
+ * const events = encryptedTable('events', {
+ *   actor:     types.TextEq('actor'),           // equality
+ *   weight:    types.IntegerOrd('weight'),         // order + range
+ *   createdAt: types.Timestamp('created_at'), // storage only
+ * })
+ * ```
+ *
+ * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the
+ * only capability-bearing chain — every other domain is fully described by its
+ * type). bigint domains are intentionally absent pending lossless FFI
+ * round-tripping (see ./columns).
+ */
+declare const types: {
+    readonly Integer: (name: string) => EncryptedIntegerColumn;
+    readonly IntegerEq: (name: string) => EncryptedIntegerEqColumn;
+    readonly IntegerOrdOre: (name: string) => EncryptedIntegerOrdOreColumn;
+    readonly IntegerOrd: (name: string) => EncryptedIntegerOrdColumn;
+    readonly Smallint: (name: string) => EncryptedSmallintColumn;
+    readonly SmallintEq: (name: string) => EncryptedSmallintEqColumn;
+    readonly SmallintOrdOre: (name: string) => EncryptedSmallintOrdOreColumn;
+    readonly SmallintOrd: (name: string) => EncryptedSmallintOrdColumn;
+    readonly Date: (name: string) => EncryptedDateColumn;
+    readonly DateEq: (name: string) => EncryptedDateEqColumn;
+    readonly DateOrdOre: (name: string) => EncryptedDateOrdOreColumn;
+    readonly DateOrd: (name: string) => EncryptedDateOrdColumn;
+    readonly Timestamp: (name: string) => EncryptedTimestampColumn;
+    readonly TimestampEq: (name: string) => EncryptedTimestampEqColumn;
+    readonly TimestampOrdOre: (name: string) => EncryptedTimestampOrdOreColumn;
+    readonly TimestampOrd: (name: string) => EncryptedTimestampOrdColumn;
+    readonly Numeric: (name: string) => EncryptedNumericColumn;
+    readonly NumericEq: (name: string) => EncryptedNumericEqColumn;
+    readonly NumericOrdOre: (name: string) => EncryptedNumericOrdOreColumn;
+    readonly NumericOrd: (name: string) => EncryptedNumericOrdColumn;
+    readonly Text: (name: string) => EncryptedTextColumn;
+    readonly TextEq: (name: string) => EncryptedTextEqColumn;
+    readonly TextMatch: (name: string) => EncryptedTextMatchColumn;
+    readonly TextOrdOre: (name: string) => EncryptedTextOrdOreColumn;
+    readonly TextOrd: (name: string) => EncryptedTextOrdColumn;
+    readonly TextSearch: (name: string) => EncryptedTextSearchColumn;
+    readonly Boolean: (name: string) => EncryptedBooleanColumn;
+    readonly Real: (name: string) => EncryptedRealColumn;
+    readonly RealEq: (name: string) => EncryptedRealEqColumn;
+    readonly RealOrdOre: (name: string) => EncryptedRealOrdOreColumn;
+    readonly RealOrd: (name: string) => EncryptedRealOrdColumn;
+    readonly Double: (name: string) => EncryptedDoubleColumn;
+    readonly DoubleEq: (name: string) => EncryptedDoubleEqColumn;
+    readonly DoubleOrdOre: (name: string) => EncryptedDoubleOrdOreColumn;
+    readonly DoubleOrd: (name: string) => EncryptedDoubleOrdColumn;
+};
+
+export { EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, types };

package/dist/eql/v3/index.d.ts

@@ -0,0 +1,71 @@
+import { m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, p as EncryptedIntegerOrdOreColumn, o as EncryptedIntegerOrdColumn, y as EncryptedSmallintColumn, z as EncryptedSmallintEqColumn, D as EncryptedSmallintOrdOreColumn, B as EncryptedSmallintOrdColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, h as EncryptedDateOrdOreColumn, g as EncryptedDateOrdColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, R as EncryptedTimestampOrdOreColumn, O as EncryptedTimestampOrdColumn, q as EncryptedNumericColumn, r as EncryptedNumericEqColumn, t as EncryptedNumericOrdOreColumn, s as EncryptedNumericOrdColumn, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, K as EncryptedTextOrdOreColumn, J as EncryptedTextOrdColumn, L as EncryptedTextSearchColumn, E as EncryptedBooleanColumn, u as EncryptedRealColumn, v as EncryptedRealEqColumn, x as EncryptedRealOrdOreColumn, w as EncryptedRealOrdColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, l as EncryptedDoubleOrdOreColumn, k as EncryptedDoubleOrdColumn } from '../../table-CIH7jZ2h.js';
+export { d as AnyEncryptedV3Column, A as AnyV3Table, C as ColumnsOf, F as EncryptedTable, S as EncryptedV3TableColumn, T as EqlTypeForColumn, U as InferEncrypted, W as InferPlaintext, P as PlaintextForColumn, X as QueryCapabilities, a as QueryTypesForColumn, Q as QueryableColumnsOf, Y as TEXT_SEARCH_EQL_TYPE, c as V3DecryptedModel, b as V3EncryptedModel, V as V3ModelInput, Z as buildEncryptConfig, _ as encryptedTable } from '../../table-CIH7jZ2h.js';
+import '../../types-public-CpS5KjwX.js';
+import '@cipherstash/protect-ffi';
+import 'zod';
+
+/**
+ * The v3 column-type namespace. Each member is a factory that builds a concrete
+ * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain
+ * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So
+ * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`
+ * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.
+ *
+ * Each factory returns the CONCRETE column class instance (never the widened
+ * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference
+ * stays precise.
+ *
+ * ```ts
+ * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
+ *
+ * const events = encryptedTable('events', {
+ *   actor:     types.TextEq('actor'),           // equality
+ *   weight:    types.IntegerOrd('weight'),         // order + range
+ *   createdAt: types.Timestamp('created_at'), // storage only
+ * })
+ * ```
+ *
+ * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the
+ * only capability-bearing chain — every other domain is fully described by its
+ * type). bigint domains are intentionally absent pending lossless FFI
+ * round-tripping (see ./columns).
+ */
+declare const types: {
+    readonly Integer: (name: string) => EncryptedIntegerColumn;
+    readonly IntegerEq: (name: string) => EncryptedIntegerEqColumn;
+    readonly IntegerOrdOre: (name: string) => EncryptedIntegerOrdOreColumn;
+    readonly IntegerOrd: (name: string) => EncryptedIntegerOrdColumn;
+    readonly Smallint: (name: string) => EncryptedSmallintColumn;
+    readonly SmallintEq: (name: string) => EncryptedSmallintEqColumn;
+    readonly SmallintOrdOre: (name: string) => EncryptedSmallintOrdOreColumn;
+    readonly SmallintOrd: (name: string) => EncryptedSmallintOrdColumn;
+    readonly Date: (name: string) => EncryptedDateColumn;
+    readonly DateEq: (name: string) => EncryptedDateEqColumn;
+    readonly DateOrdOre: (name: string) => EncryptedDateOrdOreColumn;
+    readonly DateOrd: (name: string) => EncryptedDateOrdColumn;
+    readonly Timestamp: (name: string) => EncryptedTimestampColumn;
+    readonly TimestampEq: (name: string) => EncryptedTimestampEqColumn;
+    readonly TimestampOrdOre: (name: string) => EncryptedTimestampOrdOreColumn;
+    readonly TimestampOrd: (name: string) => EncryptedTimestampOrdColumn;
+    readonly Numeric: (name: string) => EncryptedNumericColumn;
+    readonly NumericEq: (name: string) => EncryptedNumericEqColumn;
+    readonly NumericOrdOre: (name: string) => EncryptedNumericOrdOreColumn;
+    readonly NumericOrd: (name: string) => EncryptedNumericOrdColumn;
+    readonly Text: (name: string) => EncryptedTextColumn;
+    readonly TextEq: (name: string) => EncryptedTextEqColumn;
+    readonly TextMatch: (name: string) => EncryptedTextMatchColumn;
+    readonly TextOrdOre: (name: string) => EncryptedTextOrdOreColumn;
+    readonly TextOrd: (name: string) => EncryptedTextOrdColumn;
+    readonly TextSearch: (name: string) => EncryptedTextSearchColumn;
+    readonly Boolean: (name: string) => EncryptedBooleanColumn;
+    readonly Real: (name: string) => EncryptedRealColumn;
+    readonly RealEq: (name: string) => EncryptedRealEqColumn;
+    readonly RealOrdOre: (name: string) => EncryptedRealOrdOreColumn;
+    readonly RealOrd: (name: string) => EncryptedRealOrdColumn;
+    readonly Double: (name: string) => EncryptedDoubleColumn;
+    readonly DoubleEq: (name: string) => EncryptedDoubleEqColumn;
+    readonly DoubleOrdOre: (name: string) => EncryptedDoubleOrdOreColumn;
+    readonly DoubleOrd: (name: string) => EncryptedDoubleOrdColumn;
+};
+
+export { EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, types };

package/dist/eql/v3/index.js

@@ -0,0 +1,89 @@
+import {
+  EncryptedTable,
+  buildEncryptConfig,
+  encryptedTable,
+  types
+} from "../../chunk-IBSK6P33.js";
+import {
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
+  TEXT_SEARCH_EQL_TYPE
+} from "../../chunk-U66S7VIF.js";
+import "../../chunk-IADZCZEA.js";
+import "../../chunk-PZ5AY32C.js";
+export {
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTable,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
+  TEXT_SEARCH_EQL_TYPE,
+  buildEncryptConfig,
+  encryptedTable,
+  types
+};
+//# sourceMappingURL=index.js.map

package/dist/eql/v3/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/errors/index.js

@@ -2,6 +2,7 @@ import {
   EncryptionErrorTypes,
   getErrorMessage
 } from "../chunk-LBMC4D6D.js";
+import "../chunk-PZ5AY32C.js";
 export {
   EncryptionErrorTypes,
   getErrorMessage

package/dist/identity/index.cjs

@@ -30,10 +30,24 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/identity/index.ts
 var identity_exports = {};
 __export(identity_exports, {
-  LockContext: () => LockContext
+  LockContext: () => LockContext,
+  resolveLockContext: () => resolveLockContext
 });
 module.exports = __toCommonJS(identity_exports);
 
+// ../../node_modules/.pnpm/@byteslice+result@0.2.0/node_modules/@byteslice/result/dist/result.mjs
+function ensureError(ex) {
+  return ex instanceof Error ? ex : new Error("Something went wrong");
+}
+async function withResult(operation, onError, hooks) {
+  try {
+    return { data: await operation() };
+  } catch (ex) {
+    const error = hooks?.onException?.(ex) ?? ensureError(ex);
+    return { failure: onError(error) };
+  }
+}
+
 // src/errors/index.ts
 var EncryptionErrorTypes = {
   ClientInitError: "ClientInitError",
@@ -106,7 +120,7 @@ function loadWorkSpaceId(suppliedCrn) {
   return extractWorkspaceIdFromCrn(workspaceCrn);
 }
 
-// ../../node_modules/.pnpm/evlog@1.11.0_next@15.5.10_react-dom@19.2.3_react@19.2.3__react@19.2.3__react@19.2.3/node_modules/evlog/dist/utils.mjs
+// ../../node_modules/.pnpm/evlog@1.11.0_next@15.5.18_react-dom@19.2.3_react@19.2.3__react@19.2.3__react@19.2.3/node_modules/evlog/dist/utils.mjs
 function formatDuration(ms) {
   if (ms < 1e3) return `${Math.round(ms)}ms`;
   return `${(ms / 1e3).toFixed(2)}s`;
@@ -162,7 +176,7 @@ function matchesPattern(path2, pattern) {
   return new RegExp(`^${regexPattern}$`).test(path2);
 }
 
-// ../../node_modules/.pnpm/evlog@1.11.0_next@15.5.10_react-dom@19.2.3_react@19.2.3__react@19.2.3__react@19.2.3/node_modules/evlog/dist/logger.mjs
+// ../../node_modules/.pnpm/evlog@1.11.0_next@15.5.18_react-dom@19.2.3_react@19.2.3__react@19.2.3__react@19.2.3/node_modules/evlog/dist/logger.mjs
 function isPlainObject(val) {
   return val !== null && typeof val === "object" && !Array.isArray(val);
 }
@@ -467,7 +481,9 @@ var logger = {
 };
 
 // src/identity/index.ts
-var import_result = require("@byteslice/result");
+function resolveLockContext(input) {
+  return input instanceof LockContext || "identityContext" in input ? input.identityContext : input;
+}
 var LockContext = class {
   ctsToken;
   workspaceId;
@@ -489,25 +505,31 @@ var LockContext = class {
     this.context = context;
     logger.debug("Successfully initialized the EQL lock context.");
   }
+  /**
+   * The identity-claim context this lock context binds to, e.g.
+   * `{ identityClaim: ['sub'] }`. Resolved synchronously — `.withLockContext()`
+   * uses this directly; no CTS token is required.
+   */
+  get identityContext() {
+    return this.context;
+  }
   /**
    * Exchange a user's JWT for a CTS token and bind it to this lock context.
    *
-   * @param jwtToken - A valid OIDC / JWT token for the current user.
-   * @returns A `Result` containing this `LockContext` (now authenticated) or an error.
+   * @deprecated Per-operation CTS tokens were removed in protect-ffi 0.25.
+   * Authenticate the client as the user with an `OidcFederationStrategy`
+   * (`config.authStrategy`) instead, and pass the claim to `.withLockContext()`.
+   * The token fetched here is no longer used by encryption operations. This
+   * method is kept for backwards compatibility and will be removed in a
+   * future major release.
    *
-   * @example
-   * ```typescript
-   * const lc = new LockContext()
-   * const result = await lc.identify(userJwt)
-   * if (result.failure) {
-   *   console.error("Auth failed:", result.failure.message)
-   * }
-   * ```
+   * @param jwtToken - A valid OIDC / JWT token for the current user.
+   * @returns A `Result` containing this `LockContext` or an error.
    */
   async identify(jwtToken) {
     const workspaceId = this.workspaceId;
     const ctsEndpoint = process.env.CS_CTS_ENDPOINT || "https://ap-southeast-2.aws.auth.viturhosted.net";
-    const ctsFetchResult = await (0, import_result.withResult)(
+    const ctsFetchResult = await withResult(
       () => fetch(`${ctsEndpoint}/api/authorize`, {
         method: "POST",
         headers: {
@@ -526,7 +548,7 @@ var LockContext = class {
     if (ctsFetchResult.failure) {
       return ctsFetchResult;
     }
-    const identifiedLockContext = await (0, import_result.withResult)(
+    const identifiedLockContext = await withResult(
       async () => {
         const ctsToken = await ctsFetchResult.data.json();
         if (!ctsToken.accessToken) {
@@ -545,27 +567,24 @@ var LockContext = class {
     return identifiedLockContext;
   }
   /**
-   * Retrieve the current CTS token and context for use with encryption operations.
+   * Retrieve the identity context (and CTS token, if one was set).
    *
-   * Must be called after {@link identify}. Returns the token/context pair that
-   * `.withLockContext()` expects.
-   *
-   * @returns A `Result` containing the CTS token and identity context, or an error
-   *   if {@link identify} has not been called.
+   * @deprecated Encryption operations no longer consume a CTS token — they read
+   * the identity claim directly via {@link identityContext}. Pass the claim to
+   * `.withLockContext()` and authenticate the client with an
+   * `OidcFederationStrategy` instead. Kept for backwards compatibility; the
+   * returned `ctsToken` is `undefined` unless one was supplied to the
+   * constructor or {@link identify} was called.
    */
   getLockContext() {
-    return (0, import_result.withResult)(
-      () => {
-        if (!this.ctsToken?.accessToken || !this.ctsToken?.expiry) {
-          throw new Error(
-            "The CTS token is not set. Please call identify() with a users JWT token, or pass an existing CTS token to the LockContext constructor before calling getLockContext()."
-          );
-        }
-        return {
-          context: this.context,
-          ctsToken: this.ctsToken
-        };
-      },
+    return withResult(
+      () => ({
+        context: this.context,
+        // Only include `ctsToken` when one was actually set, so the
+        // returned shape matches the optional `ctsToken?` type rather
+        // than carrying an explicit `undefined`.
+        ...this.ctsToken ? { ctsToken: this.ctsToken } : {}
+      }),
       (error) => ({
         type: EncryptionErrorTypes.CtsTokenError,
         message: error.message
@@ -575,6 +594,7 @@ var LockContext = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  LockContext
+  LockContext,
+  resolveLockContext
 });
 //# sourceMappingURL=index.cjs.map