@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/dist/{chunk-ZYOZHZMJ.js → chunk-ZTP5QJ27.js}

@@ -1,26 +1,31 @@
+import {
+  resolveLockContext
+} from "./chunk-OFQ555AX.js";
 import {
   formatEncryptedResult,
   isEncryptedPayload,
   toFfiKeysetIdentifier
-} from "./chunk-XWPGAHBZ.js";
+} from "./chunk-BNO32ZMV.js";
 import {
   buildEncryptConfig,
   encryptConfigSchema
-} from "./chunk-YWQXTZ5M.js";
+} from "./chunk-CLM7E4I6.js";
 import {
   queryTypeToFfi,
   queryTypeToQueryOp
-} from "./chunk-VPOTNP4K.js";
+} from "./chunk-3B5ZX3IS.js";
+import {
+  withResult
+} from "./chunk-JSG2AMDI.js";
 import {
   createRequestLogger,
   logger
-} from "./chunk-LLCCNKDL.js";
+} from "./chunk-HQANMV7R.js";
 import {
   EncryptionErrorTypes
 } from "./chunk-LBMC4D6D.js";
 
 // src/encryption/index.ts
-import { withResult as withResult11 } from "@byteslice/result";
 import { newClient } from "@cipherstash/protect-ffi";
 
 // ../../node_modules/.pnpm/uuid@14.0.0/node_modules/uuid/dist-node/regex.js
@@ -37,6 +42,11 @@ function isScalarQueryTermArray(value) {
   return Array.isArray(value) && value.length > 0 && typeof value[0] === "object" && value[0] !== null && "column" in value[0] && "table" in value[0];
 }
 
+// src/encryption/operations/batch-encrypt-query.ts
+import {
+  encryptQueryBulk as ffiEncryptQueryBulk
+} from "@cipherstash/protect-ffi";
+
 // src/encryption/helpers/error-code.ts
 import {
   ProtectError as FfiProtectError
@@ -45,12 +55,6 @@ function getErrorCode(error) {
   return error instanceof FfiProtectError ? error.code : void 0;
 }
 
-// src/encryption/operations/batch-encrypt-query.ts
-import { withResult } from "@byteslice/result";
-import {
-  encryptQueryBulk as ffiEncryptQueryBulk
-} from "@cipherstash/protect-ffi";
-
 // src/encryption/helpers/infer-index-type.ts
 function inferIndexType(column) {
   const config = column.build();
@@ -61,6 +65,7 @@ function inferIndexType(column) {
   if (indexes.unique) return "unique";
   if (indexes.match) return "match";
   if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
   if (indexes.ste_vec) return "ste_vec";
   throw new Error(
     `Column "${column.getName()}" has no suitable index for queries`
@@ -70,7 +75,7 @@ function inferQueryOpFromPlaintext(plaintext) {
   if (typeof plaintext === "string") {
     return "ste_vec_selector";
   }
-  if (typeof plaintext === "object" || typeof plaintext === "number" || typeof plaintext === "boolean" || typeof plaintext === "bigint") {
+  if (typeof plaintext === "object" || typeof plaintext === "number" || typeof plaintext === "boolean") {
     return "ste_vec_term";
   }
   return "ste_vec_term";
@@ -82,6 +87,7 @@ function validateIndexType(column, indexType) {
     unique: !!indexes.unique,
     match: !!indexes.match,
     ore: !!indexes.ore,
+    ope: !!indexes.ope,
     ste_vec: !!indexes.ste_vec
   };
   if (!indexMap[indexType]) {
@@ -90,9 +96,26 @@ function validateIndexType(column, indexType) {
     );
   }
 }
+function equalityOrderingIndex(column) {
+  if (!("getQueryCapabilities" in column)) return null;
+  if (!column.getQueryCapabilities().equality) return null;
+  const indexes = column.build().indexes ?? {};
+  if (indexes.unique) return null;
+  if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
+  return null;
+}
 function resolveIndexType(column, queryType, plaintext) {
-  const indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
+  let indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
   if (queryType) {
+    if (queryType === "equality") {
+      const ordering = equalityOrderingIndex(column);
+      if (ordering) return { indexType: ordering };
+    }
+    if (queryType === "orderAndRange" && indexType === "ore") {
+      const indexes = column.build().indexes ?? {};
+      if (!indexes.ore && indexes.ope) indexType = "ope";
+    }
     validateIndexType(column, indexType);
     if (queryType === "searchableJson") {
       if (plaintext === void 0 || plaintext === null) {
@@ -112,6 +135,11 @@ function resolveIndexType(column, queryType, plaintext) {
 }
 
 // src/encryption/helpers/validation.ts
+var INT64_MIN = -9223372036854775808n;
+var INT64_MAX = 9223372036854775807n;
+function isBigintOutOfInt64Range(value) {
+  return typeof value === "bigint" && (value < INT64_MIN || value > INT64_MAX);
+}
 function validateNumericValue(value) {
   if (typeof value === "number" && Number.isNaN(value)) {
     return {
@@ -129,6 +157,14 @@ function validateNumericValue(value) {
       }
     };
   }
+  if (isBigintOutOfInt64Range(value)) {
+    return {
+      failure: {
+        type: EncryptionErrorTypes.EncryptionError,
+        message: "[encryption]: Cannot encrypt bigint value out of int64 range"
+      }
+    };
+  }
   return void 0;
 }
 function assertValidNumericValue(value) {
@@ -138,9 +174,14 @@ function assertValidNumericValue(value) {
   if (typeof value === "number" && !Number.isFinite(value)) {
     throw new Error("[encryption]: Cannot encrypt Infinity value");
   }
+  if (isBigintOutOfInt64Range(value)) {
+    throw new Error(
+      "[encryption]: Cannot encrypt bigint value out of int64 range"
+    );
+  }
 }
 function assertValueIndexCompatibility(value, indexType, columnName) {
-  if (typeof value === "number" && indexType === "match") {
+  if ((typeof value === "number" || typeof value === "bigint") && indexType === "match") {
     throw new Error(
       `[encryption]: Cannot use 'match' index with numeric value on column "${columnName}". The 'freeTextSearch' index only supports string values. Configure the column with 'orderAndRange()' or 'equality()' for numeric queries.`
     );
@@ -300,22 +341,16 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: this.terms.map(() => null) };
     }
-    const lockContextResult = await this.lockContext.getLockContext();
-    if (lockContextResult.failure) {
-      log.emit();
-      return { failure: lockContextResult.failure };
-    }
-    const { ctsToken, context } = lockContextResult.data;
     const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
         const { metadata } = this.getAuditData();
         const queries = nonNullTerms.map(
           ({ term }) => buildQueryPayload(term, context)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
-          serviceToken: ctsToken,
           unverifiedContext: metadata
         });
         return assembleResults(this.terms.length, encrypted, nonNullTerms);
@@ -335,7 +370,6 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/bulk-decrypt.ts
-import { withResult as withResult2 } from "@byteslice/result";
 import {
   decryptBulkFallible
 } from "@cipherstash/protect-ffi";
@@ -383,7 +417,7 @@ var BulkDecryptOperation = class extends EncryptionOperation {
       count: this.encryptedPayloads?.length ?? 0,
       lockContext: false
     });
-    const result = await withResult2(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
@@ -438,17 +472,14 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
       count: encryptedPayloads?.length ?? 0,
       lockContext: true
     });
-    const result = await withResult2(
+    const result = await withResult(
       async () => {
         if (!client) throw noClientError();
         if (!encryptedPayloads || encryptedPayloads.length === 0) return [];
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         const nonNullPayloads = createDecryptPayloads(
           encryptedPayloads,
-          context.data.context
+          lockContext
         );
         if (nonNullPayloads.length === 0) {
           return createNullResult(encryptedPayloads);
@@ -456,7 +487,6 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(client, {
           ciphertexts: nonNullPayloads,
-          serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(encryptedPayloads, decryptedData);
@@ -475,9 +505,6 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/operations/bulk-decrypt-models.ts
-import { withResult as withResult3 } from "@byteslice/result";
-
 // src/encryption/helpers/model-helpers.ts
 import {
   decryptBulk,
@@ -559,6 +586,17 @@ function prepareFieldsForDecryption(model) {
   processNestedFields(model);
   return { otherFields, operationFields, keyMap, nullFields };
 }
+function resolveEncryptColumnMap(table) {
+  const keyMap = table.buildColumnKeyMap?.();
+  if (keyMap) {
+    return {
+      columnPaths: Object.keys(keyMap),
+      toColumnName: (path) => keyMap[path] ?? path
+    };
+  }
+  const columnPaths = Object.keys(table.build().columns);
+  return { columnPaths, toColumnName: (path) => path };
+}
 function prepareFieldsForEncryption(model, table) {
   const otherFields = { ...model };
   const operationFields = {};
@@ -581,6 +619,7 @@ function prepareFieldsForEncryption(model, table) {
           );
         }
       } else if (columnPaths2.includes(fullKey)) {
+        assertValidNumericValue(value);
         const id = index.toString();
         keyMap[id] = fullKey;
         operationFields[fullKey] = value;
@@ -594,7 +633,7 @@ function prepareFieldsForEncryption(model, table) {
       }
     }
   };
-  const columnPaths = Object.keys(table.build().columns);
+  const { columnPaths } = resolveEncryptColumnMap(table);
   processNestedFields(model, "", columnPaths);
   return { otherFields, operationFields, keyMap, nullFields };
 }
@@ -633,12 +672,13 @@ async function encryptModelFields(model, table, client, auditData) {
     throw new Error("Client not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareFieldsForEncryption(model, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = Object.entries(operationFields).map(
     ([key, value]) => ({
       id: key,
       plaintext: value,
       table: table.tableName,
-      column: key
+      column: toColumnName(key)
     })
   );
   const encryptedData = await handleSingleModelBulkOperation(
@@ -672,14 +712,13 @@ async function decryptModelFieldsWithLockContext(model, client, lockContext, aud
     ([key, value]) => ({
       id: key,
       ciphertext: value,
-      lockContext: lockContext.context
+      lockContext
     })
   );
   const decryptedFields = await handleSingleModelBulkOperation(
     bulkDecryptPayload,
     (items) => decryptBulk(client, {
       ciphertexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -703,20 +742,20 @@ async function encryptModelFieldsWithLockContext(model, table, client, lockConte
     throw new Error("Lock context is not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareFieldsForEncryption(model, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = Object.entries(operationFields).map(
     ([key, value]) => ({
       id: key,
       plaintext: value,
       table: table.tableName,
-      column: key,
-      lockContext: lockContext.context
+      column: toColumnName(key),
+      lockContext
     })
   );
   const encryptedData = await handleSingleModelBulkOperation(
     bulkEncryptPayload,
     (items) => encryptBulk(client, {
       plaintexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -759,6 +798,7 @@ function prepareBulkModelsForOperation(models, table) {
             );
           }
         } else if (columnPaths.includes(fullKey)) {
+          assertValidNumericValue(value);
           const id = index.toString();
           keyMap[id] = { modelIndex, fieldKey: fullKey };
           modelOperationFields[fullKey] = value;
@@ -773,7 +813,7 @@ function prepareBulkModelsForOperation(models, table) {
       }
     };
     if (table) {
-      const columnPaths = Object.keys(table.build().columns);
+      const { columnPaths } = resolveEncryptColumnMap(table);
       processNestedFields(model, "", columnPaths);
     } else {
       const processEncryptedFields = (obj, prefix = "", columnPaths = []) => {
@@ -811,6 +851,15 @@ function prepareBulkModelsForOperation(models, table) {
   }
   return { otherFields, operationFields, keyMap, nullFields };
 }
+function fieldsForModelIndex(fields, modelIndex) {
+  const result = {};
+  for (const [id, value] of Object.entries(fields)) {
+    const sep = id.indexOf("-");
+    if (Number.parseInt(id.slice(0, sep), 10) !== modelIndex) continue;
+    result[id.slice(sep + 1)] = value;
+  }
+  return result;
+}
 async function bulkEncryptModels(models, table, client, auditData) {
   if (!client) {
     throw new Error("Client not initialized");
@@ -819,12 +868,13 @@ async function bulkEncryptModels(models, table, client, auditData) {
     return [];
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareBulkModelsForOperation(models, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = operationFields.flatMap(
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       plaintext: value,
       table: table.tableName,
-      column: key
+      column: toColumnName(key)
     }))
   );
   const encryptedData = await handleMultiModelBulkOperation(
@@ -841,15 +891,7 @@ async function bulkEncryptModels(models, table, client, auditData) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(encryptedData).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(encryptedData, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -885,15 +927,7 @@ async function bulkDecryptModels(models, client, auditData) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(decryptedFields).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(decryptedFields, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -913,14 +947,13 @@ async function bulkDecryptModelsWithLockContext(models, client, lockContext, aud
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       ciphertext: value,
-      lockContext: lockContext.context
+      lockContext
     }))
   );
   const decryptedFields = await handleMultiModelBulkOperation(
     bulkDecryptPayload,
     (items) => decryptBulk(client, {
       ciphertexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -931,15 +964,7 @@ async function bulkDecryptModelsWithLockContext(models, client, lockContext, aud
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(decryptedFields).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(decryptedFields, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -955,20 +980,20 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
     throw new Error("Lock context is not initialized");
   }
   const { otherFields, operationFields, keyMap, nullFields } = prepareBulkModelsForOperation(models, table);
+  const { toColumnName } = resolveEncryptColumnMap(table);
   const bulkEncryptPayload = operationFields.flatMap(
     (fields, modelIndex) => Object.entries(fields).map(([key, value]) => ({
       id: `${modelIndex}-${key}`,
       plaintext: value,
       table: table.tableName,
-      column: key,
-      lockContext: lockContext.context
+      column: toColumnName(key),
+      lockContext
     }))
   );
   const encryptedData = await handleMultiModelBulkOperation(
     bulkEncryptPayload,
     (items) => encryptBulk(client, {
       plaintexts: items,
-      serviceToken: lockContext.ctsToken,
       unverifiedContext: auditData?.metadata
     }),
     keyMap
@@ -979,15 +1004,7 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
       const parts = key.split(".");
       setNestedValue(result, parts, value);
     }
-    const modelData = Object.fromEntries(
-      Object.entries(encryptedData).filter(([key]) => {
-        const [idx] = key.split("-");
-        return Number.parseInt(idx) === modelIndex;
-      }).map(([key, value]) => {
-        const [_2, fieldKey] = key.split("-");
-        return [fieldKey, value];
-      })
-    );
+    const modelData = fieldsForModelIndex(encryptedData, modelIndex);
     for (const [key, value] of Object.entries(modelData)) {
       const parts = key.split(".");
       setNestedValue(result, parts, value);
@@ -1015,7 +1032,7 @@ var BulkDecryptModelsOperation = class extends EncryptionOperation {
       count: this.models.length,
       lockContext: false
     });
-    const result = await withResult3(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1062,20 +1079,17 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
       count: models.length,
       lockContext: true
     });
-    const result = await withResult3(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await bulkDecryptModelsWithLockContext(
           models,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1094,16 +1108,18 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/bulk-encrypt.ts
-import { withResult as withResult4 } from "@byteslice/result";
 import { encryptBulk as encryptBulk2 } from "@cipherstash/protect-ffi";
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
-    id,
-    plaintext,
-    column: column.getName(),
-    table: table.tableName,
-    ...lockContext && { lockContext }
-  }));
+  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => {
+    assertValidNumericValue(plaintext);
+    return {
+      id,
+      plaintext,
+      column: column.getName(),
+      table: table.tableName,
+      ...lockContext && { lockContext }
+    };
+  });
 };
 var createNullResult2 = (plaintexts) => plaintexts.map(({ id }) => ({ id, data: null }));
 var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
@@ -1143,7 +1159,7 @@ var BulkEncryptOperation = class extends EncryptionOperation {
       count: this.plaintexts?.length ?? 0,
       lockContext: false
     });
-    const result = await withResult4(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1209,7 +1225,7 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
       count: plaintexts?.length ?? 0,
       lockContext: true
     });
-    const result = await withResult4(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
@@ -1217,15 +1233,12 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!plaintexts || plaintexts.length === 0) {
           return [];
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         const nonNullPayloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
-          context.data.context
+          lockContext
         );
         if (nonNullPayloads.length === 0) {
           return createNullResult2(plaintexts);
@@ -1233,7 +1246,6 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(client, {
           plaintexts: nonNullPayloads,
-          serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
         return mapEncryptedDataToResult(plaintexts, encryptedData);
@@ -1253,7 +1265,6 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/bulk-encrypt-models.ts
-import { withResult as withResult5 } from "@byteslice/result";
 var BulkEncryptModelsOperation = class extends EncryptionOperation {
   client;
   models;
@@ -1275,7 +1286,7 @@ var BulkEncryptModelsOperation = class extends EncryptionOperation {
       count: this.models.length,
       lockContext: false
     });
-    const result = await withResult5(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1329,21 +1340,18 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
       count: models.length,
       lockContext: true
     });
-    const result = await withResult5(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await bulkEncryptModelsWithLockContext(
           models,
           table,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1362,7 +1370,6 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
 };
 
 // src/encryption/operations/decrypt.ts
-import { withResult as withResult6 } from "@byteslice/result";
 import {
   decrypt as ffiDecrypt
 } from "@cipherstash/protect-ffi";
@@ -1387,7 +1394,7 @@ var DecryptOperation = class extends EncryptionOperation {
       op: "decrypt",
       lockContext: false
     });
-    const result = await withResult6(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1439,7 +1446,7 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
       op: "decrypt",
       lockContext: true
     });
-    const result = await withResult6(
+    const result = await withResult(
       async () => {
         const { client, encryptedData } = this.operation.getOperation();
         if (!client) {
@@ -1449,15 +1456,11 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
           return null;
         }
         const { metadata } = this.getAuditData();
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         return await ffiDecrypt(client, {
           ciphertext: encryptedData,
           unverifiedContext: metadata,
-          lockContext: context.data.context,
-          serviceToken: context.data.ctsToken
+          lockContext
         });
       },
       (error) => {
@@ -1475,7 +1478,6 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/decrypt-model.ts
-import { withResult as withResult7 } from "@byteslice/result";
 var DecryptModelOperation = class extends EncryptionOperation {
   client;
   model;
@@ -1493,7 +1495,7 @@ var DecryptModelOperation = class extends EncryptionOperation {
       op: "decryptModel",
       lockContext: false
     });
-    const result = await withResult7(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1538,21 +1540,18 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
       op: "decryptModel",
       lockContext: true
     });
-    const result = await withResult7(
+    const result = await withResult(
       async () => {
         const { client, model } = this.operation.getOperation();
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await decryptModelFieldsWithLockContext(
           model,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1571,7 +1570,6 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt.ts
-import { withResult as withResult8 } from "@byteslice/result";
 import {
   encrypt as ffiEncrypt
 } from "@cipherstash/protect-ffi";
@@ -1602,7 +1600,7 @@ var EncryptOperation = class extends EncryptionOperation {
       column: this.column.getName(),
       lockContext: false
     });
-    const result = await withResult8(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1610,14 +1608,12 @@ var EncryptOperation = class extends EncryptionOperation {
         if (this.plaintext === null) {
           return null;
         }
-        if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
-          throw new Error("[encryption]: Cannot encrypt NaN value");
-        }
-        if (typeof this.plaintext === "number" && !Number.isFinite(this.plaintext)) {
-          throw new Error("[encryption]: Cannot encrypt Infinity value");
-        }
+        assertValidNumericValue(this.plaintext);
         const { metadata } = this.getAuditData();
         return await ffiEncrypt(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream `JsPlaintext` input
+          // union is corrected to include it.
           plaintext: this.plaintext,
           column: this.column.getName(),
           table: this.table.tableName,
@@ -1666,7 +1662,7 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
       column: column.getName(),
       lockContext: true
     });
-    const result = await withResult8(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
@@ -1674,17 +1670,14 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
         if (plaintext === null) {
           return null;
         }
+        assertValidNumericValue(plaintext);
         const { metadata } = this.getAuditData();
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const lockContext = resolveLockContext(this.lockContext);
         return await ffiEncrypt(client, {
           plaintext,
           column: column.getName(),
           table: table.tableName,
-          lockContext: context.data.context,
-          serviceToken: context.data.ctsToken,
+          lockContext,
           unverifiedContext: metadata
         });
       },
@@ -1703,7 +1696,6 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt-model.ts
-import { withResult as withResult9 } from "@byteslice/result";
 var EncryptModelOperation = class extends EncryptionOperation {
   client;
   model;
@@ -1724,7 +1716,7 @@ var EncryptModelOperation = class extends EncryptionOperation {
       table: this.table.tableName,
       lockContext: false
     });
-    const result = await withResult9(
+    const result = await withResult(
       async () => {
         if (!this.client) {
           throw noClientError();
@@ -1777,21 +1769,18 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
       table: table.tableName,
       lockContext: true
     });
-    const result = await withResult9(
+    const result = await withResult(
       async () => {
         if (!client) {
           throw noClientError();
         }
-        const context = await this.lockContext.getLockContext();
-        if (context.failure) {
-          throw new Error(`[encryption]: ${context.failure.message}`);
-        }
+        const context = resolveLockContext(this.lockContext);
         const auditData = this.getAuditData();
         return await encryptModelFieldsWithLockContext(
           model,
           table,
           client,
-          context.data,
+          context,
           auditData
         );
       },
@@ -1810,7 +1799,6 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
 };
 
 // src/encryption/operations/encrypt-query.ts
-import { withResult as withResult10 } from "@byteslice/result";
 import {
   encryptQuery as ffiEncryptQuery
 } from "@cipherstash/protect-ffi";
@@ -1852,7 +1840,7 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { failure: validationError.failure };
     }
-    const result = await withResult10(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
@@ -1867,6 +1855,9 @@ var EncryptQueryOperation = class extends EncryptionOperation {
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
           plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
@@ -1924,15 +1915,10 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       log.emit();
       return { failure: validationError.failure };
     }
-    const lockContextResult = await this.lockContext.getLockContext();
-    if (lockContextResult.failure) {
-      log.emit();
-      return { failure: lockContextResult.failure };
-    }
-    const { ctsToken, context } = lockContextResult.data;
-    const result = await withResult10(
+    const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
         const { metadata } = this.getAuditData();
         const { indexType, queryOp } = resolveIndexType(
           this.opts.column,
@@ -1945,13 +1931,15 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
           this.opts.column.getName()
         );
         const encrypted = await ffiEncryptQuery(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
           plaintext,
           column: this.opts.column.getName(),
           table: this.opts.table.tableName,
           indexType,
           queryOp,
           lockContext: context,
-          serviceToken: ctsToken,
           unverifiedContext: metadata
         });
         return formatEncryptedResult(encrypted, this.opts.returnType);
@@ -1974,6 +1962,20 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
 var noClientError = () => new Error(
   "The Encryption client has not been initialized. Please call init() before using the client."
 );
+function resolveEqlVersion(schemas, explicit) {
+  const v3Count = schemas.filter(
+    (schema) => typeof schema.buildColumnKeyMap === "function"
+  ).length;
+  if (v3Count > 0 && v3Count < schemas.length) {
+    throw new Error(
+      "[encryption]: cannot mix EQL v2 and EQL v3 tables in one client \u2014 one client emits exactly one wire format. Create separate clients for the v2 and v3 schemas."
+    );
+  }
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  return v3Count === 0 ? void 0 : 3;
+}
 var EncryptionClient = class {
   client;
   encryptConfig;
@@ -1984,7 +1986,7 @@ var EncryptionClient = class {
    * @returns A promise that resolves to a {@link Result} containing the initialized EncryptionClient or an {@link EncryptionError}.
    **/
   async init(config) {
-    return await withResult11(
+    return await withResult(
       async () => {
         const validated = encryptConfigSchema.parse(
           config.encryptConfig
@@ -2003,7 +2005,9 @@ var EncryptionClient = class {
             clientId: config.clientId,
             clientKey: config.clientKey,
             keyset: toFfiKeysetIdentifier(config.keyset)
-          }
+          },
+          strategy: config.authStrategy,
+          eqlVersion: config.eqlVersion
         });
         this.encryptConfig = validated;
         logger.debug("Successfully initialized the Encryption client.");
@@ -2094,7 +2098,7 @@ var EncryptionClient = class {
     return new EncryptOperation(this.client, plaintext, opts);
   }
   encryptQuery(plaintextOrTerms, opts) {
-    if (isScalarQueryTermArray(plaintextOrTerms)) {
+    if (!opts && isScalarQueryTermArray(plaintextOrTerms)) {
       return new BatchEncryptQueryOperation(this.client, plaintextOrTerms);
     }
     if (Array.isArray(plaintextOrTerms) && plaintextOrTerms.length === 0 && !opts) {
@@ -2402,6 +2406,17 @@ var EncryptionClient = class {
     return this.encryptConfig;
   }
 };
+var warnedStrategyDeprecated = false;
+function warnStrategyDeprecated() {
+  if (warnedStrategyDeprecated) return;
+  warnedStrategyDeprecated = true;
+  console.warn(
+    "[encryption]: `config.strategy` is deprecated and will be removed in a future release \u2014 use `config.authStrategy` instead."
+  );
+}
+function __resetStrategyDeprecationWarningForTests() {
+  warnedStrategyDeprecated = false;
+}
 var Encryption = async (config) => {
   const { schemas, config: clientConfig } = config;
   if (!schemas.length) {
@@ -2414,11 +2429,18 @@ var Encryption = async (config) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
+  if (clientConfig?.strategy) {
+    warnStrategyDeprecated();
+  }
+  const authStrategy = clientConfig?.authStrategy ?? clientConfig?.strategy;
   const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
+  const eqlVersion = resolveEqlVersion(schemas, clientConfig?.eqlVersion);
   const result = await client.init({
     encryptConfig,
-    ...clientConfig
+    ...clientConfig,
+    authStrategy,
+    eqlVersion
   });
   if (result.failure) {
     throw new Error(`[encryption]: ${result.failure.message}`);
@@ -2438,7 +2460,9 @@ export {
   EncryptModelOperation,
   EncryptQueryOperation,
   noClientError,
+  resolveEqlVersion,
   EncryptionClient,
+  __resetStrategyDeprecationWarningForTests,
   Encryption
 };
-//# sourceMappingURL=chunk-ZYOZHZMJ.js.map
+//# sourceMappingURL=chunk-ZTP5QJ27.js.map