@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/dist/client.d.cts

@@ -1,7 +1,8 @@
-export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-BTxqjmtv.cjs';
-export { a as EncryptionClient } from './client-Dt98Rugc.cjs';
-import 'zod';
-import '@cipherstash/protect-ffi';
-import './errors/index.cjs';
+export { EncryptionClient } from './encryption/index.cjs';
+export { q as EncryptedColumn, r as EncryptedField, z as EncryptedTable, A as EncryptedTableColumn, I as InferEncrypted, J as InferPlaintext, Z as encryptedColumn, _ as encryptedField, $ as encryptedTable } from './types-public-QMjYNfQO.cjs';
 import '@byteslice/result';
+import './errors/index.cjs';
+import '@cipherstash/protect-ffi';
 import './identity/index.cjs';
+import './base-operation-AOAIvsSB.cjs';
+import 'zod';

package/dist/client.d.ts

@@ -1,7 +1,8 @@
-export { f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, I as InferEncrypted, t as InferPlaintext, e as encryptedColumn, a as encryptedField, b as encryptedTable } from './types-public-BTxqjmtv.js';
-export { a as EncryptionClient } from './client-CIsfZ2zg.js';
-import 'zod';
-import '@cipherstash/protect-ffi';
-import './errors/index.js';
+export { EncryptionClient } from './encryption/index.js';
+export { q as EncryptedColumn, r as EncryptedField, z as EncryptedTable, A as EncryptedTableColumn, I as InferEncrypted, J as InferPlaintext, Z as encryptedColumn, _ as encryptedField, $ as encryptedTable } from './types-public-QMjYNfQO.js';
 import '@byteslice/result';
+import './errors/index.js';
+import '@cipherstash/protect-ffi';
 import './identity/index.js';
+import './base-operation-FXEzUXIq.js';
+import 'zod';

package/dist/client.js

@@ -2,7 +2,9 @@ import {
   encryptedColumn,
   encryptedField,
   encryptedTable
-} from "./chunk-YWQXTZ5M.js";
+} from "./chunk-CLM7E4I6.js";
+import "./chunk-7333ZC6L.js";
+import "./chunk-PZ5AY32C.js";
 export {
   encryptedColumn,
   encryptedField,

package/dist/columns-D2_YzrCX.d.cts

@@ -0,0 +1,622 @@
+import { k as ColumnSchema } from './types-public-QMjYNfQO.cjs';
+
+/**
+ * The query capabilities a v3 concrete domain exposes. These are SDK-facing
+ * semantic flags describing what kinds of query terms a column can produce —
+ * NOT the raw EQL index keys. They are metadata only and never emitted by
+ * `build()`.
+ *
+ * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).
+ * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).
+ * - `freeTextSearch`: tokenised substring match (EQL `bf`).
+ * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL
+ *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a
+ *   `public.eql_v3_json` document is queried by structure, not by scalar term.
+ */
+type QueryCapabilities = Readonly<{
+    equality: boolean;
+    orderAndRange: boolean;
+    freeTextSearch: boolean;
+    searchableJson?: boolean;
+}>;
+/**
+ * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.
+ *
+ * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level
+ * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)
+ * derive their "reconstructs to `Date`" decision from this array, so the next
+ * `Date`-backed cast is added in exactly one place — never hand-synced across a
+ * type and a runtime guard that could silently drift.
+ *
+ * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells
+ * the FFI not to truncate the time-of-day.)
+ */
+declare const DATE_LIKE_CASTS: readonly ["date", "timestamp"];
+/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */
+type DateLikeCast = (typeof DATE_LIKE_CASTS)[number];
+/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the
+ * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */
+type PlaintextKind = 'string' | 'number' | 'bigint' | 'boolean' | 'json' | DateLikeCast;
+/**
+ * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:
+ * the base column class carries a private field of this type so that every
+ * concrete (otherwise-empty) subclass is discriminated by its literal
+ * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT
+ * nominal, so without this a storage-only `boolean` column would be assignable to
+ * a storage-only `date` column and plaintext inference would collapse.
+ */
+type V3DomainDefinition = Readonly<{
+    eqlType: `public.${string}`;
+    castAs: PlaintextKind;
+    capabilities: QueryCapabilities;
+}>;
+/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a
+ * storage-only domain (all capability flags `false`), `true` otherwise. */
+type QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {
+    equality: false;
+    orderAndRange: false;
+    freeTextSearch: false;
+    searchableJson?: false | undefined;
+} ? false : true;
+/**
+ * The concrete EQL v3 domain name for a full-capability text column.
+ * Recorded as metadata for future DDL / query-dialect increments; it is
+ * intentionally absent from the emitted encrypt config.
+ */
+declare const TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+declare const INTEGER: {
+    readonly eqlType: "public.eql_v3_integer";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_EQ: {
+    readonly eqlType: "public.eql_v3_integer_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_integer_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_ORD: {
+    readonly eqlType: "public.eql_v3_integer_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT: {
+    readonly eqlType: "public.eql_v3_smallint";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_EQ: {
+    readonly eqlType: "public.eql_v3_smallint_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_smallint_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_ORD: {
+    readonly eqlType: "public.eql_v3_smallint_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT: {
+    readonly eqlType: "public.eql_v3_bigint";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_EQ: {
+    readonly eqlType: "public.eql_v3_bigint_eq";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_bigint_ord_ore";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD: {
+    readonly eqlType: "public.eql_v3_bigint_ord";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE: {
+    readonly eqlType: "public.eql_v3_date";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_EQ: {
+    readonly eqlType: "public.eql_v3_date_eq";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_date_ord_ore";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_ORD: {
+    readonly eqlType: "public.eql_v3_date_ord";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP: {
+    readonly eqlType: "public.eql_v3_timestamp";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_EQ: {
+    readonly eqlType: "public.eql_v3_timestamp_eq";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_timestamp_ord_ore";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_ORD: {
+    readonly eqlType: "public.eql_v3_timestamp_ord";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC: {
+    readonly eqlType: "public.eql_v3_numeric";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_EQ: {
+    readonly eqlType: "public.eql_v3_numeric_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_numeric_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_ORD: {
+    readonly eqlType: "public.eql_v3_numeric_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT: {
+    readonly eqlType: "public.eql_v3_text";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_EQ: {
+    readonly eqlType: "public.eql_v3_text_eq";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_MATCH: {
+    readonly eqlType: "public.eql_v3_text_match";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: true;
+    };
+};
+declare const TEXT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_text_ord_ore";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_ORD: {
+    readonly eqlType: "public.eql_v3_text_ord";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BOOLEAN: {
+    readonly eqlType: "public.eql_v3_boolean";
+    readonly castAs: "boolean";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL: {
+    readonly eqlType: "public.eql_v3_real";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_EQ: {
+    readonly eqlType: "public.eql_v3_real_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_real_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_ORD: {
+    readonly eqlType: "public.eql_v3_real_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE: {
+    readonly eqlType: "public.eql_v3_double";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_EQ: {
+    readonly eqlType: "public.eql_v3_double_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_double_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_ORD: {
+    readonly eqlType: "public.eql_v3_double_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+/**
+ * Shared base for every v3 concrete domain column. Parameterised by the FULL
+ * literal {@link V3DomainDefinition} (not by capabilities alone): the private
+ * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so
+ * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and
+ * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This
+ * nominality is what keeps plaintext inference precise.
+ */
+declare class EncryptedV3Column<D extends V3DomainDefinition> {
+    private readonly columnName;
+    private readonly definition;
+    constructor(columnName: string, definition: D);
+    getName(): string;
+    /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+    getEqlType(): D['eqlType'];
+    /** The semantic query capabilities this domain exposes. Metadata only. */
+    getQueryCapabilities(): D['capabilities'];
+    /** `true` when this domain can produce at least one kind of query term. */
+    isQueryable(): QueryableFlag<D>;
+    /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+    build(): ColumnSchema;
+}
+declare const TEXT_SEARCH_DOMAIN: {
+    readonly eqlType: "public.eql_v3_text_search";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: true;
+    };
+};
+/**
+ * Builder for a `public.eql_v3_text_search` column.
+ *
+ * The concrete type inherently enables equality + order/range + free-text
+ * match — there are no capability-enabling or tuning methods. The match index
+ * is always emitted with the default configuration.
+ *
+ * NOTE — querying: a `text_search` column emits all three indexes (`unique`,
+ * `ope`, `match`), and the shared index-inference picks them by fixed priority
+ * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO
+ * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text
+ * match — a substring like `'joh'` then matches nothing. To run a free-text
+ * match query you MUST pass `queryType: 'freeTextSearch'`:
+ *
+ * ```typescript
+ * // equality (default): exact value only
+ * client.encryptQuery('john@example.com', { column: users.email, table: users })
+ * // free-text match: substring/token search
+ * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })
+ * ```
+ */
+declare class EncryptedTextSearchColumn extends EncryptedV3Column<typeof TEXT_SEARCH_DOMAIN> {
+    constructor(columnName: string);
+}
+declare class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {
+}
+declare class EncryptedIntegerEqColumn extends EncryptedV3Column<typeof INTEGER_EQ> {
+}
+declare class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<typeof INTEGER_ORD_ORE> {
+}
+declare class EncryptedIntegerOrdColumn extends EncryptedV3Column<typeof INTEGER_ORD> {
+}
+declare class EncryptedSmallintColumn extends EncryptedV3Column<typeof SMALLINT> {
+}
+declare class EncryptedSmallintEqColumn extends EncryptedV3Column<typeof SMALLINT_EQ> {
+}
+declare class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<typeof SMALLINT_ORD_ORE> {
+}
+declare class EncryptedSmallintOrdColumn extends EncryptedV3Column<typeof SMALLINT_ORD> {
+}
+declare class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {
+}
+declare class EncryptedBigintEqColumn extends EncryptedV3Column<typeof BIGINT_EQ> {
+}
+declare class EncryptedBigintOrdOreColumn extends EncryptedV3Column<typeof BIGINT_ORD_ORE> {
+}
+declare class EncryptedBigintOrdColumn extends EncryptedV3Column<typeof BIGINT_ORD> {
+}
+declare class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {
+}
+declare class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {
+}
+declare class EncryptedDateOrdOreColumn extends EncryptedV3Column<typeof DATE_ORD_ORE> {
+}
+declare class EncryptedDateOrdColumn extends EncryptedV3Column<typeof DATE_ORD> {
+}
+declare class EncryptedTimestampColumn extends EncryptedV3Column<typeof TIMESTAMP> {
+}
+declare class EncryptedTimestampEqColumn extends EncryptedV3Column<typeof TIMESTAMP_EQ> {
+}
+declare class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<typeof TIMESTAMP_ORD_ORE> {
+}
+declare class EncryptedTimestampOrdColumn extends EncryptedV3Column<typeof TIMESTAMP_ORD> {
+}
+declare class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {
+}
+declare class EncryptedNumericEqColumn extends EncryptedV3Column<typeof NUMERIC_EQ> {
+}
+declare class EncryptedNumericOrdOreColumn extends EncryptedV3Column<typeof NUMERIC_ORD_ORE> {
+}
+declare class EncryptedNumericOrdColumn extends EncryptedV3Column<typeof NUMERIC_ORD> {
+}
+declare class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {
+}
+declare class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {
+}
+declare class EncryptedTextMatchColumn extends EncryptedV3Column<typeof TEXT_MATCH> {
+}
+declare class EncryptedTextOrdOreColumn extends EncryptedV3Column<typeof TEXT_ORD_ORE> {
+}
+declare class EncryptedTextOrdColumn extends EncryptedV3Column<typeof TEXT_ORD> {
+}
+declare class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {
+}
+declare class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {
+}
+declare class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {
+}
+declare class EncryptedRealOrdOreColumn extends EncryptedV3Column<typeof REAL_ORD_ORE> {
+}
+declare class EncryptedRealOrdColumn extends EncryptedV3Column<typeof REAL_ORD> {
+}
+declare class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {
+}
+declare class EncryptedDoubleEqColumn extends EncryptedV3Column<typeof DOUBLE_EQ> {
+}
+declare class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<typeof DOUBLE_ORD_ORE> {
+}
+declare class EncryptedDoubleOrdColumn extends EncryptedV3Column<typeof DOUBLE_ORD> {
+}
+declare const JSON_DOMAIN: {
+    readonly eqlType: "public.eql_v3_json";
+    readonly castAs: "json";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+        readonly searchableJson: true;
+    };
+};
+/**
+ * Builder for a `public.eql_v3_json` column — an encrypted JSONB document
+ * (a {@link JsonDocument}: object, array, or null). It round-trips through
+ * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index
+ * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,
+ * and the config index kind is `ste_vec` — both protect-ffi names.)
+ */
+declare class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {
+    constructor(columnName: string);
+}
+/**
+ * Union of every v3 concrete column type. Used as the value type for v3 table
+ * columns so a table may mix any generated domains.
+ */
+type AnyEncryptedV3Column = EncryptedIntegerColumn | EncryptedIntegerEqColumn | EncryptedIntegerOrdOreColumn | EncryptedIntegerOrdColumn | EncryptedSmallintColumn | EncryptedSmallintEqColumn | EncryptedSmallintOrdOreColumn | EncryptedSmallintOrdColumn | EncryptedBigintColumn | EncryptedBigintEqColumn | EncryptedBigintOrdOreColumn | EncryptedBigintOrdColumn | EncryptedDateColumn | EncryptedDateEqColumn | EncryptedDateOrdOreColumn | EncryptedDateOrdColumn | EncryptedTimestampColumn | EncryptedTimestampEqColumn | EncryptedTimestampOrdOreColumn | EncryptedTimestampOrdColumn | EncryptedNumericColumn | EncryptedNumericEqColumn | EncryptedNumericOrdOreColumn | EncryptedNumericOrdColumn | EncryptedTextColumn | EncryptedTextEqColumn | EncryptedTextMatchColumn | EncryptedTextOrdOreColumn | EncryptedTextOrdColumn | EncryptedTextSearchColumn | EncryptedBooleanColumn | EncryptedRealColumn | EncryptedRealEqColumn | EncryptedRealOrdOreColumn | EncryptedRealOrdColumn | EncryptedDoubleColumn | EncryptedDoubleEqColumn | EncryptedDoubleOrdOreColumn | EncryptedDoubleOrdColumn | EncryptedJsonColumn;
+/**
+ * A factory that builds a concrete v3 column for a given DB column name.
+ *
+ * Declared here rather than beside `DOMAIN_REGISTRY` so that `./types` can
+ * constrain its own export against it without importing from `./domain-registry`,
+ * which imports `./types` back as a value.
+ */
+type V3ColumnFactory = (name: string) => AnyEncryptedV3Column;
+/**
+ * Shape of v3 table columns: every value is a v3 concrete column builder.
+ * (Nested fields are deferred to later increments.)
+ */
+type EncryptedV3TableColumn = {
+    [key: string]: AnyEncryptedV3Column;
+};
+/** A JSON value at any depth. Used for the values NESTED inside a document. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON
+ * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:
+ * protect-ffi's `json` cast rejects a top-level string/number/boolean
+ * ("Cannot convert … to Json"), because a scalar belongs in a scalar domain
+ * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary
+ * {@link JsonValue}s and are fully supported.
+ */
+type JsonDocument = null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */
+type PlaintextFromKind<K extends PlaintextKind> = K extends 'string' ? string : K extends 'number' ? number : K extends 'bigint' ? bigint : K extends 'boolean' ? boolean : K extends DateLikeCast ? Date : K extends 'json' ? JsonDocument : never;
+/**
+ * The plaintext type for a single v3 column, read from the literal domain
+ * definition carried on the base class's private field. This is stable across
+ * empty subclasses that share the same base generic — a subclass-name
+ * conditional would collapse because those subclasses are structurally
+ * assignable to one another.
+ */
+type PlaintextForColumn<C> = C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never;
+/**
+ * The user-facing `queryType` names a v3 column supports, derived 1:1 from its
+ * capability flags. Resolves to `never` for a storage-only column (all flags
+ * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}
+ * keys and the first three {@link import('@/types').QueryTypeName} members.
+ */
+type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) : never;
+/**
+ * The concrete EQL v3 type string for a single column, read from the literal
+ * domain definition carried on the base class's private field (mirrors
+ * {@link PlaintextForColumn}). Distributes over a union of columns, so
+ * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's
+ * `eqlType` — the canonical, source-of-truth key set for a type-driven test
+ * matrix keyed by domain.
+ */
+type EqlTypeForColumn<C> = C extends EncryptedV3Column<infer D> ? D['eqlType'] : never;
+
+export { type AnyEncryptedV3Column as A, EncryptedSmallintEqColumn as B, EncryptedSmallintOrdColumn as C, DATE_LIKE_CASTS as D, EncryptedBigintColumn as E, EncryptedSmallintOrdOreColumn as F, EncryptedTextColumn as G, EncryptedTextEqColumn as H, EncryptedTextMatchColumn as I, EncryptedTextOrdColumn as J, EncryptedTextOrdOreColumn as K, EncryptedTextSearchColumn as L, EncryptedTimestampColumn as M, EncryptedTimestampEqColumn as N, EncryptedTimestampOrdColumn as O, EncryptedTimestampOrdOreColumn as P, EncryptedV3Column as Q, type EncryptedV3TableColumn as R, type EqlTypeForColumn as S, type JsonDocument as T, type JsonValue as U, type PlaintextForColumn as V, type QueryCapabilities as W, type QueryTypesForColumn as X, TEXT_SEARCH_EQL_TYPE as Y, type V3ColumnFactory as Z, EncryptedBigintEqColumn as a, EncryptedBigintOrdColumn as b, EncryptedBigintOrdOreColumn as c, EncryptedBooleanColumn as d, EncryptedDateColumn as e, EncryptedDateEqColumn as f, EncryptedDateOrdColumn as g, EncryptedDateOrdOreColumn as h, EncryptedDoubleColumn as i, EncryptedDoubleEqColumn as j, EncryptedDoubleOrdColumn as k, EncryptedDoubleOrdOreColumn as l, EncryptedIntegerColumn as m, EncryptedIntegerEqColumn as n, EncryptedIntegerOrdColumn as o, EncryptedIntegerOrdOreColumn as p, EncryptedJsonColumn as q, EncryptedNumericColumn as r, EncryptedNumericEqColumn as s, EncryptedNumericOrdColumn as t, EncryptedNumericOrdOreColumn as u, EncryptedRealColumn as v, EncryptedRealEqColumn as w, EncryptedRealOrdColumn as x, EncryptedRealOrdOreColumn as y, EncryptedSmallintColumn as z };