@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/dist/eql/v3/index.cjs

@@ -0,0 +1,663 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/eql/v3/index.ts
+var v3_exports = {};
+__export(v3_exports, {
+  EncryptedBigintColumn: () => EncryptedBigintColumn,
+  EncryptedBigintEqColumn: () => EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn: () => EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn: () => EncryptedBigintOrdOreColumn,
+  EncryptedBooleanColumn: () => EncryptedBooleanColumn,
+  EncryptedDateColumn: () => EncryptedDateColumn,
+  EncryptedDateEqColumn: () => EncryptedDateEqColumn,
+  EncryptedDateOrdColumn: () => EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn: () => EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn: () => EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn: () => EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn: () => EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn: () => EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn: () => EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn: () => EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn: () => EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn: () => EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn: () => EncryptedJsonColumn,
+  EncryptedNumericColumn: () => EncryptedNumericColumn,
+  EncryptedNumericEqColumn: () => EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn: () => EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn: () => EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn: () => EncryptedRealColumn,
+  EncryptedRealEqColumn: () => EncryptedRealEqColumn,
+  EncryptedRealOrdColumn: () => EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn: () => EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn: () => EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn: () => EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn: () => EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn: () => EncryptedSmallintOrdOreColumn,
+  EncryptedTable: () => EncryptedTable,
+  EncryptedTextColumn: () => EncryptedTextColumn,
+  EncryptedTextEqColumn: () => EncryptedTextEqColumn,
+  EncryptedTextMatchColumn: () => EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn: () => EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn: () => EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn: () => EncryptedTextSearchColumn,
+  EncryptedTimestampColumn: () => EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn: () => EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn: () => EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn: () => EncryptedTimestampOrdOreColumn,
+  TEXT_SEARCH_EQL_TYPE: () => TEXT_SEARCH_EQL_TYPE,
+  buildEncryptConfig: () => buildEncryptConfig,
+  encryptedTable: () => encryptedTable,
+  types: () => types
+});
+module.exports = __toCommonJS(v3_exports);
+
+// src/schema/match-defaults.ts
+function defaultMatchOpts() {
+  return {
+    tokenizer: { kind: "ngram", token_length: 3 },
+    token_filters: [{ kind: "downcase" }],
+    k: 6,
+    m: 2048,
+    include_original: true
+  };
+}
+
+// src/eql/v3/columns.ts
+var STORAGE_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var EQUALITY_ONLY = {
+  equality: true,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var ORDER_AND_RANGE = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: false
+};
+var MATCH_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: true
+};
+var TEXT_SEARCH = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: true
+};
+var TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+var INTEGER = {
+  eqlType: "public.eql_v3_integer",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var INTEGER_EQ = {
+  eqlType: "public.eql_v3_integer_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var INTEGER_ORD_ORE = {
+  eqlType: "public.eql_v3_integer_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var INTEGER_ORD = {
+  eqlType: "public.eql_v3_integer_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT = {
+  eqlType: "public.eql_v3_smallint",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var SMALLINT_EQ = {
+  eqlType: "public.eql_v3_smallint_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var SMALLINT_ORD_ORE = {
+  eqlType: "public.eql_v3_smallint_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT_ORD = {
+  eqlType: "public.eql_v3_smallint_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT = {
+  eqlType: "public.eql_v3_bigint",
+  castAs: "bigint",
+  capabilities: STORAGE_ONLY
+};
+var BIGINT_EQ = {
+  eqlType: "public.eql_v3_bigint_eq",
+  castAs: "bigint",
+  capabilities: EQUALITY_ONLY
+};
+var BIGINT_ORD_ORE = {
+  eqlType: "public.eql_v3_bigint_ord_ore",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT_ORD = {
+  eqlType: "public.eql_v3_bigint_ord",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE = {
+  eqlType: "public.eql_v3_date",
+  castAs: "date",
+  capabilities: STORAGE_ONLY
+};
+var DATE_EQ = {
+  eqlType: "public.eql_v3_date_eq",
+  castAs: "date",
+  capabilities: EQUALITY_ONLY
+};
+var DATE_ORD_ORE = {
+  eqlType: "public.eql_v3_date_ord_ore",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE_ORD = {
+  eqlType: "public.eql_v3_date_ord",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP = {
+  eqlType: "public.eql_v3_timestamp",
+  castAs: "timestamp",
+  capabilities: STORAGE_ONLY
+};
+var TIMESTAMP_EQ = {
+  eqlType: "public.eql_v3_timestamp_eq",
+  castAs: "timestamp",
+  capabilities: EQUALITY_ONLY
+};
+var TIMESTAMP_ORD_ORE = {
+  eqlType: "public.eql_v3_timestamp_ord_ore",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP_ORD = {
+  eqlType: "public.eql_v3_timestamp_ord",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC = {
+  eqlType: "public.eql_v3_numeric",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var NUMERIC_EQ = {
+  eqlType: "public.eql_v3_numeric_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var NUMERIC_ORD_ORE = {
+  eqlType: "public.eql_v3_numeric_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC_ORD = {
+  eqlType: "public.eql_v3_numeric_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT = {
+  eqlType: "public.eql_v3_text",
+  castAs: "string",
+  capabilities: STORAGE_ONLY
+};
+var TEXT_EQ = {
+  eqlType: "public.eql_v3_text_eq",
+  castAs: "string",
+  capabilities: EQUALITY_ONLY
+};
+var TEXT_MATCH = {
+  eqlType: "public.eql_v3_text_match",
+  castAs: "string",
+  capabilities: MATCH_ONLY
+};
+var TEXT_ORD_ORE = {
+  eqlType: "public.eql_v3_text_ord_ore",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT_ORD = {
+  eqlType: "public.eql_v3_text_ord",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var BOOLEAN = {
+  eqlType: "public.eql_v3_boolean",
+  castAs: "boolean",
+  capabilities: STORAGE_ONLY
+};
+var REAL = {
+  eqlType: "public.eql_v3_real",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var REAL_EQ = {
+  eqlType: "public.eql_v3_real_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var REAL_ORD_ORE = {
+  eqlType: "public.eql_v3_real_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var REAL_ORD = {
+  eqlType: "public.eql_v3_real_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE = {
+  eqlType: "public.eql_v3_double",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var DOUBLE_EQ = {
+  eqlType: "public.eql_v3_double_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var DOUBLE_ORD_ORE = {
+  eqlType: "public.eql_v3_double_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE_ORD = {
+  eqlType: "public.eql_v3_double_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+function indexesForCapabilities(capabilities, castAs, ordering) {
+  const indexes = {};
+  if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
+    indexes.unique = { token_filters: [] };
+  }
+  if (capabilities.orderAndRange) {
+    indexes[ordering] = {};
+  }
+  if (capabilities.freeTextSearch) {
+    indexes.match = { ...defaultMatchOpts(), include_original: false };
+  }
+  if (capabilities.searchableJson) {
+    indexes.ste_vec = {
+      prefix: "enabled",
+      array_index_mode: { item: true, wildcard: true, position: false },
+      mode: "compat"
+    };
+  }
+  return indexes;
+}
+function orderingForEqlType(eqlType) {
+  return eqlType.endsWith("_ord_ore") ? "ore" : "ope";
+}
+function isQueryableCapabilities(capabilities) {
+  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch || (capabilities.searchableJson ?? false);
+}
+var EncryptedV3Column = class {
+  constructor(columnName, definition) {
+    this.columnName = columnName;
+    this.definition = definition;
+  }
+  columnName;
+  definition;
+  getName() {
+    return this.columnName;
+  }
+  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+  getEqlType() {
+    return this.definition.eqlType;
+  }
+  /** The semantic query capabilities this domain exposes. Metadata only. */
+  getQueryCapabilities() {
+    return this.definition.capabilities;
+  }
+  /** `true` when this domain can produce at least one kind of query term. */
+  isQueryable() {
+    return isQueryableCapabilities(
+      this.definition.capabilities
+    );
+  }
+  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+  build() {
+    return {
+      cast_as: this.definition.castAs,
+      indexes: indexesForCapabilities(
+        this.definition.capabilities,
+        this.definition.castAs,
+        orderingForEqlType(this.definition.eqlType)
+      )
+    };
+  }
+};
+var TEXT_SEARCH_DOMAIN = {
+  eqlType: TEXT_SEARCH_EQL_TYPE,
+  castAs: "string",
+  capabilities: TEXT_SEARCH
+};
+var EncryptedTextSearchColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, TEXT_SEARCH_DOMAIN);
+  }
+};
+var EncryptedIntegerColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextMatchColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBooleanColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
+};
+var JSON_DOMAIN = {
+  eqlType: "public.eql_v3_json",
+  castAs: "json",
+  capabilities: {
+    equality: false,
+    orderAndRange: false,
+    freeTextSearch: false,
+    searchableJson: true
+  }
+};
+var EncryptedJsonColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, JSON_DOMAIN);
+  }
+};
+
+// src/eql/v3/table.ts
+var EncryptedTable = class {
+  constructor(tableName, columnBuilders) {
+    this.tableName = tableName;
+    this.columnBuilders = columnBuilders;
+  }
+  tableName;
+  columnBuilders;
+  build() {
+    const builtColumns = /* @__PURE__ */ Object.create(null);
+    for (const builder of Object.values(this.columnBuilders)) {
+      const name = builder.getName();
+      if (Object.hasOwn(builtColumns, name)) {
+        throw new Error(
+          `[eql/v3]: duplicate column name "${name}" in table "${this.tableName}" \u2014 two columns resolve to the same DB name`
+        );
+      }
+      builtColumns[name] = builder.build();
+    }
+    return {
+      tableName: this.tableName,
+      columns: builtColumns
+    };
+  }
+  /**
+   * Map each column's JS property name to its DB column name (`getName()`).
+   * The model path matches user models by property name but must address the
+   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+   * the two only agree when property == name. This recovers the mapping that
+   * `build()` discards.
+   *
+   * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+   * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+   * the mutation transform). On a plain object literal, a column named
+   * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+   * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+   * column with such a name would be mistaken for a mapped encrypted column and
+   * its `Object.prototype` value interpolated into the emitted select string.
+   * `encryptedTable()` rejects such names as JS *properties*, but nothing
+   * constrains the DB column names a table may contain.
+   */
+  buildColumnKeyMap() {
+    const map = /* @__PURE__ */ Object.create(null);
+    for (const [property, builder] of Object.entries(this.columnBuilders)) {
+      map[property] = builder.getName();
+    }
+    return map;
+  }
+};
+var RESERVED_TABLE_KEYS = /* @__PURE__ */ new Set([
+  "tableName",
+  "columnBuilders",
+  "_columnType",
+  "build",
+  "buildColumnKeyMap"
+]);
+function isReservedTableKey(tableBuilder, colName) {
+  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder;
+}
+function encryptedTable(tableName, columns) {
+  const tableBuilder = new EncryptedTable(
+    tableName,
+    columns
+  );
+  for (const [colName, colBuilder] of Object.entries(columns)) {
+    if (isReservedTableKey(tableBuilder, colName)) {
+      throw new Error(
+        `Column name "${colName}" collides with a reserved EncryptedTable property`
+      );
+    }
+    ;
+    tableBuilder[colName] = colBuilder;
+  }
+  return tableBuilder;
+}
+function buildEncryptConfig(...tables) {
+  const config = {
+    v: 1,
+    tables: {}
+  };
+  for (const tb of tables) {
+    const tableDef = tb.build();
+    if (Object.hasOwn(config.tables, tableDef.tableName)) {
+      throw new Error(
+        `[eql/v3]: duplicate table name "${tableDef.tableName}" passed to buildEncryptConfig \u2014 each table must have a unique name`
+      );
+    }
+    config.tables[tableDef.tableName] = tableDef.columns;
+  }
+  return config;
+}
+
+// src/eql/v3/types.ts
+var types = {
+  // integer
+  Integer: (name) => new EncryptedIntegerColumn(name, INTEGER),
+  IntegerEq: (name) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),
+  IntegerOrdOre: (name) => new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),
+  IntegerOrd: (name) => new EncryptedIntegerOrdColumn(name, INTEGER_ORD),
+  // smallint
+  Smallint: (name) => new EncryptedSmallintColumn(name, SMALLINT),
+  SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
+  SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
+  SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
+  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by
+  // the native protect-ffi boundary (see ./columns)
+  Bigint: (name) => new EncryptedBigintColumn(name, BIGINT),
+  BigintEq: (name) => new EncryptedBigintEqColumn(name, BIGINT_EQ),
+  BigintOrdOre: (name) => new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),
+  BigintOrd: (name) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),
+  // date
+  Date: (name) => new EncryptedDateColumn(name, DATE),
+  DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
+  DateOrdOre: (name) => new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),
+  DateOrd: (name) => new EncryptedDateOrdColumn(name, DATE_ORD),
+  // timestamp
+  Timestamp: (name) => new EncryptedTimestampColumn(name, TIMESTAMP),
+  TimestampEq: (name) => new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),
+  TimestampOrdOre: (name) => new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),
+  TimestampOrd: (name) => new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),
+  // numeric
+  Numeric: (name) => new EncryptedNumericColumn(name, NUMERIC),
+  NumericEq: (name) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),
+  NumericOrdOre: (name) => new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),
+  NumericOrd: (name) => new EncryptedNumericOrdColumn(name, NUMERIC_ORD),
+  // text
+  Text: (name) => new EncryptedTextColumn(name, TEXT),
+  TextEq: (name) => new EncryptedTextEqColumn(name, TEXT_EQ),
+  TextMatch: (name) => new EncryptedTextMatchColumn(name, TEXT_MATCH),
+  TextOrdOre: (name) => new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),
+  TextOrd: (name) => new EncryptedTextOrdColumn(name, TEXT_ORD),
+  TextSearch: (name) => new EncryptedTextSearchColumn(name),
+  // boolean
+  Boolean: (name) => new EncryptedBooleanColumn(name, BOOLEAN),
+  // real
+  Real: (name) => new EncryptedRealColumn(name, REAL),
+  RealEq: (name) => new EncryptedRealEqColumn(name, REAL_EQ),
+  RealOrdOre: (name) => new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),
+  RealOrd: (name) => new EncryptedRealOrdColumn(name, REAL_ORD),
+  // double
+  Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
+  DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
+  DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
+  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),
+  // json (encrypted JSONB document, ste_vec containment)
+  Json: (name) => new EncryptedJsonColumn(name)
+  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself
+  // by calling every value here at module load. A non-factory export would throw
+  // during module evaluation and take the supabase introspect/schema-build/verify
+  // path down with it. This turns that into a compile error at the offending line.
+  // `as const` applies first, so literal key inference is preserved.
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  EncryptedBigintColumn,
+  EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn,
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTable,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
+  TEXT_SEARCH_EQL_TYPE,
+  buildEncryptConfig,
+  encryptedTable,
+  types
+});
+//# sourceMappingURL=index.cjs.map