@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/dist/{types-public-BTxqjmtv.d.cts → types-public-QMjYNfQO.d.cts}

@@ -1,191 +1,5 @@
+import { JsPlaintext, EncryptedPayload, newClient, EncryptedQuery as EncryptedQuery$1, EncryptedV3Query, AuthStrategy, Encrypted as Encrypted$1 } from '@cipherstash/protect-ffi';
 import { z } from 'zod';
-import { Encrypted as Encrypted$1, newClient, EncryptedQuery as EncryptedQuery$1, JsPlaintext } from '@cipherstash/protect-ffi';
-
-/** Brand symbol for nominal typing */
-declare const __brand: unique symbol;
-/** Creates a branded type that is structurally incompatible with the base type */
-type Brand<T, B extends string> = T & {
-    readonly [__brand]: B;
-};
-type Client = Awaited<ReturnType<typeof newClient>> | undefined;
-/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */
-type EncryptedValue = Brand<Encrypted$1, 'encrypted'>;
-/** Structural type representing encrypted data stored in the database. Always
- * carries a ciphertext. See also `EncryptedValue` for branded nominal typing,
- * and {@link EncryptedQuery} for the search-term shape returned by
- * `encryptQuery`. */
-type Encrypted = Encrypted$1;
-/** Structural type representing an encrypted query term (search needle)
- * returned by `encryptQuery` / `encryptQueryBulk` for scalar
- * (`unique` / `match` / `ore`) lookups and `ste_vec_selector` JSON path
- * queries. Carries no ciphertext — matched against stored values, never
- * decrypted. JSON containment queries (`ste_vec_term`) return a
- * storage-shaped {@link Encrypted} payload instead. */
-type EncryptedQuery = EncryptedQuery$1;
-type KeysetIdentifier = {
-    name: string;
-} | {
-    id: string;
-};
-type ClientConfig = {
-    /**
-     * The CipherStash workspace CRN (Cloud Resource Name).
-     * Format: `crn:<region>.aws:<workspace-id>`.
-     * Can also be set via the `CS_WORKSPACE_CRN` environment variable.
-     */
-    workspaceCrn?: string;
-    /**
-     * The API access key used for authenticating with the CipherStash API.
-     * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.
-     * Obtain this from the CipherStash dashboard after creating a workspace.
-     */
-    accessKey?: string;
-    /**
-     * The client identifier used to authenticate with CipherStash services.
-     * Can also be set via the `CS_CLIENT_ID` environment variable.
-     * Generated during workspace onboarding in the CipherStash dashboard.
-     */
-    clientId?: string;
-    /**
-     * The client key material used in combination with ZeroKMS for encryption operations.
-     * Can also be set via the `CS_CLIENT_KEY` environment variable.
-     * Generated during workspace onboarding in the CipherStash dashboard.
-     */
-    clientKey?: string;
-    /**
-     * An optional keyset identifier for multi-tenant encryption.
-     * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.
-     * Specify by name (`{ name: "tenant-a" }`) or UUID (`{ id: "..." }`).
-     * Keysets are created and managed in the CipherStash dashboard.
-     */
-    keyset?: KeysetIdentifier;
-};
-type AtLeastOneCsTable<T> = [T, ...T[]];
-type EncryptionClientConfig = {
-    schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>;
-    config?: ClientConfig;
-};
-/**
- * Options for single-value encrypt operations.
- * Use a column from your table schema (from {@link encryptedColumn}) or a nested
- * field (from {@link encryptedField}) as the target for encryption.
- */
-type EncryptOptions = {
-    /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */
-    column: EncryptedColumn | EncryptedField;
-    table: EncryptedTable<EncryptedTableColumn>;
-};
-/** Format for encrypted query/search term return values */
-type EncryptedReturnType = 'eql' | 'composite-literal' | 'escaped-composite-literal';
-type SearchTerm = {
-    value: JsPlaintext;
-    column: EncryptedColumn;
-    table: EncryptedTable<EncryptedTableColumn>;
-    returnType?: EncryptedReturnType;
-};
-/** Encrypted search term result. `eql` return type yields either a storage
- * payload (`Encrypted`, for `ste_vec_term`) or a query-only term
- * (`EncryptedQuery`, for scalar lookups and `ste_vec_selector`); the
- * `composite-literal` return types yield a string. */
-type EncryptedSearchTerm = Encrypted | EncryptedQuery | string;
-/** Result of encryptQuery (single or batch). `eql` return type yields either a
- * storage payload (`Encrypted`) or a query-only term (`EncryptedQuery`); the
- * `composite-literal` return types yield a string. */
-type EncryptedQueryResult = Encrypted | EncryptedQuery | string | null;
-type EncryptedFields<T> = {
-    [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K];
-};
-type OtherFields<T> = {
-    [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K];
-};
-type DecryptedFields<T> = {
-    [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: null extends T[K] ? string | null : string;
-};
-/** Model with encrypted fields replaced by plaintext (decrypted) values */
-type Decrypted<T> = OtherFields<T> & DecryptedFields<T>;
-/**
- * Maps a plaintext model type to its encrypted form using the table schema.
- *
- * Fields whose keys match columns defined in `S` become `Encrypted`;
- * all other fields retain their original types from `T`.
- *
- * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an
- * explicit `<User>` type argument without specifying `S`), the type degrades
- * gracefully to `T` — preserving backward compatibility.
- *
- * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)
- * @typeParam S - The table schema column definition, inferred from the `table` argument
- *
- * @example
- * ```typescript
- * type User = { id: string; email: string }
- * // With a schema that defines `email`:
- * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>
- * // => { id: string; email: Encrypted }
- * ```
- */
-type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {
-    [K in keyof T]: [K] extends [keyof S] ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField] ? null extends T[K] ? Encrypted | null : Encrypted : T[K] : T[K];
-};
-type BulkEncryptPayload = Array<{
-    id?: string;
-    plaintext: JsPlaintext | null;
-}>;
-type BulkEncryptedData = Array<{
-    id?: string;
-    data: Encrypted | null;
-}>;
-type BulkDecryptPayload = Array<{
-    id?: string;
-    data: Encrypted | null;
-}>;
-type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>;
-type DecryptionSuccess<T> = {
-    error?: never;
-    data: T;
-    id?: string;
-};
-type DecryptionError<T> = {
-    error: T;
-    id?: string;
-    data?: never;
-};
-/**
- * Result type for individual items in bulk decrypt operations.
- * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations
- * can have per-item failures.
- */
-type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>;
-/**
- * User-facing query type names for encrypting query values.
- *
- * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
- * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
- * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
- * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)
- * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)
- * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)
- */
-type QueryTypeName = 'orderAndRange' | 'freeTextSearch' | 'equality' | 'steVecSelector' | 'steVecTerm' | 'searchableJson';
-declare const queryTypes: {
-    readonly orderAndRange: "orderAndRange";
-    readonly freeTextSearch: "freeTextSearch";
-    readonly equality: "equality";
-    readonly steVecSelector: "steVecSelector";
-    readonly steVecTerm: "steVecTerm";
-    readonly searchableJson: "searchableJson";
-};
-/** @internal */
-type QueryTermBase = {
-    column: EncryptedColumn;
-    table: EncryptedTable<EncryptedTableColumn>;
-    queryType?: QueryTypeName;
-    returnType?: EncryptedReturnType;
-};
-type EncryptQueryOptions = QueryTermBase;
-type ScalarQueryTerm = QueryTermBase & {
-    value: JsPlaintext;
-};
 
 /**
  * Allowed cast types for CipherStash schema fields.
@@ -194,6 +8,7 @@ type ScalarQueryTerm = QueryTermBase & {
  * - `"bigint"`
  * - `"boolean"`
  * - `"date"`
+ * - `"timestamp"`
  * - `"number"`
  * - `"string"`
  * - `"json"`
@@ -209,11 +24,15 @@ type ScalarQueryTerm = QueryTermBase & {
  * EQL cast types — the PostgreSQL-aligned types that EQL actually accepts.
  * These are stored in the `cast_as` field of the EncryptConfig.
  */
-declare const eqlCastAsEnum: z.ZodDefault<z.ZodEnum<["text", "int", "small_int", "big_int", "real", "double", "boolean", "date", "jsonb"]>>;
+declare const eqlCastAsEnum: z.ZodDefault<z.ZodEnum<["text", "int", "small_int", "big_int", "real", "double", "boolean", "date", "timestamp", "jsonb"]>>;
 /**
  * SDK-facing data types — developer-friendly aliases accepted by `dataType()`.
+ *
+ * `timestamp` is distinct from `date`: `date` is calendar-date only (time-of-day
+ * truncated to midnight), while `timestamp` preserves the full date+time. v3
+ * `timestamp` domains set `cast_as: 'timestamp'` so the FFI keeps the instant.
  */
-declare const castAsEnum: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json", "text"]>>;
+declare const castAsEnum: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
 /**
  * Map SDK-facing data types to EQL `cast_as` values.
  *
@@ -229,6 +48,7 @@ declare const tokenFilterSchema: z.ZodObject<{
     kind: "downcase";
 }>;
 declare const oreIndexOptsSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+declare const opeIndexOptsSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
 declare const uniqueIndexOptsSchema: z.ZodObject<{
     token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"downcase">;
@@ -274,28 +94,28 @@ declare const matchIndexOptsSchema: z.ZodObject<{
     m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
     include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
 }, "strip", z.ZodTypeAny, {
-    token_filters?: {
-        kind: "downcase";
-    }[] | undefined;
     tokenizer?: {
         kind: "standard";
     } | {
         kind: "ngram";
         token_length: number;
     } | undefined;
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
     k?: number | undefined;
     m?: number | undefined;
     include_original?: boolean | undefined;
 }, {
-    token_filters?: {
-        kind: "downcase";
-    }[] | undefined;
     tokenizer?: {
         kind: "standard";
     } | {
         kind: "ngram";
         token_length: number;
     } | undefined;
+    token_filters?: {
+        kind: "downcase";
+    }[] | undefined;
     k?: number | undefined;
     m?: number | undefined;
     include_original?: boolean | undefined;
@@ -315,6 +135,7 @@ declare const steVecIndexOptsSchema: z.ZodObject<{
         wildcard?: boolean | undefined;
         position?: boolean | undefined;
     }>]>>;
+    mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
 }, "strip", z.ZodTypeAny, {
     prefix: string;
     array_index_mode?: "all" | "none" | {
@@ -322,6 +143,7 @@ declare const steVecIndexOptsSchema: z.ZodObject<{
         wildcard?: boolean | undefined;
         position?: boolean | undefined;
     } | undefined;
+    mode?: "standard" | "compat" | undefined;
 }, {
     prefix: string;
     array_index_mode?: "all" | "none" | {
@@ -329,11 +151,13 @@ declare const steVecIndexOptsSchema: z.ZodObject<{
         wildcard?: boolean | undefined;
         position?: boolean | undefined;
     } | undefined;
+    mode?: "standard" | "compat" | undefined;
 }>;
 declare const columnSchema: z.ZodDefault<z.ZodObject<{
-    cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json", "text"]>>;
+    cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
     indexes: z.ZodDefault<z.ZodObject<{
         ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        ope: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
         unique: z.ZodOptional<z.ZodObject<{
             token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
                 kind: z.ZodLiteral<"downcase">;
@@ -379,28 +203,28 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         }, "strip", z.ZodTypeAny, {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
             tokenizer?: {
                 kind: "standard";
             } | {
                 kind: "ngram";
                 token_length: number;
             } | undefined;
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
             k?: number | undefined;
             m?: number | undefined;
             include_original?: boolean | undefined;
         }, {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
             tokenizer?: {
                 kind: "standard";
             } | {
                 kind: "ngram";
                 token_length: number;
             } | undefined;
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
             k?: number | undefined;
             m?: number | undefined;
             include_original?: boolean | undefined;
@@ -420,6 +244,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             }>]>>;
+            mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
         }, "strip", z.ZodTypeAny, {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -427,6 +252,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         }, {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -434,24 +260,26 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
             }[] | undefined;
         } | undefined;
         match?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
             tokenizer?: {
                 kind: "standard";
             } | {
                 kind: "ngram";
                 token_length: number;
             } | undefined;
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
             k?: number | undefined;
             m?: number | undefined;
             include_original?: boolean | undefined;
@@ -463,24 +291,26 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     }, {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
             }[] | undefined;
         } | undefined;
         match?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
             tokenizer?: {
                 kind: "standard";
             } | {
                 kind: "ngram";
                 token_length: number;
             } | undefined;
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
             k?: number | undefined;
             m?: number | undefined;
             include_original?: boolean | undefined;
@@ -492,27 +322,29 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
+    cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json";
     indexes: {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
             }[] | undefined;
         } | undefined;
         match?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
             tokenizer?: {
                 kind: "standard";
             } | {
                 kind: "ngram";
                 token_length: number;
             } | undefined;
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
             k?: number | undefined;
             m?: number | undefined;
             include_original?: boolean | undefined;
@@ -524,27 +356,29 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     };
 }, {
-    cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text" | undefined;
+    cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json" | undefined;
     indexes?: {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
             }[] | undefined;
         } | undefined;
         match?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
             tokenizer?: {
                 kind: "standard";
             } | {
                 kind: "ngram";
                 token_length: number;
             } | undefined;
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
             k?: number | undefined;
             m?: number | undefined;
             include_original?: boolean | undefined;
@@ -556,6 +390,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     } | undefined;
 }>>;
@@ -563,9 +398,10 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
 declare const encryptConfigSchema: z.ZodObject<{
     v: z.ZodNumber;
     tables: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodObject<{
-        cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "number", "string", "json", "text"]>>;
+        cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
         indexes: z.ZodDefault<z.ZodObject<{
             ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+            ope: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
             unique: z.ZodOptional<z.ZodObject<{
                 token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
                     kind: z.ZodLiteral<"downcase">;
@@ -611,28 +447,28 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             }, "strip", z.ZodTypeAny, {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             }, {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -652,6 +488,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 }>]>>;
+                mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
             }, "strip", z.ZodTypeAny, {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -659,6 +496,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             }, {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -666,24 +504,26 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
                 }[] | undefined;
             } | undefined;
             match?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -695,24 +535,26 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         }, {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
                 }[] | undefined;
             } | undefined;
             match?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -724,27 +566,29 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json";
         indexes: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
                 }[] | undefined;
             } | undefined;
             match?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -756,27 +600,29 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         };
     }, {
-        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text" | undefined;
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json" | undefined;
         indexes?: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
                 }[] | undefined;
             } | undefined;
             match?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -788,30 +634,32 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         } | undefined;
     }>>>>>>;
 }, "strip", z.ZodTypeAny, {
     v: number;
     tables: Record<string, Record<string, {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json";
         indexes: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
                 }[] | undefined;
             } | undefined;
             match?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -823,30 +671,32 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         };
     }>>;
 }, {
     v: number;
     tables?: Record<string, Record<string, {
-        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text" | undefined;
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json" | undefined;
         indexes?: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
                 }[] | undefined;
             } | undefined;
             match?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
                 tokenizer?: {
                     kind: "standard";
                 } | {
                     kind: "ngram";
                     token_length: number;
                 } | undefined;
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
                 k?: number | undefined;
                 m?: number | undefined;
                 include_original?: boolean | undefined;
@@ -858,6 +708,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         } | undefined;
     } | undefined> | undefined> | undefined;
@@ -875,6 +726,7 @@ type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>;
 type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>;
 type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>;
 type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>;
+type OpeIndexOpts = z.infer<typeof opeIndexOptsSchema>;
 type ColumnSchema = z.infer<typeof columnSchema>;
 /**
  * Shape of table columns: either top-level {@link EncryptedColumn} or nested
@@ -906,7 +758,7 @@ declare class EncryptedField {
      * a different type so the encryption layer knows how to encode the plaintext
      * before encrypting.
      *
-     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
+     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'timestamp'`, `'text'`, `'bigint'`, or `'json'`. Use `'timestamp'` (not `'date'`) to preserve time-of-day — `'date'` truncates to midnight.
      * @returns This `EncryptedField` instance for method chaining.
      *
      * @example
@@ -918,7 +770,7 @@ declare class EncryptedField {
      */
     dataType(castAs: CastAs): this;
     build(): {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json";
         indexes: {};
     };
     getName(): string;
@@ -935,7 +787,7 @@ declare class EncryptedColumn {
      * a different type so the encryption layer knows how to encode the plaintext
      * before encrypting.
      *
-     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'timestamp'`, `'text'`, `'bigint'`, or `'json'`. Use `'timestamp'` (not `'date'`) to preserve time-of-day — `'date'` truncates to midnight.
      * @returns This `EncryptedColumn` instance for method chaining.
      *
      * @example
@@ -1037,9 +889,10 @@ declare class EncryptedColumn {
      */
     searchableJson(): this;
     build(): {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "json" | "text";
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json";
         indexes: {
             ore?: OreIndexOpts;
+            ope?: OpeIndexOpts;
             unique?: UniqueIndexOpts;
             match?: Required<MatchIndexOpts>;
             ste_vec?: SteVecIndexOpts;
@@ -1212,6 +1065,350 @@ declare function encryptedField(valueName: string): EncryptedField;
  * console.log(config)
  * ```
  */
-declare function buildEncryptConfig(...protectTables: Array<EncryptedTable<EncryptedTableColumn>>): EncryptConfig;
+declare function buildEncryptConfig(...protectTables: Array<BuildableTable>): EncryptConfig;
+
+/** Brand symbol for nominal typing */
+declare const __brand: unique symbol;
+/** Creates a branded type that is structurally incompatible with the base type */
+type Brand<T, B extends string> = T & {
+    readonly [__brand]: B;
+};
+type Client = Awaited<ReturnType<typeof newClient>> | undefined;
+/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */
+type EncryptedValue = Brand<Encrypted$1, 'encrypted'>;
+/** Structural type representing encrypted data stored in the database. Always
+ * carries a ciphertext. Covers BOTH wire formats: the EQL v2.3 payloads
+ * (`k: "ct"` / `k: "sv"`) and the EQL v3 payloads (flat `{v: 3, i, c, …}`
+ * scalars and `{v: 3, k: "sv", i, sv}` SteVec documents). Which format
+ * `encrypt` produces is selected by the client's
+ * {@link ClientConfig.eqlVersion}; `decrypt` accepts both regardless.
+ * v3 scalars carry no `k` discriminator, so narrow with `'k' in payload`
+ * before reading it. See also `EncryptedValue` for branded nominal typing,
+ * and {@link EncryptedQuery} for the search-term shape returned by
+ * `encryptQuery`. */
+type Encrypted = EncryptedPayload;
+/** Structural type representing an encrypted query term (search needle)
+ * returned by `encryptQuery` / `encryptQueryBulk` for scalar
+ * (`unique` / `match` / `ore`) lookups and `ste_vec_selector` JSON path
+ * queries, plus — under `eqlVersion: 3` — the `eql_v3.jsonb_query`
+ * containment needle. Carries no ciphertext — matched against stored
+ * values, never decrypted. v2 JSON containment queries (`ste_vec_term`)
+ * return a storage-shaped {@link Encrypted} payload instead. */
+type EncryptedQuery = EncryptedQuery$1 | EncryptedV3Query;
+/**
+ * Plaintext values the SDK accepts for encryption.
+ *
+ * Widens the FFI's `JsPlaintext` (`string | number | boolean |
+ * Record<string, unknown> | JsPlaintext[]`) with `Date` and `bigint`. `Date`
+ * is a supported cast target that is omitted from the FFI's `JsPlaintext` INPUT
+ * union, but it serializes at the boundary via `toJSON` (ISO string), so it is
+ * accepted on the way in.
+ *
+ * `bigint` is the plaintext for the v3 int8/bigint domains (see `eql/v3`),
+ * which always decrypt to a JS `bigint`. protect-ffi 0.28 marshals a native
+ * `bigint` across the Neon boundary losslessly. i64 bounds
+ * (`-2^63 … 2^63 - 1`) are enforced at the protect-ffi boundary, not here —
+ * out-of-range values surface as encryption errors from the FFI.
+ *
+ * When the upstream FFI `JsPlaintext` includes `Date` and `bigint`, both extra
+ * arms can collapse back into `JsPlaintext`.
+ */
+type Plaintext = JsPlaintext | Date | bigint;
+type KeysetIdentifier = {
+    name: string;
+} | {
+    id: string;
+};
+type ClientConfig = {
+    /**
+     * The CipherStash workspace CRN (Cloud Resource Name).
+     * Format: `crn:<region>.aws:<workspace-id>`.
+     * Can also be set via the `CS_WORKSPACE_CRN` environment variable.
+     */
+    workspaceCrn?: string;
+    /**
+     * The API access key used for authenticating with the CipherStash API.
+     * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.
+     * Obtain this from the CipherStash dashboard after creating a workspace.
+     */
+    accessKey?: string;
+    /**
+     * The client identifier used to authenticate with CipherStash services.
+     * Can also be set via the `CS_CLIENT_ID` environment variable.
+     * Generated during workspace onboarding in the CipherStash dashboard.
+     */
+    clientId?: string;
+    /**
+     * The client key material used in combination with ZeroKMS for encryption operations.
+     * Can also be set via the `CS_CLIENT_KEY` environment variable.
+     * Generated during workspace onboarding in the CipherStash dashboard.
+     */
+    clientKey?: string;
+    /**
+     * An optional keyset identifier for multi-tenant encryption.
+     * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.
+     * Specify by name (`{ name: "tenant-a" }`) or UUID (`{ id: "..." }`).
+     * Keysets are created and managed in the
+     * [dashboard](https://dashboard.cipherstash.com/workspaces/_/keysets); omit to
+     * use the workspace's default keyset. A client is bound to one keyset for its
+     * lifetime, so use one client per tenant.
+     *
+     * @see {@link Encryption} for the full keysets walkthrough.
+     */
+    keyset?: KeysetIdentifier;
+    /**
+     * An optional authentication strategy for ZeroKMS requests, from
+     * `@cipherstash/auth` (re-exported by `@cipherstash/stack`). When provided,
+     * its `getToken()` is invoked on every ZeroKMS request and takes precedence
+     * over the default `auto` strategy (the `clientKey` is still required for
+     * encryption). Use:
+     *
+     * - `OidcFederationStrategy` for per-user, identity-bound encryption —
+     *   federates an end user's OIDC JWT into a CTS service token, so requests
+     *   authenticate as that user. Pair with `.withLockContext({ identityClaim })`
+     *   to bind the data key to a claim. This replaces the older
+     *   `LockContext.identify()` ceremony.
+     * - `AccessKeyStrategy` for service-to-service / CI, or any custom
+     *   `{ getToken() }` object for bespoke token acquisition / caching.
+     *
+     * Leave unset to use the default `auto` strategy, which reads credentials
+     * from the `CS_*` environment variables and falls back to the local dev
+     * profile created by `npx stash auth login`.
+     *
+     * @see {@link AuthStrategy}
+     * @see {@link Encryption} for a full walkthrough of the authentication options.
+     */
+    authStrategy?: AuthStrategy;
+    /**
+     * @deprecated Renamed to {@link ClientConfig.authStrategy}. Still honoured for
+     * backwards compatibility — passing it logs a deprecation warning at runtime —
+     * but it will be removed in a future release. Set `authStrategy` instead.
+     */
+    strategy?: AuthStrategy;
+    /**
+     * The EQL wire version the client emits — one FFI client always emits
+     * exactly one wire format.
+     *
+     * - `2` (the protect-ffi default): payloads target the
+     *   `eql_v2_encrypted` column type.
+     * - `3`: payloads target the per-capability `eql_v3` domains
+     *   (`eql_v3.text_eq`, `eql_v3.integer_ord_ore`, `eql_v3.json`, …),
+     *   derived from each column's `cast_as` and indexes.
+     *
+     * When omitted, {@link Encryption} auto-detects from the schema set:
+     * EQL v3 tables (from `@cipherstash/stack/v3`, marked by
+     * `buildColumnKeyMap()`) select `3`; v2 tables leave the FFI default
+     * (`2`) untouched. Mixing v2 and v3 tables in one client is an error —
+     * split them across two clients instead.
+     *
+     * `decrypt` accepts BOTH formats regardless of this setting, so v2 and
+     * v3 data can coexist during a migration.
+     *
+     * Under `3`, `encryptQuery` returns EQL v3 query operands (protect-ffi
+     * 0.29+): term-only scalar operands for the `eql_v3.query_<name>` twins,
+     * the `eql_v3.query_jsonb` containment needle, and bare selector-hash
+     * strings for JSON path queries.
+     */
+    eqlVersion?: 2 | 3;
+};
+type AtLeastOneCsTable<T> = [T, ...T[]];
+/** Structural contract for a column builder the client can consume for STORAGE
+ *  (`encrypt`). Satisfied by v2 `EncryptedColumn` / `EncryptedField` AND v3
+ *  `EncryptedTextSearchColumn` — fields ARE encryptable, so this stays wide. */
+interface BuildableColumn {
+    getName(): string;
+    build(): ColumnSchema;
+}
+/** Structural contract for a column the client can consume for QUERIES
+ *  (`encryptQuery` / search terms). Narrower than `BuildableColumn`: it must
+ *  EXCLUDE non-queryable `EncryptedField` (a field has no indexes). A v2
+ *  `EncryptedColumn` qualifies via the nominal arm; a v3 queryable concrete
+ *  type qualifies via the `getEqlType()` structural arm; `EncryptedField` (no
+ *  `getEqlType`, not an `EncryptedColumn`) is rejected. */
+interface BuildableV3QueryableColumn extends BuildableColumn {
+    getEqlType(): string;
+    getQueryCapabilities(): {
+        equality: boolean;
+        orderAndRange: boolean;
+        freeTextSearch: boolean;
+    };
+    isQueryable(): true;
+}
+type BuildableQueryColumn = EncryptedColumn | BuildableV3QueryableColumn;
+/** Structural contract for a table builder the client can consume. Satisfied by
+ *  v2 and v3 `EncryptedTable` alike. */
+interface BuildableTable {
+    tableName: string;
+    build(): {
+        tableName: string;
+        columns: Record<string, ColumnSchema>;
+    };
+    /**
+     * Optional map from a model field's JS property name to its encrypt-config
+     * column name (the DB name). Present when the two can differ — v3 tables key
+     * their config by DB name (`column.getName()`) while models are written with
+     * JS property keys, so the model path must match by property but address the
+     * FFI/config by DB name.
+     *
+     * Absent on v2 tables, whose `build()` already keys columns by the JS property
+     * name; the model path then matches and addresses by that same key.
+     */
+    buildColumnKeyMap?(): Record<string, string>;
+}
+type EncryptionClientConfig = {
+    schemas: AtLeastOneCsTable<BuildableTable>;
+    config?: ClientConfig;
+};
+/**
+ * The literal column map of a buildable table, read from its type-level
+ * `_columnType` brand. Both v2 and v3 `EncryptedTable` carry this brand, so this
+ * recovers the literal column keys structurally.
+ *
+ * This deliberately uses the `_columnType` brand rather than `build().columns`:
+ * `BuildableTable.build()` is typed to return `Record<string, ColumnSchema>`,
+ * which erases the literal keys and would mark EVERY model field as encrypted.
+ *
+ * The fallbacks resolve to `Record<never, never>` (a no-key type), NOT `never`:
+ * a value typed as the bare structural `BuildableTable` carries no `_columnType`
+ * brand, and `keyof never` is `string | number | symbol` — which would wrongly
+ * mark EVERY model field as encrypted. `keyof Record<never, never>` is `never`,
+ * so `EncryptedFromBuildableTable` degrades gracefully to the model unchanged.
+ */
+type BuildableTableColumns<T extends BuildableTable> = T extends {
+    readonly _columnType: infer C;
+} ? C extends Record<string, unknown> ? C : Record<never, never> : Record<never, never>;
+/**
+ * Maps a plaintext model type to its encrypted form using a buildable table.
+ *
+ * Fields whose keys match a column defined in `Table` (via its `_columnType`
+ * brand) become `Encrypted` (`Encrypted | null` when the source field is
+ * nullable); all other fields retain their original types from `T`. Works for
+ * both v2 and v3 tables. See {@link EncryptedFromSchema} for the v2-specific
+ * variant retained for backward compatibility.
+ */
+type EncryptedFromBuildableTable<T, Table extends BuildableTable> = {
+    [K in keyof T]: [K] extends [keyof BuildableTableColumns<Table>] ? null extends T[K] ? Encrypted | null : Encrypted : T[K];
+};
+/**
+ * Options for single-value encrypt operations.
+ * Use a column from your table schema (from {@link encryptedColumn}) or a nested
+ * field (from {@link encryptedField}) as the target for encryption.
+ */
+type EncryptOptions = {
+    /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */
+    column: BuildableColumn;
+    table: BuildableTable;
+};
+/** Format for encrypted query/search term return values */
+type EncryptedReturnType = 'eql' | 'composite-literal' | 'escaped-composite-literal';
+type SearchTerm = {
+    value: Plaintext;
+    column: BuildableQueryColumn;
+    table: BuildableTable;
+    returnType?: EncryptedReturnType;
+};
+/** Encrypted search term result. `eql` return type yields either a storage
+ * payload (`Encrypted`, for `ste_vec_term`) or a query-only term
+ * (`EncryptedQuery`, for scalar lookups and `ste_vec_selector`); the
+ * `composite-literal` return types yield a string. */
+type EncryptedSearchTerm = Encrypted | EncryptedQuery | string;
+/** Result of encryptQuery (single or batch). `eql` return type yields either a
+ * storage payload (`Encrypted`) or a query-only term (`EncryptedQuery`); the
+ * `composite-literal` return types yield a string. */
+type EncryptedQueryResult = Encrypted | EncryptedQuery | string | null;
+type EncryptedFields<T> = {
+    [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K];
+};
+type OtherFields<T> = {
+    [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K];
+};
+type DecryptedFields<T> = {
+    [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: null extends T[K] ? string | null : string;
+};
+/** Model with encrypted fields replaced by plaintext (decrypted) values */
+type Decrypted<T> = OtherFields<T> & DecryptedFields<T>;
+/**
+ * Maps a plaintext model type to its encrypted form using the table schema.
+ *
+ * Fields whose keys match columns defined in `S` become `Encrypted`;
+ * all other fields retain their original types from `T`.
+ *
+ * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an
+ * explicit `<User>` type argument without specifying `S`), the type degrades
+ * gracefully to `T` — preserving backward compatibility.
+ *
+ * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)
+ * @typeParam S - The table schema column definition, inferred from the `table` argument
+ *
+ * @example
+ * ```typescript
+ * type User = { id: string; email: string }
+ * // With a schema that defines `email`:
+ * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>
+ * // => { id: string; email: Encrypted }
+ * ```
+ */
+type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {
+    [K in keyof T]: [K] extends [keyof S] ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField] ? null extends T[K] ? Encrypted | null : Encrypted : T[K] : T[K];
+};
+type BulkEncryptPayload = Array<{
+    id?: string;
+    plaintext: Plaintext | null;
+}>;
+type BulkEncryptedData = Array<{
+    id?: string;
+    data: Encrypted | null;
+}>;
+type BulkDecryptPayload = Array<{
+    id?: string;
+    data: Encrypted | null;
+}>;
+type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>;
+type DecryptionSuccess<T> = {
+    error?: never;
+    data: T;
+    id?: string;
+};
+type DecryptionError<T> = {
+    error: T;
+    id?: string;
+    data?: never;
+};
+/**
+ * Result type for individual items in bulk decrypt operations.
+ * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations
+ * can have per-item failures.
+ */
+type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>;
+/**
+ * User-facing query type names for encrypting query values.
+ *
+ * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)
+ * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)
+ * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)
+ */
+type QueryTypeName = 'orderAndRange' | 'freeTextSearch' | 'equality' | 'steVecSelector' | 'steVecTerm' | 'searchableJson';
+declare const queryTypes: {
+    readonly orderAndRange: "orderAndRange";
+    readonly freeTextSearch: "freeTextSearch";
+    readonly equality: "equality";
+    readonly steVecSelector: "steVecSelector";
+    readonly steVecTerm: "steVecTerm";
+    readonly searchableJson: "searchableJson";
+};
+/** @internal */
+type QueryTermBase = {
+    column: BuildableQueryColumn;
+    table: BuildableTable;
+    queryType?: QueryTypeName;
+    returnType?: EncryptedReturnType;
+};
+type EncryptQueryOptions = QueryTermBase;
+type ScalarQueryTerm = QueryTermBase & {
+    value: Plaintext;
+};
 
-export { eqlCastAsEnum as A, type BulkDecryptedData as B, type CastAs as C, type Decrypted as D, type Encrypted as E, toEqlCastAs as F, type ClientConfig as G, type DecryptedFields as H, type InferEncrypted as I, type DecryptionResult as J, type KeysetIdentifier as K, type EncryptedFields as L, type MatchIndexOpts as M, type EncryptedQuery as N, type OreIndexOpts as O, type EncryptedSearchTerm as P, type QueryTypeName as Q, type OtherFields as R, type ScalarQueryTerm as S, type TokenFilter as T, type UniqueIndexOpts as U, type SearchTerm as V, queryTypes as W, encryptedField as a, encryptedTable as b, EncryptedTable as c, type EncryptedTableColumn as d, encryptedColumn as e, EncryptedColumn as f, type EncryptedValue as g, type EncryptedQueryResult as h, type Client as i, type BulkDecryptPayload as j, type BulkEncryptedData as k, type BulkEncryptPayload as l, type EncryptOptions as m, EncryptedField as n, type EncryptQueryOptions as o, type EncryptedReturnType as p, type EncryptConfig as q, type EncryptedFromSchema as r, type EncryptionClientConfig as s, type InferPlaintext as t, type ColumnSchema as u, type EqlCastAs as v, type SteVecIndexOpts as w, buildEncryptConfig as x, castAsEnum as y, encryptConfigSchema as z };
+export { encryptedTable as $, type EncryptedTableColumn as A, type BuildableColumn as B, type CastAs as C, type Decrypted as D, type EncryptConfig as E, type EncryptedValue as F, type EncryptionClientConfig as G, type EqlCastAs as H, type InferEncrypted as I, type InferPlaintext as J, type KeysetIdentifier as K, type OreIndexOpts as L, type MatchIndexOpts as M, type OtherFields as N, type OpeIndexOpts as O, type Plaintext as P, type QueryTypeName as Q, type SearchTerm as R, type ScalarQueryTerm as S, type SteVecIndexOpts as T, type TokenFilter as U, type UniqueIndexOpts as V, buildEncryptConfig as W, castAsEnum as X, encryptConfigSchema as Y, encryptedColumn as Z, encryptedField as _, type BuildableQueryColumn as a, eqlCastAsEnum as a0, queryTypes as a1, toEqlCastAs as a2, type BuildableTable as b, type BuildableTableColumns as c, type BuildableV3QueryableColumn as d, type BulkDecryptPayload as e, type BulkDecryptedData as f, type BulkEncryptPayload as g, type BulkEncryptedData as h, type Client as i, type ClientConfig as j, type ColumnSchema as k, type DecryptedFields as l, type DecryptionResult as m, type EncryptOptions as n, type EncryptQueryOptions as o, type Encrypted as p, EncryptedColumn as q, EncryptedField as r, type EncryptedFields as s, type EncryptedFromBuildableTable as t, type EncryptedFromSchema as u, type EncryptedQuery as v, type EncryptedQueryResult as w, type EncryptedReturnType as x, type EncryptedSearchTerm as y, EncryptedTable as z };