@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/dist/wasm-inline.d.ts

@@ -0,0 +1,1643 @@
+import { AccessKeyStrategy, OidcFederationStrategy } from '@cipherstash/auth/wasm-inline';
+export { AccessKeyStrategy, OidcFederationStrategy } from '@cipherstash/auth/wasm-inline';
+import { z } from 'zod';
+import { EncryptedPayload } from '@cipherstash/protect-ffi';
+
+/** Structural type representing encrypted data stored in the database. Always
+ * carries a ciphertext. Covers BOTH wire formats: the EQL v2.3 payloads
+ * (`k: "ct"` / `k: "sv"`) and the EQL v3 payloads (flat `{v: 3, i, c, …}`
+ * scalars and `{v: 3, k: "sv", i, sv}` SteVec documents). Which format
+ * `encrypt` produces is selected by the client's
+ * {@link ClientConfig.eqlVersion}; `decrypt` accepts both regardless.
+ * v3 scalars carry no `k` discriminator, so narrow with `'k' in payload`
+ * before reading it. See also `EncryptedValue` for branded nominal typing,
+ * and {@link EncryptedQuery} for the search-term shape returned by
+ * `encryptQuery`. */
+type Encrypted = EncryptedPayload;
+/** Structural contract for a column builder the client can consume for STORAGE
+ *  (`encrypt`). Satisfied by v2 `EncryptedColumn` / `EncryptedField` AND v3
+ *  `EncryptedTextSearchColumn` — fields ARE encryptable, so this stays wide. */
+interface BuildableColumn {
+    getName(): string;
+    build(): ColumnSchema;
+}
+/** Structural contract for a table builder the client can consume. Satisfied by
+ *  v2 and v3 `EncryptedTable` alike. */
+interface BuildableTable {
+    tableName: string;
+    build(): {
+        tableName: string;
+        columns: Record<string, ColumnSchema>;
+    };
+    /**
+     * Optional map from a model field's JS property name to its encrypt-config
+     * column name (the DB name). Present when the two can differ — v3 tables key
+     * their config by DB name (`column.getName()`) while models are written with
+     * JS property keys, so the model path must match by property but address the
+     * FFI/config by DB name.
+     *
+     * Absent on v2 tables, whose `build()` already keys columns by the JS property
+     * name; the model path then matches and addresses by that same key.
+     */
+    buildColumnKeyMap?(): Record<string, string>;
+}
+/**
+ * Options for single-value encrypt operations.
+ * Use a column from your table schema (from {@link encryptedColumn}) or a nested
+ * field (from {@link encryptedField}) as the target for encryption.
+ */
+type EncryptOptions = {
+    /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */
+    column: BuildableColumn;
+    table: BuildableTable;
+};
+
+declare const columnSchema: z.ZodDefault<z.ZodObject<{
+    cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
+    indexes: z.ZodDefault<z.ZodObject<{
+        ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        ope: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        unique: z.ZodOptional<z.ZodObject<{
+            token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"downcase">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "downcase";
+            }, {
+                kind: "downcase";
+            }>, "many">>>;
+        }, "strip", z.ZodTypeAny, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        }, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        }>>;
+        match: z.ZodOptional<z.ZodObject<{
+            tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"standard">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "standard";
+            }, {
+                kind: "standard";
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"ngram">;
+                token_length: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "ngram";
+                token_length: number;
+            }, {
+                kind: "ngram";
+                token_length: number;
+            }>]>>>;
+            token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"downcase">;
+            }, "strip", z.ZodTypeAny, {
+                kind: "downcase";
+            }, {
+                kind: "downcase";
+            }>, "many">>>;
+            k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, "strip", z.ZodTypeAny, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        }, {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        }>>;
+        ste_vec: z.ZodOptional<z.ZodObject<{
+            prefix: z.ZodString;
+            array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                item: z.ZodOptional<z.ZodBoolean>;
+                wildcard: z.ZodOptional<z.ZodBoolean>;
+                position: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }, {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            }>]>>;
+            mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
+        }, "strip", z.ZodTypeAny, {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+            mode?: "standard" | "compat" | undefined;
+        }, {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+            mode?: "standard" | "compat" | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        ore?: {} | undefined;
+        ope?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+            mode?: "standard" | "compat" | undefined;
+        } | undefined;
+    }, {
+        ore?: {} | undefined;
+        ope?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+            mode?: "standard" | "compat" | undefined;
+        } | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+    indexes: {
+        ore?: {} | undefined;
+        ope?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+            mode?: "standard" | "compat" | undefined;
+        } | undefined;
+    };
+}, {
+    cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
+    indexes?: {
+        ore?: {} | undefined;
+        ope?: {} | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
+        match?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+            tokenizer?: {
+                kind: "standard";
+            } | {
+                kind: "ngram";
+                token_length: number;
+            } | undefined;
+            k?: number | undefined;
+            m?: number | undefined;
+            include_original?: boolean | undefined;
+        } | undefined;
+        ste_vec?: {
+            prefix: string;
+            array_index_mode?: "all" | "none" | {
+                item?: boolean | undefined;
+                wildcard?: boolean | undefined;
+                position?: boolean | undefined;
+            } | undefined;
+            mode?: "standard" | "compat" | undefined;
+        } | undefined;
+    } | undefined;
+}>>;
+/** @internal */
+declare const encryptConfigSchema: z.ZodObject<{
+    v: z.ZodNumber;
+    tables: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDefault<z.ZodObject<{
+        cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
+        indexes: z.ZodDefault<z.ZodObject<{
+            ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+            ope: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+            unique: z.ZodOptional<z.ZodObject<{
+                token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    kind: z.ZodLiteral<"downcase">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "downcase";
+                }, {
+                    kind: "downcase";
+                }>, "many">>>;
+            }, "strip", z.ZodTypeAny, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            }, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            }>>;
+            match: z.ZodOptional<z.ZodObject<{
+                tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"standard">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "standard";
+                }, {
+                    kind: "standard";
+                }>, z.ZodObject<{
+                    kind: z.ZodLiteral<"ngram">;
+                    token_length: z.ZodNumber;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "ngram";
+                    token_length: number;
+                }, {
+                    kind: "ngram";
+                    token_length: number;
+                }>]>>>;
+                token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    kind: z.ZodLiteral<"downcase">;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "downcase";
+                }, {
+                    kind: "downcase";
+                }>, "many">>>;
+                k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            }, "strip", z.ZodTypeAny, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            }, {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            }>>;
+            ste_vec: z.ZodOptional<z.ZodObject<{
+                prefix: z.ZodString;
+                array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
+                    item: z.ZodOptional<z.ZodBoolean>;
+                    wildcard: z.ZodOptional<z.ZodBoolean>;
+                    position: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }, {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                }>]>>;
+                mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
+            }, "strip", z.ZodTypeAny, {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            }, {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            ore?: {} | undefined;
+            ope?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            } | undefined;
+        }, {
+            ore?: {} | undefined;
+            ope?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            } | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+        indexes: {
+            ore?: {} | undefined;
+            ope?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            } | undefined;
+        };
+    }, {
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
+        indexes?: {
+            ore?: {} | undefined;
+            ope?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            } | undefined;
+        } | undefined;
+    }>>>>>>;
+}, "strip", z.ZodTypeAny, {
+    v: number;
+    tables: Record<string, Record<string, {
+        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
+        indexes: {
+            ore?: {} | undefined;
+            ope?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            } | undefined;
+        };
+    }>>;
+}, {
+    v: number;
+    tables?: Record<string, Record<string, {
+        cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
+        indexes?: {
+            ore?: {} | undefined;
+            ope?: {} | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
+            match?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+                tokenizer?: {
+                    kind: "standard";
+                } | {
+                    kind: "ngram";
+                    token_length: number;
+                } | undefined;
+                k?: number | undefined;
+                m?: number | undefined;
+                include_original?: boolean | undefined;
+            } | undefined;
+            ste_vec?: {
+                prefix: string;
+                array_index_mode?: "all" | "none" | {
+                    item?: boolean | undefined;
+                    wildcard?: boolean | undefined;
+                    position?: boolean | undefined;
+                } | undefined;
+                mode?: "standard" | "compat" | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined> | undefined> | undefined;
+}>;
+type ColumnSchema = z.infer<typeof columnSchema>;
+type EncryptConfig = z.infer<typeof encryptConfigSchema>;
+
+/**
+ * The query capabilities a v3 concrete domain exposes. These are SDK-facing
+ * semantic flags describing what kinds of query terms a column can produce —
+ * NOT the raw EQL index keys. They are metadata only and never emitted by
+ * `build()`.
+ *
+ * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).
+ * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).
+ * - `freeTextSearch`: tokenised substring match (EQL `bf`).
+ * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL
+ *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a
+ *   `public.eql_v3_json` document is queried by structure, not by scalar term.
+ */
+type QueryCapabilities = Readonly<{
+    equality: boolean;
+    orderAndRange: boolean;
+    freeTextSearch: boolean;
+    searchableJson?: boolean;
+}>;
+/**
+ * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.
+ *
+ * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level
+ * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)
+ * derive their "reconstructs to `Date`" decision from this array, so the next
+ * `Date`-backed cast is added in exactly one place — never hand-synced across a
+ * type and a runtime guard that could silently drift.
+ *
+ * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells
+ * the FFI not to truncate the time-of-day.)
+ */
+declare const DATE_LIKE_CASTS: readonly ["date", "timestamp"];
+/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */
+type DateLikeCast = (typeof DATE_LIKE_CASTS)[number];
+/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the
+ * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */
+type PlaintextKind = 'string' | 'number' | 'bigint' | 'boolean' | 'json' | DateLikeCast;
+/**
+ * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:
+ * the base column class carries a private field of this type so that every
+ * concrete (otherwise-empty) subclass is discriminated by its literal
+ * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT
+ * nominal, so without this a storage-only `boolean` column would be assignable to
+ * a storage-only `date` column and plaintext inference would collapse.
+ */
+type V3DomainDefinition = Readonly<{
+    eqlType: `public.${string}`;
+    castAs: PlaintextKind;
+    capabilities: QueryCapabilities;
+}>;
+/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a
+ * storage-only domain (all capability flags `false`), `true` otherwise. */
+type QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {
+    equality: false;
+    orderAndRange: false;
+    freeTextSearch: false;
+    searchableJson?: false | undefined;
+} ? false : true;
+/**
+ * The concrete EQL v3 domain name for a full-capability text column.
+ * Recorded as metadata for future DDL / query-dialect increments; it is
+ * intentionally absent from the emitted encrypt config.
+ */
+declare const TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+declare const INTEGER: {
+    readonly eqlType: "public.eql_v3_integer";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_EQ: {
+    readonly eqlType: "public.eql_v3_integer_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_integer_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_ORD: {
+    readonly eqlType: "public.eql_v3_integer_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT: {
+    readonly eqlType: "public.eql_v3_smallint";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_EQ: {
+    readonly eqlType: "public.eql_v3_smallint_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_smallint_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_ORD: {
+    readonly eqlType: "public.eql_v3_smallint_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT: {
+    readonly eqlType: "public.eql_v3_bigint";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_EQ: {
+    readonly eqlType: "public.eql_v3_bigint_eq";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_bigint_ord_ore";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD: {
+    readonly eqlType: "public.eql_v3_bigint_ord";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE: {
+    readonly eqlType: "public.eql_v3_date";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_EQ: {
+    readonly eqlType: "public.eql_v3_date_eq";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_date_ord_ore";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_ORD: {
+    readonly eqlType: "public.eql_v3_date_ord";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP: {
+    readonly eqlType: "public.eql_v3_timestamp";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_EQ: {
+    readonly eqlType: "public.eql_v3_timestamp_eq";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_timestamp_ord_ore";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_ORD: {
+    readonly eqlType: "public.eql_v3_timestamp_ord";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC: {
+    readonly eqlType: "public.eql_v3_numeric";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_EQ: {
+    readonly eqlType: "public.eql_v3_numeric_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_numeric_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_ORD: {
+    readonly eqlType: "public.eql_v3_numeric_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT: {
+    readonly eqlType: "public.eql_v3_text";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_EQ: {
+    readonly eqlType: "public.eql_v3_text_eq";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_MATCH: {
+    readonly eqlType: "public.eql_v3_text_match";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: true;
+    };
+};
+declare const TEXT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_text_ord_ore";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_ORD: {
+    readonly eqlType: "public.eql_v3_text_ord";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BOOLEAN: {
+    readonly eqlType: "public.eql_v3_boolean";
+    readonly castAs: "boolean";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL: {
+    readonly eqlType: "public.eql_v3_real";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_EQ: {
+    readonly eqlType: "public.eql_v3_real_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_real_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_ORD: {
+    readonly eqlType: "public.eql_v3_real_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE: {
+    readonly eqlType: "public.eql_v3_double";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_EQ: {
+    readonly eqlType: "public.eql_v3_double_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_double_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_ORD: {
+    readonly eqlType: "public.eql_v3_double_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+/**
+ * Shared base for every v3 concrete domain column. Parameterised by the FULL
+ * literal {@link V3DomainDefinition} (not by capabilities alone): the private
+ * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so
+ * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and
+ * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This
+ * nominality is what keeps plaintext inference precise.
+ */
+declare class EncryptedV3Column<D extends V3DomainDefinition> {
+    private readonly columnName;
+    private readonly definition;
+    constructor(columnName: string, definition: D);
+    getName(): string;
+    /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+    getEqlType(): D['eqlType'];
+    /** The semantic query capabilities this domain exposes. Metadata only. */
+    getQueryCapabilities(): D['capabilities'];
+    /** `true` when this domain can produce at least one kind of query term. */
+    isQueryable(): QueryableFlag<D>;
+    /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+    build(): ColumnSchema;
+}
+declare const TEXT_SEARCH_DOMAIN: {
+    readonly eqlType: "public.eql_v3_text_search";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: true;
+    };
+};
+/**
+ * Builder for a `public.eql_v3_text_search` column.
+ *
+ * The concrete type inherently enables equality + order/range + free-text
+ * match — there are no capability-enabling or tuning methods. The match index
+ * is always emitted with the default configuration.
+ *
+ * NOTE — querying: a `text_search` column emits all three indexes (`unique`,
+ * `ope`, `match`), and the shared index-inference picks them by fixed priority
+ * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO
+ * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text
+ * match — a substring like `'joh'` then matches nothing. To run a free-text
+ * match query you MUST pass `queryType: 'freeTextSearch'`:
+ *
+ * ```typescript
+ * // equality (default): exact value only
+ * client.encryptQuery('john@example.com', { column: users.email, table: users })
+ * // free-text match: substring/token search
+ * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })
+ * ```
+ */
+declare class EncryptedTextSearchColumn extends EncryptedV3Column<typeof TEXT_SEARCH_DOMAIN> {
+    constructor(columnName: string);
+}
+declare class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {
+}
+declare class EncryptedIntegerEqColumn extends EncryptedV3Column<typeof INTEGER_EQ> {
+}
+declare class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<typeof INTEGER_ORD_ORE> {
+}
+declare class EncryptedIntegerOrdColumn extends EncryptedV3Column<typeof INTEGER_ORD> {
+}
+declare class EncryptedSmallintColumn extends EncryptedV3Column<typeof SMALLINT> {
+}
+declare class EncryptedSmallintEqColumn extends EncryptedV3Column<typeof SMALLINT_EQ> {
+}
+declare class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<typeof SMALLINT_ORD_ORE> {
+}
+declare class EncryptedSmallintOrdColumn extends EncryptedV3Column<typeof SMALLINT_ORD> {
+}
+declare class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {
+}
+declare class EncryptedBigintEqColumn extends EncryptedV3Column<typeof BIGINT_EQ> {
+}
+declare class EncryptedBigintOrdOreColumn extends EncryptedV3Column<typeof BIGINT_ORD_ORE> {
+}
+declare class EncryptedBigintOrdColumn extends EncryptedV3Column<typeof BIGINT_ORD> {
+}
+declare class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {
+}
+declare class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {
+}
+declare class EncryptedDateOrdOreColumn extends EncryptedV3Column<typeof DATE_ORD_ORE> {
+}
+declare class EncryptedDateOrdColumn extends EncryptedV3Column<typeof DATE_ORD> {
+}
+declare class EncryptedTimestampColumn extends EncryptedV3Column<typeof TIMESTAMP> {
+}
+declare class EncryptedTimestampEqColumn extends EncryptedV3Column<typeof TIMESTAMP_EQ> {
+}
+declare class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<typeof TIMESTAMP_ORD_ORE> {
+}
+declare class EncryptedTimestampOrdColumn extends EncryptedV3Column<typeof TIMESTAMP_ORD> {
+}
+declare class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {
+}
+declare class EncryptedNumericEqColumn extends EncryptedV3Column<typeof NUMERIC_EQ> {
+}
+declare class EncryptedNumericOrdOreColumn extends EncryptedV3Column<typeof NUMERIC_ORD_ORE> {
+}
+declare class EncryptedNumericOrdColumn extends EncryptedV3Column<typeof NUMERIC_ORD> {
+}
+declare class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {
+}
+declare class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {
+}
+declare class EncryptedTextMatchColumn extends EncryptedV3Column<typeof TEXT_MATCH> {
+}
+declare class EncryptedTextOrdOreColumn extends EncryptedV3Column<typeof TEXT_ORD_ORE> {
+}
+declare class EncryptedTextOrdColumn extends EncryptedV3Column<typeof TEXT_ORD> {
+}
+declare class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {
+}
+declare class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {
+}
+declare class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {
+}
+declare class EncryptedRealOrdOreColumn extends EncryptedV3Column<typeof REAL_ORD_ORE> {
+}
+declare class EncryptedRealOrdColumn extends EncryptedV3Column<typeof REAL_ORD> {
+}
+declare class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {
+}
+declare class EncryptedDoubleEqColumn extends EncryptedV3Column<typeof DOUBLE_EQ> {
+}
+declare class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<typeof DOUBLE_ORD_ORE> {
+}
+declare class EncryptedDoubleOrdColumn extends EncryptedV3Column<typeof DOUBLE_ORD> {
+}
+declare const JSON_DOMAIN: {
+    readonly eqlType: "public.eql_v3_json";
+    readonly castAs: "json";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+        readonly searchableJson: true;
+    };
+};
+/**
+ * Builder for a `public.eql_v3_json` column — an encrypted JSONB document
+ * (a {@link JsonDocument}: object, array, or null). It round-trips through
+ * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index
+ * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,
+ * and the config index kind is `ste_vec` — both protect-ffi names.)
+ */
+declare class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {
+    constructor(columnName: string);
+}
+/**
+ * Union of every v3 concrete column type. Used as the value type for v3 table
+ * columns so a table may mix any generated domains.
+ */
+type AnyEncryptedV3Column = EncryptedIntegerColumn | EncryptedIntegerEqColumn | EncryptedIntegerOrdOreColumn | EncryptedIntegerOrdColumn | EncryptedSmallintColumn | EncryptedSmallintEqColumn | EncryptedSmallintOrdOreColumn | EncryptedSmallintOrdColumn | EncryptedBigintColumn | EncryptedBigintEqColumn | EncryptedBigintOrdOreColumn | EncryptedBigintOrdColumn | EncryptedDateColumn | EncryptedDateEqColumn | EncryptedDateOrdOreColumn | EncryptedDateOrdColumn | EncryptedTimestampColumn | EncryptedTimestampEqColumn | EncryptedTimestampOrdOreColumn | EncryptedTimestampOrdColumn | EncryptedNumericColumn | EncryptedNumericEqColumn | EncryptedNumericOrdOreColumn | EncryptedNumericOrdColumn | EncryptedTextColumn | EncryptedTextEqColumn | EncryptedTextMatchColumn | EncryptedTextOrdOreColumn | EncryptedTextOrdColumn | EncryptedTextSearchColumn | EncryptedBooleanColumn | EncryptedRealColumn | EncryptedRealEqColumn | EncryptedRealOrdOreColumn | EncryptedRealOrdColumn | EncryptedDoubleColumn | EncryptedDoubleEqColumn | EncryptedDoubleOrdOreColumn | EncryptedDoubleOrdColumn | EncryptedJsonColumn;
+/**
+ * Shape of v3 table columns: every value is a v3 concrete column builder.
+ * (Nested fields are deferred to later increments.)
+ */
+type EncryptedV3TableColumn = {
+    [key: string]: AnyEncryptedV3Column;
+};
+/** A JSON value at any depth. Used for the values NESTED inside a document. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON
+ * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:
+ * protect-ffi's `json` cast rejects a top-level string/number/boolean
+ * ("Cannot convert … to Json"), because a scalar belongs in a scalar domain
+ * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary
+ * {@link JsonValue}s and are fully supported.
+ */
+type JsonDocument = null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */
+type PlaintextFromKind<K extends PlaintextKind> = K extends 'string' ? string : K extends 'number' ? number : K extends 'bigint' ? bigint : K extends 'boolean' ? boolean : K extends DateLikeCast ? Date : K extends 'json' ? JsonDocument : never;
+/**
+ * The plaintext type for a single v3 column, read from the literal domain
+ * definition carried on the base class's private field. This is stable across
+ * empty subclasses that share the same base generic — a subclass-name
+ * conditional would collapse because those subclasses are structurally
+ * assignable to one another.
+ */
+type PlaintextForColumn<C> = C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never;
+/**
+ * The user-facing `queryType` names a v3 column supports, derived 1:1 from its
+ * capability flags. Resolves to `never` for a storage-only column (all flags
+ * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}
+ * keys and the first three {@link import('@/types').QueryTypeName} members.
+ */
+type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) : never;
+/**
+ * The concrete EQL v3 type string for a single column, read from the literal
+ * domain definition carried on the base class's private field (mirrors
+ * {@link PlaintextForColumn}). Distributes over a union of columns, so
+ * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's
+ * `eqlType` — the canonical, source-of-truth key set for a type-driven test
+ * matrix keyed by domain.
+ */
+type EqlTypeForColumn<C> = C extends EncryptedV3Column<infer D> ? D['eqlType'] : never;
+
+interface TableDefinition {
+    tableName: string;
+    columns: Record<string, ColumnSchema>;
+}
+/**
+ * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3
+ * column builders. Emits the same `{ tableName, columns }` definition shape.
+ */
+declare class EncryptedTable<T extends EncryptedV3TableColumn> {
+    readonly tableName: string;
+    readonly columnBuilders: T;
+    /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
+    readonly _columnType: T;
+    constructor(tableName: string, columnBuilders: T);
+    build(): TableDefinition;
+    /**
+     * Map each column's JS property name to its DB column name (`getName()`).
+     * The model path matches user models by property name but must address the
+     * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+     * the two only agree when property == name. This recovers the mapping that
+     * `build()` discards.
+     *
+     * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+     * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+     * the mutation transform). On a plain object literal, a column named
+     * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+     * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+     * column with such a name would be mistaken for a mapped encrypted column and
+     * its `Object.prototype` value interpolated into the emitted select string.
+     * `encryptedTable()` rejects such names as JS *properties*, but nothing
+     * constrains the DB column names a table may contain.
+     */
+    buildColumnKeyMap(): Record<string, string>;
+}
+/**
+ * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`
+ * name but lives on the `/eql/v3` subpath — the importer picks the model by
+ * import path. The returned object is also a column accessor (`users.email`).
+ */
+declare function encryptedTable<T extends EncryptedV3TableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
+/**
+ * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same
+ * shape as v2's `buildEncryptConfig`.
+ */
+declare function buildEncryptConfig(...tables: Array<EncryptedTable<EncryptedV3TableColumn>>): EncryptConfig;
+/**
+ * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps
+ * to the TypeScript type of its domain's `castAs` kind.
+ */
+type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: PlaintextForColumn<C[K]>;
+} : never;
+/**
+ * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}
+ * for why no key-remap filter is needed in the flat single-type model.
+ */
+type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: Encrypted;
+} : never;
+/** Any v3 table, regardless of its column map. */
+type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>;
+/** Union of the concrete column builders declared on a v3 table. */
+type ColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? C[keyof C] : never;
+/**
+ * Union of the *queryable* column builders on a v3 table. Storage-only columns
+ * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't
+ * be passed to a query method.
+ */
+type QueryableColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never] ? never : C[K];
+}[keyof C] : never;
+/**
+ * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.
+ * `T` is inferred from the argument: keys that name a schema column are pinned to
+ * the column's plaintext type (nullable if the field is nullable), so a wrong-typed
+ * field fails assignability; all other keys pass through unchanged.
+ */
+type V3ModelInput<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? InferPlaintext<Table>[K] | null : InferPlaintext<Table>[K] : T[K];
+};
+/** The encrypted result model: schema columns become `Encrypted`, others pass through. */
+type V3EncryptedModel<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? Encrypted | null : Encrypted : T[K];
+};
+/**
+ * The decrypted result model: schema columns become their plaintext type, others
+ * pass through. Structurally identical to {@link V3ModelInput} — decrypt yields
+ * the same plaintext shape encrypt accepts — so it is aliased rather than
+ * re-declared to keep the input and output shapes from silently drifting when
+ * one copy is edited. The distinct name is kept for call-site readability.
+ */
+type V3DecryptedModel<Table extends AnyV3Table, T> = V3ModelInput<Table, T>;
+
+/**
+ * The v3 column-type namespace. Each member is a public, semantic factory name
+ * for a concrete EQL v3 column. Most members mirror the underlying domain name;
+ * JS-friendly scalar names map to Postgres concrete domains, e.g.
+ * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`
+ * builds a `public.eql_v3_boolean` column.
+ *
+ * If these factory names stop matching the emitted capability/domain surface,
+ * the stack package is out of sync with the underlying EQL build. That is a
+ * version mismatch, not a harmless naming drift.
+ *
+ * Each factory returns the CONCRETE column class instance (never the widened
+ * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference
+ * stays precise.
+ *
+ * ```ts
+ * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
+ *
+ * const events = encryptedTable('events', {
+ *   actor:     types.TextEq('actor'),           // equality
+ *   weight:    types.IntegerOrd('weight'),         // order + range
+ *   createdAt: types.Timestamp('created_at'), // storage only
+ * })
+ * ```
+ *
+ * `types.TextSearch` is fully described by its type — like every other domain,
+ * it has no capability-bearing or tuning chain. Its match index is always
+ * emitted with the default configuration; run a free-text query by passing
+ * `queryType: 'freeTextSearch'` to `encryptQuery`.
+ */
+declare const types: {
+    readonly Integer: (name: string) => EncryptedIntegerColumn;
+    readonly IntegerEq: (name: string) => EncryptedIntegerEqColumn;
+    readonly IntegerOrdOre: (name: string) => EncryptedIntegerOrdOreColumn;
+    readonly IntegerOrd: (name: string) => EncryptedIntegerOrdColumn;
+    readonly Smallint: (name: string) => EncryptedSmallintColumn;
+    readonly SmallintEq: (name: string) => EncryptedSmallintEqColumn;
+    readonly SmallintOrdOre: (name: string) => EncryptedSmallintOrdOreColumn;
+    readonly SmallintOrd: (name: string) => EncryptedSmallintOrdColumn;
+    readonly Bigint: (name: string) => EncryptedBigintColumn;
+    readonly BigintEq: (name: string) => EncryptedBigintEqColumn;
+    readonly BigintOrdOre: (name: string) => EncryptedBigintOrdOreColumn;
+    readonly BigintOrd: (name: string) => EncryptedBigintOrdColumn;
+    readonly Date: (name: string) => EncryptedDateColumn;
+    readonly DateEq: (name: string) => EncryptedDateEqColumn;
+    readonly DateOrdOre: (name: string) => EncryptedDateOrdOreColumn;
+    readonly DateOrd: (name: string) => EncryptedDateOrdColumn;
+    readonly Timestamp: (name: string) => EncryptedTimestampColumn;
+    readonly TimestampEq: (name: string) => EncryptedTimestampEqColumn;
+    readonly TimestampOrdOre: (name: string) => EncryptedTimestampOrdOreColumn;
+    readonly TimestampOrd: (name: string) => EncryptedTimestampOrdColumn;
+    readonly Numeric: (name: string) => EncryptedNumericColumn;
+    readonly NumericEq: (name: string) => EncryptedNumericEqColumn;
+    readonly NumericOrdOre: (name: string) => EncryptedNumericOrdOreColumn;
+    readonly NumericOrd: (name: string) => EncryptedNumericOrdColumn;
+    readonly Text: (name: string) => EncryptedTextColumn;
+    readonly TextEq: (name: string) => EncryptedTextEqColumn;
+    readonly TextMatch: (name: string) => EncryptedTextMatchColumn;
+    readonly TextOrdOre: (name: string) => EncryptedTextOrdOreColumn;
+    readonly TextOrd: (name: string) => EncryptedTextOrdColumn;
+    readonly TextSearch: (name: string) => EncryptedTextSearchColumn;
+    readonly Boolean: (name: string) => EncryptedBooleanColumn;
+    readonly Real: (name: string) => EncryptedRealColumn;
+    readonly RealEq: (name: string) => EncryptedRealEqColumn;
+    readonly RealOrdOre: (name: string) => EncryptedRealOrdOreColumn;
+    readonly RealOrd: (name: string) => EncryptedRealOrdColumn;
+    readonly Double: (name: string) => EncryptedDoubleColumn;
+    readonly DoubleEq: (name: string) => EncryptedDoubleEqColumn;
+    readonly DoubleOrdOre: (name: string) => EncryptedDoubleOrdOreColumn;
+    readonly DoubleOrd: (name: string) => EncryptedDoubleOrdColumn;
+    readonly Json: (name: string) => EncryptedJsonColumn;
+};
+
+/**
+ * WASM-inline entry for `@cipherstash/stack` — for Deno, Bun, Cloudflare
+ * Workers, Supabase Edge Functions, and any runtime where the native
+ * `@cipherstash/protect-ffi` NAPI bindings are unavailable.
+ *
+ * Mirrors the protect-ffi / auth `/wasm-inline` pattern: the WASM module
+ * is inlined into the JS bundle as a base64 blob (no separate `.wasm`
+ * fetch / file read), so this entry works in environments that disallow
+ * `fs` or relative asset loading.
+ *
+ * Use this import path: `@cipherstash/stack/wasm-inline`
+ *
+ * This entry is EQL v3: author schemas with the `types` DSL / `encryptedTable`
+ * re-exported here (the same authoring surface as `@cipherstash/stack/eql/v3`).
+ *
+ * @example
+ * ```ts
+ * import {
+ *   Encryption, encryptedTable, types,
+ * } from "@cipherstash/stack/wasm-inline"
+ *
+ * const users = encryptedTable("users", { email: types.TextSearch("email") })
+ *
+ * const client = await Encryption({
+ *   schemas: [users],
+ *   config: {
+ *     workspaceCrn: Deno.env.get("CS_WORKSPACE_CRN")!,
+ *     accessKey:    Deno.env.get("CS_CLIENT_ACCESS_KEY")!,
+ *     clientId:     Deno.env.get("CS_CLIENT_ID")!,
+ *     clientKey:    Deno.env.get("CS_CLIENT_KEY")!,
+ *   },
+ * })
+ *
+ * const enc = await client.encrypt("alice@example.com", {
+ *   column: users.email,
+ *   table: users,
+ * })
+ * const dec = await client.decrypt(enc)
+ * ```
+ *
+ * For per-user, identity-bound encryption on the edge, build an
+ * `OidcFederationStrategy` (federates an end user's OIDC JWT — Clerk,
+ * Supabase, … — into a CTS service token) and pass it via
+ * `config.authStrategy`:
+ *
+ * ```ts
+ * import { OidcFederationStrategy } from "@cipherstash/stack/wasm-inline"
+ * import { cookieStore } from "@cipherstash/auth/cookies"
+ *
+ * const authStrategy = OidcFederationStrategy.create(
+ *   "crn:ap-southeast-2.aws:my-workspace-id", () => getClerkSessionToken(req),
+ *   { store: cookieStore({ request: req, responseHeaders }) },
+ * )
+ * const client = await Encryption({ schemas, config: { authStrategy, clientId, clientKey } })
+ * ```
+ *
+ * For service-to-service / CI use with a custom token store, build an
+ * `AccessKeyStrategy.create(workspaceCrn, accessKey, { store })` the same
+ * way (it derives the region from the CRN). Both strategies are
+ * re-exported from this entry.
+ */
+
+/** Re-exported convenience predicate — same as the raw protect-ffi one. */
+declare function isEncrypted(value: unknown): boolean;
+/**
+ * The plaintext shape accepted by `encrypt` and returned by `decrypt`.
+ * Mirrors protect-ffi's `JsPlaintext` (recursive: arrays of any of
+ * these are valid), plus `bigint` for `int8` columns. Re-defined here so
+ * the wasm-inline `.d.ts` doesn't pull in the Node-only protect-ffi types.
+ *
+ * `bigint` is carried natively across the wasm boundary by protect-ffi
+ * 0.28's Rust `encode_plaintext` (which i64-bounds-checks on encrypt and
+ * builds a `js_sys::BigInt` on decrypt), so widening the type here is all
+ * the SDK needs to accept/return `bigint` on the wasm entry point.
+ */
+type WasmPlaintext = string | number | bigint | boolean | null | Record<string, unknown> | WasmPlaintext[];
+/**
+ * Config for {@link Encryption} on the WASM entry point.
+ *
+ * The workspace CRN is the single source of truth for workspace
+ * identity and deployment region — matching the Node entry and
+ * protect-ffi 0.25+, which read `CS_WORKSPACE_CRN` and no longer
+ * consult a separate `CS_REGION`. The CRN is passed straight to the
+ * underlying `AccessKeyStrategy`, which derives the region from it, so
+ * there is no `region` field to keep in sync.
+ *
+ * For service-to-service / CI use, pass `accessKey` plus the workspace
+ * `clientId` / `clientKey` and we construct an `AccessKeyStrategy` for
+ * you. To plug in a custom token store (cookies on Supabase Edge, KV on
+ * Cloudflare Workers, …) or to bind encryption to an end user, build the
+ * strategy yourself — `AccessKeyStrategy` or `OidcFederationStrategy` —
+ * and hand it to `config.authStrategy` instead. A pre-built strategy
+ * already carries the CRN, so `workspaceCrn` is optional on that path.
+ *
+ * Mirrors the Node `ClientConfig`: `authStrategy` is the documented field,
+ * `strategy` is retained as a deprecated alias (see below).
+ */
+type WasmClientConfig = {
+    /** Workspace client identifier — required by the WASM client. */
+    clientId: string;
+    /** Workspace client key — required by the WASM client. */
+    clientKey: string;
+} & ({
+    /**
+     * CipherStash workspace CRN, e.g.
+     * `"crn:ap-southeast-2.aws:my-workspace-id"`. Required on the
+     * access-key path — it is the single source of truth for workspace
+     * identity and `AccessKeyStrategy` derives the region from it.
+     */
+    workspaceCrn: string;
+    accessKey: string;
+    authStrategy?: never;
+    strategy?: never;
+} | {
+    /**
+     * Optional on the strategy path. A pre-built `authStrategy` (e.g.
+     * `OidcFederationStrategy.create(workspaceCrn, …)`) already
+     * encapsulates the workspace CRN and region, so the SDK never reads
+     * this — supply it if convenient, omit it otherwise.
+     */
+    workspaceCrn?: string;
+    accessKey?: never;
+    /** A pre-built auth strategy for per-user or M2M authentication. */
+    authStrategy: WasmAuthStrategy;
+    /**
+     * @deprecated Renamed to `authStrategy`. Still honoured for backwards
+     * compatibility (it logs a deprecation warning at runtime) but will be
+     * removed in a future release.
+     */
+    strategy?: WasmAuthStrategy;
+} | {
+    workspaceCrn?: string;
+    accessKey?: never;
+    authStrategy?: never;
+    /**
+     * @deprecated Renamed to `authStrategy`. Still honoured for backwards
+     * compatibility (it logs a deprecation warning at runtime) but will be
+     * removed in a future release.
+     */
+    strategy: WasmAuthStrategy;
+});
+/**
+ * Any auth strategy accepted on the WASM path. Both expose
+ * `getToken(): Promise<Result<TokenResult, AuthFailure>>` — as of
+ * `@cipherstash/auth` 0.41 the token is wrapped in a `@byteslice/result`
+ * envelope. `@cipherstash/protect-ffi` 0.28+ unwraps that envelope (reading
+ * `.data.token`, surfacing `.failure`) inside its WASM `newClient`; 0.27 read
+ * `.token` off the envelope and saw `undefined`, so keep the ffi floor at 0.28.
+ *
+ * - {@link AccessKeyStrategy} — static M2M / CI access key.
+ * - {@link OidcFederationStrategy} — federates an end-user OIDC JWT into a
+ *   CTS service token, for per-user identity-bound encryption.
+ */
+type WasmAuthStrategy = AccessKeyStrategy | OidcFederationStrategy;
+type WasmEncryptionConfig = {
+    /** One or more EQL v3 tables, authored with `types` / `encryptedTable` from
+     *  this entry. The WASM entry is EQL v3 only. */
+    schemas: [AnyV3Table, ...AnyV3Table[]];
+    config: WasmClientConfig;
+};
+/**
+ * WASM encryption client. Returned by {@link Encryption}.
+ *
+ * Wraps an opaque `wasmNewClient` handle and exposes a minimal
+ * `encrypt` / `decrypt` surface. Larger surface (bulk, query, model
+ * helpers) lives on the Node entry — port lazily as Deno / edge
+ * consumers demand it.
+ *
+ * Construct via {@link Encryption} — the constructor is private to
+ * prevent callers from wrapping arbitrary objects in this type.
+ */
+declare class WasmEncryptionClient {
+    /** @internal */
+    private readonly client;
+    /**
+     * @internal Gated by the module-scoped {@link INTERNAL_CONSTRUCT}
+     * symbol: external callers can't obtain it, so {@link Encryption} is
+     * effectively the only constructor. (A `private` constructor would
+     * block {@link Encryption} too, since it lives outside the class.)
+     */
+    constructor(token: symbol, client: unknown);
+    encrypt(plaintext: WasmPlaintext, opts: EncryptOptions): Promise<Encrypted>;
+    decrypt(encrypted: Encrypted): Promise<WasmPlaintext>;
+    isEncrypted(value: unknown): boolean;
+}
+/**
+ * Initialize a WASM-backed encryption client.
+ *
+ * Mirrors the Node entry's {@link import('./encryption').Encryption}
+ * factory, but constructs the protect-ffi client via the WASM strategy
+ * API. Use from Deno / Edge / Workers / Bun.
+ */
+declare function Encryption(config: WasmEncryptionConfig): Promise<WasmEncryptionClient>;
+/**
+ * Convert SDK-facing `cast_as` values (`'string'`, `'number'`, …) to the
+ * EQL-native variants (`'text'`, `'double'`, …) that the WASM
+ * `newClient` accepts.
+ *
+ * The Node entry of protect-ffi performs this normalization internally
+ * via `normalizeEncryptConfig.js`; the WASM bindings do not. Without
+ * this, the WASM client rejects an `encryptedColumn('email')` (which
+ * defaults to `cast_as: 'string'`) with
+ * `unknown variant `string`, expected one of `big_int`, …`.
+ *
+ * `toEqlCastAs` is exhaustive over the current `CastAs` union; if a new
+ * SDK-facing variant is added without updating that switch, this
+ * function throws synchronously at startup with a clear message rather
+ * than handing `undefined` to the WASM serde (which surfaces as an
+ * opaque `unknown variant 'null'` error).
+ *
+ * @internal exported for unit-test coverage of the drift-guard branch.
+ */
+declare function normalizeCastAs(config: EncryptConfig): unknown;
+/**
+ * Resolve a column's name structurally. Accepts any column builder exposing
+ * `getName()` — v2 `EncryptedColumn` / `EncryptedField` AND v3 column builders
+ * (e.g. `EncryptedTextSearchColumn`) alike — matching the structural
+ * `BuildableColumn` contract that `EncryptOptions.column` was widened to.
+ *
+ * An `instanceof EncryptedColumn || EncryptedField` gate would type-check after
+ * the widening but throw at runtime for a v3 column, breaking the type promise;
+ * resolving the name structurally keeps the wasm-inline encrypt entry honest.
+ * The `typeof` check still fails loudly for plain JS callers passing a value
+ * that is not a column builder.
+ *
+ * @internal exported for unit-test coverage.
+ */
+declare function getColumnName(col: EncryptOptions['column']): string;
+/**
+ * Reset the once-per-process deprecation-warning latch. Test-only hook so
+ * suites can assert the warning fires deterministically, independent of test
+ * ordering.
+ * @internal
+ */
+declare function __resetStrategyDeprecationWarningForTests(): void;
+/**
+ * Resolve the auth strategy for the WASM client from its config: an explicit
+ * `config.authStrategy` (or the deprecated `config.strategy` alias), or — for
+ * the access-key path — an `AccessKeyStrategy` built from the workspace CRN
+ * (region derived from it inside `@cipherstash/auth`). An auth strategy and
+ * `accessKey` are mutually exclusive.
+ *
+ * @internal exported for offline unit coverage of the strategy wiring; the
+ * gated Deno e2e (`e2e/wasm/roundtrip.test.ts`) is the only other exercise of
+ * this path and it skips without real `CS_*` secrets.
+ */
+declare function resolveStrategy(cfg: WasmClientConfig): WasmAuthStrategy;
+
+export { type AnyEncryptedV3Column, type AnyV3Table, type ColumnsOf, type Encrypted, EncryptedBigintColumn, EncryptedBigintEqColumn, EncryptedBigintOrdColumn, EncryptedBigintOrdOreColumn, EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedJsonColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTable, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, type EncryptedV3TableColumn, Encryption, type EqlTypeForColumn, type InferEncrypted, type InferPlaintext, type JsonDocument, type JsonValue, type PlaintextForColumn, type QueryCapabilities, type QueryTypesForColumn, type QueryableColumnsOf, TEXT_SEARCH_EQL_TYPE, type V3DecryptedModel, type V3EncryptedModel, type V3ModelInput, type WasmAuthStrategy, type WasmClientConfig, WasmEncryptionClient, type WasmEncryptionConfig, type WasmPlaintext, __resetStrategyDeprecationWarningForTests, buildEncryptConfig, encryptedTable, getColumnName, isEncrypted, normalizeCastAs, resolveStrategy, types };