@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/stack",
-  "version": "0.18.0",
+  "version": "1.0.0-rc.0",
   "description": "CipherStash Stack for TypeScript and JavaScript",
   "keywords": [
     "encrypted",
@@ -19,7 +19,7 @@
     "directory": "packages/stack"
   },
   "license": "MIT",
-  "author": "CipherStash <hello@cipherstash.com>",
+  "author": "CipherStash <humans@cipherstash.com>",
   "files": [
     "dist",
     "README.md",
@@ -39,6 +39,9 @@
       "errors": [
         "./dist/errors/index.d.ts"
       ],
+      "adapter-kit": [
+        "./dist/adapter-kit.d.ts"
+      ],
       "client": [
         "./dist/client.d.ts"
       ],
@@ -51,17 +54,20 @@
       "schema": [
         "./dist/schema/index.d.ts"
       ],
+      "eql/v3": [
+        "./dist/eql/v3/index.d.ts"
+      ],
+      "v3": [
+        "./dist/encryption/v3.d.ts"
+      ],
       "types": [
         "./dist/types-public.d.ts"
       ],
-      "drizzle": [
-        "./dist/drizzle/index.d.ts"
-      ],
       "dynamodb": [
         "./dist/dynamodb/index.d.ts"
       ],
-      "supabase": [
-        "./dist/supabase/index.d.ts"
+      "wasm-inline": [
+        "./dist/wasm-inline.d.ts"
       ]
     }
   },
@@ -96,16 +102,6 @@
         "default": "./dist/identity/index.cjs"
       }
     },
-    "./secrets": {
-      "import": {
-        "types": "./dist/secrets/index.d.ts",
-        "default": "./dist/secrets/index.js"
-      },
-      "require": {
-        "types": "./dist/secrets/index.d.cts",
-        "default": "./dist/secrets/index.cjs"
-      }
-    },
     "./schema": {
       "import": {
         "types": "./dist/schema/index.d.ts",
@@ -116,44 +112,44 @@
         "default": "./dist/schema/index.cjs"
       }
     },
-    "./types": {
+    "./eql/v3": {
       "import": {
-        "types": "./dist/types-public.d.ts",
-        "default": "./dist/types-public.js"
+        "types": "./dist/eql/v3/index.d.ts",
+        "default": "./dist/eql/v3/index.js"
       },
       "require": {
-        "types": "./dist/types-public.d.cts",
-        "default": "./dist/types-public.cjs"
+        "types": "./dist/eql/v3/index.d.cts",
+        "default": "./dist/eql/v3/index.cjs"
       }
     },
-    "./drizzle": {
+    "./v3": {
       "import": {
-        "types": "./dist/drizzle/index.d.ts",
-        "default": "./dist/drizzle/index.js"
+        "types": "./dist/encryption/v3.d.ts",
+        "default": "./dist/encryption/v3.js"
       },
       "require": {
-        "types": "./dist/drizzle/index.d.cts",
-        "default": "./dist/drizzle/index.cjs"
+        "types": "./dist/encryption/v3.d.cts",
+        "default": "./dist/encryption/v3.cjs"
       }
     },
-    "./dynamodb": {
+    "./types": {
       "import": {
-        "types": "./dist/dynamodb/index.d.ts",
-        "default": "./dist/dynamodb/index.js"
+        "types": "./dist/types-public.d.ts",
+        "default": "./dist/types-public.js"
       },
       "require": {
-        "types": "./dist/dynamodb/index.d.cts",
-        "default": "./dist/dynamodb/index.cjs"
+        "types": "./dist/types-public.d.cts",
+        "default": "./dist/types-public.cjs"
       }
     },
-    "./supabase": {
+    "./dynamodb": {
       "import": {
-        "types": "./dist/supabase/index.d.ts",
-        "default": "./dist/supabase/index.js"
+        "types": "./dist/dynamodb/index.d.ts",
+        "default": "./dist/dynamodb/index.js"
       },
       "require": {
-        "types": "./dist/supabase/index.d.cts",
-        "default": "./dist/supabase/index.cjs"
+        "types": "./dist/dynamodb/index.d.cts",
+        "default": "./dist/dynamodb/index.cjs"
       }
     },
     "./encryption": {
@@ -176,51 +172,77 @@
         "default": "./dist/errors/index.cjs"
       }
     },
+    "./adapter-kit": {
+      "import": {
+        "types": "./dist/adapter-kit.d.ts",
+        "default": "./dist/adapter-kit.js"
+      },
+      "require": {
+        "types": "./dist/adapter-kit.d.cts",
+        "default": "./dist/adapter-kit.cjs"
+      }
+    },
+    "./wasm-inline": {
+      "import": {
+        "types": "./dist/wasm-inline.d.ts",
+        "default": "./dist/wasm-inline.js"
+      }
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {
+    "@cipherstash/eql": "3.0.0",
     "@clack/prompts": "^1.4.0",
-    "@supabase/supabase-js": "^2.105.4",
+    "@clerk/backend": "3.4.9",
+    "@supabase/postgrest-js": "2.105.4",
+    "@supabase/supabase-js": "^2.110.0",
+    "@types/pg": "^8.20.0",
     "@types/uuid": "^11.0.0",
     "dotenv": "17.4.2",
     "drizzle-orm": "^0.45.2",
     "execa": "^9.5.2",
+    "fast-check": "^4.8.0",
+    "fta-cli": "3.0.0",
     "json-schema-to-typescript": "^15.0.2",
+    "pg": "8.20.0",
     "postgres": "^3.4.8",
     "tsup": "8.5.1",
     "tsx": "4.22.1",
     "typescript": "5.9.3",
-    "vitest": "3.2.4"
+    "vitest": "3.2.6"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
     "@byteslice/result": "0.2.0",
-    "@cipherstash/protect-ffi": "0.23.0",
+    "@cipherstash/auth": "0.41.0",
+    "@cipherstash/protect-ffi": "0.29.0",
     "evlog": "1.11.0",
     "uuid": "14.0.0",
     "zod": "3.25.76"
   },
-  "peerDependencies": {
-    "@supabase/supabase-js": ">=2",
-    "drizzle-orm": ">=0.33"
-  },
-  "peerDependenciesMeta": {
-    "drizzle-orm": {
-      "optional": true
-    },
-    "@supabase/supabase-js": {
-      "optional": true
-    }
+  "//optionalDependencies": "@cipherstash/auth ships per-platform native bindings as optional peerDependencies. pnpm does not auto-install platform-matched optional peer deps, so we declare them here as optionalDependencies — pnpm then picks the binary matching the host's os/cpu (from each sub-package's own package.json) and ignores the rest. Required because @cipherstash/stack re-exports the Node auth strategies (OidcFederationStrategy, AccessKeyStrategy, …). All seven names share a single catalog entry to keep them in lockstep.",
+  "optionalDependencies": {
+    "@cipherstash/auth-darwin-arm64": "0.41.0",
+    "@cipherstash/auth-darwin-x64": "0.41.0",
+    "@cipherstash/auth-linux-arm64-gnu": "0.41.0",
+    "@cipherstash/auth-linux-x64-gnu": "0.41.0",
+    "@cipherstash/auth-linux-x64-musl": "0.41.0",
+    "@cipherstash/auth-win32-x64-msvc": "0.41.0"
   },
   "engines": {
     "node": ">=22"
   },
   "scripts": {
+    "prebuild": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsup",
     "dev": "tsup --watch",
+    "analyze:complexity": "fta src/eql/v3 --score-cap 69",
+    "db:eql-v3:install": "tsx scripts/install-eql-v3.ts",
     "test": "vitest run",
-    "release": "tsup"
+    "test:types": "vitest --run --typecheck.only",
+    "release": "tsup",
+    "test:integration": "vitest run --config integration/vitest.config.ts"
   }
 }

package/dist/chunk-VPOTNP4K.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTable,\n  EncryptedTableColumn,\n  // Imported type-only for the TSDoc {@link} references in the comments below.\n  encryptedColumn,\n  encryptedField,\n} from '@/schema'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  EncryptedQuery as CipherStashEncryptedQuery,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data stored in the database. Always\n * carries a ciphertext. See also `EncryptedValue` for branded nominal typing,\n * and {@link EncryptedQuery} for the search-term shape returned by\n * `encryptQuery`. */\nexport type Encrypted = CipherStashEncrypted\n\n/** Structural type representing an encrypted query term (search needle)\n * returned by `encryptQuery` / `encryptQueryBulk` for scalar\n * (`unique` / `match` / `ore`) lookups and `ste_vec_selector` JSON path\n * queries. Carries no ciphertext — matched against stored values, never\n * decrypted. JSON containment queries (`ste_vec_term`) return a\n * storage-shaped {@link Encrypted} payload instead. */\nexport type EncryptedQuery = CipherStashEncryptedQuery\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result. `eql` return type yields either a storage\n * payload (`Encrypted`, for `ste_vec_term`) or a query-only term\n * (`EncryptedQuery`, for scalar lookups and `ste_vec_selector`); the\n * `composite-literal` return types yield a string. */\nexport type EncryptedSearchTerm = Encrypted | EncryptedQuery | string\n\n/** Result of encryptQuery (single or batch). `eql` return type yields either a\n * storage payload (`Encrypted`) or a query-only term (`EncryptedQuery`); the\n * `composite-literal` return types yield a string. */\n// null elements appear in the batch path when a term has a null/undefined\n// value — the operation preserves position so callers can correlate results\n// with their input array.\nexport type EncryptedQueryResult =\n  | Encrypted\n  | EncryptedQuery\n  | string\n  | null\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\n// Bulk payloads admit null elements — bulk operations pass them through\n// untouched (encrypt(null) -> null, decrypt(null) -> null) so callers can\n// process mixed nullable arrays without filtering ahead of time. The\n// runtime guards in the operation classes preserve the null in the\n// position-stable output.\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext | null\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted | null }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted | null }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";AA4PO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}

package/dist/chunk-XWPGAHBZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/encryption/helpers/index.ts"],"sourcesContent":["import type { Encrypted, EncryptedQueryResult, KeysetIdentifier } from '@/types'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  EncryptedQuery as CipherStashEncryptedQuery,\n  KeysetIdentifier as KeysetIdentifierFfi,\n} from '@cipherstash/protect-ffi'\n\n/**\n * The shape `encryptQuery` / `encryptQueryBulk` can return: a full storage\n * payload (returned for `ste_vec_term` containment queries) or a query-only\n * payload with no ciphertext (scalar `unique`/`match`/`ore` lookups and\n * `ste_vec_selector` path queries).\n *\n * TODO: duplicated in `@cipherstash/protect` — see\n * `packages/protect/src/helpers/index.ts`. Both copies should be removed once\n * `@cipherstash/protect-ffi` exports a named alias for the `encryptQuery`\n * return type (https://github.com/cipherstash/stack/pull/473).\n */\ntype EncryptedQueryTerm = CipherStashEncrypted | CipherStashEncryptedQuery\n\nexport type EncryptedPgComposite = {\n  data: Encrypted\n}\n\n/**\n * Helper function to transform an encrypted payload into a PostgreSQL composite type.\n * Use this when inserting data via Supabase or similar clients.\n */\nexport function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite {\n  return {\n    data: obj,\n  }\n}\n\n/**\n * Helper function to transform an encrypted payload into a PostgreSQL composite literal string.\n * Use this when querying with `.eq()` or similar equality operations in Supabase.\n *\n * @example\n * ```typescript\n * const literal = encryptedToCompositeLiteral(encrypted)\n * await supabase.from('table').select().eq('column', literal)\n * ```\n */\nexport function encryptedToCompositeLiteral(obj: EncryptedQueryTerm): string {\n  return `(${JSON.stringify(JSON.stringify(obj))})`\n}\n\n/**\n * Helper function to transform an encrypted payload into an escaped PostgreSQL composite literal string.\n * Use this when you need the composite literal format to be escaped as a string value.\n *\n * @example\n * ```typescript\n * const escapedLiteral = encryptedToEscapedCompositeLiteral(encrypted)\n * ```\n */\nexport function encryptedToEscapedCompositeLiteral(\n  obj: EncryptedQueryTerm,\n): string {\n  return JSON.stringify(encryptedToCompositeLiteral(obj))\n}\n\n/**\n * Format an encrypted result based on the requested return type.\n *\n * - `'composite-literal'` → PostgreSQL composite literal string `(\"json\")`\n * - `'escaped-composite-literal'` → escaped variant `\"(\\\"json\\\")\"`\n * - default (`'eql'` or omitted) → raw encrypted object\n */\nexport function formatEncryptedResult(\n  encrypted: EncryptedQueryTerm,\n  returnType?: string,\n): EncryptedQueryResult {\n  if (returnType === 'composite-literal') {\n    return encryptedToCompositeLiteral(encrypted)\n  }\n  if (returnType === 'escaped-composite-literal') {\n    return encryptedToEscapedCompositeLiteral(encrypted)\n  }\n  return encrypted\n}\n\n/**\n * Helper function to transform a model's encrypted fields into PostgreSQL composite types\n */\nexport function modelToEncryptedPgComposites<T extends Record<string, unknown>>(\n  model: T,\n): T {\n  const result: Record<string, unknown> = {}\n\n  for (const [key, value] of Object.entries(model)) {\n    if (isEncryptedPayload(value)) {\n      result[key] = encryptedToPgComposite(value)\n    } else {\n      result[key] = value\n    }\n  }\n\n  return result as T\n}\n\n/**\n * Helper function to transform multiple models' encrypted fields into PostgreSQL composite types\n */\nexport function bulkModelsToEncryptedPgComposites<\n  T extends Record<string, unknown>,\n>(models: T[]): T[] {\n  return models.map((model) => modelToEncryptedPgComposites(model))\n}\n\nexport function toFfiKeysetIdentifier(\n  keyset: KeysetIdentifier | undefined,\n): KeysetIdentifierFfi | undefined {\n  if (!keyset) return undefined\n\n  if ('name' in keyset) {\n    return { Name: keyset.name }\n  }\n\n  return { Uuid: keyset.id }\n}\n\n/**\n * Helper function to check if a value is an encrypted payload\n */\nexport function isEncryptedPayload(value: unknown): value is Encrypted {\n  if (value === null) return false\n  if (typeof value !== 'object') return false\n\n  const obj = value as Record<string, unknown>\n\n  // Must have version field (number)\n  if (!('v' in obj) || typeof obj.v !== 'number') return false\n\n  // Must have index field (object)\n  if (!('i' in obj) || typeof obj.i !== 'object') return false\n\n  // Must have either ciphertext (c) or searchable vector (sv)\n  if (!('c' in obj) && !('sv' in obj)) return false\n\n  return true\n}\n\nexport {\n  toJsonPath,\n  buildNestedObject,\n  parseJsonbPath,\n} from './jsonb'\n"],"mappings":";AA4BO,SAAS,uBAAuB,KAAsC;AAC3E,SAAO;AAAA,IACL,MAAM;AAAA,EACR;AACF;AAYO,SAAS,4BAA4B,KAAiC;AAC3E,SAAO,IAAI,KAAK,UAAU,KAAK,UAAU,GAAG,CAAC,CAAC;AAChD;AAWO,SAAS,mCACd,KACQ;AACR,SAAO,KAAK,UAAU,4BAA4B,GAAG,CAAC;AACxD;AASO,SAAS,sBACd,WACA,YACsB;AACtB,MAAI,eAAe,qBAAqB;AACtC,WAAO,4BAA4B,SAAS;AAAA,EAC9C;AACA,MAAI,eAAe,6BAA6B;AAC9C,WAAO,mCAAmC,SAAS;AAAA,EACrD;AACA,SAAO;AACT;AAKO,SAAS,6BACd,OACG;AACH,QAAM,SAAkC,CAAC;AAEzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,mBAAmB,KAAK,GAAG;AAC7B,aAAO,GAAG,IAAI,uBAAuB,KAAK;AAAA,IAC5C,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,kCAEd,QAAkB;AAClB,SAAO,OAAO,IAAI,CAAC,UAAU,6BAA6B,KAAK,CAAC;AAClE;AAEO,SAAS,sBACd,QACiC;AACjC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,UAAU,QAAQ;AACpB,WAAO,EAAE,MAAM,OAAO,KAAK;AAAA,EAC7B;AAEA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAKO,SAAS,mBAAmB,OAAoC;AACrE,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,MAAM;AAGZ,MAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,MAAM,SAAU,QAAO;AAGvD,MAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,MAAM,SAAU,QAAO;AAGvD,MAAI,EAAE,OAAO,QAAQ,EAAE,QAAQ,KAAM,QAAO;AAE5C,SAAO;AACT;","names":[]}

package/dist/chunk-YWQXTZ5M.js

@@ -1,383 +0,0 @@
-// src/schema/index.ts
-import { z } from "zod";
-var eqlCastAsEnum = z.enum([
-  "text",
-  "int",
-  "small_int",
-  "big_int",
-  "real",
-  "double",
-  "boolean",
-  "date",
-  "jsonb"
-]).default("text");
-var castAsEnum = z.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
-function toEqlCastAs(value) {
-  switch (value) {
-    case "string":
-      return "text";
-    case "text":
-      return "text";
-    case "number":
-      return "double";
-    case "bigint":
-      return "big_int";
-    case "boolean":
-      return "boolean";
-    case "date":
-      return "date";
-    case "json":
-      return "jsonb";
-  }
-}
-var tokenFilterSchema = z.object({
-  kind: z.literal("downcase")
-});
-var tokenizerSchema = z.union([
-  z.object({
-    kind: z.literal("standard")
-  }),
-  z.object({
-    kind: z.literal("ngram"),
-    token_length: z.number()
-  })
-]).default({ kind: "ngram", token_length: 3 }).optional();
-var oreIndexOptsSchema = z.object({});
-var uniqueIndexOptsSchema = z.object({
-  token_filters: z.array(tokenFilterSchema).default([]).optional()
-});
-var matchIndexOptsSchema = z.object({
-  tokenizer: tokenizerSchema,
-  token_filters: z.array(tokenFilterSchema).default([]).optional(),
-  k: z.number().default(6).optional(),
-  m: z.number().default(2048).optional(),
-  include_original: z.boolean().default(false).optional()
-});
-var arrayIndexModeSchema = z.union([
-  z.literal("all"),
-  z.literal("none"),
-  z.object({
-    item: z.boolean().optional(),
-    wildcard: z.boolean().optional(),
-    position: z.boolean().optional()
-  })
-]);
-var steVecIndexOptsSchema = z.object({
-  prefix: z.string(),
-  array_index_mode: arrayIndexModeSchema.optional()
-});
-var indexesSchema = z.object({
-  ore: oreIndexOptsSchema.optional(),
-  unique: uniqueIndexOptsSchema.optional(),
-  match: matchIndexOptsSchema.optional(),
-  ste_vec: steVecIndexOptsSchema.optional()
-}).default({});
-var columnSchema = z.object({
-  cast_as: castAsEnum,
-  indexes: indexesSchema
-}).default({});
-var tableSchema = z.record(columnSchema).default({});
-var tablesSchema = z.record(tableSchema).default({});
-var encryptConfigSchema = z.object({
-  v: z.number(),
-  tables: tablesSchema
-});
-var EncryptedField = class {
-  valueName;
-  castAsValue;
-  constructor(valueName) {
-    this.valueName = valueName;
-    this.castAsValue = "string";
-  }
-  /**
-   * Set or override the plaintext data type for this field.
-   *
-   * By default all values are treated as `'string'`. Use this method to specify
-   * a different type so the encryption layer knows how to encode the plaintext
-   * before encrypting.
-   *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
-   * @returns This `EncryptedField` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedField } from "@cipherstash/stack/schema"
-   *
-   * const age = encryptedField("age").dataType("number")
-   * ```
-   */
-  dataType(castAs) {
-    this.castAsValue = castAs;
-    return this;
-  }
-  build() {
-    return {
-      cast_as: this.castAsValue,
-      indexes: {}
-    };
-  }
-  getName() {
-    return this.valueName;
-  }
-};
-var EncryptedColumn = class {
-  columnName;
-  castAsValue;
-  indexesValue = {};
-  constructor(columnName) {
-    this.columnName = columnName;
-    this.castAsValue = "string";
-  }
-  /**
-   * Set or override the plaintext data type for this column.
-   *
-   * By default all columns are treated as `'string'`. Use this method to specify
-   * a different type so the encryption layer knows how to encode the plaintext
-   * before encrypting.
-   *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const dateOfBirth = encryptedColumn("date_of_birth").dataType("date")
-   * ```
-   */
-  dataType(castAs) {
-    this.castAsValue = castAs;
-    return this;
-  }
-  /**
-   * Enable Order-Revealing Encryption (ORE) indexing on this column.
-   *
-   * ORE allows sorting, comparison, and range queries on encrypted data.
-   * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
-   *
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").orderAndRange(),
-   * })
-   * ```
-   */
-  orderAndRange() {
-    this.indexesValue.ore = {};
-    return this;
-  }
-  /**
-   * Enable an exact-match (unique) index on this column.
-   *
-   * Allows equality queries on encrypted data. Use with `encryptQuery`
-   * and `queryType: 'equality'`.
-   *
-   * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
-   *   When omitted, no token filters are applied.
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").equality(),
-   * })
-   * ```
-   */
-  equality(tokenFilters) {
-    this.indexesValue.unique = {
-      token_filters: tokenFilters ?? []
-    };
-    return this;
-  }
-  /**
-   * Enable a full-text / fuzzy search (match) index on this column.
-   *
-   * Uses n-gram tokenization by default for substring and fuzzy matching.
-   * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.
-   *
-   * @param opts - Optional match index configuration. Defaults to 3-character ngram
-   *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").freeTextSearch(),
-   * })
-   *
-   * // With custom options
-   * const posts = encryptedTable("posts", {
-   *   body: encryptedColumn("body").freeTextSearch({
-   *     tokenizer: { kind: "ngram", token_length: 4 },
-   *     k: 8,
-   *     m: 4096,
-   *   }),
-   * })
-   * ```
-   */
-  freeTextSearch(opts) {
-    this.indexesValue.match = {
-      tokenizer: opts?.tokenizer ?? { kind: "ngram", token_length: 3 },
-      token_filters: opts?.token_filters ?? [
-        {
-          kind: "downcase"
-        }
-      ],
-      k: opts?.k ?? 6,
-      m: opts?.m ?? 2048,
-      include_original: opts?.include_original ?? true
-    };
-    return this;
-  }
-  /**
-   * Configure this column for searchable encrypted JSON (STE-Vec).
-   *
-   * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and
-   * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the
-   * data type to `'json'`.
-   *
-   * When used with `encryptQuery`, the query operation is auto-inferred from
-   * the plaintext type: strings become selector queries, objects/arrays become
-   * containment queries.
-   *
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const documents = encryptedTable("documents", {
-   *   metadata: encryptedColumn("metadata").searchableJson(),
-   * })
-   * ```
-   */
-  searchableJson() {
-    this.castAsValue = "json";
-    this.indexesValue.ste_vec = { prefix: "enabled", array_index_mode: "all" };
-    return this;
-  }
-  build() {
-    return {
-      cast_as: this.castAsValue,
-      indexes: this.indexesValue
-    };
-  }
-  getName() {
-    return this.columnName;
-  }
-};
-var EncryptedTable = class {
-  constructor(tableName, columnBuilders) {
-    this.tableName = tableName;
-    this.columnBuilders = columnBuilders;
-  }
-  tableName;
-  columnBuilders;
-  /**
-   * Compile this table schema into a `TableDefinition` used internally by the encryption client.
-   *
-   * Iterates over all column builders, calls `.build()` on each, and assembles
-   * the final `{ tableName, columns }` structure. For `searchableJson()` columns,
-   * the STE-Vec prefix is automatically set to `"<tableName>/<columnName>"`.
-   *
-   * @returns A `TableDefinition` containing the table name and built column configs.
-   *
-   * @example
-   * ```typescript
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").equality(),
-   * })
-   *
-   * const definition = users.build()
-   * // { tableName: "users", columns: { email: { cast_as: "string", indexes: { unique: ... } } } }
-   * ```
-   */
-  build() {
-    const builtColumns = {};
-    const processColumn = (builder, colName) => {
-      if (builder instanceof EncryptedColumn) {
-        const builtColumn = builder.build();
-        if (builtColumn.cast_as === "json" && builtColumn.indexes.ste_vec?.prefix === "enabled") {
-          builtColumns[colName] = {
-            ...builtColumn,
-            indexes: {
-              ...builtColumn.indexes,
-              ste_vec: {
-                ...builtColumn.indexes.ste_vec,
-                prefix: `${this.tableName}/${colName}`
-              }
-            }
-          };
-        } else {
-          builtColumns[colName] = builtColumn;
-        }
-      } else {
-        for (const [key, value] of Object.entries(builder)) {
-          if (value instanceof EncryptedField) {
-            builtColumns[value.getName()] = value.build();
-          } else {
-            processColumn(value, key);
-          }
-        }
-      }
-    };
-    for (const [colName, builder] of Object.entries(this.columnBuilders)) {
-      processColumn(builder, colName);
-    }
-    return {
-      tableName: this.tableName,
-      columns: builtColumns
-    };
-  }
-};
-function encryptedTable(tableName, columns) {
-  const tableBuilder = new EncryptedTable(
-    tableName,
-    columns
-  );
-  for (const [colName, colBuilder] of Object.entries(columns)) {
-    ;
-    tableBuilder[colName] = colBuilder;
-  }
-  return tableBuilder;
-}
-function encryptedColumn(columnName) {
-  return new EncryptedColumn(columnName);
-}
-function encryptedField(valueName) {
-  return new EncryptedField(valueName);
-}
-function buildEncryptConfig(...protectTables) {
-  const config = {
-    v: 1,
-    tables: {}
-  };
-  for (const tb of protectTables) {
-    const tableDef = tb.build();
-    config.tables[tableDef.tableName] = tableDef.columns;
-  }
-  return config;
-}
-
-export {
-  eqlCastAsEnum,
-  castAsEnum,
-  toEqlCastAs,
-  encryptConfigSchema,
-  EncryptedField,
-  EncryptedColumn,
-  EncryptedTable,
-  encryptedTable,
-  encryptedColumn,
-  encryptedField,
-  buildEncryptConfig
-};
-//# sourceMappingURL=chunk-YWQXTZ5M.js.map