@cipherstash/stack 0.18.0 → 1.0.0-rc.0

package/dist/client-Dt98Rugc.d.cts

@@ -1,692 +0,0 @@
-import { h as EncryptedQueryResult, i as Client, S as ScalarQueryTerm, B as BulkDecryptedData, j as BulkDecryptPayload, D as Decrypted, k as BulkEncryptedData, l as BulkEncryptPayload, m as EncryptOptions, f as EncryptedColumn, n as EncryptedField, c as EncryptedTable, d as EncryptedTableColumn, E as Encrypted, o as EncryptQueryOptions, Q as QueryTypeName, p as EncryptedReturnType, q as EncryptConfig, K as KeysetIdentifier, r as EncryptedFromSchema, s as EncryptionClientConfig } from './types-public-BTxqjmtv.cjs';
-import { EncryptionError } from './errors/index.cjs';
-import { Result } from '@byteslice/result';
-import { JsPlaintext } from '@cipherstash/protect-ffi';
-import { LockContext } from './identity/index.cjs';
-
-type AuditConfig = {
-    metadata?: Record<string, unknown>;
-};
-type AuditData = {
-    metadata?: Record<string, unknown>;
-};
-declare abstract class EncryptionOperation<T> {
-    protected auditMetadata?: Record<string, unknown>;
-    /**
-     * Attach audit metadata to this operation. Can be chained.
-     * @param config Configuration for ZeroKMS audit logging
-     * @param config.metadata Arbitrary JSON object for appending metadata to the audit log
-     */
-    audit(config: AuditConfig): this;
-    /**
-     * Get the audit data for this operation.
-     */
-    getAuditData(): AuditData;
-    /**
-     * Execute the operation and return a Result
-     */
-    abstract execute(): Promise<Result<T, EncryptionError>>;
-    /**
-     * Make the operation thenable
-     */
-    then<TResult1 = Result<T, EncryptionError>, TResult2 = never>(onfulfilled?: ((value: Result<T, EncryptionError>) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): Promise<TResult1 | TResult2>;
-}
-
-declare class BatchEncryptQueryOperation extends EncryptionOperation<EncryptedQueryResult[]> {
-    private client;
-    private terms;
-    constructor(client: Client, terms: readonly ScalarQueryTerm[]);
-    withLockContext(lockContext: LockContext): BatchEncryptQueryOperationWithLockContext;
-    execute(): Promise<Result<EncryptedQueryResult[], EncryptionError>>;
-}
-declare class BatchEncryptQueryOperationWithLockContext extends EncryptionOperation<EncryptedQueryResult[]> {
-    private client;
-    private terms;
-    private lockContext;
-    constructor(client: Client, terms: readonly ScalarQueryTerm[], lockContext: LockContext, auditMetadata?: Record<string, unknown>);
-    execute(): Promise<Result<EncryptedQueryResult[], EncryptionError>>;
-}
-
-declare class BulkDecryptOperation extends EncryptionOperation<BulkDecryptedData> {
-    private client;
-    private encryptedPayloads;
-    constructor(client: Client, encryptedPayloads: BulkDecryptPayload);
-    withLockContext(lockContext: LockContext): BulkDecryptOperationWithLockContext;
-    execute(): Promise<Result<BulkDecryptedData, EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        encryptedPayloads: BulkDecryptPayload;
-    };
-}
-declare class BulkDecryptOperationWithLockContext extends EncryptionOperation<BulkDecryptedData> {
-    private operation;
-    private lockContext;
-    constructor(operation: BulkDecryptOperation, lockContext: LockContext);
-    execute(): Promise<Result<BulkDecryptedData, EncryptionError>>;
-}
-
-declare class BulkDecryptModelsOperation<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>[]> {
-    private client;
-    private models;
-    constructor(client: Client, models: T[]);
-    withLockContext(lockContext: LockContext): BulkDecryptModelsOperationWithLockContext<T>;
-    execute(): Promise<Result<Decrypted<T>[], EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        models: T[];
-    };
-}
-declare class BulkDecryptModelsOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>[]> {
-    private operation;
-    private lockContext;
-    constructor(operation: BulkDecryptModelsOperation<T>, lockContext: LockContext);
-    execute(): Promise<Result<Decrypted<T>[], EncryptionError>>;
-}
-
-declare class BulkEncryptOperation extends EncryptionOperation<BulkEncryptedData> {
-    private client;
-    private plaintexts;
-    private column;
-    private table;
-    constructor(client: Client, plaintexts: BulkEncryptPayload, opts: EncryptOptions);
-    withLockContext(lockContext: LockContext): BulkEncryptOperationWithLockContext;
-    execute(): Promise<Result<BulkEncryptedData, EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        plaintexts: BulkEncryptPayload;
-        column: EncryptedColumn | EncryptedField;
-        table: EncryptedTable<EncryptedTableColumn>;
-    };
-}
-declare class BulkEncryptOperationWithLockContext extends EncryptionOperation<BulkEncryptedData> {
-    private operation;
-    private lockContext;
-    constructor(operation: BulkEncryptOperation, lockContext: LockContext);
-    execute(): Promise<Result<BulkEncryptedData, EncryptionError>>;
-}
-
-declare class BulkEncryptModelsOperation<T extends Record<string, unknown>> extends EncryptionOperation<T[]> {
-    private client;
-    private models;
-    private table;
-    constructor(client: Client, models: Record<string, unknown>[], table: EncryptedTable<EncryptedTableColumn>);
-    withLockContext(lockContext: LockContext): BulkEncryptModelsOperationWithLockContext<T>;
-    execute(): Promise<Result<T[], EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        models: Record<string, unknown>[];
-        table: EncryptedTable<EncryptedTableColumn>;
-    };
-}
-declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T[]> {
-    private operation;
-    private lockContext;
-    constructor(operation: BulkEncryptModelsOperation<T>, lockContext: LockContext);
-    execute(): Promise<Result<T[], EncryptionError>>;
-}
-
-/**
- * Decrypts an encrypted payload using the provided client.
- * This is the type returned by the {@link EncryptionClient.decrypt | decrypt} method of the {@link EncryptionClient}.
- */
-declare class DecryptOperation extends EncryptionOperation<JsPlaintext> {
-    private client;
-    private encryptedData;
-    constructor(client: Client, encryptedData: Encrypted | null);
-    withLockContext(lockContext: LockContext): DecryptOperationWithLockContext;
-    execute(): Promise<Result<JsPlaintext, EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        encryptedData: Encrypted | null;
-        auditData?: Record<string, unknown>;
-    };
-}
-declare class DecryptOperationWithLockContext extends EncryptionOperation<JsPlaintext> {
-    private operation;
-    private lockContext;
-    constructor(operation: DecryptOperation, lockContext: LockContext);
-    execute(): Promise<Result<JsPlaintext, EncryptionError>>;
-}
-
-declare class DecryptModelOperation<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>> {
-    private client;
-    private model;
-    constructor(client: Client, model: T);
-    withLockContext(lockContext: LockContext): DecryptModelOperationWithLockContext<T>;
-    execute(): Promise<Result<Decrypted<T>, EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        model: T;
-    };
-}
-declare class DecryptModelOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>> {
-    private operation;
-    private lockContext;
-    constructor(operation: DecryptModelOperation<T>, lockContext: LockContext);
-    execute(): Promise<Result<Decrypted<T>, EncryptionError>>;
-}
-
-declare class EncryptOperation extends EncryptionOperation<Encrypted> {
-    private client;
-    private plaintext;
-    private column;
-    private table;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptOptions);
-    withLockContext(lockContext: LockContext): EncryptOperationWithLockContext;
-    execute(): Promise<Result<Encrypted, EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        plaintext: JsPlaintext | null;
-        column: EncryptedColumn | EncryptedField;
-        table: EncryptedTable<EncryptedTableColumn>;
-    };
-}
-declare class EncryptOperationWithLockContext extends EncryptionOperation<Encrypted> {
-    private operation;
-    private lockContext;
-    constructor(operation: EncryptOperation, lockContext: LockContext);
-    execute(): Promise<Result<Encrypted, EncryptionError>>;
-}
-
-declare class EncryptModelOperation<T extends Record<string, unknown>> extends EncryptionOperation<T> {
-    private client;
-    private model;
-    private table;
-    constructor(client: Client, model: Record<string, unknown>, table: EncryptedTable<EncryptedTableColumn>);
-    withLockContext(lockContext: LockContext): EncryptModelOperationWithLockContext<T>;
-    execute(): Promise<Result<T, EncryptionError>>;
-    getOperation(): {
-        client: Client;
-        model: Record<string, unknown>;
-        table: EncryptedTable<EncryptedTableColumn>;
-    };
-}
-declare class EncryptModelOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T> {
-    private operation;
-    private lockContext;
-    constructor(operation: EncryptModelOperation<T>, lockContext: LockContext);
-    execute(): Promise<Result<T, EncryptionError>>;
-}
-
-declare class EncryptQueryOperation extends EncryptionOperation<EncryptedQueryResult> {
-    private client;
-    private plaintext;
-    private opts;
-    constructor(client: Client, plaintext: JsPlaintext | null | undefined, opts: EncryptQueryOptions);
-    withLockContext(lockContext: LockContext): EncryptQueryOperationWithLockContext;
-    execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
-    getOperation(): {
-        column: EncryptedColumn;
-        table: EncryptedTable<EncryptedTableColumn>;
-        queryType?: QueryTypeName;
-        returnType?: EncryptedReturnType;
-        client: Client;
-        plaintext: JsPlaintext | null | undefined;
-    };
-}
-declare class EncryptQueryOperationWithLockContext extends EncryptionOperation<EncryptedQueryResult> {
-    private client;
-    private plaintext;
-    private opts;
-    private lockContext;
-    constructor(client: Client, plaintext: JsPlaintext | null | undefined, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
-    execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
-}
-
-declare const noClientError: () => Error;
-/** The EncryptionClient is the main entry point for interacting with the CipherStash Encryption library.
- * It provides methods for encrypting and decrypting individual values, as well as models (objects) and bulk operations.
- *
- * The client must be initialized using the {@link Encryption} function before it can be used.
- */
-declare class EncryptionClient {
-    private client;
-    private encryptConfig;
-    /**
-     * Initializes the EncryptionClient with the provided configuration.
-     * @internal
-     * @param config - The configuration object for initializing the client.
-     * @returns A promise that resolves to a {@link Result} containing the initialized EncryptionClient or an {@link EncryptionError}.
-     **/
-    init(config: {
-        encryptConfig: EncryptConfig;
-        workspaceCrn?: string;
-        accessKey?: string;
-        clientId?: string;
-        clientKey?: string;
-        keyset?: KeysetIdentifier;
-    }): Promise<Result<EncryptionClient, EncryptionError>>;
-    /**
-     * Encrypt a value - returns a promise which resolves to an encrypted value.
-     *
-     * @param plaintext - The plaintext value to be encrypted.
-     * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
-     * @returns An EncryptOperation that can be awaited or chained with additional methods.
-     *
-     * @example
-     * The following example demonstrates how to encrypt a value using the Encryption client.
-     * It includes defining an encryption schema with {@link encryptedTable} and {@link encryptedColumn},
-     * initializing the client with {@link Encryption}, and performing the encryption.
-     *
-     * `encrypt` returns an {@link EncryptOperation} which can be awaited to get a {@link Result}
-     * which can either be the encrypted value or an {@link EncryptionError}.
-     *
-     * ```typescript
-     * // Define encryption schema
-     * import { Encryption } from "@cipherstash/stack"
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     * const userSchema = encryptedTable("users", {
-     *  email: encryptedColumn("email"),
-     * });
-     *
-     * // Initialize Encryption client
-     * const client = await Encryption({ schemas: [userSchema] })
-     *
-     * // Encrypt a value
-     * const encryptedResult = await client.encrypt(
-     *  "person@example.com",
-     *  { column: userSchema.email, table: userSchema }
-     * )
-     *
-     * // Handle encryption result
-     * if (encryptedResult.failure) {
-     *   throw new Error(`Encryption failed: ${encryptedResult.failure.message}`);
-     * }
-     *
-     * console.log("Encrypted data:", encryptedResult.data);
-     * ```
-     *
-     * @example
-     * When encrypting data, a {@link LockContext} can be provided to tie the encryption to a specific user or session.
-     * This ensures that the same lock context is required for decryption.
-     *
-     * The following example demonstrates how to create a lock context using a user's JWT token
-     * and use it during encryption.
-     *
-     * ```typescript
-     * // Define encryption schema and initialize client as above
-     *
-     * // Create a lock for the user's `sub` claim from their JWT
-     * const lc = new LockContext();
-     * const lockContext = await lc.identify(userJwt);
-     *
-     * if (lockContext.failure) {
-     *   // Handle the failure
-     * }
-     *
-     * // Encrypt a value with the lock context
-     * // Decryption will then require the same lock context
-     * const encryptedResult = await client.encrypt(
-     *  "person@example.com",
-     *  { column: userSchema.email, table: userSchema }
-     * )
-     *  .withLockContext(lockContext)
-     * ```
-     *
-     * @see {@link EncryptOptions}
-     * @see {@link Result}
-     * @see {@link encryptedTable}
-     * @see {@link encryptedColumn}
-     * @see {@link encryptedField}
-     * @see {@link LockContext}
-     * @see {@link EncryptOperation}
-     */
-    encrypt(plaintext: JsPlaintext, opts: EncryptOptions): EncryptOperation;
-    /**
-     * Encrypt a query value - returns a promise which resolves to an encrypted query value.
-     *
-     * @param plaintext - The plaintext value to be encrypted for querying.
-     * @param opts - Options specifying the column, table, and optional queryType for encryption.
-     * @returns An EncryptQueryOperation that can be awaited or chained with additional methods.
-     *
-     * @example
-     * The following example demonstrates how to encrypt a query value using the Encryption client.
-     *
-     * ```typescript
-     * // Define encryption schema
-     * import { Encryption } from "@cipherstash/stack"
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     * const userSchema = encryptedTable("users", {
-     *  email: encryptedColumn("email").equality(),
-     * });
-     *
-     * // Initialize Encryption client
-     * const client = await Encryption({ schemas: [userSchema] })
-     *
-     * // Encrypt a query value
-     * const encryptedResult = await client.encryptQuery(
-     *  "person@example.com",
-     *  { column: userSchema.email, table: userSchema, queryType: 'equality' }
-     * )
-     *
-     * // Handle encryption result
-     * if (encryptedResult.failure) {
-     *   throw new Error(`Encryption failed: ${encryptedResult.failure.message}`);
-     * }
-     *
-     * console.log("Encrypted query:", encryptedResult.data);
-     * ```
-     *
-     * @example
-     * The queryType can be auto-inferred from the column's configured indexes:
-     *
-     * ```typescript
-     * // When queryType is omitted, it will be inferred from the column's indexes
-     * const encryptedResult = await client.encryptQuery(
-     *  "person@example.com",
-     *  { column: userSchema.email, table: userSchema }
-     * )
-     * ```
-     *
-     * @see {@link EncryptQueryOperation}
-     *
-     * **JSONB columns (searchableJson):**
-     * When `queryType` is omitted on a `searchableJson()` column, the query operation is inferred:
-     * - String plaintext → `steVecSelector` (JSONPath queries like `'$.user.email'`)
-     * - Object/Array plaintext → `steVecTerm` (containment queries like `{ role: 'admin' }`)
-     */
-    encryptQuery(plaintext: JsPlaintext, opts: EncryptQueryOptions): EncryptQueryOperation;
-    /**
-     * Encrypt multiple values for use in queries (batch operation).
-     * @param terms - Array of query terms to encrypt
-     */
-    encryptQuery(terms: readonly ScalarQueryTerm[]): BatchEncryptQueryOperation;
-    /**
-     * Decryption - returns a promise which resolves to a decrypted value.
-     *
-     * @param encryptedData - The encrypted data to be decrypted.
-     * @returns A DecryptOperation that can be awaited or chained with additional methods.
-     *
-     * @example
-     * The following example demonstrates how to decrypt a value that was previously encrypted using the {@link encrypt} method.
-     * It includes encrypting a value first, then decrypting it, and handling the result.
-     *
-     * ```typescript
-     * const encryptedData = await client.encrypt(
-     *  "person@example.com",
-     *  { column: "email", table: "users" }
-     * )
-     * const decryptResult = await client.decrypt(encryptedData)
-     * if (decryptResult.failure) {
-     *   throw new Error(`Decryption failed: ${decryptResult.failure.message}`);
-     * }
-     * console.log("Decrypted data:", decryptResult.data);
-     * ```
-     *
-     * @example
-     * Provide a lock context when decrypting:
-     * ```typescript
-     *    await client.decrypt(encryptedData)
-     *      .withLockContext(lockContext)
-     * ```
-     *
-     * @remarks
-     * The public input type rejects null, but at runtime `decrypt` will
-     * short-circuit and return null when given a null ciphertext
-     * (defense in depth for legacy / manually-NULLed DB rows reached via
-     * casts or dynamic field walking). The narrow return type holds for
-     * any caller that respects the input contract.
-     *
-     * @see {@link LockContext}
-     * @see {@link DecryptOperation}
-     */
-    decrypt(encryptedData: Encrypted): DecryptOperation;
-    /**
-     * Encrypt a model (object) based on the table schema.
-     *
-     * Only fields whose keys match columns defined in the table schema are encrypted.
-     * All other fields are passed through unchanged. Returns a thenable operation
-     * that supports `.withLockContext()` for identity-aware encryption.
-     *
-     * The return type is **schema-aware**: fields matching the table schema are
-     * typed as `Encrypted`, while other fields retain their original types. For
-     * best results, let TypeScript infer the type parameters from the arguments
-     * rather than providing an explicit type argument.
-     *
-     * @param input - The model object with plaintext values to encrypt.
-     * @param table - The table schema defining which fields to encrypt.
-     * @returns An `EncryptModelOperation` that can be awaited to get a `Result`
-     *   containing the model with schema-defined fields typed as `Encrypted`,
-     *   or an `EncryptionError`.
-     *
-     * @example
-     * ```typescript
-     * import { Encryption } from "@cipherstash/stack"
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * type User = { id: string; email: string; createdAt: Date }
-     *
-     * const usersSchema = encryptedTable("users", {
-     *   email: encryptedColumn("email").equality(),
-     * })
-     *
-     * const client = await Encryption({ schemas: [usersSchema] })
-     *
-     * // Let TypeScript infer the return type from the schema.
-     * // result.data.email is typed as `Encrypted`, result.data.id stays `string`.
-     * const result = await client.encryptModel(
-     *   { id: "user_123", email: "alice@example.com", createdAt: new Date() },
-     *   usersSchema,
-     * )
-     *
-     * if (result.failure) {
-     *   console.error(result.failure.message)
-     * } else {
-     *   console.log(result.data.id)    // string
-     *   console.log(result.data.email) // Encrypted
-     * }
-     * ```
-     */
-    encryptModel<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: T, table: EncryptedTable<S>): EncryptModelOperation<EncryptedFromSchema<T, S>>;
-    /**
-     * Decrypt a model (object) whose fields contain encrypted values.
-     *
-     * Identifies encrypted fields automatically and decrypts them, returning the
-     * model with plaintext values. Returns a thenable operation that supports
-     * `.withLockContext()` for identity-aware decryption.
-     *
-     * @param input - The model object with encrypted field values.
-     * @returns A `DecryptModelOperation<T>` that can be awaited to get a `Result`
-     *   containing the model with decrypted plaintext fields, or an `EncryptionError`.
-     *
-     * @example
-     * ```typescript
-     * // Decrypt a previously encrypted model
-     * const decrypted = await client.decryptModel<User>(encryptedUser)
-     *
-     * if (decrypted.failure) {
-     *   console.error(decrypted.failure.message)
-     * } else {
-     *   console.log(decrypted.data.email) // "alice@example.com"
-     * }
-     *
-     * // With a lock context
-     * const decrypted = await client
-     *   .decryptModel<User>(encryptedUser)
-     *   .withLockContext(lockContext)
-     * ```
-     */
-    decryptModel<T extends Record<string, unknown>>(input: T): DecryptModelOperation<T>;
-    /**
-     * Encrypt multiple models (objects) in a single bulk operation.
-     *
-     * Performs a single call to ZeroKMS regardless of the number of models,
-     * while still using a unique key for each encrypted value. Only fields
-     * matching the table schema are encrypted; other fields pass through unchanged.
-     *
-     * The return type is **schema-aware**: fields matching the table schema are
-     * typed as `Encrypted`, while other fields retain their original types. For
-     * best results, let TypeScript infer the type parameters from the arguments.
-     *
-     * @param input - An array of model objects with plaintext values to encrypt.
-     * @param table - The table schema defining which fields to encrypt.
-     * @returns A `BulkEncryptModelsOperation` that can be awaited to get a `Result`
-     *   containing an array of models with schema-defined fields typed as `Encrypted`,
-     *   or an `EncryptionError`.
-     *
-     * @example
-     * ```typescript
-     * import { Encryption } from "@cipherstash/stack"
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * type User = { id: string; email: string }
-     *
-     * const usersSchema = encryptedTable("users", {
-     *   email: encryptedColumn("email"),
-     * })
-     *
-     * const client = await Encryption({ schemas: [usersSchema] })
-     *
-     * // Let TypeScript infer the return type from the schema.
-     * // Each item's email is typed as `Encrypted`, id stays `string`.
-     * const result = await client.bulkEncryptModels(
-     *   [
-     *     { id: "1", email: "alice@example.com" },
-     *     { id: "2", email: "bob@example.com" },
-     *   ],
-     *   usersSchema,
-     * )
-     *
-     * if (!result.failure) {
-     *   console.log(result.data) // array of models with encrypted email fields
-     * }
-     * ```
-     */
-    bulkEncryptModels<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: Array<T>, table: EncryptedTable<S>): BulkEncryptModelsOperation<EncryptedFromSchema<T, S>>;
-    /**
-     * Decrypt multiple models (objects) in a single bulk operation.
-     *
-     * Performs a single call to ZeroKMS regardless of the number of models,
-     * restoring all encrypted fields to their original plaintext values.
-     *
-     * @param input - An array of model objects with encrypted field values.
-     * @returns A `BulkDecryptModelsOperation<T>` that can be awaited to get a `Result`
-     *   containing an array of models with decrypted plaintext fields, or an `EncryptionError`.
-     *
-     * @example
-     * ```typescript
-     * const encryptedUsers = encryptedResult.data // from bulkEncryptModels
-     *
-     * const result = await client.bulkDecryptModels<User>(encryptedUsers)
-     *
-     * if (!result.failure) {
-     *   for (const user of result.data) {
-     *     console.log(user.email) // plaintext email
-     *   }
-     * }
-     *
-     * // With a lock context
-     * const result = await client
-     *   .bulkDecryptModels<User>(encryptedUsers)
-     *   .withLockContext(lockContext)
-     * ```
-     */
-    bulkDecryptModels<T extends Record<string, unknown>>(input: Array<T>): BulkDecryptModelsOperation<T>;
-    /**
-     * Encrypt multiple plaintext values in a single bulk operation.
-     *
-     * Each value is encrypted with its own unique key via a single call to ZeroKMS.
-     * Values can include optional `id` fields for correlating results back to
-     * your application data.
-     *
-     * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
-     * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
-     * @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
-     *   containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
-     *
-     * @example
-     * ```typescript
-     * import { Encryption } from "@cipherstash/stack"
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * const users = encryptedTable("users", {
-     *   email: encryptedColumn("email"),
-     * })
-     * const client = await Encryption({ schemas: [users] })
-     *
-     * const result = await client.bulkEncrypt(
-     *   [
-     *     { id: "u1", plaintext: "alice@example.com" },
-     *     { id: "u2", plaintext: "bob@example.com" },
-     *   ],
-     *   { column: users.email, table: users },
-     * )
-     *
-     * if (!result.failure) {
-     *   // result.data = [{ id: "u1", data: Encrypted }, { id: "u2", data: Encrypted }, ...]
-     *   console.log(result.data)
-     * }
-     * ```
-     */
-    bulkEncrypt(plaintexts: BulkEncryptPayload, opts: EncryptOptions): BulkEncryptOperation;
-    /**
-     * Decrypt multiple encrypted values in a single bulk operation.
-     *
-     * Performs a single call to ZeroKMS to decrypt all values. The result uses
-     * a multi-status pattern: each item in the returned array has either a `data`
-     * field (success) or an `error` field (failure), allowing graceful handling
-     * of partial failures.
-     *
-     * @param encryptedPayloads - An array of objects with `data` (encrypted payload) and optional `id` fields.
-     * @returns A `BulkDecryptOperation` that can be awaited to get a `Result`
-     *   containing an array of `{ id?, data: plaintext }` or `{ id?, error: string }` objects,
-     *   or an `EncryptionError` if the entire operation fails.
-     *
-     * @example
-     * ```typescript
-     * const encrypted = await client.bulkEncrypt(plaintexts, { column: users.email, table: users })
-     *
-     * const result = await client.bulkDecrypt(encrypted.data)
-     *
-     * if (!result.failure) {
-     *   for (const item of result.data) {
-     *     if ("data" in item) {
-     *       console.log(`${item.id}: ${item.data}`)
-     *     } else {
-     *       console.error(`${item.id} failed: ${item.error}`)
-     *     }
-     *   }
-     * }
-     * ```
-     */
-    bulkDecrypt(encryptedPayloads: BulkDecryptPayload): BulkDecryptOperation;
-    /**
-     * Get the encrypt config object.
-     *
-     * @returns The encrypt config object.
-     */
-    getEncryptConfig(): EncryptConfig | undefined;
-}
-/**
- * Creates and initializes an Encryption client for encrypting and decrypting data with CipherStash.
- *
- * Provide at least one schema (from {@link encryptedTable}) so the client knows which tables and
- * columns to use. Credentials are read from the optional `config` or from the environment
- * (`CS_WORKSPACE_CRN`, `CS_CLIENT_ID`, `CS_CLIENT_KEY`, `CS_CLIENT_ACCESS_KEY`).
- *
- * @param config - Initialization options. Must include `schemas`; optionally include `config` for
- *   workspace/keys. Logging is configured via the `STASH_STACK_LOG` environment variable
- *   (`debug | info | error`, default: `error`).
- * @returns A Promise that resolves to an initialized {@link EncryptionClient} ready for
- *   {@link EncryptionClient.encrypt}, {@link EncryptionClient.decrypt}, and related operations.
- *
- * @throws Throws if `schemas` is empty, or if a keyset `id` is supplied but is not a valid UUID.
- *   Also throws if the client fails to initialize (e.g. invalid credentials or config).
- *
- * @example
- * ```typescript
- * import { Encryption, encryptedTable, encryptedColumn } from "@cipherstash/stack"
- *
- * const users = encryptedTable("users", {
- *   email: encryptedColumn("email"),
- * })
- * const client = await Encryption({ schemas: [users] })
- * const result = await client.encrypt("alice@example.com", { column: users.email, table: users })
- * ```
- *
- * @see {@link EncryptionClientConfig} for full config options.
- * @see {@link EncryptionClient} for available methods after initialization.
- */
-declare const Encryption: (config: EncryptionClientConfig) => Promise<EncryptionClient>;
-
-export { type AuditConfig as A, BatchEncryptQueryOperation as B, DecryptModelOperation as D, Encryption as E, EncryptionClient as a, BulkDecryptModelsOperation as b, BulkDecryptOperation as c, BulkEncryptModelsOperation as d, BulkEncryptOperation as e, DecryptOperation as f, EncryptModelOperation as g, EncryptOperation as h, EncryptQueryOperation as i, noClientError as n };