@cipherstash/stack 0.19.0 → 1.0.0-rc.0

package/dist/client.d.cts

@@ -1,7 +1,8 @@
-export { e as EncryptionClient } from './client-DSGHBN-g.cjs';
-export { k as EncryptedColumn, x as EncryptedField, g as EncryptedTable, h as EncryptedTableColumn, I as InferEncrypted, y as InferPlaintext, e as encryptedColumn, d as encryptedField, f as encryptedTable } from './types-public-CpS5KjwX.cjs';
+export { EncryptionClient } from './encryption/index.cjs';
+export { q as EncryptedColumn, r as EncryptedField, z as EncryptedTable, A as EncryptedTableColumn, I as InferEncrypted, J as InferPlaintext, Z as encryptedColumn, _ as encryptedField, $ as encryptedTable } from './types-public-QMjYNfQO.cjs';
 import '@byteslice/result';
 import './errors/index.cjs';
 import '@cipherstash/protect-ffi';
 import './identity/index.cjs';
+import './base-operation-AOAIvsSB.cjs';
 import 'zod';

package/dist/client.d.ts

@@ -1,7 +1,8 @@
-export { e as EncryptionClient } from './client-DfCrlHXh.js';
-export { k as EncryptedColumn, x as EncryptedField, g as EncryptedTable, h as EncryptedTableColumn, I as InferEncrypted, y as InferPlaintext, e as encryptedColumn, d as encryptedField, f as encryptedTable } from './types-public-CpS5KjwX.js';
+export { EncryptionClient } from './encryption/index.js';
+export { q as EncryptedColumn, r as EncryptedField, z as EncryptedTable, A as EncryptedTableColumn, I as InferEncrypted, J as InferPlaintext, Z as encryptedColumn, _ as encryptedField, $ as encryptedTable } from './types-public-QMjYNfQO.js';
 import '@byteslice/result';
 import './errors/index.js';
 import '@cipherstash/protect-ffi';
 import './identity/index.js';
+import './base-operation-FXEzUXIq.js';
 import 'zod';

package/dist/client.js

@@ -2,8 +2,8 @@ import {
   encryptedColumn,
   encryptedField,
   encryptedTable
-} from "./chunk-MP3SSDNN.js";
-import "./chunk-IADZCZEA.js";
+} from "./chunk-CLM7E4I6.js";
+import "./chunk-7333ZC6L.js";
 import "./chunk-PZ5AY32C.js";
 export {
   encryptedColumn,

package/dist/{table-DihEAlxG.d.cts → columns-D2_YzrCX.d.cts}

@@ -1,4 +1,4 @@
-import { i as ColumnSchema, M as MatchIndexOpts, a as Encrypted, j as EncryptConfig } from './types-public-CpS5KjwX.cjs';
+import { k as ColumnSchema } from './types-public-QMjYNfQO.cjs';
 
 /**
  * The query capabilities a v3 concrete domain exposes. These are SDK-facing
@@ -7,17 +7,36 @@ import { i as ColumnSchema, M as MatchIndexOpts, a as Encrypted, j as EncryptCon
  * `build()`.
  *
  * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).
- * - `orderAndRange`: comparison / range lookups (EQL `ob`).
+ * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).
  * - `freeTextSearch`: tokenised substring match (EQL `bf`).
+ * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL
+ *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a
+ *   `public.eql_v3_json` document is queried by structure, not by scalar term.
  */
 type QueryCapabilities = Readonly<{
     equality: boolean;
     orderAndRange: boolean;
     freeTextSearch: boolean;
+    searchableJson?: boolean;
 }>;
+/**
+ * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.
+ *
+ * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level
+ * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)
+ * derive their "reconstructs to `Date`" decision from this array, so the next
+ * `Date`-backed cast is added in exactly one place — never hand-synced across a
+ * type and a runtime guard that could silently drift.
+ *
+ * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells
+ * the FFI not to truncate the time-of-day.)
+ */
+declare const DATE_LIKE_CASTS: readonly ["date", "timestamp"];
+/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */
+type DateLikeCast = (typeof DATE_LIKE_CASTS)[number];
 /** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the
  * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */
-type PlaintextKind = 'string' | 'number' | 'boolean' | 'date' | 'timestamp';
+type PlaintextKind = 'string' | 'number' | 'bigint' | 'boolean' | 'json' | DateLikeCast;
 /**
  * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:
  * the base column class carries a private field of this type so that every
@@ -27,7 +46,7 @@ type PlaintextKind = 'string' | 'number' | 'boolean' | 'date' | 'timestamp';
  * a storage-only `date` column and plaintext inference would collapse.
  */
 type V3DomainDefinition = Readonly<{
-    eqlType: `eql_v3.${string}`;
+    eqlType: `public.${string}`;
     castAs: PlaintextKind;
     capabilities: QueryCapabilities;
 }>;
@@ -37,15 +56,16 @@ type QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {
     equality: false;
     orderAndRange: false;
     freeTextSearch: false;
+    searchableJson?: false | undefined;
 } ? false : true;
 /**
  * The concrete EQL v3 domain name for a full-capability text column.
  * Recorded as metadata for future DDL / query-dialect increments; it is
  * intentionally absent from the emitted encrypt config.
  */
-declare const TEXT_SEARCH_EQL_TYPE = "eql_v3.text_search";
+declare const TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
 declare const INTEGER: {
-    readonly eqlType: "eql_v3.integer";
+    readonly eqlType: "public.eql_v3_integer";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: false;
@@ -54,7 +74,7 @@ declare const INTEGER: {
     };
 };
 declare const INTEGER_EQ: {
-    readonly eqlType: "eql_v3.integer_eq";
+    readonly eqlType: "public.eql_v3_integer_eq";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -63,7 +83,7 @@ declare const INTEGER_EQ: {
     };
 };
 declare const INTEGER_ORD_ORE: {
-    readonly eqlType: "eql_v3.integer_ord_ore";
+    readonly eqlType: "public.eql_v3_integer_ord_ore";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -72,7 +92,7 @@ declare const INTEGER_ORD_ORE: {
     };
 };
 declare const INTEGER_ORD: {
-    readonly eqlType: "eql_v3.integer_ord";
+    readonly eqlType: "public.eql_v3_integer_ord";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -81,7 +101,7 @@ declare const INTEGER_ORD: {
     };
 };
 declare const SMALLINT: {
-    readonly eqlType: "eql_v3.smallint";
+    readonly eqlType: "public.eql_v3_smallint";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: false;
@@ -90,7 +110,7 @@ declare const SMALLINT: {
     };
 };
 declare const SMALLINT_EQ: {
-    readonly eqlType: "eql_v3.smallint_eq";
+    readonly eqlType: "public.eql_v3_smallint_eq";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -99,7 +119,7 @@ declare const SMALLINT_EQ: {
     };
 };
 declare const SMALLINT_ORD_ORE: {
-    readonly eqlType: "eql_v3.smallint_ord_ore";
+    readonly eqlType: "public.eql_v3_smallint_ord_ore";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -108,7 +128,7 @@ declare const SMALLINT_ORD_ORE: {
     };
 };
 declare const SMALLINT_ORD: {
-    readonly eqlType: "eql_v3.smallint_ord";
+    readonly eqlType: "public.eql_v3_smallint_ord";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -116,8 +136,44 @@ declare const SMALLINT_ORD: {
         readonly freeTextSearch: false;
     };
 };
+declare const BIGINT: {
+    readonly eqlType: "public.eql_v3_bigint";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_EQ: {
+    readonly eqlType: "public.eql_v3_bigint_eq";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_bigint_ord_ore";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD: {
+    readonly eqlType: "public.eql_v3_bigint_ord";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
 declare const DATE: {
-    readonly eqlType: "eql_v3.date";
+    readonly eqlType: "public.eql_v3_date";
     readonly castAs: "date";
     readonly capabilities: {
         readonly equality: false;
@@ -126,7 +182,7 @@ declare const DATE: {
     };
 };
 declare const DATE_EQ: {
-    readonly eqlType: "eql_v3.date_eq";
+    readonly eqlType: "public.eql_v3_date_eq";
     readonly castAs: "date";
     readonly capabilities: {
         readonly equality: true;
@@ -135,7 +191,7 @@ declare const DATE_EQ: {
     };
 };
 declare const DATE_ORD_ORE: {
-    readonly eqlType: "eql_v3.date_ord_ore";
+    readonly eqlType: "public.eql_v3_date_ord_ore";
     readonly castAs: "date";
     readonly capabilities: {
         readonly equality: true;
@@ -144,7 +200,7 @@ declare const DATE_ORD_ORE: {
     };
 };
 declare const DATE_ORD: {
-    readonly eqlType: "eql_v3.date_ord";
+    readonly eqlType: "public.eql_v3_date_ord";
     readonly castAs: "date";
     readonly capabilities: {
         readonly equality: true;
@@ -153,7 +209,7 @@ declare const DATE_ORD: {
     };
 };
 declare const TIMESTAMP: {
-    readonly eqlType: "eql_v3.timestamp";
+    readonly eqlType: "public.eql_v3_timestamp";
     readonly castAs: "timestamp";
     readonly capabilities: {
         readonly equality: false;
@@ -162,7 +218,7 @@ declare const TIMESTAMP: {
     };
 };
 declare const TIMESTAMP_EQ: {
-    readonly eqlType: "eql_v3.timestamp_eq";
+    readonly eqlType: "public.eql_v3_timestamp_eq";
     readonly castAs: "timestamp";
     readonly capabilities: {
         readonly equality: true;
@@ -171,7 +227,7 @@ declare const TIMESTAMP_EQ: {
     };
 };
 declare const TIMESTAMP_ORD_ORE: {
-    readonly eqlType: "eql_v3.timestamp_ord_ore";
+    readonly eqlType: "public.eql_v3_timestamp_ord_ore";
     readonly castAs: "timestamp";
     readonly capabilities: {
         readonly equality: true;
@@ -180,7 +236,7 @@ declare const TIMESTAMP_ORD_ORE: {
     };
 };
 declare const TIMESTAMP_ORD: {
-    readonly eqlType: "eql_v3.timestamp_ord";
+    readonly eqlType: "public.eql_v3_timestamp_ord";
     readonly castAs: "timestamp";
     readonly capabilities: {
         readonly equality: true;
@@ -189,7 +245,7 @@ declare const TIMESTAMP_ORD: {
     };
 };
 declare const NUMERIC: {
-    readonly eqlType: "eql_v3.numeric";
+    readonly eqlType: "public.eql_v3_numeric";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: false;
@@ -198,7 +254,7 @@ declare const NUMERIC: {
     };
 };
 declare const NUMERIC_EQ: {
-    readonly eqlType: "eql_v3.numeric_eq";
+    readonly eqlType: "public.eql_v3_numeric_eq";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -207,7 +263,7 @@ declare const NUMERIC_EQ: {
     };
 };
 declare const NUMERIC_ORD_ORE: {
-    readonly eqlType: "eql_v3.numeric_ord_ore";
+    readonly eqlType: "public.eql_v3_numeric_ord_ore";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -216,7 +272,7 @@ declare const NUMERIC_ORD_ORE: {
     };
 };
 declare const NUMERIC_ORD: {
-    readonly eqlType: "eql_v3.numeric_ord";
+    readonly eqlType: "public.eql_v3_numeric_ord";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -225,7 +281,7 @@ declare const NUMERIC_ORD: {
     };
 };
 declare const TEXT: {
-    readonly eqlType: "eql_v3.text";
+    readonly eqlType: "public.eql_v3_text";
     readonly castAs: "string";
     readonly capabilities: {
         readonly equality: false;
@@ -234,7 +290,7 @@ declare const TEXT: {
     };
 };
 declare const TEXT_EQ: {
-    readonly eqlType: "eql_v3.text_eq";
+    readonly eqlType: "public.eql_v3_text_eq";
     readonly castAs: "string";
     readonly capabilities: {
         readonly equality: true;
@@ -243,7 +299,7 @@ declare const TEXT_EQ: {
     };
 };
 declare const TEXT_MATCH: {
-    readonly eqlType: "eql_v3.text_match";
+    readonly eqlType: "public.eql_v3_text_match";
     readonly castAs: "string";
     readonly capabilities: {
         readonly equality: false;
@@ -252,7 +308,7 @@ declare const TEXT_MATCH: {
     };
 };
 declare const TEXT_ORD_ORE: {
-    readonly eqlType: "eql_v3.text_ord_ore";
+    readonly eqlType: "public.eql_v3_text_ord_ore";
     readonly castAs: "string";
     readonly capabilities: {
         readonly equality: true;
@@ -261,7 +317,7 @@ declare const TEXT_ORD_ORE: {
     };
 };
 declare const TEXT_ORD: {
-    readonly eqlType: "eql_v3.text_ord";
+    readonly eqlType: "public.eql_v3_text_ord";
     readonly castAs: "string";
     readonly capabilities: {
         readonly equality: true;
@@ -270,7 +326,7 @@ declare const TEXT_ORD: {
     };
 };
 declare const BOOLEAN: {
-    readonly eqlType: "eql_v3.boolean";
+    readonly eqlType: "public.eql_v3_boolean";
     readonly castAs: "boolean";
     readonly capabilities: {
         readonly equality: false;
@@ -279,7 +335,7 @@ declare const BOOLEAN: {
     };
 };
 declare const REAL: {
-    readonly eqlType: "eql_v3.real";
+    readonly eqlType: "public.eql_v3_real";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: false;
@@ -288,7 +344,7 @@ declare const REAL: {
     };
 };
 declare const REAL_EQ: {
-    readonly eqlType: "eql_v3.real_eq";
+    readonly eqlType: "public.eql_v3_real_eq";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -297,7 +353,7 @@ declare const REAL_EQ: {
     };
 };
 declare const REAL_ORD_ORE: {
-    readonly eqlType: "eql_v3.real_ord_ore";
+    readonly eqlType: "public.eql_v3_real_ord_ore";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -306,7 +362,7 @@ declare const REAL_ORD_ORE: {
     };
 };
 declare const REAL_ORD: {
-    readonly eqlType: "eql_v3.real_ord";
+    readonly eqlType: "public.eql_v3_real_ord";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -315,7 +371,7 @@ declare const REAL_ORD: {
     };
 };
 declare const DOUBLE: {
-    readonly eqlType: "eql_v3.double";
+    readonly eqlType: "public.eql_v3_double";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: false;
@@ -324,7 +380,7 @@ declare const DOUBLE: {
     };
 };
 declare const DOUBLE_EQ: {
-    readonly eqlType: "eql_v3.double_eq";
+    readonly eqlType: "public.eql_v3_double_eq";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -333,7 +389,7 @@ declare const DOUBLE_EQ: {
     };
 };
 declare const DOUBLE_ORD_ORE: {
-    readonly eqlType: "eql_v3.double_ord_ore";
+    readonly eqlType: "public.eql_v3_double_ord_ore";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -342,7 +398,7 @@ declare const DOUBLE_ORD_ORE: {
     };
 };
 declare const DOUBLE_ORD: {
-    readonly eqlType: "eql_v3.double_ord";
+    readonly eqlType: "public.eql_v3_double_ord";
     readonly castAs: "number";
     readonly capabilities: {
         readonly equality: true;
@@ -373,7 +429,7 @@ declare class EncryptedV3Column<D extends V3DomainDefinition> {
     build(): ColumnSchema;
 }
 declare const TEXT_SEARCH_DOMAIN: {
-    readonly eqlType: "eql_v3.text_search";
+    readonly eqlType: "public.eql_v3_text_search";
     readonly castAs: "string";
     readonly capabilities: {
         readonly equality: true;
@@ -382,15 +438,15 @@ declare const TEXT_SEARCH_DOMAIN: {
     };
 };
 /**
- * Builder for an `eql_v3.text_search` column.
+ * Builder for a `public.eql_v3_text_search` column.
  *
  * The concrete type inherently enables equality + order/range + free-text
- * match — there are no capability-enabling methods. `.freeTextSearch(opts?)`
- * tunes the match index only.
+ * match — there are no capability-enabling or tuning methods. The match index
+ * is always emitted with the default configuration.
  *
  * NOTE — querying: a `text_search` column emits all three indexes (`unique`,
- * `ore`, `match`), and the shared index-inference picks them by fixed priority
- * `unique > match > ore`. So `encryptQuery(value, { column, table })` with NO
+ * `ope`, `match`), and the shared index-inference picks them by fixed priority
+ * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO
  * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text
  * match — a substring like `'joh'` then matches nothing. To run a free-text
  * match query you MUST pass `queryType: 'freeTextSearch'`:
@@ -403,16 +459,7 @@ declare const TEXT_SEARCH_DOMAIN: {
  * ```
  */
 declare class EncryptedTextSearchColumn extends EncryptedV3Column<typeof TEXT_SEARCH_DOMAIN> {
-    private matchOpts;
     constructor(columnName: string);
-    /**
-     * Tune the match index. Each provided key replaces its default; omitted
-     * keys keep the default. This NEVER enables a capability — match is always
-     * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.
-     */
-    freeTextSearch(opts?: MatchIndexOpts): this;
-    /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */
-    build(): ColumnSchema;
 }
 declare class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {
 }
@@ -430,6 +477,14 @@ declare class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<typeof SMA
 }
 declare class EncryptedSmallintOrdColumn extends EncryptedV3Column<typeof SMALLINT_ORD> {
 }
+declare class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {
+}
+declare class EncryptedBigintEqColumn extends EncryptedV3Column<typeof BIGINT_EQ> {
+}
+declare class EncryptedBigintOrdOreColumn extends EncryptedV3Column<typeof BIGINT_ORD_ORE> {
+}
+declare class EncryptedBigintOrdColumn extends EncryptedV3Column<typeof BIGINT_ORD> {
+}
 declare class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {
 }
 declare class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {
@@ -482,11 +537,39 @@ declare class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<typeof DOUBL
 }
 declare class EncryptedDoubleOrdColumn extends EncryptedV3Column<typeof DOUBLE_ORD> {
 }
+declare const JSON_DOMAIN: {
+    readonly eqlType: "public.eql_v3_json";
+    readonly castAs: "json";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+        readonly searchableJson: true;
+    };
+};
+/**
+ * Builder for a `public.eql_v3_json` column — an encrypted JSONB document
+ * (a {@link JsonDocument}: object, array, or null). It round-trips through
+ * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index
+ * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,
+ * and the config index kind is `ste_vec` — both protect-ffi names.)
+ */
+declare class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {
+    constructor(columnName: string);
+}
 /**
  * Union of every v3 concrete column type. Used as the value type for v3 table
  * columns so a table may mix any generated domains.
  */
-type AnyEncryptedV3Column = EncryptedIntegerColumn | EncryptedIntegerEqColumn | EncryptedIntegerOrdOreColumn | EncryptedIntegerOrdColumn | EncryptedSmallintColumn | EncryptedSmallintEqColumn | EncryptedSmallintOrdOreColumn | EncryptedSmallintOrdColumn | EncryptedDateColumn | EncryptedDateEqColumn | EncryptedDateOrdOreColumn | EncryptedDateOrdColumn | EncryptedTimestampColumn | EncryptedTimestampEqColumn | EncryptedTimestampOrdOreColumn | EncryptedTimestampOrdColumn | EncryptedNumericColumn | EncryptedNumericEqColumn | EncryptedNumericOrdOreColumn | EncryptedNumericOrdColumn | EncryptedTextColumn | EncryptedTextEqColumn | EncryptedTextMatchColumn | EncryptedTextOrdOreColumn | EncryptedTextOrdColumn | EncryptedTextSearchColumn | EncryptedBooleanColumn | EncryptedRealColumn | EncryptedRealEqColumn | EncryptedRealOrdOreColumn | EncryptedRealOrdColumn | EncryptedDoubleColumn | EncryptedDoubleEqColumn | EncryptedDoubleOrdOreColumn | EncryptedDoubleOrdColumn;
+type AnyEncryptedV3Column = EncryptedIntegerColumn | EncryptedIntegerEqColumn | EncryptedIntegerOrdOreColumn | EncryptedIntegerOrdColumn | EncryptedSmallintColumn | EncryptedSmallintEqColumn | EncryptedSmallintOrdOreColumn | EncryptedSmallintOrdColumn | EncryptedBigintColumn | EncryptedBigintEqColumn | EncryptedBigintOrdOreColumn | EncryptedBigintOrdColumn | EncryptedDateColumn | EncryptedDateEqColumn | EncryptedDateOrdOreColumn | EncryptedDateOrdColumn | EncryptedTimestampColumn | EncryptedTimestampEqColumn | EncryptedTimestampOrdOreColumn | EncryptedTimestampOrdColumn | EncryptedNumericColumn | EncryptedNumericEqColumn | EncryptedNumericOrdOreColumn | EncryptedNumericOrdColumn | EncryptedTextColumn | EncryptedTextEqColumn | EncryptedTextMatchColumn | EncryptedTextOrdOreColumn | EncryptedTextOrdColumn | EncryptedTextSearchColumn | EncryptedBooleanColumn | EncryptedRealColumn | EncryptedRealEqColumn | EncryptedRealOrdOreColumn | EncryptedRealOrdColumn | EncryptedDoubleColumn | EncryptedDoubleEqColumn | EncryptedDoubleOrdOreColumn | EncryptedDoubleOrdColumn | EncryptedJsonColumn;
+/**
+ * A factory that builds a concrete v3 column for a given DB column name.
+ *
+ * Declared here rather than beside `DOMAIN_REGISTRY` so that `./types` can
+ * constrain its own export against it without importing from `./domain-registry`,
+ * which imports `./types` back as a value.
+ */
+type V3ColumnFactory = (name: string) => AnyEncryptedV3Column;
 /**
  * Shape of v3 table columns: every value is a v3 concrete column builder.
  * (Nested fields are deferred to later increments.)
@@ -494,8 +577,23 @@ type AnyEncryptedV3Column = EncryptedIntegerColumn | EncryptedIntegerEqColumn |
 type EncryptedV3TableColumn = {
     [key: string]: AnyEncryptedV3Column;
 };
+/** A JSON value at any depth. Used for the values NESTED inside a document. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON
+ * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:
+ * protect-ffi's `json` cast rejects a top-level string/number/boolean
+ * ("Cannot convert … to Json"), because a scalar belongs in a scalar domain
+ * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary
+ * {@link JsonValue}s and are fully supported.
+ */
+type JsonDocument = null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
 /** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */
-type PlaintextFromKind<K extends PlaintextKind> = K extends 'string' ? string : K extends 'number' ? number : K extends 'boolean' ? boolean : K extends 'date' | 'timestamp' ? Date : never;
+type PlaintextFromKind<K extends PlaintextKind> = K extends 'string' ? string : K extends 'number' ? number : K extends 'bigint' ? bigint : K extends 'boolean' ? boolean : K extends DateLikeCast ? Date : K extends 'json' ? JsonDocument : never;
 /**
  * The plaintext type for a single v3 column, read from the literal domain
  * definition carried on the base class's private field. This is stable across
@@ -521,83 +619,4 @@ type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabil
  */
 type EqlTypeForColumn<C> = C extends EncryptedV3Column<infer D> ? D['eqlType'] : never;
 
-interface TableDefinition {
-    tableName: string;
-    columns: Record<string, ColumnSchema>;
-}
-/**
- * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3
- * column builders. Emits the same `{ tableName, columns }` definition shape.
- */
-declare class EncryptedTable<T extends EncryptedV3TableColumn> {
-    readonly tableName: string;
-    readonly columnBuilders: T;
-    /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
-    readonly _columnType: T;
-    constructor(tableName: string, columnBuilders: T);
-    build(): TableDefinition;
-    /**
-     * Map each column's JS property name to its DB column name (`getName()`).
-     * The model path matches user models by property name but must address the
-     * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
-     * the two only agree when property == name. This recovers the mapping that
-     * `build()` discards.
-     */
-    buildColumnKeyMap(): Record<string, string>;
-}
-/**
- * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`
- * name but lives on the `/eql/v3` subpath — the importer picks the model by
- * import path. The returned object is also a column accessor (`users.email`).
- */
-declare function encryptedTable<T extends EncryptedV3TableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
-/**
- * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same
- * shape as v2's `buildEncryptConfig`.
- */
-declare function buildEncryptConfig(...tables: Array<EncryptedTable<EncryptedV3TableColumn>>): EncryptConfig;
-/**
- * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps
- * to the TypeScript type of its domain's `castAs` kind.
- */
-type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
-    [K in keyof C]: PlaintextForColumn<C[K]>;
-} : never;
-/**
- * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}
- * for why no key-remap filter is needed in the flat single-type model.
- */
-type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
-    [K in keyof C]: Encrypted;
-} : never;
-/** Any v3 table, regardless of its column map. */
-type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>;
-/** Union of the concrete column builders declared on a v3 table. */
-type ColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? C[keyof C] : never;
-/**
- * Union of the *queryable* column builders on a v3 table. Storage-only columns
- * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't
- * be passed to a query method.
- */
-type QueryableColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? {
-    [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never] ? never : C[K];
-}[keyof C] : never;
-/**
- * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.
- * `T` is inferred from the argument: keys that name a schema column are pinned to
- * the column's plaintext type (nullable if the field is nullable), so a wrong-typed
- * field fails assignability; all other keys pass through unchanged.
- */
-type V3ModelInput<Table extends AnyV3Table, T> = {
-    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? InferPlaintext<Table>[K] | null : InferPlaintext<Table>[K] : T[K];
-};
-/** The encrypted result model: schema columns become `Encrypted`, others pass through. */
-type V3EncryptedModel<Table extends AnyV3Table, T> = {
-    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? Encrypted | null : Encrypted : T[K];
-};
-/** The decrypted result model: schema columns become their plaintext type, others pass through. */
-type V3DecryptedModel<Table extends AnyV3Table, T> = {
-    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? InferPlaintext<Table>[K] | null : InferPlaintext<Table>[K] : T[K];
-};
-
-export { type AnyV3Table as A, EncryptedSmallintOrdColumn as B, type ColumnsOf as C, EncryptedSmallintOrdOreColumn as D, EncryptedBooleanColumn as E, EncryptedTable as F, EncryptedTextColumn as G, EncryptedTextEqColumn as H, EncryptedTextMatchColumn as I, EncryptedTextOrdColumn as J, EncryptedTextOrdOreColumn as K, EncryptedTextSearchColumn as L, EncryptedTimestampColumn as M, EncryptedTimestampEqColumn as N, EncryptedTimestampOrdColumn as O, type PlaintextForColumn as P, type QueryableColumnsOf as Q, EncryptedTimestampOrdOreColumn as R, type EncryptedV3TableColumn as S, type EqlTypeForColumn as T, type InferEncrypted as U, type V3ModelInput as V, type InferPlaintext as W, type QueryCapabilities as X, TEXT_SEARCH_EQL_TYPE as Y, buildEncryptConfig as Z, encryptedTable as _, type QueryTypesForColumn as a, type V3EncryptedModel as b, type V3DecryptedModel as c, type AnyEncryptedV3Column as d, EncryptedDateColumn as e, EncryptedDateEqColumn as f, EncryptedDateOrdColumn as g, EncryptedDateOrdOreColumn as h, EncryptedDoubleColumn as i, EncryptedDoubleEqColumn as j, EncryptedDoubleOrdColumn as k, EncryptedDoubleOrdOreColumn as l, EncryptedIntegerColumn as m, EncryptedIntegerEqColumn as n, EncryptedIntegerOrdColumn as o, EncryptedIntegerOrdOreColumn as p, EncryptedNumericColumn as q, EncryptedNumericEqColumn as r, EncryptedNumericOrdColumn as s, EncryptedNumericOrdOreColumn as t, EncryptedRealColumn as u, EncryptedRealEqColumn as v, EncryptedRealOrdColumn as w, EncryptedRealOrdOreColumn as x, EncryptedSmallintColumn as y, EncryptedSmallintEqColumn as z };
+export { type AnyEncryptedV3Column as A, EncryptedSmallintEqColumn as B, EncryptedSmallintOrdColumn as C, DATE_LIKE_CASTS as D, EncryptedBigintColumn as E, EncryptedSmallintOrdOreColumn as F, EncryptedTextColumn as G, EncryptedTextEqColumn as H, EncryptedTextMatchColumn as I, EncryptedTextOrdColumn as J, EncryptedTextOrdOreColumn as K, EncryptedTextSearchColumn as L, EncryptedTimestampColumn as M, EncryptedTimestampEqColumn as N, EncryptedTimestampOrdColumn as O, EncryptedTimestampOrdOreColumn as P, EncryptedV3Column as Q, type EncryptedV3TableColumn as R, type EqlTypeForColumn as S, type JsonDocument as T, type JsonValue as U, type PlaintextForColumn as V, type QueryCapabilities as W, type QueryTypesForColumn as X, TEXT_SEARCH_EQL_TYPE as Y, type V3ColumnFactory as Z, EncryptedBigintEqColumn as a, EncryptedBigintOrdColumn as b, EncryptedBigintOrdOreColumn as c, EncryptedBooleanColumn as d, EncryptedDateColumn as e, EncryptedDateEqColumn as f, EncryptedDateOrdColumn as g, EncryptedDateOrdOreColumn as h, EncryptedDoubleColumn as i, EncryptedDoubleEqColumn as j, EncryptedDoubleOrdColumn as k, EncryptedDoubleOrdOreColumn as l, EncryptedIntegerColumn as m, EncryptedIntegerEqColumn as n, EncryptedIntegerOrdColumn as o, EncryptedIntegerOrdOreColumn as p, EncryptedJsonColumn as q, EncryptedNumericColumn as r, EncryptedNumericEqColumn as s, EncryptedNumericOrdColumn as t, EncryptedNumericOrdOreColumn as u, EncryptedRealColumn as v, EncryptedRealEqColumn as w, EncryptedRealOrdColumn as x, EncryptedRealOrdOreColumn as y, EncryptedSmallintColumn as z };