@cipherstash/stack 0.19.0 → 1.0.0-rc.0

package/dist/eql/v3/index.js

@@ -1,10 +1,13 @@
 import {
   EncryptedTable,
   buildEncryptConfig,
-  encryptedTable,
-  types
-} from "../../chunk-IBSK6P33.js";
+  encryptedTable
+} from "../../chunk-X3JRXEIB.js";
 import {
+  EncryptedBigintColumn,
+  EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn,
   EncryptedDateColumn,
   EncryptedDateEqColumn,
@@ -18,6 +21,7 @@ import {
   EncryptedIntegerEqColumn,
   EncryptedIntegerOrdColumn,
   EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn,
   EncryptedNumericColumn,
   EncryptedNumericEqColumn,
   EncryptedNumericOrdColumn,
@@ -40,11 +44,16 @@ import {
   EncryptedTimestampEqColumn,
   EncryptedTimestampOrdColumn,
   EncryptedTimestampOrdOreColumn,
-  TEXT_SEARCH_EQL_TYPE
-} from "../../chunk-U66S7VIF.js";
-import "../../chunk-IADZCZEA.js";
+  TEXT_SEARCH_EQL_TYPE,
+  types
+} from "../../chunk-V2Q3NYIH.js";
+import "../../chunk-7333ZC6L.js";
 import "../../chunk-PZ5AY32C.js";
 export {
+  EncryptedBigintColumn,
+  EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn,
   EncryptedDateColumn,
   EncryptedDateEqColumn,
@@ -58,6 +67,7 @@ export {
   EncryptedIntegerEqColumn,
   EncryptedIntegerOrdColumn,
   EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn,
   EncryptedNumericColumn,
   EncryptedNumericEqColumn,
   EncryptedNumericOrdColumn,

package/dist/index-BquA71_Y.d.ts

@@ -0,0 +1,24 @@
+import { p as Encrypted } from './types-public-QMjYNfQO.js';
+
+type EncryptedPgComposite = {
+    data: Encrypted;
+};
+/**
+ * Helper function to transform an encrypted payload into a PostgreSQL composite type.
+ * Use this when inserting data via Supabase or similar clients.
+ */
+declare function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite;
+/**
+ * Helper function to transform a model's encrypted fields into PostgreSQL composite types
+ */
+declare function modelToEncryptedPgComposites<T extends Record<string, unknown>>(model: T): T;
+/**
+ * Helper function to transform multiple models' encrypted fields into PostgreSQL composite types
+ */
+declare function bulkModelsToEncryptedPgComposites<T extends Record<string, unknown>>(models: T[]): T[];
+/**
+ * Helper function to check if a value is an encrypted payload
+ */
+declare function isEncryptedPayload(value: unknown): value is Encrypted;
+
+export { bulkModelsToEncryptedPgComposites as b, encryptedToPgComposite as e, isEncryptedPayload as i, modelToEncryptedPgComposites as m };

package/dist/index-fhWTOV0K.d.cts

@@ -0,0 +1,24 @@
+import { p as Encrypted } from './types-public-QMjYNfQO.cjs';
+
+type EncryptedPgComposite = {
+    data: Encrypted;
+};
+/**
+ * Helper function to transform an encrypted payload into a PostgreSQL composite type.
+ * Use this when inserting data via Supabase or similar clients.
+ */
+declare function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite;
+/**
+ * Helper function to transform a model's encrypted fields into PostgreSQL composite types
+ */
+declare function modelToEncryptedPgComposites<T extends Record<string, unknown>>(model: T): T;
+/**
+ * Helper function to transform multiple models' encrypted fields into PostgreSQL composite types
+ */
+declare function bulkModelsToEncryptedPgComposites<T extends Record<string, unknown>>(models: T[]): T[];
+/**
+ * Helper function to check if a value is an encrypted payload
+ */
+declare function isEncryptedPayload(value: unknown): value is Encrypted;
+
+export { bulkModelsToEncryptedPgComposites as b, encryptedToPgComposite as e, isEncryptedPayload as i, modelToEncryptedPgComposites as m };

package/dist/index.cjs

@@ -4128,6 +4128,23 @@ function defaultMatchOpts() {
     include_original: true
   };
 }
+function cloneMatchOpts(opts) {
+  return {
+    ...opts,
+    tokenizer: { ...opts.tokenizer },
+    token_filters: opts.token_filters.map((f) => ({ ...f }))
+  };
+}
+function resolveMatchOpts(opts) {
+  const defaults = defaultMatchOpts();
+  return cloneMatchOpts({
+    tokenizer: opts?.tokenizer ?? defaults.tokenizer,
+    token_filters: opts?.token_filters ?? defaults.token_filters,
+    k: opts?.k ?? defaults.k,
+    m: opts?.m ?? defaults.m,
+    include_original: opts?.include_original ?? defaults.include_original
+  });
+}
 
 // src/schema/index.ts
 var eqlCastAsEnum = external_exports.enum([
@@ -4165,6 +4182,7 @@ var tokenizerSchema = external_exports.union([
   })
 ]).default({ kind: "ngram", token_length: 3 }).optional();
 var oreIndexOptsSchema = external_exports.object({});
+var opeIndexOptsSchema = external_exports.object({});
 var uniqueIndexOptsSchema = external_exports.object({
   token_filters: external_exports.array(tokenFilterSchema).default([]).optional()
 });
@@ -4186,10 +4204,12 @@ var arrayIndexModeSchema = external_exports.union([
 ]);
 var steVecIndexOptsSchema = external_exports.object({
   prefix: external_exports.string(),
-  array_index_mode: arrayIndexModeSchema.optional()
+  array_index_mode: arrayIndexModeSchema.optional(),
+  mode: external_exports.enum(["compat", "standard"]).optional()
 });
 var indexesSchema = external_exports.object({
   ore: oreIndexOptsSchema.optional(),
+  ope: opeIndexOptsSchema.optional(),
   unique: uniqueIndexOptsSchema.optional(),
   match: matchIndexOptsSchema.optional(),
   ste_vec: steVecIndexOptsSchema.optional()
@@ -4218,7 +4238,7 @@ var EncryptedField = class {
    * a different type so the encryption layer knows how to encode the plaintext
    * before encrypting.
    *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'timestamp'`, `'text'`, `'bigint'`, or `'json'`. Use `'timestamp'` (not `'date'`) to preserve time-of-day — `'date'` truncates to midnight.
    * @returns This `EncryptedField` instance for method chaining.
    *
    * @example
@@ -4257,7 +4277,7 @@ var EncryptedColumn = class {
    * a different type so the encryption layer knows how to encode the plaintext
    * before encrypting.
    *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'timestamp'`, `'text'`, `'bigint'`, or `'json'`. Use `'timestamp'` (not `'date'`) to preserve time-of-day — `'date'` truncates to midnight.
    * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
@@ -4346,14 +4366,7 @@ var EncryptedColumn = class {
    * ```
    */
   freeTextSearch(opts) {
-    const defaults = defaultMatchOpts();
-    this.indexesValue.match = {
-      tokenizer: opts?.tokenizer ?? defaults.tokenizer,
-      token_filters: opts?.token_filters ?? defaults.token_filters,
-      k: opts?.k ?? defaults.k,
-      m: opts?.m ?? defaults.m,
-      include_original: opts?.include_original ?? defaults.include_original
-    };
+    this.indexesValue.match = resolveMatchOpts(opts);
     return this;
   }
   /**
@@ -4380,7 +4393,11 @@ var EncryptedColumn = class {
    */
   searchableJson() {
     this.castAsValue = "json";
-    this.indexesValue.ste_vec = { prefix: "enabled", array_index_mode: "all" };
+    this.indexesValue.ste_vec = {
+      prefix: "enabled",
+      array_index_mode: "all",
+      mode: "standard"
+    };
     return this;
   }
   build() {
@@ -5076,6 +5093,8 @@ var LockContext = class {
 
 // src/types.ts
 var queryTypeToFfi = {
+  // v3 `_ord` domains carry `ope` instead — `resolveIndexType` swaps this
+  // static default for the ordering index the column actually configures.
   orderAndRange: "ore",
   freeTextSearch: "match",
   equality: "unique",
@@ -5098,6 +5117,7 @@ function inferIndexType(column) {
   if (indexes.unique) return "unique";
   if (indexes.match) return "match";
   if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
   if (indexes.ste_vec) return "ste_vec";
   throw new Error(
     `Column "${column.getName()}" has no suitable index for queries`
@@ -5119,6 +5139,7 @@ function validateIndexType(column, indexType) {
     unique: !!indexes.unique,
     match: !!indexes.match,
     ore: !!indexes.ore,
+    ope: !!indexes.ope,
     ste_vec: !!indexes.ste_vec
   };
   if (!indexMap[indexType]) {
@@ -5127,17 +5148,25 @@ function validateIndexType(column, indexType) {
     );
   }
 }
-function resolvesEqualityViaOre(column) {
-  if (!("getQueryCapabilities" in column)) return false;
-  if (!column.getQueryCapabilities().equality) return false;
+function equalityOrderingIndex(column) {
+  if (!("getQueryCapabilities" in column)) return null;
+  if (!column.getQueryCapabilities().equality) return null;
   const indexes = column.build().indexes ?? {};
-  return !indexes.unique && !!indexes.ore;
+  if (indexes.unique) return null;
+  if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
+  return null;
 }
 function resolveIndexType(column, queryType, plaintext) {
-  const indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
+  let indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
   if (queryType) {
-    if (queryType === "equality" && resolvesEqualityViaOre(column)) {
-      return { indexType: "ore" };
+    if (queryType === "equality") {
+      const ordering = equalityOrderingIndex(column);
+      if (ordering) return { indexType: ordering };
+    }
+    if (queryType === "orderAndRange" && indexType === "ore") {
+      const indexes = column.build().indexes ?? {};
+      if (!indexes.ore && indexes.ope) indexType = "ope";
     }
     validateIndexType(column, indexType);
     if (queryType === "searchableJson") {
@@ -5158,6 +5187,11 @@ function resolveIndexType(column, queryType, plaintext) {
 }
 
 // src/encryption/helpers/validation.ts
+var INT64_MIN = -9223372036854775808n;
+var INT64_MAX = 9223372036854775807n;
+function isBigintOutOfInt64Range(value) {
+  return typeof value === "bigint" && (value < INT64_MIN || value > INT64_MAX);
+}
 function validateNumericValue(value) {
   if (typeof value === "number" && Number.isNaN(value)) {
     return {
@@ -5175,6 +5209,14 @@ function validateNumericValue(value) {
       }
     };
   }
+  if (isBigintOutOfInt64Range(value)) {
+    return {
+      failure: {
+        type: EncryptionErrorTypes.EncryptionError,
+        message: "[encryption]: Cannot encrypt bigint value out of int64 range"
+      }
+    };
+  }
   return void 0;
 }
 function assertValidNumericValue(value) {
@@ -5184,9 +5226,14 @@ function assertValidNumericValue(value) {
   if (typeof value === "number" && !Number.isFinite(value)) {
     throw new Error("[encryption]: Cannot encrypt Infinity value");
   }
+  if (isBigintOutOfInt64Range(value)) {
+    throw new Error(
+      "[encryption]: Cannot encrypt bigint value out of int64 range"
+    );
+  }
 }
 function assertValueIndexCompatibility(value, indexType, columnName) {
-  if (typeof value === "number" && indexType === "match") {
+  if ((typeof value === "number" || typeof value === "bigint") && indexType === "match") {
     throw new Error(
       `[encryption]: Cannot use 'match' index with numeric value on column "${columnName}". The 'freeTextSearch' index only supports string values. Configure the column with 'orderAndRange()' or 'equality()' for numeric queries.`
     );
@@ -5619,6 +5666,7 @@ function prepareFieldsForEncryption(model, table) {
           );
         }
       } else if (columnPaths2.includes(fullKey)) {
+        assertValidNumericValue(value);
         const id = index.toString();
         keyMap[id] = fullKey;
         operationFields[fullKey] = value;
@@ -5797,6 +5845,7 @@ function prepareBulkModelsForOperation(models, table) {
             );
           }
         } else if (columnPaths.includes(fullKey)) {
+          assertValidNumericValue(value);
           const id = index.toString();
           keyMap[id] = { modelIndex, fieldKey: fullKey };
           modelOperationFields[fullKey] = value;
@@ -6108,13 +6157,16 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 // src/encryption/operations/bulk-encrypt.ts
 var import_protect_ffi5 = require("@cipherstash/protect-ffi");
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
-    id,
-    plaintext,
-    column: column.getName(),
-    table: table.tableName,
-    ...lockContext && { lockContext }
-  }));
+  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => {
+    assertValidNumericValue(plaintext);
+    return {
+      id,
+      plaintext,
+      column: column.getName(),
+      table: table.tableName,
+      ...lockContext && { lockContext }
+    };
+  });
 };
 var createNullResult2 = (plaintexts) => plaintexts.map(({ id }) => ({ id, data: null }));
 var mapEncryptedDataToResult = (plaintexts, encryptedData) => {