@cipherstash/stack 0.19.0 → 1.0.0-rc.0

package/dist/wasm-inline.d.ts

@@ -52,123 +52,11 @@ type EncryptOptions = {
     table: BuildableTable;
 };
 
-/**
- * SDK-facing data types — developer-friendly aliases accepted by `dataType()`.
- */
-declare const castAsEnum: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
-declare const tokenFilterSchema: z.ZodObject<{
-    kind: z.ZodLiteral<"downcase">;
-}, "strip", z.ZodTypeAny, {
-    kind: "downcase";
-}, {
-    kind: "downcase";
-}>;
-declare const oreIndexOptsSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
-declare const uniqueIndexOptsSchema: z.ZodObject<{
-    token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
-        kind: z.ZodLiteral<"downcase">;
-    }, "strip", z.ZodTypeAny, {
-        kind: "downcase";
-    }, {
-        kind: "downcase";
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    token_filters?: {
-        kind: "downcase";
-    }[] | undefined;
-}, {
-    token_filters?: {
-        kind: "downcase";
-    }[] | undefined;
-}>;
-declare const matchIndexOptsSchema: z.ZodObject<{
-    tokenizer: z.ZodOptional<z.ZodDefault<z.ZodUnion<[z.ZodObject<{
-        kind: z.ZodLiteral<"standard">;
-    }, "strip", z.ZodTypeAny, {
-        kind: "standard";
-    }, {
-        kind: "standard";
-    }>, z.ZodObject<{
-        kind: z.ZodLiteral<"ngram">;
-        token_length: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        kind: "ngram";
-        token_length: number;
-    }, {
-        kind: "ngram";
-        token_length: number;
-    }>]>>>;
-    token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
-        kind: z.ZodLiteral<"downcase">;
-    }, "strip", z.ZodTypeAny, {
-        kind: "downcase";
-    }, {
-        kind: "downcase";
-    }>, "many">>>;
-    k: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-    m: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-    include_original: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-}, "strip", z.ZodTypeAny, {
-    token_filters?: {
-        kind: "downcase";
-    }[] | undefined;
-    tokenizer?: {
-        kind: "standard";
-    } | {
-        kind: "ngram";
-        token_length: number;
-    } | undefined;
-    k?: number | undefined;
-    m?: number | undefined;
-    include_original?: boolean | undefined;
-}, {
-    token_filters?: {
-        kind: "downcase";
-    }[] | undefined;
-    tokenizer?: {
-        kind: "standard";
-    } | {
-        kind: "ngram";
-        token_length: number;
-    } | undefined;
-    k?: number | undefined;
-    m?: number | undefined;
-    include_original?: boolean | undefined;
-}>;
-declare const steVecIndexOptsSchema: z.ZodObject<{
-    prefix: z.ZodString;
-    array_index_mode: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"none">, z.ZodObject<{
-        item: z.ZodOptional<z.ZodBoolean>;
-        wildcard: z.ZodOptional<z.ZodBoolean>;
-        position: z.ZodOptional<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        item?: boolean | undefined;
-        wildcard?: boolean | undefined;
-        position?: boolean | undefined;
-    }, {
-        item?: boolean | undefined;
-        wildcard?: boolean | undefined;
-        position?: boolean | undefined;
-    }>]>>;
-}, "strip", z.ZodTypeAny, {
-    prefix: string;
-    array_index_mode?: "all" | "none" | {
-        item?: boolean | undefined;
-        wildcard?: boolean | undefined;
-        position?: boolean | undefined;
-    } | undefined;
-}, {
-    prefix: string;
-    array_index_mode?: "all" | "none" | {
-        item?: boolean | undefined;
-        wildcard?: boolean | undefined;
-        position?: boolean | undefined;
-    } | undefined;
-}>;
 declare const columnSchema: z.ZodDefault<z.ZodObject<{
     cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
     indexes: z.ZodDefault<z.ZodObject<{
         ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+        ope: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
         unique: z.ZodOptional<z.ZodObject<{
             token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
                 kind: z.ZodLiteral<"downcase">;
@@ -255,6 +143,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             }>]>>;
+            mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
         }, "strip", z.ZodTypeAny, {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -262,6 +151,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         }, {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -269,9 +159,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -298,9 +190,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     }, {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -327,12 +221,14 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
     indexes: {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -359,12 +255,14 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     };
 }, {
     cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
     indexes?: {
         ore?: {} | undefined;
+        ope?: {} | undefined;
         unique?: {
             token_filters?: {
                 kind: "downcase";
@@ -391,6 +289,7 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
                 wildcard?: boolean | undefined;
                 position?: boolean | undefined;
             } | undefined;
+            mode?: "standard" | "compat" | undefined;
         } | undefined;
     } | undefined;
 }>>;
@@ -401,6 +300,7 @@ declare const encryptConfigSchema: z.ZodObject<{
         cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
         indexes: z.ZodDefault<z.ZodObject<{
             ore: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
+            ope: z.ZodOptional<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>;
             unique: z.ZodOptional<z.ZodObject<{
                 token_filters: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
                     kind: z.ZodLiteral<"downcase">;
@@ -487,6 +387,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 }>]>>;
+                mode: z.ZodOptional<z.ZodEnum<["compat", "standard"]>>;
             }, "strip", z.ZodTypeAny, {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -494,6 +395,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             }, {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -501,9 +403,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -530,9 +434,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         }, {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -559,12 +465,14 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
         indexes: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -591,12 +499,14 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         };
     }, {
         cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
         indexes?: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -623,6 +533,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         } | undefined;
     }>>>>>>;
@@ -632,6 +543,7 @@ declare const encryptConfigSchema: z.ZodObject<{
         cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
         indexes: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -658,6 +570,7 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         };
     }>>;
@@ -667,6 +580,7 @@ declare const encryptConfigSchema: z.ZodObject<{
         cast_as?: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text" | undefined;
         indexes?: {
             ore?: {} | undefined;
+            ope?: {} | undefined;
             unique?: {
                 token_filters?: {
                     kind: "downcase";
@@ -693,337 +607,790 @@ declare const encryptConfigSchema: z.ZodObject<{
                     wildcard?: boolean | undefined;
                     position?: boolean | undefined;
                 } | undefined;
+                mode?: "standard" | "compat" | undefined;
             } | undefined;
         } | undefined;
     } | undefined> | undefined> | undefined;
 }>;
+type ColumnSchema = z.infer<typeof columnSchema>;
+type EncryptConfig = z.infer<typeof encryptConfigSchema>;
+
 /**
- * Type-safe alias for {@link castAsEnum} used to specify the *unencrypted* data type of a column or value.
- * This is important because once encrypted, all data is stored as binary blobs.
+ * The query capabilities a v3 concrete domain exposes. These are SDK-facing
+ * semantic flags describing what kinds of query terms a column can produce —
+ * NOT the raw EQL index keys. They are metadata only and never emitted by
+ * `build()`.
  *
- * @see {@link castAsEnum} for possible values.
+ * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).
+ * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).
+ * - `freeTextSearch`: tokenised substring match (EQL `bf`).
+ * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL
+ *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a
+ *   `public.eql_v3_json` document is queried by structure, not by scalar term.
  */
-type CastAs = z.infer<typeof castAsEnum>;
-type TokenFilter = z.infer<typeof tokenFilterSchema>;
-type MatchIndexOpts = z.infer<typeof matchIndexOptsSchema>;
-type SteVecIndexOpts = z.infer<typeof steVecIndexOptsSchema>;
-type UniqueIndexOpts = z.infer<typeof uniqueIndexOptsSchema>;
-type OreIndexOpts = z.infer<typeof oreIndexOptsSchema>;
-type ColumnSchema = z.infer<typeof columnSchema>;
+type QueryCapabilities = Readonly<{
+    equality: boolean;
+    orderAndRange: boolean;
+    freeTextSearch: boolean;
+    searchableJson?: boolean;
+}>;
 /**
- * Shape of table columns: either top-level {@link EncryptedColumn} or nested
- * objects whose leaves are {@link EncryptedField}. Used with {@link encryptedTable}.
+ * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.
+ *
+ * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level
+ * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)
+ * derive their "reconstructs to `Date`" decision from this array, so the next
+ * `Date`-backed cast is added in exactly one place — never hand-synced across a
+ * type and a runtime guard that could silently drift.
+ *
+ * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells
+ * the FFI not to truncate the time-of-day.)
  */
-type EncryptedTableColumn = {
-    [key: string]: EncryptedColumn | {
-        [key: string]: EncryptedField | {
-            [key: string]: EncryptedField | {
-                [key: string]: EncryptedField;
-            };
-        };
+declare const DATE_LIKE_CASTS: readonly ["date", "timestamp"];
+/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */
+type DateLikeCast = (typeof DATE_LIKE_CASTS)[number];
+/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the
+ * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */
+type PlaintextKind = 'string' | 'number' | 'bigint' | 'boolean' | 'json' | DateLikeCast;
+/**
+ * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:
+ * the base column class carries a private field of this type so that every
+ * concrete (otherwise-empty) subclass is discriminated by its literal
+ * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT
+ * nominal, so without this a storage-only `boolean` column would be assignable to
+ * a storage-only `date` column and plaintext inference would collapse.
+ */
+type V3DomainDefinition = Readonly<{
+    eqlType: `public.${string}`;
+    castAs: PlaintextKind;
+    capabilities: QueryCapabilities;
+}>;
+/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a
+ * storage-only domain (all capability flags `false`), `true` otherwise. */
+type QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {
+    equality: false;
+    orderAndRange: false;
+    freeTextSearch: false;
+    searchableJson?: false | undefined;
+} ? false : true;
+/**
+ * The concrete EQL v3 domain name for a full-capability text column.
+ * Recorded as metadata for future DDL / query-dialect increments; it is
+ * intentionally absent from the emitted encrypt config.
+ */
+declare const TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+declare const INTEGER: {
+    readonly eqlType: "public.eql_v3_integer";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_EQ: {
+    readonly eqlType: "public.eql_v3_integer_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_integer_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const INTEGER_ORD: {
+    readonly eqlType: "public.eql_v3_integer_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT: {
+    readonly eqlType: "public.eql_v3_smallint";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_EQ: {
+    readonly eqlType: "public.eql_v3_smallint_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_smallint_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const SMALLINT_ORD: {
+    readonly eqlType: "public.eql_v3_smallint_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT: {
+    readonly eqlType: "public.eql_v3_bigint";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_EQ: {
+    readonly eqlType: "public.eql_v3_bigint_eq";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_bigint_ord_ore";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BIGINT_ORD: {
+    readonly eqlType: "public.eql_v3_bigint_ord";
+    readonly castAs: "bigint";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE: {
+    readonly eqlType: "public.eql_v3_date";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_EQ: {
+    readonly eqlType: "public.eql_v3_date_eq";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_date_ord_ore";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DATE_ORD: {
+    readonly eqlType: "public.eql_v3_date_ord";
+    readonly castAs: "date";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP: {
+    readonly eqlType: "public.eql_v3_timestamp";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_EQ: {
+    readonly eqlType: "public.eql_v3_timestamp_eq";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_timestamp_ord_ore";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TIMESTAMP_ORD: {
+    readonly eqlType: "public.eql_v3_timestamp_ord";
+    readonly castAs: "timestamp";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC: {
+    readonly eqlType: "public.eql_v3_numeric";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_EQ: {
+    readonly eqlType: "public.eql_v3_numeric_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_numeric_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const NUMERIC_ORD: {
+    readonly eqlType: "public.eql_v3_numeric_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT: {
+    readonly eqlType: "public.eql_v3_text";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_EQ: {
+    readonly eqlType: "public.eql_v3_text_eq";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_MATCH: {
+    readonly eqlType: "public.eql_v3_text_match";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: true;
+    };
+};
+declare const TEXT_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_text_ord_ore";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const TEXT_ORD: {
+    readonly eqlType: "public.eql_v3_text_ord";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const BOOLEAN: {
+    readonly eqlType: "public.eql_v3_boolean";
+    readonly castAs: "boolean";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL: {
+    readonly eqlType: "public.eql_v3_real";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_EQ: {
+    readonly eqlType: "public.eql_v3_real_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_real_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const REAL_ORD: {
+    readonly eqlType: "public.eql_v3_real_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE: {
+    readonly eqlType: "public.eql_v3_double";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_EQ: {
+    readonly eqlType: "public.eql_v3_double_eq";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_ORD_ORE: {
+    readonly eqlType: "public.eql_v3_double_ord_ore";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
+    };
+};
+declare const DOUBLE_ORD: {
+    readonly eqlType: "public.eql_v3_double_ord";
+    readonly castAs: "number";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: false;
     };
 };
-type EncryptConfig = z.infer<typeof encryptConfigSchema>;
 /**
- * Builder for a nested encrypted field (encrypted but not searchable).
- * Create with {@link encryptedField}. Use inside nested objects in {@link encryptedTable};
- * supports `.dataType()` for plaintext type. No index methods (equality, orderAndRange, etc.).
+ * Shared base for every v3 concrete domain column. Parameterised by the FULL
+ * literal {@link V3DomainDefinition} (not by capabilities alone): the private
+ * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so
+ * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and
+ * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This
+ * nominality is what keeps plaintext inference precise.
  */
-declare class EncryptedField {
-    private valueName;
-    private castAsValue;
-    constructor(valueName: string);
-    /**
-     * Set or override the plaintext data type for this field.
-     *
-     * By default all values are treated as `'string'`. Use this method to specify
-     * a different type so the encryption layer knows how to encode the plaintext
-     * before encrypting.
-     *
-     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
-     * @returns This `EncryptedField` instance for method chaining.
-     *
-     * @example
-     * ```typescript
-     * import { encryptedField } from "@cipherstash/stack/schema"
-     *
-     * const age = encryptedField("age").dataType("number")
-     * ```
-     */
-    dataType(castAs: CastAs): this;
-    build(): {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
-        indexes: {};
-    };
+declare class EncryptedV3Column<D extends V3DomainDefinition> {
+    private readonly columnName;
+    private readonly definition;
+    constructor(columnName: string, definition: D);
     getName(): string;
+    /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+    getEqlType(): D['eqlType'];
+    /** The semantic query capabilities this domain exposes. Metadata only. */
+    getQueryCapabilities(): D['capabilities'];
+    /** `true` when this domain can produce at least one kind of query term. */
+    isQueryable(): QueryableFlag<D>;
+    /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+    build(): ColumnSchema;
 }
-declare class EncryptedColumn {
-    private columnName;
-    private castAsValue;
-    private indexesValue;
+declare const TEXT_SEARCH_DOMAIN: {
+    readonly eqlType: "public.eql_v3_text_search";
+    readonly castAs: "string";
+    readonly capabilities: {
+        readonly equality: true;
+        readonly orderAndRange: true;
+        readonly freeTextSearch: true;
+    };
+};
+/**
+ * Builder for a `public.eql_v3_text_search` column.
+ *
+ * The concrete type inherently enables equality + order/range + free-text
+ * match — there are no capability-enabling or tuning methods. The match index
+ * is always emitted with the default configuration.
+ *
+ * NOTE — querying: a `text_search` column emits all three indexes (`unique`,
+ * `ope`, `match`), and the shared index-inference picks them by fixed priority
+ * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO
+ * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text
+ * match — a substring like `'joh'` then matches nothing. To run a free-text
+ * match query you MUST pass `queryType: 'freeTextSearch'`:
+ *
+ * ```typescript
+ * // equality (default): exact value only
+ * client.encryptQuery('john@example.com', { column: users.email, table: users })
+ * // free-text match: substring/token search
+ * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })
+ * ```
+ */
+declare class EncryptedTextSearchColumn extends EncryptedV3Column<typeof TEXT_SEARCH_DOMAIN> {
     constructor(columnName: string);
-    /**
-     * Set or override the plaintext data type for this column.
-     *
-     * By default all columns are treated as `'string'`. Use this method to specify
-     * a different type so the encryption layer knows how to encode the plaintext
-     * before encrypting.
-     *
-     * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-     * @returns This `EncryptedColumn` instance for method chaining.
-     *
-     * @example
-     * ```typescript
-     * import { encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * const dateOfBirth = encryptedColumn("date_of_birth").dataType("date")
-     * ```
-     */
-    dataType(castAs: CastAs): this;
-    /**
-     * Enable Order-Revealing Encryption (ORE) indexing on this column.
-     *
-     * ORE allows sorting, comparison, and range queries on encrypted data.
-     * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
-     *
-     * @returns This `EncryptedColumn` instance for method chaining.
-     *
-     * @example
-     * ```typescript
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * const users = encryptedTable("users", {
-     *   email: encryptedColumn("email").orderAndRange(),
-     * })
-     * ```
-     */
-    orderAndRange(): this;
-    /**
-     * Enable an exact-match (unique) index on this column.
-     *
-     * Allows equality queries on encrypted data. Use with `encryptQuery`
-     * and `queryType: 'equality'`.
-     *
-     * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
-     *   When omitted, no token filters are applied.
-     * @returns This `EncryptedColumn` instance for method chaining.
-     *
-     * @example
-     * ```typescript
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * const users = encryptedTable("users", {
-     *   email: encryptedColumn("email").equality(),
-     * })
-     * ```
-     */
-    equality(tokenFilters?: TokenFilter[]): this;
-    /**
-     * Enable a full-text / fuzzy search (match) index on this column.
-     *
-     * Uses n-gram tokenization by default for substring and fuzzy matching.
-     * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.
-     *
-     * @param opts - Optional match index configuration. Defaults to 3-character ngram
-     *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
-     * @returns This `EncryptedColumn` instance for method chaining.
-     *
-     * @example
-     * ```typescript
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * const users = encryptedTable("users", {
-     *   email: encryptedColumn("email").freeTextSearch(),
-     * })
-     *
-     * // With custom options
-     * const posts = encryptedTable("posts", {
-     *   body: encryptedColumn("body").freeTextSearch({
-     *     tokenizer: { kind: "ngram", token_length: 4 },
-     *     k: 8,
-     *     m: 4096,
-     *   }),
-     * })
-     * ```
-     */
-    freeTextSearch(opts?: MatchIndexOpts): this;
-    /**
-     * Configure this column for searchable encrypted JSON (STE-Vec).
-     *
-     * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and
-     * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the
-     * data type to `'json'`.
-     *
-     * When used with `encryptQuery`, the query operation is auto-inferred from
-     * the plaintext type: strings become selector queries, objects/arrays become
-     * containment queries.
-     *
-     * @returns This `EncryptedColumn` instance for method chaining.
-     *
-     * @example
-     * ```typescript
-     * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-     *
-     * const documents = encryptedTable("documents", {
-     *   metadata: encryptedColumn("metadata").searchableJson(),
-     * })
-     * ```
-     */
-    searchableJson(): this;
-    build(): {
-        cast_as: "string" | "number" | "bigint" | "boolean" | "date" | "timestamp" | "json" | "text";
-        indexes: {
-            ore?: OreIndexOpts;
-            unique?: UniqueIndexOpts;
-            match?: Required<MatchIndexOpts>;
-            ste_vec?: SteVecIndexOpts;
-        };
+}
+declare class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {
+}
+declare class EncryptedIntegerEqColumn extends EncryptedV3Column<typeof INTEGER_EQ> {
+}
+declare class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<typeof INTEGER_ORD_ORE> {
+}
+declare class EncryptedIntegerOrdColumn extends EncryptedV3Column<typeof INTEGER_ORD> {
+}
+declare class EncryptedSmallintColumn extends EncryptedV3Column<typeof SMALLINT> {
+}
+declare class EncryptedSmallintEqColumn extends EncryptedV3Column<typeof SMALLINT_EQ> {
+}
+declare class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<typeof SMALLINT_ORD_ORE> {
+}
+declare class EncryptedSmallintOrdColumn extends EncryptedV3Column<typeof SMALLINT_ORD> {
+}
+declare class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {
+}
+declare class EncryptedBigintEqColumn extends EncryptedV3Column<typeof BIGINT_EQ> {
+}
+declare class EncryptedBigintOrdOreColumn extends EncryptedV3Column<typeof BIGINT_ORD_ORE> {
+}
+declare class EncryptedBigintOrdColumn extends EncryptedV3Column<typeof BIGINT_ORD> {
+}
+declare class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {
+}
+declare class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {
+}
+declare class EncryptedDateOrdOreColumn extends EncryptedV3Column<typeof DATE_ORD_ORE> {
+}
+declare class EncryptedDateOrdColumn extends EncryptedV3Column<typeof DATE_ORD> {
+}
+declare class EncryptedTimestampColumn extends EncryptedV3Column<typeof TIMESTAMP> {
+}
+declare class EncryptedTimestampEqColumn extends EncryptedV3Column<typeof TIMESTAMP_EQ> {
+}
+declare class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<typeof TIMESTAMP_ORD_ORE> {
+}
+declare class EncryptedTimestampOrdColumn extends EncryptedV3Column<typeof TIMESTAMP_ORD> {
+}
+declare class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {
+}
+declare class EncryptedNumericEqColumn extends EncryptedV3Column<typeof NUMERIC_EQ> {
+}
+declare class EncryptedNumericOrdOreColumn extends EncryptedV3Column<typeof NUMERIC_ORD_ORE> {
+}
+declare class EncryptedNumericOrdColumn extends EncryptedV3Column<typeof NUMERIC_ORD> {
+}
+declare class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {
+}
+declare class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {
+}
+declare class EncryptedTextMatchColumn extends EncryptedV3Column<typeof TEXT_MATCH> {
+}
+declare class EncryptedTextOrdOreColumn extends EncryptedV3Column<typeof TEXT_ORD_ORE> {
+}
+declare class EncryptedTextOrdColumn extends EncryptedV3Column<typeof TEXT_ORD> {
+}
+declare class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {
+}
+declare class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {
+}
+declare class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {
+}
+declare class EncryptedRealOrdOreColumn extends EncryptedV3Column<typeof REAL_ORD_ORE> {
+}
+declare class EncryptedRealOrdColumn extends EncryptedV3Column<typeof REAL_ORD> {
+}
+declare class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {
+}
+declare class EncryptedDoubleEqColumn extends EncryptedV3Column<typeof DOUBLE_EQ> {
+}
+declare class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<typeof DOUBLE_ORD_ORE> {
+}
+declare class EncryptedDoubleOrdColumn extends EncryptedV3Column<typeof DOUBLE_ORD> {
+}
+declare const JSON_DOMAIN: {
+    readonly eqlType: "public.eql_v3_json";
+    readonly castAs: "json";
+    readonly capabilities: {
+        readonly equality: false;
+        readonly orderAndRange: false;
+        readonly freeTextSearch: false;
+        readonly searchableJson: true;
     };
-    getName(): string;
+};
+/**
+ * Builder for a `public.eql_v3_json` column — an encrypted JSONB document
+ * (a {@link JsonDocument}: object, array, or null). It round-trips through
+ * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index
+ * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,
+ * and the config index kind is `ste_vec` — both protect-ffi names.)
+ */
+declare class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {
+    constructor(columnName: string);
 }
+/**
+ * Union of every v3 concrete column type. Used as the value type for v3 table
+ * columns so a table may mix any generated domains.
+ */
+type AnyEncryptedV3Column = EncryptedIntegerColumn | EncryptedIntegerEqColumn | EncryptedIntegerOrdOreColumn | EncryptedIntegerOrdColumn | EncryptedSmallintColumn | EncryptedSmallintEqColumn | EncryptedSmallintOrdOreColumn | EncryptedSmallintOrdColumn | EncryptedBigintColumn | EncryptedBigintEqColumn | EncryptedBigintOrdOreColumn | EncryptedBigintOrdColumn | EncryptedDateColumn | EncryptedDateEqColumn | EncryptedDateOrdOreColumn | EncryptedDateOrdColumn | EncryptedTimestampColumn | EncryptedTimestampEqColumn | EncryptedTimestampOrdOreColumn | EncryptedTimestampOrdColumn | EncryptedNumericColumn | EncryptedNumericEqColumn | EncryptedNumericOrdOreColumn | EncryptedNumericOrdColumn | EncryptedTextColumn | EncryptedTextEqColumn | EncryptedTextMatchColumn | EncryptedTextOrdOreColumn | EncryptedTextOrdColumn | EncryptedTextSearchColumn | EncryptedBooleanColumn | EncryptedRealColumn | EncryptedRealEqColumn | EncryptedRealOrdOreColumn | EncryptedRealOrdColumn | EncryptedDoubleColumn | EncryptedDoubleEqColumn | EncryptedDoubleOrdOreColumn | EncryptedDoubleOrdColumn | EncryptedJsonColumn;
+/**
+ * Shape of v3 table columns: every value is a v3 concrete column builder.
+ * (Nested fields are deferred to later increments.)
+ */
+type EncryptedV3TableColumn = {
+    [key: string]: AnyEncryptedV3Column;
+};
+/** A JSON value at any depth. Used for the values NESTED inside a document. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON
+ * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:
+ * protect-ffi's `json` cast rejects a top-level string/number/boolean
+ * ("Cannot convert … to Json"), because a scalar belongs in a scalar domain
+ * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary
+ * {@link JsonValue}s and are fully supported.
+ */
+type JsonDocument = null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */
+type PlaintextFromKind<K extends PlaintextKind> = K extends 'string' ? string : K extends 'number' ? number : K extends 'bigint' ? bigint : K extends 'boolean' ? boolean : K extends DateLikeCast ? Date : K extends 'json' ? JsonDocument : never;
+/**
+ * The plaintext type for a single v3 column, read from the literal domain
+ * definition carried on the base class's private field. This is stable across
+ * empty subclasses that share the same base generic — a subclass-name
+ * conditional would collapse because those subclasses are structurally
+ * assignable to one another.
+ */
+type PlaintextForColumn<C> = C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never;
+/**
+ * The user-facing `queryType` names a v3 column supports, derived 1:1 from its
+ * capability flags. Resolves to `never` for a storage-only column (all flags
+ * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}
+ * keys and the first three {@link import('@/types').QueryTypeName} members.
+ */
+type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) : never;
+/**
+ * The concrete EQL v3 type string for a single column, read from the literal
+ * domain definition carried on the base class's private field (mirrors
+ * {@link PlaintextForColumn}). Distributes over a union of columns, so
+ * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's
+ * `eqlType` — the canonical, source-of-truth key set for a type-driven test
+ * matrix keyed by domain.
+ */
+type EqlTypeForColumn<C> = C extends EncryptedV3Column<infer D> ? D['eqlType'] : never;
+
 interface TableDefinition {
     tableName: string;
     columns: Record<string, ColumnSchema>;
 }
-declare class EncryptedTable<T extends EncryptedTableColumn> {
+/**
+ * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3
+ * column builders. Emits the same `{ tableName, columns }` definition shape.
+ */
+declare class EncryptedTable<T extends EncryptedV3TableColumn> {
     readonly tableName: string;
     readonly columnBuilders: T;
     /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
     readonly _columnType: T;
     constructor(tableName: string, columnBuilders: T);
+    build(): TableDefinition;
     /**
-     * Compile this table schema into a `TableDefinition` used internally by the encryption client.
-     *
-     * Iterates over all column builders, calls `.build()` on each, and assembles
-     * the final `{ tableName, columns }` structure. For `searchableJson()` columns,
-     * the STE-Vec prefix is automatically set to `"<tableName>/<columnName>"`.
-     *
-     * @returns A `TableDefinition` containing the table name and built column configs.
+     * Map each column's JS property name to its DB column name (`getName()`).
+     * The model path matches user models by property name but must address the
+     * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+     * the two only agree when property == name. This recovers the mapping that
+     * `build()` discards.
      *
-     * @example
-     * ```typescript
-     * const users = encryptedTable("users", {
-     *   email: encryptedColumn("email").equality(),
-     * })
-     *
-     * const definition = users.build()
-     * // { tableName: "users", columns: { email: { cast_as: "string", indexes: { unique: ... } } } }
-     * ```
+     * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+     * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+     * the mutation transform). On a plain object literal, a column named
+     * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+     * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+     * column with such a name would be mistaken for a mapped encrypted column and
+     * its `Object.prototype` value interpolated into the emitted select string.
+     * `encryptedTable()` rejects such names as JS *properties*, but nothing
+     * constrains the DB column names a table may contain.
      */
-    build(): TableDefinition;
+    buildColumnKeyMap(): Record<string, string>;
 }
 /**
- * Infer the plaintext (decrypted) type from a EncryptedTable schema.
- *
- * @example
- * ```typescript
- * const users = encryptedTable("users", {
- *   email: encryptedColumn("email").equality(),
- *   name: encryptedColumn("name"),
- * })
- *
- * type UserPlaintext = InferPlaintext<typeof users>
- * // => { email: string; name: string }
- * ```
+ * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`
+ * name but lives on the `/eql/v3` subpath — the importer picks the model by
+ * import path. The returned object is also a column accessor (`users.email`).
  */
-type InferPlaintext<T extends EncryptedTable<any>> = T extends EncryptedTable<infer C> ? {
-    [K in keyof C as C[K] extends EncryptedColumn | EncryptedField ? K : never]: string;
+declare function encryptedTable<T extends EncryptedV3TableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
+/**
+ * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same
+ * shape as v2's `buildEncryptConfig`.
+ */
+declare function buildEncryptConfig(...tables: Array<EncryptedTable<EncryptedV3TableColumn>>): EncryptConfig;
+/**
+ * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps
+ * to the TypeScript type of its domain's `castAs` kind.
+ */
+type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: PlaintextForColumn<C[K]>;
 } : never;
 /**
- * Infer the encrypted type from a EncryptedTable schema.
- *
- * @example
- * ```typescript
- * const users = encryptedTable("users", {
- *   email: encryptedColumn("email").equality(),
- * })
- *
- * type UserEncrypted = InferEncrypted<typeof users>
- * // => { email: Encrypted }
- * ```
+ * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}
+ * for why no key-remap filter is needed in the flat single-type model.
  */
-type InferEncrypted<T extends EncryptedTable<any>> = T extends EncryptedTable<infer C> ? {
-    [K in keyof C as C[K] extends EncryptedColumn | EncryptedField ? K : never]: Encrypted;
+type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: Encrypted;
 } : never;
+/** Any v3 table, regardless of its column map. */
+type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>;
+/** Union of the concrete column builders declared on a v3 table. */
+type ColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? C[keyof C] : never;
 /**
- * Define an encrypted table schema.
- *
- * Creates a `EncryptedTable` that maps a database table name to a set of encrypted
- * column definitions. Pass the resulting object to `Encryption({ schemas: [...] })`
- * when initializing the client.
- *
- * The returned object is also a proxy that exposes each column builder directly,
- * so you can reference columns as `users.email` when calling `encrypt`, `decrypt`,
- * and `encryptQuery`.
- *
- * @param tableName - The name of the database table this schema represents.
- * @param columns - An object whose keys are logical column names and values are
- *   {@link EncryptedColumn} from {@link encryptedColumn}, or nested objects whose
- *   leaves are {@link EncryptedField} from {@link encryptedField}.
- * @returns A `EncryptedTable<T> & T` that can be used as both a schema definition
- *   and a column accessor.
- *
- * @example
- * ```typescript
- * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
- *
- * const users = encryptedTable("users", {
- *   email: encryptedColumn("email").equality().freeTextSearch(),
- *   address: encryptedColumn("address"),
- * })
- *
- * // Use as schema
- * const client = await Encryption({ schemas: [users] })
- *
- * // Use as column accessor
- * await client.encrypt("hello@example.com", { column: users.email, table: users })
- * ```
+ * Union of the *queryable* column builders on a v3 table. Storage-only columns
+ * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't
+ * be passed to a query method.
  */
-declare function encryptedTable<T extends EncryptedTableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
+type QueryableColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never] ? never : C[K];
+}[keyof C] : never;
 /**
- * Define an encrypted column within a table schema.
- *
- * Creates a `EncryptedColumn` builder for the given column name. Chain index
- * methods (`.equality()`, `.freeTextSearch()`, `.orderAndRange()`,
- * `.searchableJson()`) and/or `.dataType()` to configure searchable encryption
- * and the plaintext data type.
- *
- * @param columnName - The name of the database column to encrypt.
- * @returns A new `EncryptedColumn` builder.
- *
- * @example
- * ```typescript
- * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
- *
- * const users = encryptedTable("users", {
- *   email: encryptedColumn("email").equality().freeTextSearch().orderAndRange(),
- * })
- * ```
+ * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.
+ * `T` is inferred from the argument: keys that name a schema column are pinned to
+ * the column's plaintext type (nullable if the field is nullable), so a wrong-typed
+ * field fails assignability; all other keys pass through unchanged.
  */
-declare function encryptedColumn(columnName: string): EncryptedColumn;
+type V3ModelInput<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? InferPlaintext<Table>[K] | null : InferPlaintext<Table>[K] : T[K];
+};
+/** The encrypted result model: schema columns become `Encrypted`, others pass through. */
+type V3EncryptedModel<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? Encrypted | null : Encrypted : T[K];
+};
+/**
+ * The decrypted result model: schema columns become their plaintext type, others
+ * pass through. Structurally identical to {@link V3ModelInput} — decrypt yields
+ * the same plaintext shape encrypt accepts — so it is aliased rather than
+ * re-declared to keep the input and output shapes from silently drifting when
+ * one copy is edited. The distinct name is kept for call-site readability.
+ */
+type V3DecryptedModel<Table extends AnyV3Table, T> = V3ModelInput<Table, T>;
+
 /**
- * Define an encrypted field for use in nested or structured schemas.
+ * The v3 column-type namespace. Each member is a public, semantic factory name
+ * for a concrete EQL v3 column. Most members mirror the underlying domain name;
+ * JS-friendly scalar names map to Postgres concrete domains, e.g.
+ * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`
+ * builds a `public.eql_v3_boolean` column.
  *
- * `encryptedField` is similar to {@link encryptedColumn} but creates an {@link EncryptedField}
- * for nested fields that are encrypted but not searchable (no indexes). Use `.dataType()`
- * to specify the plaintext type.
+ * If these factory names stop matching the emitted capability/domain surface,
+ * the stack package is out of sync with the underlying EQL build. That is a
+ * version mismatch, not a harmless naming drift.
  *
- * @param valueName - The name of the value field.
- * @returns A new `EncryptedField` builder.
+ * Each factory returns the CONCRETE column class instance (never the widened
+ * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference
+ * stays precise.
  *
- * @example
- * ```typescript
- * import { encryptedTable, encryptedField } from "@cipherstash/stack/schema"
+ * ```ts
+ * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
  *
- * const orders = encryptedTable("orders", {
- *   details: {
- *     amount: encryptedField("amount").dataType("number"),
- *     currency: encryptedField("currency"),
- *   },
+ * const events = encryptedTable('events', {
+ *   actor:     types.TextEq('actor'),           // equality
+ *   weight:    types.IntegerOrd('weight'),         // order + range
+ *   createdAt: types.Timestamp('created_at'), // storage only
  * })
  * ```
+ *
+ * `types.TextSearch` is fully described by its type — like every other domain,
+ * it has no capability-bearing or tuning chain. Its match index is always
+ * emitted with the default configuration; run a free-text query by passing
+ * `queryType: 'freeTextSearch'` to `encryptQuery`.
  */
-declare function encryptedField(valueName: string): EncryptedField;
+declare const types: {
+    readonly Integer: (name: string) => EncryptedIntegerColumn;
+    readonly IntegerEq: (name: string) => EncryptedIntegerEqColumn;
+    readonly IntegerOrdOre: (name: string) => EncryptedIntegerOrdOreColumn;
+    readonly IntegerOrd: (name: string) => EncryptedIntegerOrdColumn;
+    readonly Smallint: (name: string) => EncryptedSmallintColumn;
+    readonly SmallintEq: (name: string) => EncryptedSmallintEqColumn;
+    readonly SmallintOrdOre: (name: string) => EncryptedSmallintOrdOreColumn;
+    readonly SmallintOrd: (name: string) => EncryptedSmallintOrdColumn;
+    readonly Bigint: (name: string) => EncryptedBigintColumn;
+    readonly BigintEq: (name: string) => EncryptedBigintEqColumn;
+    readonly BigintOrdOre: (name: string) => EncryptedBigintOrdOreColumn;
+    readonly BigintOrd: (name: string) => EncryptedBigintOrdColumn;
+    readonly Date: (name: string) => EncryptedDateColumn;
+    readonly DateEq: (name: string) => EncryptedDateEqColumn;
+    readonly DateOrdOre: (name: string) => EncryptedDateOrdOreColumn;
+    readonly DateOrd: (name: string) => EncryptedDateOrdColumn;
+    readonly Timestamp: (name: string) => EncryptedTimestampColumn;
+    readonly TimestampEq: (name: string) => EncryptedTimestampEqColumn;
+    readonly TimestampOrdOre: (name: string) => EncryptedTimestampOrdOreColumn;
+    readonly TimestampOrd: (name: string) => EncryptedTimestampOrdColumn;
+    readonly Numeric: (name: string) => EncryptedNumericColumn;
+    readonly NumericEq: (name: string) => EncryptedNumericEqColumn;
+    readonly NumericOrdOre: (name: string) => EncryptedNumericOrdOreColumn;
+    readonly NumericOrd: (name: string) => EncryptedNumericOrdColumn;
+    readonly Text: (name: string) => EncryptedTextColumn;
+    readonly TextEq: (name: string) => EncryptedTextEqColumn;
+    readonly TextMatch: (name: string) => EncryptedTextMatchColumn;
+    readonly TextOrdOre: (name: string) => EncryptedTextOrdOreColumn;
+    readonly TextOrd: (name: string) => EncryptedTextOrdColumn;
+    readonly TextSearch: (name: string) => EncryptedTextSearchColumn;
+    readonly Boolean: (name: string) => EncryptedBooleanColumn;
+    readonly Real: (name: string) => EncryptedRealColumn;
+    readonly RealEq: (name: string) => EncryptedRealEqColumn;
+    readonly RealOrdOre: (name: string) => EncryptedRealOrdOreColumn;
+    readonly RealOrd: (name: string) => EncryptedRealOrdColumn;
+    readonly Double: (name: string) => EncryptedDoubleColumn;
+    readonly DoubleEq: (name: string) => EncryptedDoubleEqColumn;
+    readonly DoubleOrdOre: (name: string) => EncryptedDoubleOrdOreColumn;
+    readonly DoubleOrd: (name: string) => EncryptedDoubleOrdColumn;
+    readonly Json: (name: string) => EncryptedJsonColumn;
+};
 
 /**
  * WASM-inline entry for `@cipherstash/stack` — for Deno, Bun, Cloudflare
@@ -1037,13 +1404,16 @@ declare function encryptedField(valueName: string): EncryptedField;
  *
  * Use this import path: `@cipherstash/stack/wasm-inline`
  *
+ * This entry is EQL v3: author schemas with the `types` DSL / `encryptedTable`
+ * re-exported here (the same authoring surface as `@cipherstash/stack/eql/v3`).
+ *
  * @example
  * ```ts
  * import {
- *   Encryption, encryptedTable, encryptedColumn,
+ *   Encryption, encryptedTable, types,
  * } from "@cipherstash/stack/wasm-inline"
  *
- * const users = encryptedTable("users", { email: encryptedColumn("email") })
+ * const users = encryptedTable("users", { email: types.TextSearch("email") })
  *
  * const client = await Encryption({
  *   schemas: [users],
@@ -1089,10 +1459,15 @@ declare function isEncrypted(value: unknown): boolean;
 /**
  * The plaintext shape accepted by `encrypt` and returned by `decrypt`.
  * Mirrors protect-ffi's `JsPlaintext` (recursive: arrays of any of
- * these are valid). Re-defined here so the wasm-inline `.d.ts` doesn't
- * pull in the Node-only protect-ffi types.
+ * these are valid), plus `bigint` for `int8` columns. Re-defined here so
+ * the wasm-inline `.d.ts` doesn't pull in the Node-only protect-ffi types.
+ *
+ * `bigint` is carried natively across the wasm boundary by protect-ffi
+ * 0.28's Rust `encode_plaintext` (which i64-bounds-checks on encrypt and
+ * builds a `js_sys::BigInt` on decrypt), so widening the type here is all
+ * the SDK needs to accept/return `bigint` on the wasm entry point.
  */
-type WasmPlaintext = string | number | boolean | null | Record<string, unknown> | WasmPlaintext[];
+type WasmPlaintext = string | number | bigint | boolean | null | Record<string, unknown> | WasmPlaintext[];
 /**
  * Config for {@link Encryption} on the WASM entry point.
  *
@@ -1172,10 +1547,9 @@ type WasmClientConfig = {
  */
 type WasmAuthStrategy = AccessKeyStrategy | OidcFederationStrategy;
 type WasmEncryptionConfig = {
-    schemas: [
-        EncryptedTable<EncryptedTableColumn>,
-        ...EncryptedTable<EncryptedTableColumn>[]
-    ];
+    /** One or more EQL v3 tables, authored with `types` / `encryptedTable` from
+     *  this entry. The WASM entry is EQL v3 only. */
+    schemas: [AnyV3Table, ...AnyV3Table[]];
     config: WasmClientConfig;
 };
 /**
@@ -1266,4 +1640,4 @@ declare function __resetStrategyDeprecationWarningForTests(): void;
  */
 declare function resolveStrategy(cfg: WasmClientConfig): WasmAuthStrategy;
 
-export { type Encrypted, EncryptedColumn, EncryptedField, EncryptedTable, type EncryptedTableColumn, Encryption, type InferEncrypted, type InferPlaintext, type WasmAuthStrategy, type WasmClientConfig, WasmEncryptionClient, type WasmEncryptionConfig, type WasmPlaintext, __resetStrategyDeprecationWarningForTests, encryptedColumn, encryptedField, encryptedTable, getColumnName, isEncrypted, normalizeCastAs, resolveStrategy };
+export { type AnyEncryptedV3Column, type AnyV3Table, type ColumnsOf, type Encrypted, EncryptedBigintColumn, EncryptedBigintEqColumn, EncryptedBigintOrdColumn, EncryptedBigintOrdOreColumn, EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedJsonColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTable, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, type EncryptedV3TableColumn, Encryption, type EqlTypeForColumn, type InferEncrypted, type InferPlaintext, type JsonDocument, type JsonValue, type PlaintextForColumn, type QueryCapabilities, type QueryTypesForColumn, type QueryableColumnsOf, TEXT_SEARCH_EQL_TYPE, type V3DecryptedModel, type V3EncryptedModel, type V3ModelInput, type WasmAuthStrategy, type WasmClientConfig, WasmEncryptionClient, type WasmEncryptionConfig, type WasmPlaintext, __resetStrategyDeprecationWarningForTests, buildEncryptConfig, encryptedTable, getColumnName, isEncrypted, normalizeCastAs, resolveStrategy, types };