@cipherstash/stack 0.19.0 → 1.0.0-rc.0

package/dist/wasm-inline.js

@@ -15,6 +15,551 @@ import {
   newClient as wasmNewClient
 } from "@cipherstash/protect-ffi/wasm-inline";
 
+// src/schema/match-defaults.ts
+function defaultMatchOpts() {
+  return {
+    tokenizer: { kind: "ngram", token_length: 3 },
+    token_filters: [{ kind: "downcase" }],
+    k: 6,
+    m: 2048,
+    include_original: true
+  };
+}
+
+// src/eql/v3/columns.ts
+var STORAGE_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var EQUALITY_ONLY = {
+  equality: true,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var ORDER_AND_RANGE = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: false
+};
+var MATCH_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: true
+};
+var TEXT_SEARCH = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: true
+};
+var TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+var INTEGER = {
+  eqlType: "public.eql_v3_integer",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var INTEGER_EQ = {
+  eqlType: "public.eql_v3_integer_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var INTEGER_ORD_ORE = {
+  eqlType: "public.eql_v3_integer_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var INTEGER_ORD = {
+  eqlType: "public.eql_v3_integer_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT = {
+  eqlType: "public.eql_v3_smallint",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var SMALLINT_EQ = {
+  eqlType: "public.eql_v3_smallint_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var SMALLINT_ORD_ORE = {
+  eqlType: "public.eql_v3_smallint_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT_ORD = {
+  eqlType: "public.eql_v3_smallint_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT = {
+  eqlType: "public.eql_v3_bigint",
+  castAs: "bigint",
+  capabilities: STORAGE_ONLY
+};
+var BIGINT_EQ = {
+  eqlType: "public.eql_v3_bigint_eq",
+  castAs: "bigint",
+  capabilities: EQUALITY_ONLY
+};
+var BIGINT_ORD_ORE = {
+  eqlType: "public.eql_v3_bigint_ord_ore",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT_ORD = {
+  eqlType: "public.eql_v3_bigint_ord",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE = {
+  eqlType: "public.eql_v3_date",
+  castAs: "date",
+  capabilities: STORAGE_ONLY
+};
+var DATE_EQ = {
+  eqlType: "public.eql_v3_date_eq",
+  castAs: "date",
+  capabilities: EQUALITY_ONLY
+};
+var DATE_ORD_ORE = {
+  eqlType: "public.eql_v3_date_ord_ore",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE_ORD = {
+  eqlType: "public.eql_v3_date_ord",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP = {
+  eqlType: "public.eql_v3_timestamp",
+  castAs: "timestamp",
+  capabilities: STORAGE_ONLY
+};
+var TIMESTAMP_EQ = {
+  eqlType: "public.eql_v3_timestamp_eq",
+  castAs: "timestamp",
+  capabilities: EQUALITY_ONLY
+};
+var TIMESTAMP_ORD_ORE = {
+  eqlType: "public.eql_v3_timestamp_ord_ore",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP_ORD = {
+  eqlType: "public.eql_v3_timestamp_ord",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC = {
+  eqlType: "public.eql_v3_numeric",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var NUMERIC_EQ = {
+  eqlType: "public.eql_v3_numeric_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var NUMERIC_ORD_ORE = {
+  eqlType: "public.eql_v3_numeric_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC_ORD = {
+  eqlType: "public.eql_v3_numeric_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT = {
+  eqlType: "public.eql_v3_text",
+  castAs: "string",
+  capabilities: STORAGE_ONLY
+};
+var TEXT_EQ = {
+  eqlType: "public.eql_v3_text_eq",
+  castAs: "string",
+  capabilities: EQUALITY_ONLY
+};
+var TEXT_MATCH = {
+  eqlType: "public.eql_v3_text_match",
+  castAs: "string",
+  capabilities: MATCH_ONLY
+};
+var TEXT_ORD_ORE = {
+  eqlType: "public.eql_v3_text_ord_ore",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT_ORD = {
+  eqlType: "public.eql_v3_text_ord",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var BOOLEAN = {
+  eqlType: "public.eql_v3_boolean",
+  castAs: "boolean",
+  capabilities: STORAGE_ONLY
+};
+var REAL = {
+  eqlType: "public.eql_v3_real",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var REAL_EQ = {
+  eqlType: "public.eql_v3_real_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var REAL_ORD_ORE = {
+  eqlType: "public.eql_v3_real_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var REAL_ORD = {
+  eqlType: "public.eql_v3_real_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE = {
+  eqlType: "public.eql_v3_double",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var DOUBLE_EQ = {
+  eqlType: "public.eql_v3_double_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var DOUBLE_ORD_ORE = {
+  eqlType: "public.eql_v3_double_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE_ORD = {
+  eqlType: "public.eql_v3_double_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+function indexesForCapabilities(capabilities, castAs, ordering) {
+  const indexes = {};
+  if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
+    indexes.unique = { token_filters: [] };
+  }
+  if (capabilities.orderAndRange) {
+    indexes[ordering] = {};
+  }
+  if (capabilities.freeTextSearch) {
+    indexes.match = { ...defaultMatchOpts(), include_original: false };
+  }
+  if (capabilities.searchableJson) {
+    indexes.ste_vec = {
+      prefix: "enabled",
+      array_index_mode: { item: true, wildcard: true, position: false },
+      mode: "compat"
+    };
+  }
+  return indexes;
+}
+function orderingForEqlType(eqlType) {
+  return eqlType.endsWith("_ord_ore") ? "ore" : "ope";
+}
+function isQueryableCapabilities(capabilities) {
+  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch || (capabilities.searchableJson ?? false);
+}
+var EncryptedV3Column = class {
+  constructor(columnName, definition) {
+    this.columnName = columnName;
+    this.definition = definition;
+  }
+  columnName;
+  definition;
+  getName() {
+    return this.columnName;
+  }
+  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+  getEqlType() {
+    return this.definition.eqlType;
+  }
+  /** The semantic query capabilities this domain exposes. Metadata only. */
+  getQueryCapabilities() {
+    return this.definition.capabilities;
+  }
+  /** `true` when this domain can produce at least one kind of query term. */
+  isQueryable() {
+    return isQueryableCapabilities(
+      this.definition.capabilities
+    );
+  }
+  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+  build() {
+    return {
+      cast_as: this.definition.castAs,
+      indexes: indexesForCapabilities(
+        this.definition.capabilities,
+        this.definition.castAs,
+        orderingForEqlType(this.definition.eqlType)
+      )
+    };
+  }
+};
+var TEXT_SEARCH_DOMAIN = {
+  eqlType: TEXT_SEARCH_EQL_TYPE,
+  castAs: "string",
+  capabilities: TEXT_SEARCH
+};
+var EncryptedTextSearchColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, TEXT_SEARCH_DOMAIN);
+  }
+};
+var EncryptedIntegerColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextMatchColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBooleanColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
+};
+var JSON_DOMAIN = {
+  eqlType: "public.eql_v3_json",
+  castAs: "json",
+  capabilities: {
+    equality: false,
+    orderAndRange: false,
+    freeTextSearch: false,
+    searchableJson: true
+  }
+};
+var EncryptedJsonColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, JSON_DOMAIN);
+  }
+};
+
+// src/eql/v3/table.ts
+var EncryptedTable = class {
+  constructor(tableName, columnBuilders) {
+    this.tableName = tableName;
+    this.columnBuilders = columnBuilders;
+  }
+  tableName;
+  columnBuilders;
+  build() {
+    const builtColumns = /* @__PURE__ */ Object.create(null);
+    for (const builder of Object.values(this.columnBuilders)) {
+      const name = builder.getName();
+      if (Object.hasOwn(builtColumns, name)) {
+        throw new Error(
+          `[eql/v3]: duplicate column name "${name}" in table "${this.tableName}" \u2014 two columns resolve to the same DB name`
+        );
+      }
+      builtColumns[name] = builder.build();
+    }
+    return {
+      tableName: this.tableName,
+      columns: builtColumns
+    };
+  }
+  /**
+   * Map each column's JS property name to its DB column name (`getName()`).
+   * The model path matches user models by property name but must address the
+   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+   * the two only agree when property == name. This recovers the mapping that
+   * `build()` discards.
+   *
+   * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+   * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+   * the mutation transform). On a plain object literal, a column named
+   * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+   * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+   * column with such a name would be mistaken for a mapped encrypted column and
+   * its `Object.prototype` value interpolated into the emitted select string.
+   * `encryptedTable()` rejects such names as JS *properties*, but nothing
+   * constrains the DB column names a table may contain.
+   */
+  buildColumnKeyMap() {
+    const map = /* @__PURE__ */ Object.create(null);
+    for (const [property, builder] of Object.entries(this.columnBuilders)) {
+      map[property] = builder.getName();
+    }
+    return map;
+  }
+};
+var RESERVED_TABLE_KEYS = /* @__PURE__ */ new Set([
+  "tableName",
+  "columnBuilders",
+  "_columnType",
+  "build",
+  "buildColumnKeyMap"
+]);
+function isReservedTableKey(tableBuilder, colName) {
+  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder;
+}
+function encryptedTable(tableName, columns) {
+  const tableBuilder = new EncryptedTable(
+    tableName,
+    columns
+  );
+  for (const [colName, colBuilder] of Object.entries(columns)) {
+    if (isReservedTableKey(tableBuilder, colName)) {
+      throw new Error(
+        `Column name "${colName}" collides with a reserved EncryptedTable property`
+      );
+    }
+    ;
+    tableBuilder[colName] = colBuilder;
+  }
+  return tableBuilder;
+}
+function buildEncryptConfig(...tables) {
+  const config = {
+    v: 1,
+    tables: {}
+  };
+  for (const tb of tables) {
+    const tableDef = tb.build();
+    if (Object.hasOwn(config.tables, tableDef.tableName)) {
+      throw new Error(
+        `[eql/v3]: duplicate table name "${tableDef.tableName}" passed to buildEncryptConfig \u2014 each table must have a unique name`
+      );
+    }
+    config.tables[tableDef.tableName] = tableDef.columns;
+  }
+  return config;
+}
+
+// src/eql/v3/types.ts
+var types = {
+  // integer
+  Integer: (name) => new EncryptedIntegerColumn(name, INTEGER),
+  IntegerEq: (name) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),
+  IntegerOrdOre: (name) => new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),
+  IntegerOrd: (name) => new EncryptedIntegerOrdColumn(name, INTEGER_ORD),
+  // smallint
+  Smallint: (name) => new EncryptedSmallintColumn(name, SMALLINT),
+  SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
+  SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
+  SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
+  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by
+  // the native protect-ffi boundary (see ./columns)
+  Bigint: (name) => new EncryptedBigintColumn(name, BIGINT),
+  BigintEq: (name) => new EncryptedBigintEqColumn(name, BIGINT_EQ),
+  BigintOrdOre: (name) => new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),
+  BigintOrd: (name) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),
+  // date
+  Date: (name) => new EncryptedDateColumn(name, DATE),
+  DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
+  DateOrdOre: (name) => new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),
+  DateOrd: (name) => new EncryptedDateOrdColumn(name, DATE_ORD),
+  // timestamp
+  Timestamp: (name) => new EncryptedTimestampColumn(name, TIMESTAMP),
+  TimestampEq: (name) => new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),
+  TimestampOrdOre: (name) => new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),
+  TimestampOrd: (name) => new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),
+  // numeric
+  Numeric: (name) => new EncryptedNumericColumn(name, NUMERIC),
+  NumericEq: (name) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),
+  NumericOrdOre: (name) => new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),
+  NumericOrd: (name) => new EncryptedNumericOrdColumn(name, NUMERIC_ORD),
+  // text
+  Text: (name) => new EncryptedTextColumn(name, TEXT),
+  TextEq: (name) => new EncryptedTextEqColumn(name, TEXT_EQ),
+  TextMatch: (name) => new EncryptedTextMatchColumn(name, TEXT_MATCH),
+  TextOrdOre: (name) => new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),
+  TextOrd: (name) => new EncryptedTextOrdColumn(name, TEXT_ORD),
+  TextSearch: (name) => new EncryptedTextSearchColumn(name),
+  // boolean
+  Boolean: (name) => new EncryptedBooleanColumn(name, BOOLEAN),
+  // real
+  Real: (name) => new EncryptedRealColumn(name, REAL),
+  RealEq: (name) => new EncryptedRealEqColumn(name, REAL_EQ),
+  RealOrdOre: (name) => new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),
+  RealOrd: (name) => new EncryptedRealOrdColumn(name, REAL_ORD),
+  // double
+  Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
+  DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
+  DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
+  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),
+  // json (encrypted JSONB document, ste_vec containment)
+  Json: (name) => new EncryptedJsonColumn(name)
+  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself
+  // by calling every value here at module load. A non-factory export would throw
+  // during module evaluation and take the supabase introspect/schema-build/verify
+  // path down with it. This turns that into a compile error at the offending line.
+  // `as const` applies first, so literal key inference is preserved.
+};
+
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -2805,9 +3350,9 @@ var ZodUnion = class extends ZodType {
     return this._def.options;
   }
 };
-ZodUnion.create = (types, params) => {
+ZodUnion.create = (types2, params) => {
   return new ZodUnion({
-    options: types,
+    options: types2,
     typeName: ZodFirstPartyTypeKind.ZodUnion,
     ...processCreateParams(params)
   });
@@ -4056,17 +4601,6 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// src/schema/match-defaults.ts
-function defaultMatchOpts() {
-  return {
-    tokenizer: { kind: "ngram", token_length: 3 },
-    token_filters: [{ kind: "downcase" }],
-    k: 6,
-    m: 2048,
-    include_original: true
-  };
-}
-
 // src/schema/index.ts
 var eqlCastAsEnum = external_exports.enum([
   "text",
@@ -4123,6 +4657,7 @@ var tokenizerSchema = external_exports.union([
   })
 ]).default({ kind: "ngram", token_length: 3 }).optional();
 var oreIndexOptsSchema = external_exports.object({});
+var opeIndexOptsSchema = external_exports.object({});
 var uniqueIndexOptsSchema = external_exports.object({
   token_filters: external_exports.array(tokenFilterSchema).default([]).optional()
 });
@@ -4144,10 +4679,12 @@ var arrayIndexModeSchema = external_exports.union([
 ]);
 var steVecIndexOptsSchema = external_exports.object({
   prefix: external_exports.string(),
-  array_index_mode: arrayIndexModeSchema.optional()
+  array_index_mode: arrayIndexModeSchema.optional(),
+  mode: external_exports.enum(["compat", "standard"]).optional()
 });
 var indexesSchema = external_exports.object({
   ore: oreIndexOptsSchema.optional(),
+  ope: opeIndexOptsSchema.optional(),
   unique: uniqueIndexOptsSchema.optional(),
   match: matchIndexOptsSchema.optional(),
   ste_vec: steVecIndexOptsSchema.optional()
@@ -4162,287 +4699,6 @@ var encryptConfigSchema = external_exports.object({
   v: external_exports.number(),
   tables: tablesSchema
 });
-var EncryptedField = class {
-  valueName;
-  castAsValue;
-  constructor(valueName) {
-    this.valueName = valueName;
-    this.castAsValue = "string";
-  }
-  /**
-   * Set or override the plaintext data type for this field.
-   *
-   * By default all values are treated as `'string'`. Use this method to specify
-   * a different type so the encryption layer knows how to encode the plaintext
-   * before encrypting.
-   *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
-   * @returns This `EncryptedField` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedField } from "@cipherstash/stack/schema"
-   *
-   * const age = encryptedField("age").dataType("number")
-   * ```
-   */
-  dataType(castAs) {
-    this.castAsValue = castAs;
-    return this;
-  }
-  build() {
-    return {
-      cast_as: this.castAsValue,
-      indexes: {}
-    };
-  }
-  getName() {
-    return this.valueName;
-  }
-};
-var EncryptedColumn = class {
-  columnName;
-  castAsValue;
-  indexesValue = {};
-  constructor(columnName) {
-    this.columnName = columnName;
-    this.castAsValue = "string";
-  }
-  /**
-   * Set or override the plaintext data type for this column.
-   *
-   * By default all columns are treated as `'string'`. Use this method to specify
-   * a different type so the encryption layer knows how to encode the plaintext
-   * before encrypting.
-   *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const dateOfBirth = encryptedColumn("date_of_birth").dataType("date")
-   * ```
-   */
-  dataType(castAs) {
-    this.castAsValue = castAs;
-    return this;
-  }
-  /**
-   * Enable Order-Revealing Encryption (ORE) indexing on this column.
-   *
-   * ORE allows sorting, comparison, and range queries on encrypted data.
-   * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
-   *
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").orderAndRange(),
-   * })
-   * ```
-   */
-  orderAndRange() {
-    this.indexesValue.ore = {};
-    return this;
-  }
-  /**
-   * Enable an exact-match (unique) index on this column.
-   *
-   * Allows equality queries on encrypted data. Use with `encryptQuery`
-   * and `queryType: 'equality'`.
-   *
-   * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
-   *   When omitted, no token filters are applied.
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").equality(),
-   * })
-   * ```
-   */
-  equality(tokenFilters) {
-    this.indexesValue.unique = {
-      token_filters: tokenFilters ?? []
-    };
-    return this;
-  }
-  /**
-   * Enable a full-text / fuzzy search (match) index on this column.
-   *
-   * Uses n-gram tokenization by default for substring and fuzzy matching.
-   * Use with `encryptQuery` and `queryType: 'freeTextSearch'`.
-   *
-   * @param opts - Optional match index configuration. Defaults to 3-character ngram
-   *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").freeTextSearch(),
-   * })
-   *
-   * // With custom options
-   * const posts = encryptedTable("posts", {
-   *   body: encryptedColumn("body").freeTextSearch({
-   *     tokenizer: { kind: "ngram", token_length: 4 },
-   *     k: 8,
-   *     m: 4096,
-   *   }),
-   * })
-   * ```
-   */
-  freeTextSearch(opts) {
-    const defaults = defaultMatchOpts();
-    this.indexesValue.match = {
-      tokenizer: opts?.tokenizer ?? defaults.tokenizer,
-      token_filters: opts?.token_filters ?? defaults.token_filters,
-      k: opts?.k ?? defaults.k,
-      m: opts?.m ?? defaults.m,
-      include_original: opts?.include_original ?? defaults.include_original
-    };
-    return this;
-  }
-  /**
-   * Configure this column for searchable encrypted JSON (STE-Vec).
-   *
-   * Enables encrypted JSONPath selector queries (e.g. `'$.user.email'`) and
-   * containment queries (e.g. `{ role: 'admin' }`). Automatically sets the
-   * data type to `'json'`.
-   *
-   * When used with `encryptQuery`, the query operation is auto-inferred from
-   * the plaintext type: strings become selector queries, objects/arrays become
-   * containment queries.
-   *
-   * @returns This `EncryptedColumn` instance for method chaining.
-   *
-   * @example
-   * ```typescript
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const documents = encryptedTable("documents", {
-   *   metadata: encryptedColumn("metadata").searchableJson(),
-   * })
-   * ```
-   */
-  searchableJson() {
-    this.castAsValue = "json";
-    this.indexesValue.ste_vec = { prefix: "enabled", array_index_mode: "all" };
-    return this;
-  }
-  build() {
-    return {
-      cast_as: this.castAsValue,
-      indexes: this.indexesValue
-    };
-  }
-  getName() {
-    return this.columnName;
-  }
-};
-var EncryptedTable = class {
-  constructor(tableName, columnBuilders) {
-    this.tableName = tableName;
-    this.columnBuilders = columnBuilders;
-  }
-  tableName;
-  columnBuilders;
-  /**
-   * Compile this table schema into a `TableDefinition` used internally by the encryption client.
-   *
-   * Iterates over all column builders, calls `.build()` on each, and assembles
-   * the final `{ tableName, columns }` structure. For `searchableJson()` columns,
-   * the STE-Vec prefix is automatically set to `"<tableName>/<columnName>"`.
-   *
-   * @returns A `TableDefinition` containing the table name and built column configs.
-   *
-   * @example
-   * ```typescript
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email").equality(),
-   * })
-   *
-   * const definition = users.build()
-   * // { tableName: "users", columns: { email: { cast_as: "string", indexes: { unique: ... } } } }
-   * ```
-   */
-  build() {
-    const builtColumns = {};
-    const processColumn = (builder, colName) => {
-      if (builder instanceof EncryptedColumn) {
-        const builtColumn = builder.build();
-        if (builtColumn.cast_as === "json" && builtColumn.indexes.ste_vec?.prefix === "enabled") {
-          builtColumns[colName] = {
-            ...builtColumn,
-            indexes: {
-              ...builtColumn.indexes,
-              ste_vec: {
-                ...builtColumn.indexes.ste_vec,
-                prefix: `${this.tableName}/${colName}`
-              }
-            }
-          };
-        } else {
-          builtColumns[colName] = builtColumn;
-        }
-      } else {
-        for (const [key, value] of Object.entries(builder)) {
-          if (value instanceof EncryptedField) {
-            builtColumns[value.getName()] = value.build();
-          } else {
-            processColumn(value, key);
-          }
-        }
-      }
-    };
-    for (const [colName, builder] of Object.entries(this.columnBuilders)) {
-      processColumn(builder, colName);
-    }
-    return {
-      tableName: this.tableName,
-      columns: builtColumns
-    };
-  }
-};
-function encryptedTable(tableName, columns) {
-  const tableBuilder = new EncryptedTable(
-    tableName,
-    columns
-  );
-  for (const [colName, colBuilder] of Object.entries(columns)) {
-    ;
-    tableBuilder[colName] = colBuilder;
-  }
-  return tableBuilder;
-}
-function encryptedColumn(columnName) {
-  return new EncryptedColumn(columnName);
-}
-function encryptedField(valueName) {
-  return new EncryptedField(valueName);
-}
-function buildEncryptConfig(...protectTables) {
-  const config = {
-    v: 1,
-    tables: {}
-  };
-  for (const tb of protectTables) {
-    const tableDef = tb.build();
-    config.tables[tableDef.tableName] = tableDef.columns;
-  }
-  return config;
-}
 
 // src/wasm-inline.ts
 import {
@@ -4500,6 +4756,14 @@ async function Encryption(config) {
       "[encryption]: At least one encryptedTable must be provided to initialize the encryption client"
     );
   }
+  for (const table of schemas) {
+    const isV3 = typeof table.buildColumnKeyMap === "function";
+    if (!isV3) {
+      throw new Error(
+        "[encryption]: `@cipherstash/stack/wasm-inline` is EQL v3 only \u2014 author schemas with `types` / `encryptedTable` from this entry. (EQL v2 is available on the native `@cipherstash/stack` entry.)"
+      );
+    }
+  }
   const encryptConfig = encryptConfigSchema.parse(
     buildEncryptConfig(...schemas)
   );
@@ -4508,7 +4772,8 @@ async function Encryption(config) {
     strategy,
     encryptConfig: normalizeCastAs(encryptConfig),
     clientId: clientConfig.clientId,
-    clientKey: clientConfig.clientKey
+    clientKey: clientConfig.clientKey,
+    eqlVersion: 3
   });
   return new WasmEncryptionClient(INTERNAL_CONSTRUCT, client);
 }
@@ -4579,16 +4844,58 @@ function resolveStrategy(cfg) {
 }
 export {
   AccessKeyStrategy2 as AccessKeyStrategy,
+  EncryptedBigintColumn,
+  EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn,
+  EncryptedBooleanColumn,
+  EncryptedDateColumn,
+  EncryptedDateEqColumn,
+  EncryptedDateOrdColumn,
+  EncryptedDateOrdOreColumn,
+  EncryptedDoubleColumn,
+  EncryptedDoubleEqColumn,
+  EncryptedDoubleOrdColumn,
+  EncryptedDoubleOrdOreColumn,
+  EncryptedIntegerColumn,
+  EncryptedIntegerEqColumn,
+  EncryptedIntegerOrdColumn,
+  EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn,
+  EncryptedNumericColumn,
+  EncryptedNumericEqColumn,
+  EncryptedNumericOrdColumn,
+  EncryptedNumericOrdOreColumn,
+  EncryptedRealColumn,
+  EncryptedRealEqColumn,
+  EncryptedRealOrdColumn,
+  EncryptedRealOrdOreColumn,
+  EncryptedSmallintColumn,
+  EncryptedSmallintEqColumn,
+  EncryptedSmallintOrdColumn,
+  EncryptedSmallintOrdOreColumn,
+  EncryptedTable,
+  EncryptedTextColumn,
+  EncryptedTextEqColumn,
+  EncryptedTextMatchColumn,
+  EncryptedTextOrdColumn,
+  EncryptedTextOrdOreColumn,
+  EncryptedTextSearchColumn,
+  EncryptedTimestampColumn,
+  EncryptedTimestampEqColumn,
+  EncryptedTimestampOrdColumn,
+  EncryptedTimestampOrdOreColumn,
   Encryption,
   OidcFederationStrategy,
+  TEXT_SEARCH_EQL_TYPE,
   WasmEncryptionClient,
   __resetStrategyDeprecationWarningForTests,
-  encryptedColumn,
-  encryptedField,
+  buildEncryptConfig,
   encryptedTable,
   getColumnName,
   isEncrypted,
   normalizeCastAs,
-  resolveStrategy
+  resolveStrategy,
+  types
 };
 //# sourceMappingURL=wasm-inline.js.map