@cipherstash/stack 0.19.0 → 1.0.0-rc.0

package/dist/chunk-4AVL4VZD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  AuthStrategy,\n  Encrypted as CipherStashEncrypted,\n  EncryptedPayload as CipherStashEncryptedPayload,\n  EncryptedQuery as CipherStashEncryptedQuery,\n  EncryptedV3Query as CipherStashEncryptedV3Query,\n  JsPlaintext,\n  newClient,\n  QueryOpName,\n} from '@cipherstash/protect-ffi'\nimport type {\n  ColumnSchema,\n  EncryptedColumn,\n  EncryptedField,\n  EncryptedTableColumn,\n  // Imported type-only for the TSDoc {@link} references in the comments below.\n  encryptedColumn,\n  encryptedField,\n} from '@/schema'\n\n/**\n * A pluggable authentication strategy for ZeroKMS requests. Any object\n * with a `getToken(): Promise<{ token: string }>` method satisfies it —\n * notably the strategies from `@cipherstash/auth`: `OidcFederationStrategy`\n * (per-user, identity-bound encryption) and `AccessKeyStrategy`\n * (service-to-service / CI). When supplied to {@link ClientConfig.authStrategy},\n * `getToken()` is invoked on every ZeroKMS request, taking precedence over\n * the default `auto` strategy.\n *\n * @see ClientConfig.authStrategy\n */\nexport type { AuthStrategy }\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data stored in the database. Always\n * carries a ciphertext. Covers BOTH wire formats: the EQL v2.3 payloads\n * (`k: \"ct\"` / `k: \"sv\"`) and the EQL v3 payloads (flat `{v: 3, i, c, …}`\n * scalars and `{v: 3, k: \"sv\", i, sv}` SteVec documents). Which format\n * `encrypt` produces is selected by the client's\n * {@link ClientConfig.eqlVersion}; `decrypt` accepts both regardless.\n * v3 scalars carry no `k` discriminator, so narrow with `'k' in payload`\n * before reading it. See also `EncryptedValue` for branded nominal typing,\n * and {@link EncryptedQuery} for the search-term shape returned by\n * `encryptQuery`. */\nexport type Encrypted = CipherStashEncryptedPayload\n\n/** Structural type representing an encrypted query term (search needle)\n * returned by `encryptQuery` / `encryptQueryBulk` for scalar\n * (`unique` / `match` / `ore`) lookups and `ste_vec_selector` JSON path\n * queries, plus — under `eqlVersion: 3` — the `eql_v3.jsonb_query`\n * containment needle. Carries no ciphertext — matched against stored\n * values, never decrypted. v2 JSON containment queries (`ste_vec_term`)\n * return a storage-shaped {@link Encrypted} payload instead. */\nexport type EncryptedQuery =\n  | CipherStashEncryptedQuery\n  | CipherStashEncryptedV3Query\n\n/**\n * Plaintext values the SDK accepts for encryption.\n *\n * Widens the FFI's `JsPlaintext` (`string | number | boolean |\n * Record<string, unknown> | JsPlaintext[]`) with `Date`. `Date` is a supported\n * cast target that is omitted from the FFI's `JsPlaintext` INPUT union, but it\n * serializes at the boundary via `toJSON` (ISO string), so it is accepted on the\n * way in.\n *\n * `bigint` is intentionally NOT included: the native `@cipherstash/protect-ffi`\n * build cannot marshal a JS `bigint` (V8 throws \"Do not know how to serialize a\n * BigInt\") and rejects a `string` for a `big_int` column. The v3 int8 domains\n * are therefore omitted from the SDK entirely (see `eql/v3`) until the FFI\n * supports lossless bigint I/O; `bigint` returns here alongside them.\n *\n * When the upstream FFI `JsPlaintext` is corrected to include `Date`, the `Date`\n * arm can collapse back into `JsPlaintext`.\n */\nexport type Plaintext = JsPlaintext | Date\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the\n   * [dashboard](https://dashboard.cipherstash.com/workspaces/_/keysets); omit to\n   * use the workspace's default keyset. A client is bound to one keyset for its\n   * lifetime, so use one client per tenant.\n   *\n   * @see {@link Encryption} for the full keysets walkthrough.\n   */\n  keyset?: KeysetIdentifier\n\n  /**\n   * An optional authentication strategy for ZeroKMS requests, from\n   * `@cipherstash/auth` (re-exported by `@cipherstash/stack`). When provided,\n   * its `getToken()` is invoked on every ZeroKMS request and takes precedence\n   * over the default `auto` strategy (the `clientKey` is still required for\n   * encryption). Use:\n   *\n   * - `OidcFederationStrategy` for per-user, identity-bound encryption —\n   *   federates an end user's OIDC JWT into a CTS service token, so requests\n   *   authenticate as that user. Pair with `.withLockContext({ identityClaim })`\n   *   to bind the data key to a claim. This replaces the older\n   *   `LockContext.identify()` ceremony.\n   * - `AccessKeyStrategy` for service-to-service / CI, or any custom\n   *   `{ getToken() }` object for bespoke token acquisition / caching.\n   *\n   * Leave unset to use the default `auto` strategy, which reads credentials\n   * from the `CS_*` environment variables and falls back to the local dev\n   * profile created by `npx stash auth login`.\n   *\n   * @see {@link AuthStrategy}\n   * @see {@link Encryption} for a full walkthrough of the authentication options.\n   */\n  authStrategy?: AuthStrategy\n\n  /**\n   * @deprecated Renamed to {@link ClientConfig.authStrategy}. Still honoured for\n   * backwards compatibility — passing it logs a deprecation warning at runtime —\n   * but it will be removed in a future release. Set `authStrategy` instead.\n   */\n  strategy?: AuthStrategy\n\n  /**\n   * The EQL wire version the client emits — one FFI client always emits\n   * exactly one wire format.\n   *\n   * - `2` (the protect-ffi default): payloads target the\n   *   `eql_v2_encrypted` column type.\n   * - `3`: payloads target the per-capability `eql_v3` domains\n   *   (`eql_v3.text_eq`, `eql_v3.integer_ord_ore`, `eql_v3.json`, …),\n   *   derived from each column's `cast_as` and indexes.\n   *\n   * When omitted, {@link Encryption} auto-detects from the schema set:\n   * EQL v3 tables (from `@cipherstash/stack/v3`, marked by\n   * `buildColumnKeyMap()`) select `3`; v2 tables leave the FFI default\n   * (`2`) untouched. Mixing v2 and v3 tables in one client is an error —\n   * split them across two clients instead.\n   *\n   * `decrypt` accepts BOTH formats regardless of this setting, so v2 and\n   * v3 data can coexist during a migration.\n   *\n   * v3 limitation (protect-ffi 0.27): `encryptQuery` supports only JSON\n   * containment queries — scalar-index and selector queries throw\n   * `EQL_V3_QUERY_UNSUPPORTED` until a v3 scalar query wire shape exists.\n   */\n  eqlVersion?: 2 | 3\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\n/** Structural contract for a column builder the client can consume for STORAGE\n *  (`encrypt`). Satisfied by v2 `EncryptedColumn` / `EncryptedField` AND v3\n *  `EncryptedTextSearchColumn` — fields ARE encryptable, so this stays wide. */\nexport interface BuildableColumn {\n  getName(): string\n  build(): ColumnSchema\n}\n\n/** Structural contract for a column the client can consume for QUERIES\n *  (`encryptQuery` / search terms). Narrower than `BuildableColumn`: it must\n *  EXCLUDE non-queryable `EncryptedField` (a field has no indexes). A v2\n *  `EncryptedColumn` qualifies via the nominal arm; a v3 queryable concrete\n *  type qualifies via the `getEqlType()` structural arm; `EncryptedField` (no\n *  `getEqlType`, not an `EncryptedColumn`) is rejected. */\nexport interface BuildableV3QueryableColumn extends BuildableColumn {\n  getEqlType(): string\n  getQueryCapabilities(): {\n    equality: boolean\n    orderAndRange: boolean\n    freeTextSearch: boolean\n  }\n  isQueryable(): true\n}\n\nexport type BuildableQueryColumn = EncryptedColumn | BuildableV3QueryableColumn\n\n/** Structural contract for a table builder the client can consume. Satisfied by\n *  v2 and v3 `EncryptedTable` alike. */\nexport interface BuildableTable {\n  tableName: string\n  build(): { tableName: string; columns: Record<string, ColumnSchema> }\n  /**\n   * Optional map from a model field's JS property name to its encrypt-config\n   * column name (the DB name). Present when the two can differ — v3 tables key\n   * their config by DB name (`column.getName()`) while models are written with\n   * JS property keys, so the model path must match by property but address the\n   * FFI/config by DB name.\n   *\n   * Absent on v2 tables, whose `build()` already keys columns by the JS property\n   * name; the model path then matches and addresses by that same key.\n   */\n  buildColumnKeyMap?(): Record<string, string>\n}\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<BuildableTable>\n  config?: ClientConfig\n}\n\n/**\n * The literal column map of a buildable table, read from its type-level\n * `_columnType` brand. Both v2 and v3 `EncryptedTable` carry this brand, so this\n * recovers the literal column keys structurally.\n *\n * This deliberately uses the `_columnType` brand rather than `build().columns`:\n * `BuildableTable.build()` is typed to return `Record<string, ColumnSchema>`,\n * which erases the literal keys and would mark EVERY model field as encrypted.\n *\n * The fallbacks resolve to `Record<never, never>` (a no-key type), NOT `never`:\n * a value typed as the bare structural `BuildableTable` carries no `_columnType`\n * brand, and `keyof never` is `string | number | symbol` — which would wrongly\n * mark EVERY model field as encrypted. `keyof Record<never, never>` is `never`,\n * so `EncryptedFromBuildableTable` degrades gracefully to the model unchanged.\n */\nexport type BuildableTableColumns<T extends BuildableTable> = T extends {\n  readonly _columnType: infer C\n}\n  ? C extends Record<string, unknown>\n    ? C\n    : Record<never, never>\n  : Record<never, never>\n\n/**\n * Maps a plaintext model type to its encrypted form using a buildable table.\n *\n * Fields whose keys match a column defined in `Table` (via its `_columnType`\n * brand) become `Encrypted` (`Encrypted | null` when the source field is\n * nullable); all other fields retain their original types from `T`. Works for\n * both v2 and v3 tables. See {@link EncryptedFromSchema} for the v2-specific\n * variant retained for backward compatibility.\n */\nexport type EncryptedFromBuildableTable<T, Table extends BuildableTable> = {\n  [K in keyof T]: [K] extends [keyof BuildableTableColumns<Table>]\n    ? null extends T[K]\n      ? Encrypted | null\n      : Encrypted\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: BuildableColumn // storage: fields are encryptable, so stays wide\n  table: BuildableTable\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: Plaintext\n  column: BuildableQueryColumn // query: excludes non-queryable EncryptedField\n  table: BuildableTable\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result. `eql` return type yields either a storage\n * payload (`Encrypted`, for `ste_vec_term`) or a query-only term\n * (`EncryptedQuery`, for scalar lookups and `ste_vec_selector`); the\n * `composite-literal` return types yield a string. */\nexport type EncryptedSearchTerm = Encrypted | EncryptedQuery | string\n\n/** Result of encryptQuery (single or batch). `eql` return type yields either a\n * storage payload (`Encrypted`) or a query-only term (`EncryptedQuery`); the\n * `composite-literal` return types yield a string. */\n// null elements appear in the batch path when a term has a null/undefined\n// value — the operation preserves position so callers can correlate results\n// with their input array.\nexport type EncryptedQueryResult = Encrypted | EncryptedQuery | string | null\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted\n    ? K\n    : never]: null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K]\n        ? Encrypted | null\n        : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\n// Bulk payloads admit null elements — bulk operations pass them through\n// untouched (encrypt(null) -> null, decrypt(null) -> null) so callers can\n// process mixed nullable arrays without filtering ahead of time. The\n// runtime guards in the operation classes preserve the null in the\n// position-stable output.\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: Plaintext | null\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted | null }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted | null }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext | null>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: BuildableQueryColumn // query: excludes non-queryable EncryptedField\n  table: BuildableTable\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: Plaintext\n}\n"],"mappings":";AAsbO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}

package/dist/chunk-IADZCZEA.js

@@ -1,23 +0,0 @@
-// src/schema/match-defaults.ts
-function defaultMatchOpts() {
-  return {
-    tokenizer: { kind: "ngram", token_length: 3 },
-    token_filters: [{ kind: "downcase" }],
-    k: 6,
-    m: 2048,
-    include_original: true
-  };
-}
-function cloneMatchOpts(opts) {
-  return {
-    ...opts,
-    tokenizer: { ...opts.tokenizer },
-    token_filters: opts.token_filters.map((f) => ({ ...f }))
-  };
-}
-
-export {
-  defaultMatchOpts,
-  cloneMatchOpts
-};
-//# sourceMappingURL=chunk-IADZCZEA.js.map

package/dist/chunk-IADZCZEA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/schema/match-defaults.ts"],"sourcesContent":["import type { MatchIndexOpts } from './index'\n\n/**\n * Fully-resolved match-index options: every field present and non-`undefined`.\n *\n * `MatchIndexOpts` (the user-facing tuning input) has all fields optional —\n * each is `.default(...).optional()` in the zod schema, so its inferred type is\n * `T | undefined`. This type pins the BUILT/resolved shape explicitly via\n * `NonNullable<...>`, which states the non-null intent directly and is robust\n * regardless of `Required<>`'s subtle, `exactOptionalPropertyTypes`-dependent\n * stripping semantics.\n */\nexport type BuiltMatchIndexOpts = {\n  tokenizer: NonNullable<MatchIndexOpts['tokenizer']>\n  token_filters: NonNullable<MatchIndexOpts['token_filters']>\n  k: NonNullable<MatchIndexOpts['k']>\n  m: NonNullable<MatchIndexOpts['m']>\n  include_original: NonNullable<MatchIndexOpts['include_original']>\n}\n\n/**\n * Default match-index parameters — the single source of truth shared by the\n * v2 `freeTextSearch()` builder and the v3 domain builders (note\n * `include_original: true`, which is the v2 builder default rather than the\n * zod-schema default of `false`).\n *\n * This is a FACTORY (not a shared `const`) so every caller gets fresh, unaliased\n * nested objects (`tokenizer`, `token_filters` and the `{ kind: 'downcase' }`\n * inside it). A shared const would be shallow-copied by `{ ...DEFAULT }`, leaving\n * those nested objects aliased across every column — a caller mutating one built\n * config could then corrupt the defaults used by later columns.\n */\nexport function defaultMatchOpts(): BuiltMatchIndexOpts {\n  return {\n    tokenizer: { kind: 'ngram', token_length: 3 },\n    token_filters: [{ kind: 'downcase' }],\n    k: 6,\n    m: 2048,\n    include_original: true,\n  }\n}\n\n/**\n * Deep-clone a built match block (`tokenizer` and `token_filters` are its only\n * nested values) so no emitted config or stored builder state ever aliases\n * another's nested objects — a caller mutating one cannot corrupt the other.\n */\nexport function cloneMatchOpts(opts: BuiltMatchIndexOpts): BuiltMatchIndexOpts {\n  return {\n    ...opts,\n    tokenizer: { ...opts.tokenizer },\n    token_filters: opts.token_filters.map((f) => ({ ...f })),\n  }\n}\n"],"mappings":";AAgCO,SAAS,mBAAwC;AACtD,SAAO;AAAA,IACL,WAAW,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,IAC5C,eAAe,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,kBAAkB;AAAA,EACpB;AACF;AAOO,SAAS,eAAe,MAAgD;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,EAAE,GAAG,KAAK,UAAU;AAAA,IAC/B,eAAe,KAAK,cAAc,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,EACzD;AACF;","names":[]}

package/dist/chunk-IBSK6P33.js

@@ -1,209 +0,0 @@
-import {
-  BOOLEAN,
-  DATE,
-  DATE_EQ,
-  DATE_ORD,
-  DATE_ORD_ORE,
-  DOUBLE,
-  DOUBLE_EQ,
-  DOUBLE_ORD,
-  DOUBLE_ORD_ORE,
-  EncryptedBooleanColumn,
-  EncryptedDateColumn,
-  EncryptedDateEqColumn,
-  EncryptedDateOrdColumn,
-  EncryptedDateOrdOreColumn,
-  EncryptedDoubleColumn,
-  EncryptedDoubleEqColumn,
-  EncryptedDoubleOrdColumn,
-  EncryptedDoubleOrdOreColumn,
-  EncryptedIntegerColumn,
-  EncryptedIntegerEqColumn,
-  EncryptedIntegerOrdColumn,
-  EncryptedIntegerOrdOreColumn,
-  EncryptedNumericColumn,
-  EncryptedNumericEqColumn,
-  EncryptedNumericOrdColumn,
-  EncryptedNumericOrdOreColumn,
-  EncryptedRealColumn,
-  EncryptedRealEqColumn,
-  EncryptedRealOrdColumn,
-  EncryptedRealOrdOreColumn,
-  EncryptedSmallintColumn,
-  EncryptedSmallintEqColumn,
-  EncryptedSmallintOrdColumn,
-  EncryptedSmallintOrdOreColumn,
-  EncryptedTextColumn,
-  EncryptedTextEqColumn,
-  EncryptedTextMatchColumn,
-  EncryptedTextOrdColumn,
-  EncryptedTextOrdOreColumn,
-  EncryptedTextSearchColumn,
-  EncryptedTimestampColumn,
-  EncryptedTimestampEqColumn,
-  EncryptedTimestampOrdColumn,
-  EncryptedTimestampOrdOreColumn,
-  INTEGER,
-  INTEGER_EQ,
-  INTEGER_ORD,
-  INTEGER_ORD_ORE,
-  NUMERIC,
-  NUMERIC_EQ,
-  NUMERIC_ORD,
-  NUMERIC_ORD_ORE,
-  REAL,
-  REAL_EQ,
-  REAL_ORD,
-  REAL_ORD_ORE,
-  SMALLINT,
-  SMALLINT_EQ,
-  SMALLINT_ORD,
-  SMALLINT_ORD_ORE,
-  TEXT,
-  TEXT_EQ,
-  TEXT_MATCH,
-  TEXT_ORD,
-  TEXT_ORD_ORE,
-  TIMESTAMP,
-  TIMESTAMP_EQ,
-  TIMESTAMP_ORD,
-  TIMESTAMP_ORD_ORE
-} from "./chunk-U66S7VIF.js";
-
-// src/eql/v3/table.ts
-var EncryptedTable = class {
-  constructor(tableName, columnBuilders) {
-    this.tableName = tableName;
-    this.columnBuilders = columnBuilders;
-  }
-  tableName;
-  columnBuilders;
-  build() {
-    const builtColumns = {};
-    for (const builder of Object.values(this.columnBuilders)) {
-      const name = builder.getName();
-      if (Object.hasOwn(builtColumns, name)) {
-        throw new Error(
-          `[eql/v3]: duplicate column name "${name}" in table "${this.tableName}" \u2014 two columns resolve to the same DB name`
-        );
-      }
-      builtColumns[name] = builder.build();
-    }
-    return {
-      tableName: this.tableName,
-      columns: builtColumns
-    };
-  }
-  /**
-   * Map each column's JS property name to its DB column name (`getName()`).
-   * The model path matches user models by property name but must address the
-   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
-   * the two only agree when property == name. This recovers the mapping that
-   * `build()` discards.
-   */
-  buildColumnKeyMap() {
-    const map = {};
-    for (const [property, builder] of Object.entries(this.columnBuilders)) {
-      map[property] = builder.getName();
-    }
-    return map;
-  }
-};
-var RESERVED_TABLE_KEYS = /* @__PURE__ */ new Set([
-  "tableName",
-  "columnBuilders",
-  "_columnType",
-  "build",
-  "buildColumnKeyMap"
-]);
-function isReservedTableKey(tableBuilder, colName) {
-  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder;
-}
-function encryptedTable(tableName, columns) {
-  const tableBuilder = new EncryptedTable(
-    tableName,
-    columns
-  );
-  for (const [colName, colBuilder] of Object.entries(columns)) {
-    if (isReservedTableKey(tableBuilder, colName)) {
-      throw new Error(
-        `Column name "${colName}" collides with a reserved EncryptedTable property`
-      );
-    }
-    ;
-    tableBuilder[colName] = colBuilder;
-  }
-  return tableBuilder;
-}
-function buildEncryptConfig(...tables) {
-  const config = {
-    v: 1,
-    tables: {}
-  };
-  for (const tb of tables) {
-    const tableDef = tb.build();
-    if (Object.hasOwn(config.tables, tableDef.tableName)) {
-      throw new Error(
-        `[eql/v3]: duplicate table name "${tableDef.tableName}" passed to buildEncryptConfig \u2014 each table must have a unique name`
-      );
-    }
-    config.tables[tableDef.tableName] = tableDef.columns;
-  }
-  return config;
-}
-
-// src/eql/v3/types.ts
-var types = {
-  // integer
-  Integer: (name) => new EncryptedIntegerColumn(name, INTEGER),
-  IntegerEq: (name) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),
-  IntegerOrdOre: (name) => new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),
-  IntegerOrd: (name) => new EncryptedIntegerOrdColumn(name, INTEGER_ORD),
-  // smallint
-  Smallint: (name) => new EncryptedSmallintColumn(name, SMALLINT),
-  SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
-  SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
-  SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
-  // date
-  Date: (name) => new EncryptedDateColumn(name, DATE),
-  DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
-  DateOrdOre: (name) => new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),
-  DateOrd: (name) => new EncryptedDateOrdColumn(name, DATE_ORD),
-  // timestamp
-  Timestamp: (name) => new EncryptedTimestampColumn(name, TIMESTAMP),
-  TimestampEq: (name) => new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),
-  TimestampOrdOre: (name) => new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),
-  TimestampOrd: (name) => new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),
-  // numeric
-  Numeric: (name) => new EncryptedNumericColumn(name, NUMERIC),
-  NumericEq: (name) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),
-  NumericOrdOre: (name) => new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),
-  NumericOrd: (name) => new EncryptedNumericOrdColumn(name, NUMERIC_ORD),
-  // text
-  Text: (name) => new EncryptedTextColumn(name, TEXT),
-  TextEq: (name) => new EncryptedTextEqColumn(name, TEXT_EQ),
-  TextMatch: (name) => new EncryptedTextMatchColumn(name, TEXT_MATCH),
-  TextOrdOre: (name) => new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),
-  TextOrd: (name) => new EncryptedTextOrdColumn(name, TEXT_ORD),
-  TextSearch: (name) => new EncryptedTextSearchColumn(name),
-  // boolean
-  Boolean: (name) => new EncryptedBooleanColumn(name, BOOLEAN),
-  // real
-  Real: (name) => new EncryptedRealColumn(name, REAL),
-  RealEq: (name) => new EncryptedRealEqColumn(name, REAL_EQ),
-  RealOrdOre: (name) => new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),
-  RealOrd: (name) => new EncryptedRealOrdColumn(name, REAL_ORD),
-  // double
-  Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
-  DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
-  DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
-  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD)
-};
-
-export {
-  EncryptedTable,
-  encryptedTable,
-  buildEncryptConfig,
-  types
-};
-//# sourceMappingURL=chunk-IBSK6P33.js.map

package/dist/chunk-IBSK6P33.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/eql/v3/table.ts","../src/eql/v3/types.ts"],"sourcesContent":["import type { ColumnSchema, EncryptConfig } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type {\n  EncryptedV3TableColumn,\n  PlaintextForColumn,\n  QueryTypesForColumn,\n} from './columns'\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\n/**\n * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3\n * column builders. Emits the same `{ tableName, columns }` definition shape.\n */\nexport class EncryptedTable<T extends EncryptedV3TableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n    for (const builder of Object.values(this.columnBuilders)) {\n      // Key by the column's DB name (`getName()`), NOT the JS property name.\n      // `encrypt`/`decrypt` look columns up in the config by `column.getName()`,\n      // so a camelCase JS key mapping to a snake_case DB column (e.g.\n      // `createdOn: types.Date('created_on')`) must register under\n      // `created_on` or the FFI reports \"column not found in Encrypt config\".\n      const name = builder.getName()\n      // Two JS properties resolving to the same DB name would silently overwrite\n      // here (later wins), dropping the first column's config. Fail loudly —\n      // matching the duplicate-tableName guard in buildEncryptConfig and the\n      // reserved-key guard in encryptedTable.\n      if (Object.hasOwn(builtColumns, name)) {\n        throw new Error(\n          `[eql/v3]: duplicate column name \"${name}\" in table \"${this.tableName}\" — two columns resolve to the same DB name`,\n        )\n      }\n      builtColumns[name] = builder.build()\n    }\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n\n  /**\n   * Map each column's JS property name to its DB column name (`getName()`).\n   * The model path matches user models by property name but must address the\n   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so\n   * the two only agree when property == name. This recovers the mapping that\n   * `build()` discards.\n   */\n  buildColumnKeyMap(): Record<string, string> {\n    const map: Record<string, string> = {}\n    for (const [property, builder] of Object.entries(this.columnBuilders)) {\n      map[property] = builder.getName()\n    }\n    return map\n  }\n}\n\n/**\n * Own instance members of {@link EncryptedTable} that a column name must not\n * shadow. Because {@link encryptedTable} copies column builders onto the\n * instance for accessor access (`users.email`), a column named e.g. `build`\n * would otherwise overwrite the method that {@link buildEncryptConfig} relies\n * on. `_columnType` is a type-only `declare` (no runtime property) so it is\n * listed explicitly here rather than caught by the `in` check below.\n */\nconst RESERVED_TABLE_KEYS = new Set([\n  'tableName',\n  'columnBuilders',\n  '_columnType',\n  'build',\n  'buildColumnKeyMap',\n])\n\n/**\n * Whether a column name would collide with a reserved property on the table\n * object — either an own member ({@link RESERVED_TABLE_KEYS}) or any inherited\n * `Object.prototype` member (`constructor`, `toString`, `valueOf`,\n * `hasOwnProperty`, …). The `in` check covers the prototype chain so assigning\n * the column as an own property can never shadow a prototype method/accessor.\n */\nfunction isReservedTableKey(tableBuilder: object, colName: string): boolean {\n  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder\n}\n\n/**\n * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`\n * name but lives on the `/eql/v3` subpath — the importer picks the model by\n * import path. The returned object is also a column accessor (`users.email`).\n */\nexport function encryptedTable<T extends EncryptedV3TableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    if (isReservedTableKey(tableBuilder, colName)) {\n      throw new Error(\n        `Column name \"${colName}\" collides with a reserved EncryptedTable property`,\n      )\n    }\n    ;(tableBuilder as EncryptedV3TableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same\n * shape as v2's `buildEncryptConfig`.\n */\nexport function buildEncryptConfig(\n  ...tables: Array<EncryptedTable<EncryptedV3TableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 1,\n    tables: {},\n  }\n\n  for (const tb of tables) {\n    const tableDef = tb.build()\n    // Config tables are keyed by name, so a duplicate would silently overwrite\n    // the earlier table. Fail loudly instead. (v3-only additive guard; v2's\n    // buildEncryptConfig keeps its existing silent-overwrite behavior.)\n    if (Object.hasOwn(config.tables, tableDef.tableName)) {\n      throw new Error(\n        `[eql/v3]: duplicate table name \"${tableDef.tableName}\" passed to buildEncryptConfig — each table must have a unique name`,\n      )\n    }\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n\n/**\n * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps\n * to the TypeScript type of its domain's `castAs` kind.\n */\nexport type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C>\n    ? { [K in keyof C]: PlaintextForColumn<C[K]> }\n    : never\n\n/**\n * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}\n * for why no key-remap filter is needed in the flat single-type model.\n */\nexport type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C> ? { [K in keyof C]: Encrypted } : never\n\n// ---------------------------------------------------------------------------\n// Typed-client surface helpers (@cipherstash/stack/v3)\n// ---------------------------------------------------------------------------\n\n/** Any v3 table, regardless of its column map. */\nexport type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>\n\n/** Union of the concrete column builders declared on a v3 table. */\nexport type ColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C> ? C[keyof C] : never\n\n/**\n * Union of the *queryable* column builders on a v3 table. Storage-only columns\n * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't\n * be passed to a query method.\n */\nexport type QueryableColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never]\n          ? never\n          : C[K]\n      }[keyof C]\n    : never\n\n/**\n * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.\n * `T` is inferred from the argument: keys that name a schema column are pinned to\n * the column's plaintext type (nullable if the field is nullable), so a wrong-typed\n * field fails assignability; all other keys pass through unchanged.\n */\nexport type V3ModelInput<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n\n/** The encrypted result model: schema columns become `Encrypted`, others pass through. */\nexport type V3EncryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? Encrypted | null\n      : Encrypted\n    : T[K]\n}\n\n/** The decrypted result model: schema columns become their plaintext type, others pass through. */\nexport type V3DecryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n","import {\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a factory that builds a concrete\n * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain\n * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So\n * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`\n * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the\n * only capability-bearing chain — every other domain is fully described by its\n * type). bigint domains are intentionally absent pending lossless FFI\n * round-tripping (see ./columns).\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n} as const\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,IAAM,iBAAN,MAAuD;AAAA,EAI5D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EAGlB,QAAyB;AACvB,UAAM,eAA6C,CAAC;AACpD,eAAW,WAAW,OAAO,OAAO,KAAK,cAAc,GAAG;AAMxD,YAAM,OAAO,QAAQ,QAAQ;AAK7B,UAAI,OAAO,OAAO,cAAc,IAAI,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,oCAAoC,IAAI,eAAe,KAAK,SAAS;AAAA,QACvE;AAAA,MACF;AACA,mBAAa,IAAI,IAAI,QAAQ,MAAM;AAAA,IACrC;AACA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oBAA4C;AAC1C,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACrE,UAAI,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AACF;AAUA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,mBAAmB,cAAsB,SAA0B;AAC1E,SAAO,oBAAoB,IAAI,OAAO,KAAK,WAAW;AACxD;AAOO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D,QAAI,mBAAmB,cAAc,OAAO,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF;AACA;AAAC,IAAC,aAAwC,OAAO,IAAI;AAAA,EACvD;AAEA,SAAO;AACT;AAMO,SAAS,sBACX,QACY;AACf,QAAM,SAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,QAAQ,CAAC;AAAA,EACX;AAEA,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,GAAG,MAAM;AAI1B,QAAI,OAAO,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,SAAS;AAAA,MACvD;AAAA,IACF;AACA,WAAO,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,EAC/C;AAEA,SAAO;AACT;;;ACjDO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA,EAGnD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAC5E;","names":[]}

package/dist/chunk-U66S7VIF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/eql/v3/columns.ts"],"sourcesContent":["import type { ColumnSchema, MatchIndexOpts } from '@/schema'\nimport {\n  type BuiltMatchIndexOpts,\n  cloneMatchOpts,\n  defaultMatchOpts,\n} from '@/schema/match-defaults'\n\n/**\n * The query capabilities a v3 concrete domain exposes. These are SDK-facing\n * semantic flags describing what kinds of query terms a column can produce —\n * NOT the raw EQL index keys. They are metadata only and never emitted by\n * `build()`.\n *\n * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).\n * - `orderAndRange`: comparison / range lookups (EQL `ob`).\n * - `freeTextSearch`: tokenised substring match (EQL `bf`).\n */\nexport type QueryCapabilities = Readonly<{\n  equality: boolean\n  orderAndRange: boolean\n  freeTextSearch: boolean\n}>\n\n/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the\n * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */\ntype PlaintextKind = 'string' | 'number' | 'boolean' | 'date' | 'timestamp'\n\n/**\n * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:\n * the base column class carries a private field of this type so that every\n * concrete (otherwise-empty) subclass is discriminated by its literal\n * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT\n * nominal, so without this a storage-only `boolean` column would be assignable to\n * a storage-only `date` column and plaintext inference would collapse.\n */\ntype V3DomainDefinition = Readonly<{\n  eqlType: `eql_v3.${string}`\n  castAs: PlaintextKind\n  capabilities: QueryCapabilities\n}>\n\n/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a\n * storage-only domain (all capability flags `false`), `true` otherwise. */\ntype QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {\n  equality: false\n  orderAndRange: false\n  freeTextSearch: false\n}\n  ? false\n  : true\n\nconst STORAGE_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst EQUALITY_ONLY = {\n  equality: true,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst ORDER_AND_RANGE = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: false,\n} as const\n\nconst MATCH_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: true,\n} as const\n\nconst TEXT_SEARCH = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: true,\n} as const\n\n/**\n * The concrete EQL v3 domain name for a full-capability text column.\n * Recorded as metadata for future DDL / query-dialect increments; it is\n * intentionally absent from the emitted encrypt config.\n */\nexport const TEXT_SEARCH_EQL_TYPE = 'eql_v3.text_search'\n\n// Per-domain literal definitions. Each concrete column subclass is parameterised\n// by `typeof <CONST>`; the literal `eqlType`/`castAs`/`capabilities` on each is\n// what makes the otherwise-empty subclasses nominally distinct (see\n// V3DomainDefinition). Order mirrors eql-bindings `CATALOG` order.\n//\n// Exported for the `types` namespace factory (see ./types); they are internal\n// building blocks and are intentionally NOT re-exported from the public barrel.\nexport const INTEGER = {\n  eqlType: 'eql_v3.integer',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const INTEGER_EQ = {\n  eqlType: 'eql_v3.integer_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const INTEGER_ORD_ORE = {\n  eqlType: 'eql_v3.integer_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const INTEGER_ORD = {\n  eqlType: 'eql_v3.integer_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const SMALLINT = {\n  eqlType: 'eql_v3.smallint',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const SMALLINT_EQ = {\n  eqlType: 'eql_v3.smallint_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const SMALLINT_ORD_ORE = {\n  eqlType: 'eql_v3.smallint_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const SMALLINT_ORD = {\n  eqlType: 'eql_v3.smallint_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// NOTE: bigint (int8) domains are intentionally NOT defined yet. The native\n// protect-ffi build cannot round-trip a 64-bit int losslessly: a JS `bigint`\n// fails JSON serialization, and a `string` is rejected for a `big_int` column\n// (\"Cannot convert String to BigInt\"), while `number` loses precision above\n// 2^53. Re-add BIGINT/BIGINT_EQ/BIGINT_ORD_ORE/BIGINT_ORD and their builders once the\n// FFI accepts a lossless bigint on input and returns it on decrypt.\n\nexport const DATE = {\n  eqlType: 'eql_v3.date',\n  castAs: 'date',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DATE_EQ = {\n  eqlType: 'eql_v3.date_eq',\n  castAs: 'date',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DATE_ORD_ORE = {\n  eqlType: 'eql_v3.date_ord_ore',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DATE_ORD = {\n  eqlType: 'eql_v3.date_ord',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// Timestamp domains cast as 'timestamp' (not 'date') so decrypt preserves the\n// time-of-day component — the FFI's 'date' variant truncates to midnight.\n// Both kinds decrypt to a JS `Date`.\nexport const TIMESTAMP = {\n  eqlType: 'eql_v3.timestamp',\n  castAs: 'timestamp',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TIMESTAMP_EQ = {\n  eqlType: 'eql_v3.timestamp_eq',\n  castAs: 'timestamp',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TIMESTAMP_ORD_ORE = {\n  eqlType: 'eql_v3.timestamp_ord_ore',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TIMESTAMP_ORD = {\n  eqlType: 'eql_v3.timestamp_ord',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const NUMERIC = {\n  eqlType: 'eql_v3.numeric',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const NUMERIC_EQ = {\n  eqlType: 'eql_v3.numeric_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const NUMERIC_ORD_ORE = {\n  eqlType: 'eql_v3.numeric_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const NUMERIC_ORD = {\n  eqlType: 'eql_v3.numeric_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TEXT = {\n  eqlType: 'eql_v3.text',\n  castAs: 'string',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TEXT_EQ = {\n  eqlType: 'eql_v3.text_eq',\n  castAs: 'string',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TEXT_MATCH = {\n  eqlType: 'eql_v3.text_match',\n  castAs: 'string',\n  capabilities: MATCH_ONLY,\n} as const\nexport const TEXT_ORD_ORE = {\n  eqlType: 'eql_v3.text_ord_ore',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TEXT_ORD = {\n  eqlType: 'eql_v3.text_ord',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const BOOLEAN = {\n  eqlType: 'eql_v3.boolean',\n  castAs: 'boolean',\n  capabilities: STORAGE_ONLY,\n} as const\n\nexport const REAL = {\n  eqlType: 'eql_v3.real',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const REAL_EQ = {\n  eqlType: 'eql_v3.real_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const REAL_ORD_ORE = {\n  eqlType: 'eql_v3.real_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const REAL_ORD = {\n  eqlType: 'eql_v3.real_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DOUBLE = {\n  eqlType: 'eql_v3.double',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DOUBLE_EQ = {\n  eqlType: 'eql_v3.double_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DOUBLE_ORD_ORE = {\n  eqlType: 'eql_v3.double_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DOUBLE_ORD = {\n  eqlType: 'eql_v3.double_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n/**\n * Translate a domain's semantic {@link QueryCapabilities} (plus its plaintext\n * `castAs`, which decides how equality is answered) into the concrete EQL index\n * block emitted by `build()`.\n *\n * - `unique` (the `hm` HMAC index) whenever equality is answered via HMAC:\n *   equality-only domains of ANY type, AND text order domains. Text equality is\n *   HMAC-based — the `eql_v3.text_ord` / `eql_v3.text_ord_ore` SQL domains\n *   REQUIRE `hm` in the stored ciphertext (their `eql_v3.eq_term` extracts it).\n * - `ore` for any order/range domain (the `ob` term). For numeric/date order\n *   domains `ob` also answers equality (via the SQL `=` operator), so those emit\n *   `ore` ONLY — no `hm`. Text order domains emit BOTH `unique` and `ore`.\n * - `match` (the `bf` bloom-filter index) for free-text search, deep-cloned from\n *   the per-call defaults so no nested object is ever shared across columns.\n */\nfunction indexesForCapabilities(\n  capabilities: QueryCapabilities,\n  castAs: PlaintextKind,\n): ColumnSchema['indexes'] {\n  const indexes: ColumnSchema['indexes'] = {}\n\n  // Text equality is always HMAC-based, so a text order domain (`string` +\n  // order/range) still needs `unique`; numeric/date order domains answer\n  // equality via `ob` and must NOT emit `unique`.\n  if (\n    capabilities.equality &&\n    (!capabilities.orderAndRange || castAs === 'string')\n  ) {\n    indexes.unique = { token_filters: [] }\n  }\n\n  if (capabilities.orderAndRange) {\n    indexes.ore = {}\n  }\n\n  if (capabilities.freeTextSearch) {\n    // The factory returns fresh, unaliased nested objects per call, so no\n    // column's emitted match block ever shares state with another's.\n    indexes.match = defaultMatchOpts()\n  }\n\n  return indexes\n}\n\n/** Whether a domain's capabilities make it queryable at all (any flag set). */\nfunction isQueryableCapabilities(capabilities: QueryCapabilities): boolean {\n  return (\n    capabilities.equality ||\n    capabilities.orderAndRange ||\n    capabilities.freeTextSearch\n  )\n}\n\n/**\n * Shared base for every v3 concrete domain column. Parameterised by the FULL\n * literal {@link V3DomainDefinition} (not by capabilities alone): the private\n * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so\n * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and\n * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This\n * nominality is what keeps plaintext inference precise.\n */\nexport class EncryptedV3Column<D extends V3DomainDefinition> {\n  constructor(\n    private readonly columnName: string,\n    private readonly definition: D,\n  ) {}\n\n  getName(): string {\n    return this.columnName\n  }\n\n  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */\n  getEqlType(): D['eqlType'] {\n    return this.definition.eqlType\n  }\n\n  /** The semantic query capabilities this domain exposes. Metadata only. */\n  getQueryCapabilities(): D['capabilities'] {\n    return this.definition.capabilities\n  }\n\n  /** `true` when this domain can produce at least one kind of query term. */\n  isQueryable(): QueryableFlag<D> {\n    return isQueryableCapabilities(\n      this.definition.capabilities,\n    ) as QueryableFlag<D>\n  }\n\n  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */\n  build(): ColumnSchema {\n    return {\n      cast_as: this.definition.castAs,\n      indexes: indexesForCapabilities(\n        this.definition.capabilities,\n        this.definition.castAs,\n      ),\n    }\n  }\n}\n\nconst TEXT_SEARCH_DOMAIN = {\n  eqlType: TEXT_SEARCH_EQL_TYPE,\n  castAs: 'string',\n  capabilities: TEXT_SEARCH,\n} as const\n\n/**\n * Builder for an `eql_v3.text_search` column.\n *\n * The concrete type inherently enables equality + order/range + free-text\n * match — there are no capability-enabling methods. `.freeTextSearch(opts?)`\n * tunes the match index only.\n *\n * NOTE — querying: a `text_search` column emits all three indexes (`unique`,\n * `ore`, `match`), and the shared index-inference picks them by fixed priority\n * `unique > match > ore`. So `encryptQuery(value, { column, table })` with NO\n * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text\n * match — a substring like `'joh'` then matches nothing. To run a free-text\n * match query you MUST pass `queryType: 'freeTextSearch'`:\n *\n * ```typescript\n * // equality (default): exact value only\n * client.encryptQuery('john@example.com', { column: users.email, table: users })\n * // free-text match: substring/token search\n * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })\n * ```\n */\nexport class EncryptedTextSearchColumn extends EncryptedV3Column<\n  typeof TEXT_SEARCH_DOMAIN\n> {\n  private matchOpts: BuiltMatchIndexOpts\n\n  constructor(columnName: string) {\n    super(columnName, TEXT_SEARCH_DOMAIN)\n    this.matchOpts = defaultMatchOpts()\n  }\n\n  /**\n   * Tune the match index. Each provided key replaces its default; omitted\n   * keys keep the default. This NEVER enables a capability — match is always\n   * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.\n   */\n  freeTextSearch(opts?: MatchIndexOpts): this {\n    // A fresh defaults object per call supplies the `?? ` fallbacks, so no\n    // nested default object is ever shared into `this.matchOpts` by reference.\n    const defaults = defaultMatchOpts()\n    // Clone-on-write: deep-copy the nested tokenizer / token_filters when\n    // storing them so a caller mutating their own opts object between\n    // freeTextSearch(opts) and build() cannot leak into the emitted config.\n    this.matchOpts = cloneMatchOpts({\n      tokenizer: opts?.tokenizer ?? defaults.tokenizer,\n      token_filters: opts?.token_filters ?? defaults.token_filters,\n      k: opts?.k ?? defaults.k,\n      m: opts?.m ?? defaults.m,\n      include_original: opts?.include_original ?? defaults.include_original,\n    })\n    return this\n  }\n\n  /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */\n  override build(): ColumnSchema {\n    // Deep-clone the match block so the returned config NEVER aliases this\n    // builder's internal `matchOpts` (or any caller-supplied opts merged into\n    // it). A caller mutating the returned object cannot corrupt this builder's\n    // state or another column's defaults.\n    return {\n      cast_as: 'string',\n      indexes: {\n        unique: { token_filters: [] },\n        ore: {},\n        match: cloneMatchOpts(this.matchOpts),\n      },\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Concrete domain columns\n//\n// Every concrete class is an empty subclass parameterised by its literal domain\n// definition (see EncryptedV3Column). The `types` namespace (see ./types)\n// constructs these with the SAME literal constant so the instance's private\n// `definition` field carries full literal type data — that is what keeps\n// distinct domains nominally incompatible.\n// ---------------------------------------------------------------------------\n\n// integer\nexport class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {}\nexport class EncryptedIntegerEqColumn extends EncryptedV3Column<\n  typeof INTEGER_EQ\n> {}\nexport class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD_ORE\n> {}\nexport class EncryptedIntegerOrdColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD\n> {}\n\n// smallint\nexport class EncryptedSmallintColumn extends EncryptedV3Column<\n  typeof SMALLINT\n> {}\nexport class EncryptedSmallintEqColumn extends EncryptedV3Column<\n  typeof SMALLINT_EQ\n> {}\nexport class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD_ORE\n> {}\nexport class EncryptedSmallintOrdColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD\n> {}\n\n// bigint (int8) domain builders are intentionally omitted pending FFI support\n// for lossless bigint round-tripping — see the note by the INTEGER/DATE domain\n// definitions above.\n\n// date\nexport class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {}\nexport class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {}\nexport class EncryptedDateOrdOreColumn extends EncryptedV3Column<\n  typeof DATE_ORD_ORE\n> {}\nexport class EncryptedDateOrdColumn extends EncryptedV3Column<\n  typeof DATE_ORD\n> {}\n\n// timestamp\nexport class EncryptedTimestampColumn extends EncryptedV3Column<\n  typeof TIMESTAMP\n> {}\nexport class EncryptedTimestampEqColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_EQ\n> {}\nexport class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD_ORE\n> {}\nexport class EncryptedTimestampOrdColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD\n> {}\n\n// numeric\nexport class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {}\nexport class EncryptedNumericEqColumn extends EncryptedV3Column<\n  typeof NUMERIC_EQ\n> {}\nexport class EncryptedNumericOrdOreColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD_ORE\n> {}\nexport class EncryptedNumericOrdColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD\n> {}\n\n// text (text_search is defined above with its match-tuning override)\nexport class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {}\nexport class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {}\nexport class EncryptedTextMatchColumn extends EncryptedV3Column<\n  typeof TEXT_MATCH\n> {}\nexport class EncryptedTextOrdOreColumn extends EncryptedV3Column<\n  typeof TEXT_ORD_ORE\n> {}\nexport class EncryptedTextOrdColumn extends EncryptedV3Column<\n  typeof TEXT_ORD\n> {}\n\n// boolean\nexport class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {}\n\n// real\nexport class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {}\nexport class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {}\nexport class EncryptedRealOrdOreColumn extends EncryptedV3Column<\n  typeof REAL_ORD_ORE\n> {}\nexport class EncryptedRealOrdColumn extends EncryptedV3Column<\n  typeof REAL_ORD\n> {}\n\n// double\nexport class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {}\nexport class EncryptedDoubleEqColumn extends EncryptedV3Column<\n  typeof DOUBLE_EQ\n> {}\nexport class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD_ORE\n> {}\nexport class EncryptedDoubleOrdColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD\n> {}\n\n/**\n * Union of every v3 concrete column type. Used as the value type for v3 table\n * columns so a table may mix any generated domains.\n */\nexport type AnyEncryptedV3Column =\n  | EncryptedIntegerColumn\n  | EncryptedIntegerEqColumn\n  | EncryptedIntegerOrdOreColumn\n  | EncryptedIntegerOrdColumn\n  | EncryptedSmallintColumn\n  | EncryptedSmallintEqColumn\n  | EncryptedSmallintOrdOreColumn\n  | EncryptedSmallintOrdColumn\n  | EncryptedDateColumn\n  | EncryptedDateEqColumn\n  | EncryptedDateOrdOreColumn\n  | EncryptedDateOrdColumn\n  | EncryptedTimestampColumn\n  | EncryptedTimestampEqColumn\n  | EncryptedTimestampOrdOreColumn\n  | EncryptedTimestampOrdColumn\n  | EncryptedNumericColumn\n  | EncryptedNumericEqColumn\n  | EncryptedNumericOrdOreColumn\n  | EncryptedNumericOrdColumn\n  | EncryptedTextColumn\n  | EncryptedTextEqColumn\n  | EncryptedTextMatchColumn\n  | EncryptedTextOrdOreColumn\n  | EncryptedTextOrdColumn\n  | EncryptedTextSearchColumn\n  | EncryptedBooleanColumn\n  | EncryptedRealColumn\n  | EncryptedRealEqColumn\n  | EncryptedRealOrdOreColumn\n  | EncryptedRealOrdColumn\n  | EncryptedDoubleColumn\n  | EncryptedDoubleEqColumn\n  | EncryptedDoubleOrdOreColumn\n  | EncryptedDoubleOrdColumn\n\n/**\n * Shape of v3 table columns: every value is a v3 concrete column builder.\n * (Nested fields are deferred to later increments.)\n */\nexport type EncryptedV3TableColumn = {\n  [key: string]: AnyEncryptedV3Column\n}\n\n/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */\ntype PlaintextFromKind<K extends PlaintextKind> = K extends 'string'\n  ? string\n  : K extends 'number'\n    ? number\n    : K extends 'boolean'\n      ? boolean\n      : K extends 'date' | 'timestamp'\n        ? Date\n        : never\n\n/**\n * The plaintext type for a single v3 column, read from the literal domain\n * definition carried on the base class's private field. This is stable across\n * empty subclasses that share the same base generic — a subclass-name\n * conditional would collapse because those subclasses are structurally\n * assignable to one another.\n */\nexport type PlaintextForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never\n\n/**\n * The user-facing `queryType` names a v3 column supports, derived 1:1 from its\n * capability flags. Resolves to `never` for a storage-only column (all flags\n * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}\n * keys and the first three {@link import('@/types').QueryTypeName} members.\n */\nexport type QueryTypesForColumn<C> =\n  C extends EncryptedV3Column<infer D>\n    ?\n        | (D['capabilities']['equality'] extends true ? 'equality' : never)\n        | (D['capabilities']['orderAndRange'] extends true\n            ? 'orderAndRange'\n            : never)\n        | (D['capabilities']['freeTextSearch'] extends true\n            ? 'freeTextSearch'\n            : never)\n    : never\n\n/**\n * The concrete EQL v3 type string for a single column, read from the literal\n * domain definition carried on the base class's private field (mirrors\n * {@link PlaintextForColumn}). Distributes over a union of columns, so\n * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's\n * `eqlType` — the canonical, source-of-truth key set for a type-driven test\n * matrix keyed by domain.\n */\nexport type EqlTypeForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? D['eqlType'] : never\n"],"mappings":";;;;;;AAmDA,IAAM,eAAe;AAAA,EACnB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,kBAAkB;AAAA,EACtB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,aAAa;AAAA,EACjB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,cAAc;AAAA,EAClB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAOO,IAAM,uBAAuB;AAS7B,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AASO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAKO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,oBAAoB;AAAA,EAC/B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAiBA,SAAS,uBACP,cACA,QACyB;AACzB,QAAM,UAAmC,CAAC;AAK1C,MACE,aAAa,aACZ,CAAC,aAAa,iBAAiB,WAAW,WAC3C;AACA,YAAQ,SAAS,EAAE,eAAe,CAAC,EAAE;AAAA,EACvC;AAEA,MAAI,aAAa,eAAe;AAC9B,YAAQ,MAAM,CAAC;AAAA,EACjB;AAEA,MAAI,aAAa,gBAAgB;AAG/B,YAAQ,QAAQ,iBAAiB;AAAA,EACnC;AAEA,SAAO;AACT;AAGA,SAAS,wBAAwB,cAA0C;AACzE,SACE,aAAa,YACb,aAAa,iBACb,aAAa;AAEjB;AAUO,IAAM,oBAAN,MAAsD;AAAA,EAC3D,YACmB,YACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,UAAkB;AAChB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,aAA2B;AACzB,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,uBAA0C;AACxC,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,cAAgC;AAC9B,WAAO;AAAA,MACL,KAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,QAAsB;AACpB,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACP,KAAK,WAAW;AAAA,QAChB,KAAK,WAAW;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBO,IAAM,4BAAN,cAAwC,kBAE7C;AAAA,EACQ;AAAA,EAER,YAAY,YAAoB;AAC9B,UAAM,YAAY,kBAAkB;AACpC,SAAK,YAAY,iBAAiB;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,MAA6B;AAG1C,UAAM,WAAW,iBAAiB;AAIlC,SAAK,YAAY,eAAe;AAAA,MAC9B,WAAW,MAAM,aAAa,SAAS;AAAA,MACvC,eAAe,MAAM,iBAAiB,SAAS;AAAA,MAC/C,GAAG,MAAM,KAAK,SAAS;AAAA,MACvB,GAAG,MAAM,KAAK,SAAS;AAAA,MACvB,kBAAkB,MAAM,oBAAoB,SAAS;AAAA,IACvD,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGS,QAAsB;AAK7B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,QAAQ,EAAE,eAAe,CAAC,EAAE;AAAA,QAC5B,KAAK,CAAC;AAAA,QACN,OAAO,eAAe,KAAK,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACF;AAaO,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,gCAAN,cAA4C,kBAEjD;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AAOI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AACI,IAAM,iCAAN,cAA6C,kBAElD;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AAGxE,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;","names":[]}